06_境外及港澳台调查报告_part10.md

06_境外及港澳台调查报告 · 整合分片 part10

本片含 60 份报告。

FD07248 ｜ 2002_美国_AAR0201.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2002 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Aircraft Accident Report Loss of Control and Impact with Pacific Ocean Alaska Airlines Flight 261 McDonnell Douglas MD-83, N963AS About 2.7 Miles North of Anacapa Island, California January 31, 2000 National Transportation Safety Board Washington, D.C. A A N T I O N L T R A S P O R A T I O N B O A R D S A F E T Y N T E

P L U R IB US UN U M

NTSB/AAR-02/01 PB2002-910402

this page intentionally left blank

Aircraft Accident Report Loss of Control and Impact with Pacific Ocean Alaska Airlines Flight 261 McDonnell Douglas MD-83, N963AS About 2.7 Miles North of Anacapa Island, California January 31, 2000 NTSB/AAR-02/01 PB2002-910402 National Transportation Safety Board Notation 7263E 490 L’Enfant Plaza, S.W. Adopted December 30, 2002 Washington, D.C. 20594 E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N

National Transportation Safety Board. 2003. Loss of Control and Impact with Pacific Ocean, Alaska Airlines Flight 261, McDonnell Douglas MD-83, N963AS, About 2.7 Miles North of Anacapa Island, California, January 31, 2000. Aircraft Accident Report NTSB/AAR-02/01. Washington, DC. Abstract: This report explains the accident involving Alaska Airlines flight 261, a McDonnell Douglas MD-83, which crashed into the Pacific Ocean about 2.7 miles north of Anacapa Island, California. Safety issues discussed in this report include lubrication and inspection of the jackscrew assembly, extension of lubrication and end play check intervals, jackscrew assembly overhaul procedures, the design and certification of the MD-80 horizontal stabilizer trim control system, Alaska Airlines’ maintenance program, and Federal Aviation Administration (FAA) oversight of Alaska Airlines. Safety recommendations are addressed to the FAA. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2002-910402 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Aircraft Accident Report Contents Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii

1. Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
2. 1

History of Flight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.2 Injuries to Persons. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.3 Damage to Airplane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.4 Other Damage. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.5 Personnel Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.5.1 The Captain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.5.2 The First Officer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1.6 Airplane Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1.6.1 MD-80 Longitudinal Trim Control System Information . . . . . . . . . . . . . . . . . . . . . 13 1.6.1.1 Primary Trim Control System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 1.6.1.2 Alternate Trim Control System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 1.6.1.3 Autopilot Pitch Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 1.6.2 Design and Certification of MD-80 Series Airplanes . . . . . . . . . . . . . . . . . . . . . . . 19 1.6.2.1 General. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 1.6.2.2 Longitudinal Trim Control System Certification. . . . . . . . . . . . . . . . . . . . . . . . . 19 1.6.3 Maintenance Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 1.6.3.1 Alaska Airlines’ MD-80 Maintenance Program . . . . . . . . . . . . . . . . . . . . . . . . . 24 1.6.3.1.1 Maintenance Program Development Guidance. . . . . . . . . . . . . . . . . . . . . . . 24 1.6.3.1.2 Alaska Airlines’ Continuous Airworthiness Maintenance Program . . . . . . . 26 1.6.3.1.3 Alaska Airlines’ Reliability Analysis Program. . . . . . . . . . . . . . . . . . . . . . . 26 1.6.3.2 Jackscrew Assembly Lubrication Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 1.6.3.2.1 Jackscrew Assembly Lubrication Intervals. . . . . . . . . . . . . . . . . . . . . . . . . . 31 1.6.3.2.1.1 Manufacturer-Recommended Lubrication Intervals. . . . . . . . . . . . . . 31 1.6.3.2.1.2 Alaska Airlines’ Lubrication Intervals . . . . . . . . . . . . . . . . . . . . . . . . 32 1.6.3.2.2 Chronology of Grease Type Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 1.6.3.2.3 July 19, 2002, Alaska Airlines Maintenance Information Letter . . . . . . . . . 36 1.6.3.3 Procedures for Monitoring Acme Nut Thread Wear . . . . . . . . . . . . . . . . . . . . . . 37 1.6.3.3.1 Defining and Calculating Wear Rate. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 1.6.3.3.2 Development of End Play Check Procedures . . . . . . . . . . . . . . . . . . . . . . . . 38 1.6.3.3.2.1 Alaska Airlines’ End Play Check Procedure . . . . . . . . . . . . . . . . . . . 43 1.6.3.3.3 Horizontal Stabilizer Restraining Fixture . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 1.6.3.3.3.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 1.6.3.3.3.2 Alaska Airlines-Manufactured Restraining Fixtures . . . . . . . . . . . . . 44 1.6.3.3.4 End Play Check Intervals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 1.6.3.3.4.1 Manufacturer-Recommended End Play Check Intervals . . . . . . . . . . 47 1.6.3.3.4.2 Alaska Airlines’ End Play Check Intervals . . . . . . . . . . . . . . . . . . . . 47 1.6.3.4 Accident Airplane’s Maintenance Information . . . . . . . . . . . . . . . . . . . . . . . . . . 49 1.6.3.4.1 Accident Airplane’s Last C Check Requiring an End Play Check . . . . . . . . 50

Contents iv Aircraft Accident Report 1.6.3.4.2 Maintenance Personnel Statements Regarding the Accident Airplane’s Last End Play Check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 1.7 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 1.8 Aids to Navigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 1.9 Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 1.10 Airport Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 1.11 Flight Recorders. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 1.11.1 Cockpit Voice Recorder. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 1.11.1.1 CVR Sound Spectrum Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 1.11.2 Flight Data Recorder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 1.12 Wreckage and Impact Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 1.12.1 General. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 1.12.2 Horizontal Stabilizer Jackscrew Assembly Components. . . . . . . . . . . . . . . . . . . . . 58 1.13 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 1.14 Fire. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 1.15 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 1.16 Tests and Research. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 1.16.1 Airplane Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 1.16.1.1 Airplane Performance Simulation Studies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 1.16.2 Metallurgical Examinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 1.16.2.1 Horizontal Stabilizer Forward Spar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 1.16.2.2 Acme Screw. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 1.16.2.3 Acme Screw Torque Tube . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 1.16.2.4 Lower Mechanical Stop and Corresponding Spline Area on the Acme Screw. . 71 1.16.2.5 Acme Nut. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 1.16.2.6 Acme Nut Thread Remnant Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 1.16.3 Shear Load Capability of the Acme Nut Threads . . . . . . . . . . . . . . . . . . . . . . . . . . 77 1.16.4 Studies of Thread Stress and Deformation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 1.16.5 Torque Tube Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 1.16.6 Additional Safety Board Jackscrew Assembly Examinations . . . . . . . . . . . . . . . . . 80 1.16.6.1 February 2000 Post-AD 2000-03-51 Jackscrew Assembly Examinations . . . . . 80 1.16.6.2 Examinations of Hawaiian Airlines’ Jackscrew Assemblies. . . . . . . . . . . . . . . . 81 1.16.6.3 Examinations of Alaska Airlines Reports of Acme Screw “Wobble”. . . . . . . . . 83 1.16.7 Chemical and Microscopic Analyses of Grease Residues from the Accident Jackscrew Assembly . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 1.16.8 Additional Grease Testing, Experiments, and Analysis . . . . . . . . . . . . . . . . . . . . . 85 1.16.8.1 Standardized Grease Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 1.16.8.2 Experiments and Analysis on the Surface Chemistry of Acme Nut Material When Exposed to Various Greases or Grease Mixtures . . . . . . . . 85 1.16.8.3 Wear Testing Under Various Grease Conditions. . . . . . . . . . . . . . . . . . . . . . . . . 86 1.17 Organizational and Management Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 1.17.1 Alaska Airlines, Inc.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 1.17.2 Alaska Airlines Flight Crew Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 1.17.2.1 Stabilizer Trim Check Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 1.17.2.2 Runaway Stabilizer Checklist Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 1.17.2.3 Stabilizer Inoperative Checklist Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 1.17.2.3.1 Postaccident Boeing Flight Operations Bulletin on Stabilizer Trim Inoperative/Malfunction Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . 92 1.17.3 FAA Oversight of Alaska Airlines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 1.17.3.1 General. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

Contents v Aircraft Accident Report 1.17.3.2 Preaccident FAA National Aviation Safety Inspection Program Inspection. . . . 93 1.17.3.3 FAA Air Transportation Oversight System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 1.17.3.3.1 Seattle CMO Memorandum on Staff Shortages for Surveillance of Alaska Airlines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 1.17.3.4 FAA Postaccident Special Inspection of Alaska Airlines . . . . . . . . . . . . . . . . . . 95 1.17.3.4.1 FAA Proposed Suspension of Alaska Airlines’ Heavy Maintenance Authority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 1.17.3.4.2 Alaska Airlines Airworthiness and Operations Action Plan. . . . . . . . . . . . . 99 1.17.3.4.3 FAA Followup Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 1.17.3.4.4 DOT Office of the Inspector General Report on FAA Oversight of Continuing Analysis and Surveillance Programs . . . . . . . . . . . . . . . . . . 102 1.17.4 Other Safety Evaluations of Alaska Airlines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 1.17.4.1 DoD Capability Survey of Alaska Airlines . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 1.17.4.2 Criminal Investigation of Alaska Airlines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 1.17.4.3 Postaccident Independent Safety Assessment of Alaska Airlines. . . . . . . . . . . 104 1.18 Additional Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 1.18.1 Postaccident Airworthiness Directives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 1.18.1.1 Safety Board and FAA Correspondence Regarding the 2,000-Flight-Hour End Play Check Interval Specified in ADs 2000-03-51 and 2000-15-15 . . . . . 106 1.18.2 Safety Board Statistical End Play Data Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 1.18.3 Previous Safety Recommendations Resulting from the Alaska Airlines Flight 261 Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 1.18.4 Alaska Airlines Fleetwide MD-80 Jackscrew Assembly Data and Tracking History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 1.18.5 MD-11 Jackscrew Assembly Acme Nut Wear History . . . . . . . . . . . . . . . . . . . . . 116 1.18.6 Safety Board Observations of Jackscrew Assembly Lubrications. . . . . . . . . . . . . 116 1.18.7 End Play Check Anomalies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 1.18.7.1 Safety Board End Play Check Observations . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 1.18.7.2 Postaccident Alaska Airlines-Reported Near-Zero End Play Measurements . . 118 1.18.8 Jackscrew Assembly Overhaul Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 1.18.8.1 Jackscrew Overhaul Specifications and Authority . . . . . . . . . . . . . . . . . . . . . . 119 1.18.8.2 Review of the Boeing DC-9 Overhaul Maintenance Manual . . . . . . . . . . . . . . 120 1.18.8.3 Safety Board Maintenance Facility Observations . . . . . . . . . . . . . . . . . . . . . . . 121 1.18.8.4 Overhauled Jackscrew Assembly Data From 1996 to 1999 . . . . . . . . . . . . . . . 122 1.18.9 Industrywide Jackscrew Assembly Maintenance Procedures . . . . . . . . . . . . . . . . 122 1.18.10 FAA Commercial Airplane Certification Process Study . . . . . . . . . . . . . . . . . . . . 123 1.18.11 Fail-Safe Jackscrew Assembly Designs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

1. Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
2. 1

General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 2.2 Accident Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 2.2.1 Takeoff and Climbout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 2.2.2 Jamming of the Horizontal Stabilizer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 2.2.2.1 Cause of the Jam . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 2.2.3 Release of the Jam and the Initial Dive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 2.2.4 The Second and Final Dive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 2.2.5 Flight Crew Decision-Making . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 2.2.5.1 Decision to Continue Flying Rather than Return to PVR . . . . . . . . . . . . . . . . . 135 2.2.5.2 Use of the Autopilot. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 2.2.5.3 Configuration Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138

Contents vi Aircraft Accident Report 2.2.5.4 Activation of the Primary Trim Motor. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 2.2.5.5 Adequacy of Current Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 2.3 Evaluation of Potential Reasons for Excessive Acme Nut Thread Wear. . . . . . . . . . . 140 2.3.1 Use of Aeroshell 33 for Lubrication of the Jackscrew Assembly . . . . . . . . . . . . . 141 2.3.2 Acme Screw Thread Surface Finish. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 2.3.3 Foreign Debris . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 2.3.4 Abnormal Loading of the Acme Nut Threads . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 2.3.5 Summary of Possibilities Ruled Out as Reasons for the Excessive Acme Nut Thread Wear . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 2.3.6 Insufficient Lubrication of the Jackscrew Assembly. . . . . . . . . . . . . . . . . . . . . . . 144 2.3.6.1 Analysis of How Many Recently Scheduled Lubrications Might Have Been Missed or Inadequately Performed Before the Accident . . . . . . . . . . . . . 146 2.3.6.2 Alaska Airlines’ Lubrication Interval Extension . . . . . . . . . . . . . . . . . . . . . . . . 146 2.3.6.2.1 Safety Implications of Lubrication Interval Extension . . . . . . . . . . . . . . . . 147 2.3.6.3 Adequacy of Lubrication Procedures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 2.4 Monitoring Acme Nut Thread Wear. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151 2.4.1 Alaska Airlines’ Preaccident End Play Check Intervals . . . . . . . . . . . . . . . . . . . . 151 2.4.1.1 Adequacy of Existing Process for Establishing Maintenance Task Intervals . . 153 2.4.2 Adequacy of Current End Play Check Intervals . . . . . . . . . . . . . . . . . . . . . . . . . . 154 2.4.3 Adequacy of End Play Check Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 2.5 Deficiencies of Jackscrew Assembly Overhaul Procedures and Practices. . . . . . . . . . 159 2.6 Horizontal Stabilizer Trim System Design and Certification Issues . . . . . . . . . . . . . . 162 2.6.1 Acme Nut Thread Loss as a Catastrophic Single-Point Failure Mode . . . . . . . . . 162 2.6.2 Prevention of Acme Nut Thread Loss Through Maintenance and Inspection. . . . 165 2.6.3 Elimination of Catastrophic Effects of Acme Nut Thread Loss Through Design. 166 2.6.4 Consideration of Wear-Related Failures During Design and Certification . . . . . . 167 2.7 Deficiencies in Alaska Airlines’ Maintenance Program. . . . . . . . . . . . . . . . . . . . . . . . 167 2.7.1 April 2000 FAA Special Inspection Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 2.7.2 Maintenance-Related Deficiencies Identified During This Accident Investigation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169 2.7.2.1 General Policy Decisions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169 2.7.2.2 Specific Maintenance Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 2.7.3 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174 2.8 FAA Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174

1. Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
2. 1

Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176 3.2 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180

1. Recommendations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
2. 1

New Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 4.2 Previously Issued Recommendations Resulting From This Accident Investigation . . 184 Board Member Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187

1. Appendixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190

vii Aircraft Accident Report Figures

1. The accident airplane’s flightpath, starting about 1609 (about the time of the initial dive)

and ending about 1620 (about the time of the second and final dive). . . . . . . . . . . . . . . . . . . . . . . . . . 5

1. Radar altitude data and selected ATC transmissions from about 1609 to 1620.. . . . . . . . . . . . . . . . . . 6
2. Installation of jackscrew assembly within the horizontal and vertical stabilizers. . . . . . . . . . . . . . . . 13
3. The MD-80 horizontal and vertical stabilizer tail structure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
4. Acme screw and nut. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
5. Detailed schematic of the longitudinal trim actuating mechanism. . . . . . . . . . . . . . . . . . . . . . . . . . . 16
6. Cockpit switches, handles, and indicators for the longitudinal control system. . . . . . . . . . . . . . . . . . 17
7. Depiction of how restraining fixture should be placed on the horizontal stabilizer during an

end play check. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

1. View of a typical dial indicator set up for end play checks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
2. Two Alaska Airlines-fabricated restraining fixtures and three Boeing- manufactured fixtures. . . . . 46
3. The September 27, 1997, MIG-4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

12a. The acme screw immediately after it was brought on board the recovery ship . . . . . . . . . . . . . . . . . 59 12b. The acme screw immediately after it was brought to shore . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 12c. The acme screw during initial inspection.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

1. A photograph of the acme screw thread remnants wrapped around the screw, the red rust

areas, and the white deposits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

1. A photograph of the sand/grease mixture packed between the acme screw’s lower threads. . . . . . . 69
2. A photograph of an overall view of the recovered acme nut assembly. . . . . . . . . . . . . . . . . . . . . . . . 73
3. A photograph of a closer view of the interior of the acme nut. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
4. A diagram of a cross-section through the acme nut’s grease passageway and fitting. Red areas

denote the locations where red grease was found, and gray areas denote the location where the dry residue was found. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74

1. A photograph of the grease passageway and counterbore after the acme nut was sectioned. . . . . . . 75

Figures viii Aircraft Accident Report

1. A summary of the results of the high-load wear tests, including the contamination

and low-temperature tests.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

1. A graphical depiction of the stages of acme nut thread wear to the point of fracture. . . . . . . . . . . 131

ix Aircraft Accident Report Abbreviations AC advisory circular AD airworthiness directive ALPA Air Line Pilots Association AMFA Aircraft Mechanics Fraternal Association AOL all operators letter ARTCC Air Route Traffic Control Center ASB alert service bulletin ATC air traffic control ATOS Air Transportation Oversight System ATP airline transport pilot CAM cockpit area microphone CAR Civil Aeronautics Regulations CFR Code of Federal Regulations CG center of gravity CMO Certificate Management Office CMR certification maintenance requirement CSP comprehensive surveillance plan CVR cockpit voice recorder DFGC digital flight guidance computer DoD Department of Defense DOT Department of Transportation EDS (x-ray) energy dispersive spectroscopy E.O. engineering order FAA Federal Aviation Administration FARs Federal Aviation Regulations FDR flight data recorder

Abbreviations x Aircraft Accident Report FEA finite element analysis FL flight level FSAW Flight Standards Information Bulletin for Airworthiness FSDO Flight Standards District Office Ftu minimum ultimate strength GMM General Maintenance Manual KIAS knots indicated airspeed LAX Los Angeles International Airport, Los Angeles, California MAC mean aerodynamic chord MRB Maintenance Review Board MSG Maintenance Steering Group MSI maintenance significant item MTBR mean time between removal MTBUR mean time between unscheduled removal NASIP National Aviation Safety Inspection Program OAK Oakland International Airport, Oakland, California OAMP on-aircraft maintenance planning OJT on-the-job training P/N part number PMI principal maintenance inspector psi pounds per square inch PST Pacific standard time PTRS Program Tracking and Reporting System PVR Lic Gustavo Diaz Ordaz International Airport, Puerto Vallarta, Mexico QRH Quick Reference Handbook RMS root mean squared S/N serial number SAE Society of Automotive Engineers

Abbreviations xi Aircraft Accident Report SB service bulletin SEA Seattle-Tacoma International Airport, Seattle, Washington SEM scanning electron microscopy SFO San Francisco International Airport, San Francisco, California UNS unified numbering system

xii Aircraft Accident Report Executive Summary On January 31, 2000, about 1621 Pacific standard time, Alaska Airlines, Inc., flight 261, a McDonnell Douglas MD-83, N963AS, crashed into the Pacific Ocean about 2.7 miles north of Anacapa Island, California. The 2 pilots, 3 cabin crewmembers, and 83 passengers on board were killed, and the airplane was destroyed by impact forces. Flight 261 was operating as a scheduled international passenger flight under the provisions of 14 Code of Federal Regulations Part 121 from Lic Gustavo Diaz Ordaz International Airport, Puerto Vallarta, Mexico, to Seattle-Tacoma International Airport, Seattle, Washington, with an intermediate stop planned at San Francisco International Airport, San Francisco, California. Visual meteorological conditions prevailed for the flight, which operated on an instrument flight rules flight plan. The National Transportation Safety Board determines that the probable cause of this accident was a loss of airplane pitch control resulting from the in-flight failure of the horizontal stabilizer trim system jackscrew assembly’s acme nut threads. The thread failure was caused by excessive wear resulting from Alaska Airlines’ insufficient lubrication of the jackscrew assembly. Contributing to the accident were Alaska Airlines’ extended lubrication interval and the Federal Aviation Administration’s (FAA) approval of that extension, which increased the likelihood that a missed or inadequate lubrication would result in excessive wear of the acme nut threads, and Alaska Airlines’ extended end play check interval and the FAA’s approval of that extension, which allowed the excessive wear of the acme nut threads to progress to failure without the opportunity for detection. Also contributing to the accident was the absence on the McDonnell Douglas MD-80 of a fail-safe mechanism to prevent the catastrophic effects of total acme nut thread loss. The safety issues discussed in this report include lubrication and inspection of the jackscrew assembly, extension of lubrication and end play check intervals, jackscrew assembly overhaul procedures, the design and certification of the MD-80 horizontal stabilizer trim control system, Alaska Airlines’ maintenance program, and FAA oversight of Alaska Airlines. Safety recommendations are addressed to the FAA.

Factual Information 1 Aircraft Accident Report 1. Factual Information 1.1 History of Flight On January 31, 2000, about 1621 Pacific standard time (PST),1 Alaska Airlines, Inc., flight 261, a McDonnell Douglas MD-83 (MD-83), N963AS, crashed into the Pacific Ocean about 2.7 miles north of Anacapa Island, California. The 2 pilots, 3 cabin crewmembers, and 83 passengers2 on board were killed, and the airplane was destroyed by impact forces. Flight 261 was operating as a scheduled international passenger flight under the provisions of 14 Code of Federal Regulations (CFR) Part 121 from Lic Gustavo Diaz Ordaz International Airport (PVR), Puerto Vallarta, Mexico, to Seattle-Tacoma International Airport (SEA), Seattle, Washington, with an intermediate stop planned at San Francisco International Airport (SFO), San Francisco, California. Visual meteorological conditions prevailed for the flight, which operated on an instrument flight rules flight plan. The accident airplane arrived at PVR about 1239 on the day of the accident.3 The inbound pilots stated that they met the accident pilots outside the airplane and briefly discussed its status.4 FDR information from the accident flight indicated that during taxi for takeoff, when the FDR started recording, the horizontal stabilizer5 was at the 7° airplane-nose-up position, which was the takeoff pitch trim6 setting. About 1337, the accident airplane departed PVR as flight 261. A National Transportation Safety Board review of FAA air traffic control (ATC) tapes and FDR data from the accident flight indicated that the first 1 Unless otherwise indicated, all times are PST, based on a 24-hour clock. The times reported in the cockpit voice recorder (CVR) transcript were based on a coordinated universal time reference clock used by the Federal Aviation Administration’s (FAA) Southern California Terminal Radar Approach Control facility for recorded radar data. CVR times were also correlated to flight data recorder (FDR) data. After the correlation was accomplished, all times from both recorders were converted to PST. 2 The 83 passengers included 3 children who were less than 2 years old. These children were lap-held passengers. 3 FDR data indicated that the accident airplane landed at PVR with a horizontal stabilizer angle of 6º airplane nose up. 4 The inbound captain described the accident flight crew as rested, relaxed, and in good spirits. The inbound first officer stated that the accident captain was happy to see them, upbeat, rested, and ready to go to work. 5 The MD-80’s horizontal stabilizer is a critical flight control located at the top of the vertical stabilizer. The horizontal stabilizer is hinged near its trailing edge so that the leading edge can traverse up and down to provide trim for the airplane in the pitch axis. For a description of the airplane’s horizontal stabilizer and other components of the longitudinal trim control system, see section 1.6.1. 6 Pitch trim (also known as longitudinal trim) is the adjustment of the airplane’s horizontal stabilizer to achieve a balanced, or stable, flight condition. The longitudinal trim control system is designed to minimize or eliminate the pilot control forces needed to hold the flight controls in the proper position to achieve the desired pitch for a particular phase of flight.

Factual Information 2 Aircraft Accident Report officer was the pilot flying immediately after the airplane’s departure.7 The flight plan indicated that flight 261’s cruising altitude would be flight level (FL) 310.8 FDR data indicated that during the initial portion of the climb, the horizontal stabilizer moved at the primary trim motor rate of 1/3º per second from 7º to 2º airplane nose up. According to FDR data, the autopilot was engaged at 1340:12, as the airplane climbed through an altitude of approximately 6,200 feet. Thereafter, the FDR recorded horizontal stabilizer movement at the alternate trim motor rate of 1/10º per second from 2° airplane nose up to 0.4° airplane nose down.9 At 1349:51, as the airplane continued to climb through approximately 23,400 feet at 331 knots indicated airspeed (KIAS), the CVR recorded the horizontal stabilizer move from 0.25° to 0.4° airplane nose down.10 This was the last horizontal stabilizer movement recorded until the airplane’s initial dive about 2 hours and 20 minutes later. At 1353:12, when the airplane was climbing through 28,557 feet at 296 KIAS, the autopilot disengaged. FDR information and airplane performance calculations indicated that, during the next 7 minutes, the airplane continued to climb at a much slower rate. During this part of the ascent, the elevators were deflected between -1° and -3°, and the airplane was flown manually using up to as much as 50 pounds of control column pulling force.11 After reaching level flight, the airplane was flown for about 24 minutes using approximately 30 pounds of pulling force at approximately 31,050 feet and 280 KIAS. The airspeed was then increased to 301 KIAS, and the airplane was flown for almost another 1 hour 22 minutes using about 10 pounds of pulling force. At 1546:59, the autopilot was re-engaged. According to Alaska Airlines documents, ATC and CVR information, and postaccident interviews with Alaska Airlines dispatch and maintenance personnel, the flight crew contacted the airline’s dispatch and maintenance control facilities in SEA some time before the beginning of the CVR transcript at 1549:4912 to discuss a jammed horizontal stabilizer and a possible diversion to Los Angeles International Airport (LAX), Los Angeles, California.13 These discussions were conducted on a shared company radio 7 According to FDR data, the No. 2 autopilot was selected during the initial part of the flight. Selection of the No. 2 autopilot commands the No. 2 digital flight guidance computer (DFGC) to provide steering guidance to the first officer’s instruments. 8 FL 310 is 31,000 feet mean sea level, based on an altimeter setting of 29.92 inches of mercury. 9 Operation of the alternate trim motor during this period is consistent with pitch control being commanded by the autopilot, which was engaged at 1340:12. 10 KIAS is the speed of the airplane as shown on the airspeed indicator on the cockpit control panel. All airspeed information from the FDR is given in KIAS. 11 All estimates of pulling force in this report refer to the combined control column forces from both the captain’s and the first officer’s control columns. It is not known whether these forces were applied by the captain, the first officer, or both. 12 For a complete transcript of the 31-minute CVR recording, see appendix B. 13 FDR data indicated that a continuing series of radio transmissions began over the very-high frequency 2 channel (used for all non-ATC radio transmissions) about 1521 and continued until the end of the FDR recording about 1620:56.

Factual Information 3 Aircraft Accident Report frequency between Alaska Airlines’ dispatch and maintenance facilities at SEA and its operations and maintenance facilities at LAX. At 1549:56, the autopilot was disengaged; it was re-engaged at 1550:15. According to the CVR transcript, at 1550:44, SEA maintenance asked the flight crew, “understand you’re requesting…diversion to LA…is there a specific reason you prefer LA over San Francisco?”14 The captain replied, “well a lotta times its windy and rainy and wet in San Francisco and uh, it seemed to me that a dry runway…where the wind is usually right down the runway seemed a little more reasonable.” At 1552:02, an SEA dispatcher provided the flight crew with the current SFO weather (wind was 180° at 6 knots; visibility was 9 miles). The SEA dispatcher added, “if uh you want to land at LA of course for safety reasons we will do that…we’ll…tell you though that if we land in LA…we’ll be looking at probably an hour to an hour and a half we have a major flow program going right now.”15 At 1552:41, the captain replied, “I really didn’t want to hear about the flow being the reason you’re calling us cause I’m concerned about overflying suitable airports.” At 1553:28, the captain discussed with the first officer potential landing runways at SFO, stating, “one eight zero at six…so that’s runway one six what we need is runway one nine, and they’re not landing runway one nine.” The first officer replied, “I don’t think so.” At 1553:46, the captain asked SEA dispatch if they could “get some support” or “any ideas” from an instructor to troubleshoot the problem; he received no response. At 1555:00, the captain commented, “it just blows me away they think we’re gonna land, they’re gonna fix it, now they’re worried about the flow, I’m sorry this airplane’s [not] gonna go anywhere for a while…so you know.” A flight attendant replied, “so they’re trying to put the pressure on you,” the captain stated, “well, no, yea.” At 1556:08, the SEA dispatcher informed the flight crew that, according to the SFO automatic terminal information service, the landing runways in use at SFO were 28R and 28L and that “it hasn’t rained there in hours so I’m looking at…probably a dry runway.” At 1556:26, the captain stated that he was waiting for a requested center of gravity (CG) update (for landing), and then he requested information on wind conditions at LAX. At 1556:50, the SEA dispatcher replied that the wind at LAX was 260° at 9 knots. Nine seconds later, the captain, comparing SFO and LAX wind conditions, told the SEA dispatcher, “versus a direct crosswind which is effectively no change in groundspeed…I gotta tell you, when I look at it from a safety point I think that something that lowers my groundspeed makes sense.”16 The SEA dispatcher replied, “that’ll mean LAX then for you.” He then asked the captain to provide LAX operations with the information needed to recompute the airplane’s CG because “they can probably whip out that CG for you real quick.” At 1558:15, the captain told the SEA dispatcher, “we’re goin 14 This is the first reference on the CVR recording to the accident flight crew’s request to divert to LAX. 15 The SEA dispatcher’s comment refers to ongoing departure delays at LAX caused by heavy air traffic congestion. 16 If the airplane had landed at SFO, it would have encountered a direct crosswind from the south. If the airplane had landed at LAX, it would have encountered a minimal crosswind from the southwest.

Factual Information 4 Aircraft Accident Report to LAX we’re gonna stay up here and burn a little more gas[17] get all our ducks in a row, and then we’ll uh be talking to LAX when we start down to go in there.” At 1558:45, the captain asked LAX operations if it could “compute [the airplane’s] current CG based on the information we had at takeoff.” At 1602:33, the captain asked LAX operations for wind information at SFO. LAX operations replied that the winds at SFO were 170° at 6 knots. The captain replied, “that’s what I needed. We are comin in to see you.” At 1603:56, the first officer began giving LAX operations the information it needed to recompute the airplane’s CG for landing. At 1607:54, a mechanic at Alaska Airlines’ LAX maintenance facility contacted the flight crew on the company radio frequency and asked, “are you [the] guys with the uh, horizontal [stabilizer] situation?” The captain replied, “affirmative,” and the mechanic, referring to the stabilizer’s primary trim system, asked, “did you try the suitcase handles and the pickle switches?”18 At 1608:03, the captain replied, “yea we tried everything together.” At 1608:08, the captain added, “we’ve run just about everything if you’ve got any hidden circuit breakers we’d love to know about ‘em.”19 The mechanic stated that he would “look at the uh circuit breaker uh guide just as a double check.” The LAX mechanic then asked the flight crew about the status of the alternate trim system, and, at 1608:35, the captain replied that “it appears to be jammed…the whole thing, it [the AC load meter] spikes out when we use the primary, we get AC [electrical] load that tells me the motor’s tryin to run but the brake won’t move it. when we use the alternate, nothing happens.”20 At 1608:50, the LAX mechanic asked, “you say you get a spike…on the meter up there in the cockpit when you uh try to move it with the…primary right?” According to the CVR transcript, at 1608:59, the captain addressed the first officer before responding to the mechanic, stating, “I’m gonna click it off you got it.” One second later, the first officer replied, “ok.” At 1609:01, the captain reiterated to the LAX mechanic that the spike occurred “when we do the primary trim but there’s no appreciable uh change in the uh electrical uh when we do the alternate.” The LAX mechanic replied that he would see them when they arrived at the LAX maintenance facility. 17 The airplane did not have an in-flight fuel dumping system. 18 “Suitcase handles” is a colloquial term for the longitudinal trim handles located on the center control pedestal. “Pickle switches” is a colloquial term for the trim switches located on the outboard side of each of the control wheels. 19 According to the CVR transcript, at 1550:14, the first officer had asked the captain to move his seat forward so that he could check a panel behind the captain’s seat that contained circuit breakers for the horizontal stabilizer trim system. The first officer then stated to the captain, “I don’t think there’s anything beyond that we haven’t checked.” 20 According to postaccident testing, the indicator needle on the AC load meter in the cockpit normally “spikes,” or rises, to a maximum indication when the primary trim motor is engaged. Once the acme screw begins to rotate, the amount of electrical current required to sustain the rotation drops significantly, and the indicator needle will quickly drop to near zero. However, if the acme screw is held fixed or jammed while the primary trim motor is engaged, the indicator needle will remain at the maximum indication. Engagement of the alternate trim motor, regardless of the acme screw’s condition, does not cause the indicator needle to spike because of its significantly lower electrical current requirements. For more information about the primary and alternate trim systems, see sections 1.6.1.1 and 1.6.1.2.

Factual Information 5 Aircraft Accident Report At 1609:13, the captain stated, “lets do that.” At 1609:14.8, the CVR recorded the sound of a click and, at the same time, the captain stating, “this’ll click it off.” According to FDR data, the autopilot was disengaged at 1609:16. At the same time, the CVR recorded the sound of a clunk, followed by two faint thumps in short succession at 1609:16.9. The CVR recorded a sound similar to the horizontal stabilizer-in-motion tone21 at 1609:17. At 1609:19.6, the CVR again recorded a sound similar to the horizontal stabilizer-in-motion tone, followed by the captain’s comment, “you got it?” (FDR data indicated that during the 3 to 4 seconds after the autopilot was disengaged, the horizontal stabilizer moved from 0.4° to a recorded position of 2.5° airplane nose down, and the airplane began to pitch nose down, starting a dive that lasted about 80 seconds as the airplane went from about 31,050 to between 23,000 and 24,000 feet.)22 Figure 1 shows the accident airplane’s flightpath, starting about 1609 (about the time of the initial dive) and ending about 1620 (about the time of the second and final dive). Figure 2 shows the radar altitude data and selected ATC transmissions for about the same time period. Figure 1. The accident airplane’s flightpath, starting about 1609 (about the time of the initial dive) and ending about 1620 (about the time of the second and final dive). 21 The MD-80 is equipped with a sensor to detect movement of a cable loop that is connected to the horizontal stabilizer. If the horizontal stabilizer continuously moves through about 1.1°, a 1-second audible signal is produced in the cockpit by the sensor. This audible signal is produced about every 0.55° of continuous movement thereafter. The sensor resets when the horizontal stabilizer stops moving. 22 During the initial dive, the airplane accelerated to a maximum speed of 353 KIAS, and this value remained nearly constant until 1610:23 as the airplane was descending through 24,200 feet.

Factual Information 6 Aircraft Accident Report Figure 2. Radar altitude data and selected ATC transmissions from about 1609 to 1620. At 1609:26, the captain stated, “it got worse,” and, 5 seconds later, he stated “you’re stalled.” One second later, the CVR recorded a sound similar to airframe vibration getting louder. At 1609:33, the captain stated, “no no you gotta release it ya gotta release it.” This statement was followed by the sound of a click 1 second later. At 1609:52, the captain stated, “help me back help me back.” Two seconds later, the first officer responded, “ok.” One second later, at 1609:55, the captain contacted the Los Angeles Air Route Traffic Control Center (ARTCC)23 and stated, “center Alaska two sixty one we are uh in a dive here.” At 1610:01.6, the captain added, “and I’ve lost control, vertical pitch.” At 1610:01.9, the CVR recorded the sound of the overspeed warning (which continued for the next 33 seconds). At 1610:05, the controller asked flight 261 to repeat the transmission, and, at 1610:06, the captain responded, “yea we’re out of twenty six 23 According to the CVR and ATC transcripts, flight 261 had established contact with the Los Angeles ARTCC controller about 1551:21.

Factual Information 7 Aircraft Accident Report thousand feet, we are in a vertical dive…not a dive yet…but uh we’ve lost vertical control of our airplane.” At 1610:20, the captain stated, “just help me.” At 1610:28.2, the captain informed the Los Angeles ARTCC controller, “we’re at twenty three seven request uh.” At 1610:33, the captain added, “yea we got it back under control here.” One second later, the first officer transmitted, “no we don’t.” At 1610:45, the first officer stated, “let’s take the speedbrakes off.” One second later, the captain responded, “no no leave them there. it seems to be helping.” At 1610:55, the captain stated, “ok it really wants to pitch down.” At 1611:06.6, the captain stated that they were at “twenty four thousand feet, kinda stabilized.” Three seconds later he added, “we’re slowin’ here, and uh, we’re gonna uh do a little troubleshooting, can you gimme a block [altitude] between uh, twenty and twenty five?”24 FDR data indicated that, by 1611:13, the airplane’s airspeed had decreased to 262 KIAS, and the airplane was maintaining an altitude of approximately 24,400 feet with a pitch angle of 4.4°. At 1611:21, the controller assigned flight 261 a block altitude of between FL 200 and 250. Airplane performance calculations indicated that between about 130 and 140 pounds of pulling force was required to recover from the dive. At 1611:43, the first officer stated, “whatever we did is no good, don’t do that again.” One second later, the captain responded, “yea, no it went down it went to full nose down.” Four seconds later, the first officer asked, “uh it’s a lot worse than it was?” At 1611:50, the captain replied, “yea yea we’re in much worse shape now,” adding, at 1611:59, “I think it’s at the stop, full stop…and I’m thinking…can it go any worse…but it probably can…but when we slowed down, lets slow it lets get down to two hundred knots and see what happens.” At 1612:33, the captain told LAX maintenance, “we did both the pickle switch and the suitcase handles and it ran away full nose trim down.” At 1612:42, the captain added, “and now we’re in a pinch so we’re holding uh we’re worse than we were.” At 1613:04, the captain indicated to LAX maintenance that he was reluctant to try troubleshooting the trim system again because the trim might “go in the other direction.” At 1613:10, the LAX mechanic responded, “ok well your discretion uh if you want to try it, that’s ok with me if not that’s fine. um we’ll see you at the gate.” At 1613:22, the captain stated, “I went tab down…right, and it should have come back instead it went the other way.” At 1613:32, the captain asked the first officer, “you wanna try it or not?” The first officer replied, “uhh no. boy I don’t know.” Airplane performance calculations indicated that about 120 pounds of pulling force was being applied to the pilots’ control columns at this point. At 1614:54, the Los Angeles ARTCC controller instructed the flight crew to contact another ARTCC controller on frequency 126.52, which the flight crew acknowledged. At 1615:19, the first officer contacted another ARTCC controller on 126.52 and stated, “we’re with you we’re at twenty two five, we have a jammed stabilizer and we’re maintaining altitude with difficulty. uh but uh we can maintain altitude we think…our intention is to land at Los Angeles.” The controller cleared the airplane direct 24 A block altitude assignment allows an airplane to operate between the assigned upper and lower altitude limits.

Factual Information 8 Aircraft Accident Report to LAX and then asked, “you want lower [altitude] now or what do you want to do sir?” At 1615:56, the captain replied, “I need to get down about ten, change my configuration, make sure I can control the jet and I’d like to do that out here over the bay if I may.” At 1616:32, the Los Angeles ARTCC controller issued flight 261 a heading of 280° and cleared the flight to descend to 17,000 feet. At 1616:39, the captain acknowledged, “two eight zero and one seven seventeen thousand Alaska two sixty one. and we generally need a block altitude.” At 1616:45, the controller responded, “ok and just um I tell you what do that for now sir, and contact LA center on one three five point five they’ll have further uh instructions for you sir.” At 1616:56.9, the first officer acknowledged, “ok thirty five five say the altimeter setting.” The controller responded, “the LA altimeter is three zero one eight.” At 1617:02, the first officer responded, “thank you.” According to the CVR and ATC recordings, this was the last radio transmission made from flight 261. After the radio transmission, the captain told a flight attendant that he needed “everything picked up” and “everybody strapped down.” At 1617:04, the captain added, “I’m gonna unload the airplane and see if we can…we can regain control of it that way.” At 1617:09, the flight attendant stated, “ok we had like a big bang back there,” and, the captain replied, “yea I heard it.” At 1617:15, the captain stated, “I think the stab trim thing is broke.” At 1617:21, the captain again told the flight attendant to make sure the passengers were “strapped in now,” adding 3 seconds later, “cause I’m gonna I’m going to release the back pressure and see if I can get it…back.” At 1617:54, the captain stated, “gimme slats extend,” and, at 1617:56.6, a sound similar to slat/flap handle movement was recorded by the CVR. At 1617:58, the captain added, “I’m test flyin now.” At 1618:05, the captain commanded an 11° flap deployment, and, at 1618:07, a sound similar to slat/flap handle movement was recorded. At 1618:17, the captain stated, “its pretty stable right here…see but we got to get down to a hundred an[d] eighty [knots].” At 1618:26, the captain stated, “OK…bring bring the flaps and slats back up for me,” and, at 1618:36.8, sounds similar to slat/flap handle movement were recorded. At 1618:47, the captain stated, “what I wanna do…is get the nose up…and then let the nose fall through and see if we can stab it when it’s unloaded.” At 1618:56, the first officer responded, “you mean use this again? I don’t think we should…if it can fly.” At 1619:01, the captain replied, “it’s on the stop now, it’s on the stop.” At 1619:04, the first officer replied, “well not according to that it’s not.” At this time, FDR data indicated a horizontal stabilizer angle of 2.5° airplane nose down. Three seconds later, the first officer added, “the trim might be, and then it might be uh, if something’s popped back there… it might be mechanical damage too.” At 1619:14, the first officer stated, “I think if it’s controllable, we oughta just try to land it.” Two seconds later, the captain replied, “you think so? ok lets head for LA.” About 5 seconds later, the CVR recorded the sound of a series of at least four distinct “thumps.”25 At 1619:24, the first officer asked, “you feel that?” and the captain 25 The CVR transcript describes this sound as a “faint thump.”

Factual Information 9 Aircraft Accident Report replied, “yea.” At 1619:29, the captain stated, “ok gimme sl---.” At 1619:32.8, the CVR recorded the sound of two clicks similar to the sound of slat/flap movement. At 1619:36.6, the CVR recorded the sound of an “extremely loud noise” and the sound of background noise increasing, which continued until the end of the recording. At the same time, the CVR also recorded sounds similar to loose articles moving around the cockpit. FDR data indicated that at 1619:36.6, the flaps were extending and the slats were moving to the mid position. The next few seconds of FDR data indicated a maximum airplane-nose-down pitch rate of nearly 25° per second. The FDR recorded a significant decrease in vertical acceleration values (negative Gs),26 a nose-down pitch angle, and a significant decrease in lateral acceleration values. By 1619:40, the airplane was rolling left wing down, and the rudder was deflected 3° to the right. FDR data indicated that, by 1619:42, the airplane had reached its maximum valid recorded airplane-nose-down pitch angle of -70°. At this time, the roll angle was passing through -76° left wing down. At 1619:43, the first officer stated, “mayday,” but did not make a radio transmission. Six seconds later, the captain stated, “push and roll, push and roll.” FDR data indicated that, by 1619:45, the pitch angle had increased to -28°, and the airplane had rolled to -180° (inverted). Further, the airplane had descended to 16,420 feet, and the indicated airspeed had decreased to 208 knots. At 1619:54, the captain stated, “ok, we are inverted…and now we gotta get it.” FDR data indicated that at this time, the left aileron moved to more than 16° (to command right wing down), then, during the next 6 seconds, it moved in the opposite direction to -13° (to command left wing down). At 1619:57, the rudder returned to the near 0° position, the flaps were retracted, and the airplane was rolling through -150° with an airplane-nose-down pitch angle of -9°. After 1619:57, the airplane remained near inverted and its pitch oscillated in the nose-down position. At 1620:04, the captain stated, “push push push…push the blue side up.” At 1620:16, the captain stated, “ok now lets kick rudder…left rudder left rudder.” Two seconds later, the first officer replied, “I can’t reach it.” At 1620:20, the captain replied, “ok right rudder…right rudder.” At 1620:38, the captain stated, “gotta get it over again…at least upside down we’re flyin.” At 1620:49, the CVR recorded sounds similar to engine compressor stalls and engine spooldown.27 At 1620:54, the captain commanded deployment of the speedbrakes, and, about 1 second later, the first officer replied, “got it.” At 1620:56.2, the captain stated, “ah here we go.” The FDR recording ended at 1620:56.3, and the CVR recording ended at 1620:57.1. The airplane impacted the Pacific Ocean near Port Hueneme, California. Pieces of the airplane wreckage were found floating on and beneath the surface of the ocean. The main wreckage was found at 34° 03.5' north latitude and 119° 20.8' west longitude. 26 A G is a unit of measurement of force on a body undergoing acceleration as a multiple of its weight. The normal load factor for an airplane in straight and level flight is about 1 G. As the load factor decreases from 1 G, objects become increasingly weightless, and at 0 G, those objects float. 27 An engine compressor stall, or surge, results from interruption of normal airflow through the engine, which can be caused by an engine malfunction or disturbance of inlet airflow at high angles-of-attack.

Factual Information 10 Aircraft Accident Report 1.2 Injuries to Persons Table 1. Injury chart. 1.3 Damage to Airplane The airplane was destroyed by impact forces. 1.4 Other Damage No other damage resulted from this accident. 1.5 Personnel Information The accident flight crew spent the night before the accident at Alaska Airlines’ layover hotel, which was in a resort located outside of Puerto Vallarta. Witness statements and hotel records indicated that the captain and first officer watched the Super Bowl in the hotel lounge and ate both breakfast and dinner in the hotel restaurant.28 The flight crew that flew the accident airplane into PVR spoke to the accident flight crewmembers, and they indicated that the flight crew appeared rested before the accident flight. 1.5.1 The Captain The captain, age 53, was hired by JetAmerica29 on August 16, 1982. The captain held an airline transport pilot (ATP) certificate, issued March 16, 1984, with a type rating Injuries Flight Crew Cabin Crew Passengers Other Total Fatal 2 3 83 0 88 Serious 0 0 0 0 0 Minor 0 0 0 0 0 None 0 0 0 0 0 Total 2 3 83 0 88 28 For more information about the flight crew’s preaccident activities, see the Operations/Human Performance Group Chairman’s report and addendums in the Safety Board’s public docket for this accident. 29 JetAmerica merged with Alaska Airlines in 1987. According to Alaska Airlines records, the captain began JetAmerica merger training on September 8, 1987.

Factual Information 11 Aircraft Accident Report in the Douglas DC-9 (DC-9)/McDonnell Douglas MD-80 (MD-80). Additionally, he held a turbojet flight engineer certificate and ground and flight instructor certificates. The captain’s most recent FAA first-class medical certificate was issued on November 15, 1999, and contained the limitation that he must wear corrective lenses. According to Alaska Airlines records, the captain had flown approximately 17,750 total flight hours, including 10,460 hours as pilot-in-command, of which about 4,150 hours were as pilot-in-command in the MD-80. He had flown approximately 133, 52, and 24 hours in the last 90, 30, and 7 days, respectively, before the accident. According to company records, the captain satisfactorily completed his last line check on July 15, 1999; his last recurrent training on November 19, 1999; and his last proficiency check on November 23, 1999. Company records also indicated that the captain was off-duty for 2 days before the day of the accident flight. A search of FAA and company records showed no accident, incident, or enforcement or disciplinary actions, and a search of records at the National Driver Register found no history of driver’s license revocation or suspension. 1.5.2 The First Officer The first officer, age 57, was hired by Alaska Airlines on July 17, 1985.30 The first officer held an ATP certificate, issued April 3, 1985, with type ratings in the DC-9/MD-80, DC-6, and DC-7. The flight officer’s most recent FAA second-class medical certificate was issued on April 7, 1999, and contained the limitation that he must wear corrective lenses. According to Alaska Airlines records, the first officer had flown approximately 8,140 total flight hours, including about 8,060 hours as first officer in the MD-80. He had flown approximately 142, 78, and 15 hours in the past 90, 30, and 7 days, respectively, before the accident. According to company records, the first officer satisfactorily completed his last line check on March 16, 1997; his last recurrent training on April 23, 1999; and his last proficiency check on April 25, 1999. Company records also indicated that the first officer was off-duty for 3 days before the day of the accident flight. A search of FAA and company records showed no accident, incident, or enforcement or disciplinary actions, and a search of records at the National Driver Register found no history of driver’s license revocation or suspension. 1.6 Airplane Information The MD-80 is a low-wing, twin engine, transport-category airplane. The MD-80, which the FAA certified in August 1980, was derived from earlier DC-9 series model airplanes. As a result, much of the MD-80’s structure and many of its systems, components, and installations are similar to the earlier DC-9 model. According to 30 According to Alaska Airlines records, the first officer also began JetAmerica merger training on September 8, 1987.

Factual Information 12 Aircraft Accident Report Boeing,31 the first DC-9 airplane entered service in December 1965; the final DC-9 airplane entered service in October 1982. MD-80 series model airplanes—the MD-81, -82, -83, and -88—were in production through 1999.32 The DC-9 family of airplanes also includes McDonnell Douglas MD-90 (MD-90) and Boeing 717 (717) series airplanes.33 Alaska Airlines began operating MD-80 airplanes on June 30, 1984. The accident airplane, N963AS, an MD-83, serial number (S/N) 53077, was manufactured in 1992 and added to Alaska Airlines’ operating certificate on May 27, 1992.34 According to Alaska Airlines records, the airplane had accumulated about 26,584 total hours of operation (14,315 flight cycles)35 at the time of the accident. The airplane was configured to seat a maximum of 12 first-class and 128 economy-class passengers and to carry cargo. The accident airplane was equipped with two Pratt & Whitney JT8D-217C turbofan engines. Company records indicated that the No. 1 (left) engine, S/N 728068, was manufactured in May 1995 and installed on the accident airplane on April 20, 1999, and had operated about 16,970 hours (8,994 flight cycles) since new. At the time of the accident, the No. 1 engine had 3,006 flight cycles remaining until a limited inspection of its low-pressure turbine shaft was required. The No. 2 (right) engine, S/N 726852, was manufactured in April 1992 and installed on the accident airplane on May 24, 1999, and had operated about 24,034 hours (13,266 flight cycles) since new. At the time of the accident, the No. 2 engine had 6,305 flight cycles remaining until a limited inspection of its low-pressure turbine shaft was required. According to Alaska Airlines dispatch documents for the accident flight, the accident airplane’s takeoff weight was calculated to be 136,513 pounds,36 including 34,902 pounds of fuel. Alaska Airlines’ load sheet for the accident flight indicated that there were 10 passengers in the first-class cabin, 70 passengers (not including 3 children)37 in the coach cabin, and 5 crewmembers (2 flight crewmembers and 3 cabin crewmembers) on board the airplane. The dispatch documents indicated that the airplane’s takeoff CG was calculated to be 12.8 percent mean aerodynamic chord (MAC).38 31 The Boeing Commercial Airplane Group and the McDonnell Douglas Corporation merged in August 1997. The Douglas Aircraft Company became the McDonnell Douglas Corporation in April 1967 when it merged with the McDonnell Aircraft Company. 32 A total of 1,191 MD-80 series airplanes were produced. 33 A total of 117 MD-90 series airplanes were produced from February 13, 1993, to October 23, 2000. A total of 104 717s have been produced, starting on September 23, 1999, and 717s are still in production. 34 According to Alaska Airlines, the registered airplane owner was the First Security Bank of Utah. 35 A flight cycle is one complete takeoff and landing sequence. 36 The accident airplane’s weight and balance were calculated using the January 10, 2000, revision of the Alaska Airlines MD-80 Loading Handbook. The maximum certificated takeoff gross weight for the accident airplane was 160,000 pounds, the maximum climb weight for takeoff was 153,900 pounds, and the maximum landing weight was 130,000 pounds. 37 According to the Alaska Airlines MD-80 Loading Handbook, passengers under 2 years of age are not considered for weight and balance purposes during normal operations. 38 The maximum forward CG limit for the accident airplane was 8.0 percent MAC, and the maximum aft CG limit was 26.0 percent MAC.

Factual Information 13 Aircraft Accident Report 1.6.1 MD-80 Longitudinal Trim Control System Information Longitudinal control for the MD-80 (and for all DC-9, MD-90, and 717 series airplanes), that is, control of the airplane’s pitch movements, is provided by the horizontal stabilizer and the elevators. The horizontal stabilizer is mounted on top of the 18-foot-high vertical stabilizer; they are connected by two hinges at the aft spar of the horizontal stabilizer and with a single jackscrew assembly at the front spar of the stabilizer in a T-tail configuration (see figure 3). The horizontal stabilizer is about 40 feet long and comprises a center box and a left and a right outboard section. Each outboard section of the horizontal stabilizer has an elevator hinged to its trailing edge. Coarse pitch movements are achieved with elevator movement via mechanical linkage from the elevator control tabs to the cockpit control columns (see figure 4). Finer adjustments to pitch are achieved by changing the angle of the entire horizontal stabilizer. The leading edge of the horizontal stabilizer is raised or lowered by the jackscrew assembly as the stabilizer’s trailing edge pivots (rotates) about its hinge points. Figure 3. Installation of jackscrew assembly within the horizontal and vertical stabilizers.

Factual Information 14 Aircraft Accident Report Figure 4. The MD-80 horizontal and vertical stabilizer tail structure. Movement of the horizontal stabilizer is provided by the jackscrew assembly, which consists of an acme screw and nut, a torque tube inside the acme screw, two gearboxes, two trim motors (an alternate and a primary), and associated components and supports. (See figures 3 through 6 for details of the longitudinal trim system actuating mechanism and the jackscrew assembly.) The upper end of the jackscrew assembly is attached to the front spar of the horizontal stabilizer, and the lower end is threaded through the acme nut, which is attached to the vertical stabilizer with a gimbal ring and retaining pins. The acme screw and nut each have two threads that rotate in a spiral along their length. Figure 6 shows the longitudinal trim system and the jackscrew assembly.

Factual Information 15 Aircraft Accident Report Figure 5. Acme screw and nut. Movement of the horizontal stabilizer is commanded either automatically by the autopilot when it is engaged, or manually by the flight crew by depressing either set of dual trim switches (located on each control wheel), moving the dual longitudinal trim handles on the center control pedestal, or moving the dual alternate trim control switches on the center pedestal (see figure 7). Any of these commands activates one of the two electric motors that rotate the acme screw by applying torque to the titanium torque tube that is held fixed inside the acme screw. The motors are deenergized whenever either the autopilot senses that the horizontal stabilizer has reached the desired pitch trim condition, when pilot commands are terminated, or when the horizontal stabilizer reaches its maximum travel limits. Electrical travel limit shutoff switches (also known as the electrical stops) stop the motors at the maximum limits of travel. The MD-80 horizontal stabilizer’s design limits are 12.2° leading edge down, which results in airplane-nose-up trim, and 2.1° leading edge up, which results in airplane-nose-down trim, as set by the electrical stops.

Factual Information 16 Aircraft Accident Report Figure 6. Detailed schematic of the longitudinal trim actuating mechanism.

Factual Information 17 Aircraft Accident Report Figure 7. Cockpit switches, handles, and indicators for the longitudinal control system. The jackscrew assembly also has upper and lower mechanical stops splined to the acme screw to stop screw rotation if the travel limit shutoff switches malfunction. The mechanical stops rotate with the acme screw as it turns and act as the mechanical limits for

Factual Information 18 Aircraft Accident Report its range of travel.39 Stopping action is provided by contact between the head of a steel stop bolt in the mechanical stop and the head of a similar bolt in the acme nut. 1.6.1.1 Primary Trim Control System As previously stated, the primary trim control system is activated by depressing either set of control wheel trim switches or moving the dual longitudinal trim handles. The pair of switches located on each control wheel is designed to be depressed simultaneously. Both switches on the same control wheel must be moved simultaneously in the same direction to command up or down movement of the horizontal stabilizer. One switch is a motor control switch; the other switch is a brake control switch. Moving the motor control switch energizes the airplane-nose-up or nose-down circuits. Moving the brake control switch energizes the corresponding brake control relay and releases the brake in the trim motor. Energizing the brake control relay automatically disengages the autopilot. The pair of longitudinal trim handles on the left side of the control pedestal also serve as a mechanical means of activating the trim control system in the event of an electrical circuit failure in the control wheel switches. The pair of handles is designed to be gripped with one hand and moved simultaneously in the same direction. Operation of the handles in a trim direction opposite that being commanded by the control wheel trim switches will override the control wheel trim switch command. A primary trim brake switch is also installed on the center pedestal; it is designed to stop horizontal stabilizer movement, when activated, if a malfunction occurs in the primary trim control system. The primary trim control system uses the primary trim motor, which is mounted on top of the jackscrew assembly. When powered by the primary trim motor, the horizontal stabilizer moves about 1/3° per second. The primary trim motor rotates the acme screw at speeds of about 35 rpm and has a maximum torque capability (stall torque) of 18,850 inch-pounds. 1.6.1.2 Alternate Trim Control System As previously mentioned, the alternate trim control system is activated by autopilot commands or by activation of a pair of alternate trim control switches, which are located in the center of the control pedestal, aft of the throttles. These alternate trim control switches must be moved simultaneously in the same direction to activate the alternate trim system. As with the primary trim system, one switch controls the motor, and the other switch controls the brake. The alternate trim control system uses the alternate trim motor, which is mounted on the jackscrew assembly next to the primary trim motor. When powered by the alternate trim motor, the horizontal stabilizer moves about 1/10° per second. The alternate trim 39 Boeing engineering data, computer modeling, and ground demonstrations on an actual airplane indicated that the maximum possible horizontal stabilizer position when the acme screw lower mechanical stop is pulling up on, but is restrained by, the acme nut is about 3.1º airplane nose down.

Factual Information 19 Aircraft Accident Report motor rotates the acme screw at speeds of about 10 rpm and has a maximum torque capability of 4,400 inch-pounds. 1.6.1.3 Autopilot Pitch Control When the autopilot is engaged and the flight crew selects a desired flight mode (for example, maintaining a constant altitude, pitch angle, or rate of climb), the autopilot will transmit pitch control signals to the DFGC. The DFGC processes the signals and sends them to the elevator control tab servos, which move the elevator control tabs the proper amount to execute the commanded pitch maneuver. If the signals to the servos are sustained for more than 5 seconds, the DFGC will then command the alternate trim motor to move the horizontal stabilizer in a direction that will relieve the elevator deflection. Autopilot trim annunciator warning lights in the cockpit illuminate to alert the flight crew if a horizontal stabilizer out-of-trim condition exists while the autopilot is engaged. Specifically, after 10 seconds if there is no horizontal stabilizer movement in response to autopilot commands, the autopilot trim annunciator warning lights illuminate. If such a condition exists, the autopilot will not automatically disengage. The light will remain on until the autopilot is manually disengaged. According to Boeing, both the captain’s and the first officer’s control panels have flight mode annunciators to annunciate “A/P [autopilot] TRIM.” 1.6.2 Design and Certification of MD-80 Series Airplanes 1.6.2.1 General The original DC-9 was certified in 1965 under Civil Aeronautics Regulations (CAR) 4b, as revised through Amendment 12, March 30, 1962, as were other early models in the DC-9 series. The MD-80 was certified in 1980. More recent models of the DC-9, MD-80, MD-90, and 717 were certified under 14 CFR Part 25 and applicable amendments. However, systems that were similar to or that did not change significantly from the earlier DC-9 models, such as the longitudinal trim control system, were not required to be recertified under 14 CFR Part 25. Therefore, CAR 4b remained the certification basis for those parts of the MD-80, MD-90, and 717. 1.6.2.2 Longitudinal Trim Control System Certification Pertinent sections of CAR 4b that were applicable to the original certification of the DC-9’s longitudinal trim control system are outlined below. CAR Section 4b.201(a), “Strength and Deformation,” stated that structure “shall be capable of supporting limit loads without suffering detrimental permanent deformation.”40 CAR Section 4b.270, “Fatigue Evaluation of Flight Structure,” stated the following:41 40 Substantially similar requirements are currently contained in 14 CFR 25.305. 41 Substantially similar requirements are currently contained in 14 CFR 25.571.

Factual Information 20 Aircraft Accident Report The strength, detail design, and fabrication of those portions of the airplane’s flight structure in which fatigue may be critical shall be evaluated in accordance with the provisions of either paragraph (a) or (b) of this section. (a) Fatigue strength. The structure shall be shown by analysis and/or tests to be capable of withstanding the repeated loads of variable magnitude expected in service…. (b) Fail safe strength. It shall be shown by analysis and/or tests that catastrophic failure or excessive structural deformation, which could adversely affect the flight characteristics of the airplane, are not probable after fatigue failure or obvious partial failure of a single principal structural element. After such failure, the remaining structure shall be capable of withstanding static loads corresponding with the flight loading condition specified [in CAR 4b]. These loads shall be multiplied by a factor of 1.15 unless the dynamic effects of failure under static load are otherwise taken into consideration. CAR Section 4b.320(d), “Control Systems,” stated the following:42 “Each adjustable stabilizer must have a means to allow any adjustment necessary for continued safety of flight after the occurrence of any reasonably probable single failure of the actuating system.” CAR Section 4b.322, “Trim Controls and Systems,” described the trim control systems requirements as follows:43 (a) Trim controls shall be designed to safe guard against inadvertent or abrupt operation…. (e) Trim devices shall be capable of continued normal operation in the event of failure of any one connecting or transmitting element of the primary flight control system. CAR Section 4b.325, “Control System Stops,” stated the following:44 (a) All control systems shall be provided with stops which positively limit the range of motion of the control surfaces. (b) Control system stops shall be so located in the systems that wear, slackness, or take-up adjustments will not affect adversely the control characteristics of the airplane because of a change in the range of surface travel. (c) Control system stops shall be capable of withstanding the loads corresponding with the design conditions for the control systems. 42 Substantially similar requirements are currently contained in 14 CFR 25.671. 43 Substantially similar requirements are currently contained in 14 CFR 25.677. 44 Substantially similar requirements are currently contained in 14 CFR 25.675.

Factual Information 21 Aircraft Accident Report CAR Section 4b.606, “Equipment, Systems, and Installations,” Subsection (b), “Hazards,” stated, “All equipment, systems, and installations shall be designed to safeguard against hazards to the airplane in the event of their malfunctioning or failure.” Similar requirements are currently contained in 14 CFR 25.1309. Specifically, 14 CFR 25.1309 requires that airplane systems and associated components be designed so that “the occurrence of any failure condition which would prevent the continued safe flight and landing of the airplane[45] is extremely improbable.” Further, FAA AC 25.1309-1A, “System Design and Analysis,” defines “extremely improbable” failure conditions as “those so unlikely that they are not anticipated to occur during the entire operational life of all airplanes of one type” and “having a probability on the order of 1 x 10-9 or less each flight hour, based on a flight of mean duration for the airplane type.” AC 25.1309-1A specifies that in demonstrating compliance with 14 CFR 25.1309, “the failure of any single element, component, or connection during any one flight…should be assumed, regardless of its probability,” and “such single failures should not prevent continued safe flight and landing, or significantly reduce the capability of the airplane or the ability of the crew to cope with the resulting failure condition.” According to Boeing, the longitudinal trim control system on the DC-9 was similar to the one used on earlier Douglas DC-8 (DC-8) airplanes. However, the DC-8 was equipped with a dual jackscrew design that provided structural and operational redundancy. According to Boeing, even though the DC-9 had a single jackscrew assembly, structural redundancy was accomplished by inserting a torque tube within the acme screw. A Safety Board review of DC-9, MD-80/90, and 717 series airplane certification documents46 indicated that the manufacturer provided material strength and loads information, stress calculations, and analyses to support assertions that the acme screw and torque tube were designed so that each of these two components could withstand tensile and compressive loads well beyond that which could be generated by aerodynamic forces acting on the horizontal stabilizer.47 The documents also indicated that these assertions were based on the assumption of a new, intact acme screw and nut that met design specifications and that the acme screw and nut threads were intact and engaged to act as a load path. Certification documents also included calculations and analyses to support the assertions that the jackscrew assembly was capable of carrying limit loads, with a margin 45 A failure that would prevent continued safe flight and landing is referred to in Advisory Circular (AC) 25.1309-1A as a “catastrophic” failure condition. 46 The Safety Board requested all available documentation addressing the certification of these airplane designs. Documentation provided by Boeing included the April 15, 1965, DC-9 Flight Controls System Fault Analysis Report (revised July 14, 1997); the 1964 DC-9 Control System Design Criteria; and the April 1998 MD-95-30 Control Systems Loads and Criteria Report. (The MD-95 was renamed the Boeing 717 when McDonnell Douglas and Boeing merged.) Internal design memorandums that addressed the horizontal stabilizer trim system were also reviewed. 47 According to certification documents provided by Boeing, the DC-9/MD-80 series horizontal stabilizer acme screw was designed to carry an ultimate tension load of about 53,000 pounds. This load was calculated by assuming the highest aerodynamic loads that could be safely carried by the horizontal stabilizer structure in flight and then multiplying that load by 150 percent.

Factual Information 22 Aircraft Accident Report of safety, in either pure tension or compression, without failing, for each of the following scenarios: • A fractured acme screw. According to the certification documents, this was accomplished by designing the inner torque tube with the capability to support limit operational tension and compression loads (in addition to the normal operational torsion loads) generated by the horizontal stabilizer. • A fractured torque tube. According to the certification documents, this was accomplished by designing the jackscrew assembly so that if a torque tube fractured, trim operation would immediately cease. Under this failure scenario, the loads generated by the horizontal stabilizer would continue to be carried by the acme screw and nut, and pitch control would still be possible through the elevators. • The loss of 90 percent of acme screw and nut threads. According to the certification documents, this was accomplished by designing the acme screw and nut with more threads than were structurally necessary. • The failure of one entire thread spiral in the acme screw or nut. According to the certification documents, this was accomplished by incorporating two independent thread spirals along the acme screw’s length. A Boeing Airplane Services structures engineering manager who testified at the Safety Board’s public hearing on the flight 261 accident confirmed that “the reason behind having two independent threads is that if one of the threads were to fail, the other thread will carry the load.” A Safety Board review of the April 15, 1965, DC-9 Flight Controls System Fault Analysis Report (revised July 14, 1997) indicated that no contingency for the complete loss of the acme nut threads was incorporated into the design for the longitudinal trim control system. According to the fault analysis, the acme nut was designed with a softer material than the acme screw and its threads were designed to wear. Acme nut threads are made of an aluminum-bronze alloy and are about 0.15 inch thick at the minor diameter when new. The acme screw threads are made of case-hardened steel. The DC-9 jackscrew assembly was originally designed for a service life of 30,000 flight hours and was not originally subject to periodic inspections for wear. In 1966, 1 year after the DC-9 went into service, the discovery of several assemblies with excessive wear resulted in the development and implementation of an on-wing end play check procedure to measure the gap between the acme screw and nut threads as an indicator of wear.48 Thereafter, Douglas guidance specified that acme nut thread wear periodically be measured using an end play check procedure, and the acme nut was to be replaced when the specified end play measurement (0.040 inch) was exceeded.49 An FAA senior Aircraft Certification Office aerospace engineer testified at the public hearing that the jackscrew assembly was considered “primary structure because it 48 End play is an indirect measurement of acme nut thread wear. For more information, see sections 1.6.3.3.1 and 1.6.3.3.2.

Factual Information 23 Aircraft Accident Report is the primary load-carrying load path from the horizontal [stabilizer] to the vertical [stabilizer], other than the pivot attaches at the rear spar.” The FAA certification engineer also testified that it was not considered a principal structural element and added that “not all primary structure is a principal structural element.” He defined a principal structural element, “in damage tolerance philosophy,” as an element “whose failure, if it remained undetected, could lead to loss of the aircraft.” The FAA senior certification engineer further testified that the “jackscrew assembly and acme nut in particular…have to comply with the ultimate strength and limit load deflection criteria which provides for their strength.” However, according to the FAA certification engineer, “because of the evaluation which indicates that the fatigue stresses are so low as to preclude the initiation or a propagation of a crack in the thread, they need not be considered under Part A or Part B of [CAR] 4b.270 [Fatigue Evaluation of Flight Structure].” According to the FAA certification engineer, who was referring to Boeing information, the “normal flight load…in the jackscrew to be transmitted from the screw through the nut to the vertical stabilizer is in the neighborhood of 4,000 or 5,000 pounds.” A Boeing structures engineering manager testified at the public hearing that “if the torque tube fails, the acme screw will carry the load, and if the acme screw fails, the torque tube will carry the load.” The Boeing manager also stated that “we have no reported cases of fatigue failures or fatigue damage on this torque tube design for the four basic models, DC-9, MD-80, MD-90 and 717, and that is over 95 million accumulated flight hours, and…over 2,300 airplanes [were] delivered.” The FAA senior certification engineer testified at the public hearing that the jackscrew assembly was a “combination structural element and systems element…and [that] as such, the systems portion would fall under the systems requirements, and the structures portion would be required to address the structural requirements.” The FAA certification engineer also indicated that the acme nut was not considered a system and, therefore, was not required to comply with airplane systems’ certification requirements. The Boeing structures engineering manager testified at the public hearing that “the acme nut thread is a wear component. Since the two independent threads in the acme nut are both subject to wear due to jackscrew rotation, we took this into account when we designed the system and defined the maintenance procedures to manage and inspect the wear.…When the acme nut is new, the strength of the threads is over 15 times in excess of design loads.” The Boeing manager further testified that an acme screw and nut “unit worn to an end play reading of 0.040 of an inch remains 10 times stronger [than the maximum design loads].” He added, “Taking the end play reading to 0.080 of an inch, or twice the removal threshold, still leaves us with an installation five times stronger than the maximum design loads. [The] current in-service end play limit 0.040 of an inch is conservative from both the strength and the design standpoint. This assembly is 49 Before the accident, there was no requirement to record or track end play measurements obtained during end play check procedures. After the accident, Airworthiness Directives (AD) 2000-03-51 and 2000-15-15 required that end play measurements be reported to Boeing. For more information about these ADs, see section 1.18.1.

Factual Information 24 Aircraft Accident Report recognized as a wear component which is addressed initially by its robust design and later by in-service maintenance action to control and monitor that wear.” The FAA senior certification engineer testified that wear is “not considered as a mode of failure for either a systems safety analysis or for structural considerations.” The FAA certification engineer further stated that the “Douglas design of the acme nut and acme screw provided enough over-strength so that the regulatory requirements could be met with a significant amount of wear.” He indicated that even if 14 CFR 25.1309 had been applicable to the entire jackscrew assembly, acme nut thread wear would not have been considered in the required systems safety analysis. He explained, “if you refer to a [section 25.1309] type safety analysis to try and determine a failure rate for a wear item, there are not, and there’s really no such thing as a wear-critical item, never has been. The question of wear being a quantifiable element so that one could do a safety-type analysis for structure—it’s not feasible. The data to do such an evaluation is not available. It doesn’t exist.”50 The FAA senior certification engineer stated that regulatory definitions of type design safety assume that the “safety of that type design is maintained…[because] the type certificate holder is required to recommend a maintenance program for [operators] such that the level of safety is maintained….We presume that those maintenance requirements are complied with.” The FAA certification engineer added, “wear is considered as part of a design…and, as with any mechanism, maintenance is necessary.” He concluded by stating, “I believe that the current design of the MD-80, DC-9, 717 and MD-90 pitch trim system demonstrates compliance to the applicable regulations and provides the level of safety associated with those certification requirements.” 1.6.3 Maintenance Information 1.6.3.1 Alaska Airlines’ MD-80 Maintenance Program 1.6.3.1.1 Maintenance Program Development Guidance In 1968, an aviation industry team Maintenance Steering Group (MSG) developed a maintenance program development document for the then-new Boeing 747 (747). This guidance document contained decision logic and procedures for use in developing initial minimum maintenance and inspection requirements. Using the experience gained through the 747 project, in 1970, another MSG developed an updated guidance document, known as the MSG-2, which was designed to be applicable to all future newly type-certificated aircraft and/or powerplants, not just the 747. According to the MSG-2 guidance document, it was intended “to present a means for developing a maintenance program” that will be acceptable to the FAA, operators, and manufacturers. In September 1980, through the combined efforts of the FAA, the Air Transport Association of America, U.S. and European aircraft and engine manufacturers, and U.S. 50 The Boeing manager confirmed that “the condition of wear or wear-out was not included in the original DC-9 fault analysis.”

Factual Information 25 Aircraft Accident Report and foreign airlines, a third guidance document, known as MSG-3, was issued. The MSG-3 guidance document, which incorporated data from more than 10 years of airline maintenance programs analysis and service experience, was developed, in part, to reduce confusion about how to interpret maintenance processes defined in the MSG-2 methodology, including hard-time, on-condition, condition-monitoring, and overhaul.51 The MSG-3 task-oriented logic methodology used a “consequence of failure approach.” For example, servicing and lubrication were included in the MSG-3 guidance document as part of the logic diagram to ensure that this category of task was considered each time an item was analyzed. After using MSG-3 analysis procedures on a number of new aircraft and powerplants in the first half of the 1980s, the airline industry decided that the experience should be used to improve the document for future applications, and, in 1988, Revision 1 to MSG-3 was issued; Revision 2 was issued in 1993. The MSG-2 and MSG-3 guidance documents are accepted by the FAA and are used by Maintenance Review Boards (MRB) that are convened to develop reports containing guidance specific to an airplane type or model. MRB reports outline the recommended initial minimum scheduled maintenance and inspection requirements for a particular transport-category airplane and on-wing engine program. MRB reports are initially developed by an industry steering committee that is headed by an FAA chairperson. The steering committee directs working groups that include representatives from aircraft manufacturers and operators. The working groups are responsible for the development of initial minimum scheduled maintenance and inspection requirements for new or derivative aircraft to be used in the development of an operator’s continuing airworthiness maintenance program. MRB reports are published and distributed by the manufacturer, but they contain FAA requirements. According to FAA AC 121-22A, the MRB report is “a means, in part, of developing instructions for continuing airworthiness, as required by [14 CFR section] 25.1529.” The MRB report is submitted to the FAA for approval as part of these instructions. On the basis of the guidance in the applicable MRB report, manufacturers issue on-aircraft maintenance planning (OAMP) documents and generic task cards outlining specific maintenance tasks. The tasks and intervals in an OAMP document are typically the same as those contained in the associated MRB report. Two MRB reports and associated OAMP documents are currently used as the basis for the maintenance of the MD-80: those derived from MSG-2, issued in 1993, and those derived from MSG-3, issued in 1996. Carriers can use the guidance in the MRB report and OAMP documents to 51 Hard-time is a maintenance process that requires an item to be removed from service or overhauled at or before a previously specified time. On-condition is a maintenance process that requires periodic inspections or checks of a unit against an appropriate physical standard to determine whether it can continue in service until the next scheduled check and to remove the unit from service before failure occurs during normal operations. Condition-monitoring is a maintenance process for items that do not have hard-time or on-condition as the primary maintenance process and is accomplished through continuous data collection and analysis of components or systems. Analysis of failures or other indications of deterioration are used to evaluate the continuing airworthiness of the airplane. Overhaul is the disassembly, cleaning, inspection, repair, and testing of a component to the extent necessary to ensure (substantiated by service experience and accepted practices) that it is in satisfactory condition to operate for a given period. It includes the replacement, repair, adjustment, or refinishing of such parts as required, which, if not properly accomplished, would adversely affect the airworthiness of the airplane.

Factual Information 26 Aircraft Accident Report develop their maintenance programs.52 Carriers with maintenance programs based on the MSG-2 MRB report are permitted to use the MSG-3 MRB report and its listed intervals to adjust existing intervals in coordination with the airline’s FAA principal maintenance inspector (PMI).53 1.6.3.1.2 Alaska Airlines’ Continuous Airworthiness Maintenance Program Alaska Airlines’ continuous airworthiness maintenance program for its MD-80 fleet received initial FAA approval in March 1985 and was based on the FAA-accepted MRB report for DC-9/MD-80 airplanes derived from the MSG-2 maintenance program development document. The MRB report and the resulting OAMP document recommended C-check intervals of 3,500 flight hours or 15 months, whichever came first. Alaska Airlines’ initial C-check interval was 2,500 flight hours. In 1988, it was extended to every 13 months (which, based on the average airplane utilization rate at Alaska Airlines at the time, was about 3,200 flight hours). In 1996, the C-check interval was extended to 15 months (which, based on the average airplane utilization rate at Alaska Airlines at the time, was about 4,775 flight hours). In addition to the 15-month C-check interval, Alaska Airlines’ General Maintenance Manual (GMM), dated February 5, 1998, revealed that Alaska Airlines had the following maintenance inspections and intervals for its MD-80 fleet at the time of the accident: • Walk-around check—accomplished by Alaska Airlines maintenance personnel after each arrival. • Service check—accomplished when the airplane remains on the ground for 8 or more hours at a maintenance facility capable of conducting at least A check maintenance. • A check—accomplished at intervals not to exceed 250 flight hours. 1.6.3.1.3 Alaska Airlines’ Reliability Analysis Program CFR Section 121.373(a), “Continuing Analysis and Surveillance,” requires operators to establish and maintain a system for the continuing analysis and surveillance of the performance and effectiveness of their maintenance and inspection programs and for the correction of any deficiency found in those programs. According to FAA Order 8300.10, chapter 37, continuing analysis and surveillance programs should have, as a minimum, procedures for monitoring mechanical performance, which should be done 52 FAA AC 121-22A states that an MRB report “contains the initial minimum scheduled maintenance/inspection requirements for a particular…aircraft…[it should] not to be confused with, or thought of, as a maintenance program. After approval by the FAA, the requirements become a base or framework around which each air carrier develops its own individual maintenance program.” 53 Alaska Airlines used the MSG-2 MRB report as the basis for its maintenance program; however, it used the MSG-3 MRB report to extend some maintenance task intervals by replacing them with the newer intervals specified in the MSG-3 MRB report. The FAA’s MD-80 MRB Chairman confirmed that existing MSG-2 operators, such as Alaska Airlines, could use intervals from MSG-3. Alaska Airlines’ manager of reliability and maintenance programs testified that the airline had done so in some areas.

Factual Information 27 Aircraft Accident Report through emergency response, day-to-day and long-term monitoring, and auditing functions. The handbook states that “some operators with approved reliability programs use the reliability program to fulfill the monitoring mechanical performance functions requirement of its [continuing analysis and surveillance] program.” Typical sources of data collection for reliability programs are unscheduled removals, mechanical delays and cancellations, pilot reports, sampling inspections, shop findings, functional checks, bench checks, service difficulty reports, and mechanical interruption summaries. The objective of data analysis is to recognize the need for corrective action, establish what corrective action is needed, and determine the effectiveness of that action. Other indicators of component reliability used to detect unfavorable trends are operational incident reports and direct information from maintenance control, component shops, or repair control about component discrepancies. Alaska Airlines’ reliability analysis program was authorized on April 3, 1995, as part of the airline’s FAA-approved operations specifications. According to reliability analysis program guidelines, Alaska Airlines managed its maintenance program by implementing decisions based on continuing analysis of operational data. All scheduled maintenance/inspection tasks, checks, and intervals were included in the reliability analysis program. Reliability analysis program findings could result in changes, additions, or deletions of maintenance tasks, intervals, or operating limits. Alaska Airlines has made changes to its reliability analysis program since the flight 261 accident. This discussion describes Alaska Airlines’ reliability analysis program up until the time of the accident. The Reliability Analysis Program Control Board, which reported to Alaska Airlines’ vice president of maintenance and engineering, was responsible for the overall program.54 The Reliability Analysis Program Control Board was authorized to determine what course of remedial action was necessary and to order implementation of its decisions. The Reliability Department, which reported to the Reliability Analysis Program Control Board, administered the program and was responsible for reviewing and analyzing collected data, issuing alert notices, and providing notification of reliability issues. The Reliability Analysis Program Control Board also included a smaller Reliability Action Board that addressed problems considered critical or urgent and that had to be considered before the next Reliability Analysis Program Control Board meeting.55 Reliability Action Board decisions that required changes to the activities controlled by the reliability analysis program required the preparation and approval of a Reliability Analysis Program Control Board directive. 54 Alaska Airlines Reliability Analysis Program Control Board, which met once per month, comprised the airline’s reliability manager (who served as board chairman), the director of base maintenance, the director of line maintenance, the director of quality control, the director of engineering, the manager of maintenance control/technical services, the manager of maintenance programs and publications, and the director of maintenance planning and production control. 55 A Reliability Action Board meeting did not require the attendance of the full Reliability Analysis Program Control Board but had to be attended by the Reliability Analysis Program Control Board Chairman (or designee) and other members, as appropriate to the issue being discussed.

Factual Information 28 Aircraft Accident Report In addition, a company MRB at Alaska Airlines met biweekly to review and approve changes to the maintenance program.56 The MRB also reviewed ME-01 change requests57 that required MRB approval. Under Alaska Airlines’ MRB program, the manager of maintenance programs and publications reviewed ME-01 change requests to determine whether the change required MRB approval. If the ME-01 did not require MRB/Reliability Analysis Program Control Board approval, the request was routed to management personnel in the following order: reliability, director of engineering, director of line maintenance, director of base maintenance, manager of maintenance control, director of quality control, director of maintenance planning and production control. The MRB/Reliability Analysis Program Control Board voting member representing the department that requested the change reviewed the ME-01 and then decided whether to sign it. If signed, the ME-01 is forwarded to the manager of the maintenance programs and technical publications department for processing. MRB approval was required for any change to Alaska Airlines’ GMM. Reliability analysis program approval was required for any maintenance program change, some of which required FAA approval. According to Alaska Airlines’ reliability analysis program, maintenance program changes that required FAA approval included the following: • Addition or deletion of an aircraft manufacturer’s MSG-2 OAMP recommended maintenance significant item (MSI),58 or an aircraft manufacturer’s MSG-3 OAMP document recommended systems maintenance, structural, or zonal task.59 • Addition or deletion of an MSG-2 MRB recommended MSI or an MSG-3 MRB recommended systems maintenance, structural, or zonal task. • Escalation of hard-time component overhaul intervals, periodic maintenance check intervals, or structural inspection intervals to greater than 10 percent of the present interval. • Escalation of an individual maintenance task interval (currently performed at or in excess of the interval recommended in the applicable aircraft’s OAMP document) to greater than 10 percent of the current interval. Changes that did not require FAA approval included the following: 56 Alaska Airlines’ company MRB members were the same as those who served on the Reliability Analysis Program Control Board. 57 The ME-01 form is used by Alaska Airlines to process requests and recommendations to change existing maintenance program procedures, intervals, and documents (task cards, maintenance manuals, and policy and procedures manuals), and other documents under the control of the airline’s engineering and quality departments. The ME-01 is not required for typographical errors, P/N changes, clarification of existing procedures, changes to torques, clearances and limits required to reflect manual revisions, and changes generated by previously authorized airplane modifications or actions to meet AD or Federal Aviation Regulations (FAR) requirements. 58 An MSI is an item identified by the manufacturer, the failure of which is undetectable during operations and could affect safety (on ground or in flight) or could have significant operational economic impact. 59 Zonal tasks are tasks associated with specific areas of the airplane, such as the wing and fuselage.

Factual Information 29 Aircraft Accident Report • Escalation of hard-time component overhaul intervals, periodic maintenance check intervals, or structural inspection intervals that did not exceed 10 percent of the current interval. (Although FAA approval is not required for these escalations, data justifying the change must be available to the FAA on request.) • Escalation of an individual maintenance task interval (which is not listed on the airplane’s MRB) up to the interval recommended in the applicable airplane’s OAMP document, regardless of the increase of the current interval. • Periodic maintenance intervals of MSIs identified as condition-monitored items, which have a periodic maintenance activity or task at some determined interval. Items that cannot be changed or that required approval beyond the local FAA Flight Standards District Office (FSDO) included the following: • Those tasks listed as certification maintenance requirements (CMR),60 airworthiness limitation items,61 or fixed maintenance intervals unless approval is granted from the FAA Aircraft Certification Office. • Life limits mandated by the manufacturer. • Time limits mandated by an AD, except in accordance with the AD. • Time limits mandated by an aircraft’s type certificate data sheet. 1.6.3.2 Jackscrew Assembly Lubrication Procedures The Alaska Airlines maintenance task card for elevator and horizontal stabilizer lubrication (No. 28312000) specified the following steps for lubricating the jackscrew assembly:62 A. Open access doors 6307, 6308, 6306 and 6309. B. Lube per the following 60 According to AC 25-19, “Certification Maintenance Requirements,” dated November 28, 1994, “a CMR is a required periodic task, established during the design certification of the airplane as an operating limitation of the type certificate…[and is] intended to detect safety-significant latent failures that would, in combination with one or more other specific failures or events, result in a hazardous or catastrophic failure condition.” According to the AC, “CMRs are designed to verify that a certain failure has or has not occurred, and does not provide any preventative maintenance function.” (Emphasis in original.) 61 Airworthiness limitation items are documents that contain information that defines mandatory replacement times for safe-life structure and inspection requirements for principal structural elements and provide specific nondestructive inspection techniques and procedures for each principal structural element. 62 Illustrations were attached to the task card to show the areas to be lubricated.

Factual Information 30 Aircraft Accident Report C. Close doors 6307, 6308, 6306 and 6309. General lubrication guidance contained in Boeing’s Maintenance Manual states that, when lubricating vented bearings, “force grease into fittings until all old grease is extruded.” According to a February 25, 2002, letter from Boeing to the Safety Board, this lubrication task requires about 4.5 person hours to accomplish, including removal and closure of the access panels. During the investigation, Safety Board investigators conducted interviews with Alaska Airlines mechanics who had lubricated the accident airplane’s elevators and horizontal stabilizer components to determine how they understood and practiced the lubrication procedures. The Alaska Airlines mechanic who was responsible for lubricating the accident airplane’s elevators and horizontal stabilizer components during a C check at the airline’s maintenance facility at Oakland International Airport (OAK), Oakland, California, in September 199763 told Safety Board investigators that lubrication of the elevators and horizontal stabilizer components “takes a couple of hours.” The mechanic stated that if the lubrication of the elevators and horizontal stabilizer components is accomplished during a C check, the task is accomplished by a mechanic standing on a ITEM NO. ITEM DESCRIPTION NO. OF FITTINGS OR AREAS 1. MAIN GEAR BOX 1 Check oil level and fill to fill plug with approved jet engine oil. Oil capacity is approximately 0.6 pint. 2. ACTUATOR ASSEMBLY 1 3. JACKSCREW 0 Apply light coat of grease to threads, then operate mechanism through full range of travel to distribute lubricant over length of jackscrew. 4. SCREW GIMBAL 3 5. HORIZONTAL STABILIZER HINGE 2 6. JACKSCREW STOP 0 Fill cavity between screw and stop with Parker-O-Lube.

Factual Information 31 Aircraft Accident Report tail-stand platform in the hangar. He stated that he would apply grease to acme nut grease fittings until “the grease starts to come out…the sides where you’re greasing, where it starts to bulge out.” The mechanic stated that he would also use a “paint brush” to apply grease to the acme screw threads. He added, “When I do it, I do the brush, too, but I don’t feel it’s enough. I always do an over-kill. I always like to put more on…[to] put a big glob on my hand and make sure it’s on. More’s better. It’s not going to hurt anything.” The Alaska Airlines mechanic who was responsible for performing the accident airplane’s last elevator and horizontal stabilizer components lubrication at SFO in September 1999 told Safety Board investigators that he would know if the grease fitting for the acme nut was clogged “because you’d feel it in the [grease] gun as you try to put it in. If it wasn’t going in, you could feel it.” When asked how he determined whether the lubrication was being accomplished properly and when to stop pumping the grease gun, the mechanic responded, “I don’t.” When asked whether he would be able to see grease coming out of the top of the acme nut during lubrication, the mechanic responded, “You know, I can’t remember looking to see if there was.” He added that lubrications at SFO were accomplished most often during the evening, outside of the hangar (even if it was raining), and in the basket of a lift-truck. He added that he used a battery-operated head lamp during night lubrication tasks. He stated that the lubrication task took “roughly…probably an hour” to accomplish. It was not entirely clear from his testimony whether he was including removal of the access panels in his estimate. When asked whether his 1-hour estimate included gaining access to the area, he replied, “No, that would probably take a little—well, you’ve got probably a dozen screws to take out of the one panel, so that’s—I wouldn’t think any more than an hour.” The questioner then stated, “including access?” and the mechanic replied, “Yeah.” The mechanic also stated that he applied grease to the acme screw with a brush, adding, “You basically take out a little bit of grease with you, or you pump it out of the grease gun onto a paint brush and just paint a real light coat on there.”64 1.6.3.2.1 Jackscrew Assembly Lubrication Intervals 1.6.3.2.1.1 Manufacturer-Recommended Lubrication Intervals Original DC-9 certification documents, including Douglas Process Standard 3.17-49 (issued August 1, 1964), specified a lubrication interval for the jackscrew assembly of 300 to 350 flight hours. The manufacturer’s initial OAMP document for the DC-9 and the MD-80 specified lubrication intervals of 600 to 900 flight hours. In 1996, McDonnell Douglas issued another OAMP document, which was developed to reflect the guidance and philosophy in the MSG-3 MSG-3 MRB report for the MD-80. The MSG-3 MRB called for lubrication of the jackscrew assembly at C-check 63 There were three scheduled lubrications after the September 1997 C check. The C check performed in September 1997 was the last C check accomplished on the accident airplane that required an end play check of the acme screw and nut. For more information about the accident airplane’s maintenance history, see section 1.6.3.5. 64 For information about Safety Board observations of jackscrew assembly lubrications performed by maintenance personnel from two MD-80 operators, see section 1.18.6.

Factual Information 32 Aircraft Accident Report intervals (every 3,600 flight hours or 15 months, whichever comes first). The MSG-3 OAMP also called for lubrication of the jackscrew assembly at C-check intervals (every 3,600 flight hours).65 Testimony at the Safety Board’s public hearing and Boeing documents indicated that Douglas’ earlier recommended lubrication interval of 600 to 900 flight hours was not considered during the MSG-3 decision-making process to extend the recommended interval. Further, Boeing design engineers were not consulted about nor aware of the extended lubrication interval specified in the MSG-3 documents. The FAA’s MD-80 MRB chairman testified at the public hearing that the longer interval in the MSG-3 documents was supported by reliability data from the carriers and the manufacturer. He explained that the MSG-3 MD-80 MRB considered the jackscrew lubrication task change as part of a larger C-check “package” and that the extension of C-check intervals in the MSG-3 MD-80 MRB did not involve a task-by-task analysis of each task that would be affected by the changed interval. 1.6.3.2.1.2 Alaska Airlines’ Lubrication Intervals Alaska Airlines maintenance records chronicled the following changes in lubrication intervals from 1985 to April 2000: • In March 1985, the B-check interval was 350 flight hours, and the jackscrew assembly lubrication was to be accomplished at every other B check, or every 700 flight hours. • In March 1987, the B-check interval was increased to 500 flight hours, and the jackscrew assembly lubrication was changed to be accomplished at every B check, or every 500 flight hours. • In July 1988, B checks were eliminated from Alaska Airlines’ MD-80 maintenance program, and the tasks accomplished during B checks were incorporated into the A and C checks. A checks were to be accomplished every 125 flight hours. The jackscrew assembly lubrication was to be accomplished at every eighth A check, or every 1,000 flight hours. • In February 1991, A-check intervals were increased to 150 flight hours. Jackscrew assembly lubrication was still to be accomplished at every eighth A check, or every 1,200 flight hours. • In December 1994, the A-check interval was increased to 200 flight hours. Jackscrew assembly lubrication was still to be accomplished at every eighth A check, or every 1,600 flight hours. • In July 1996, the jackscrew assembly lubrication task was removed from the A check and placed on a time-controlled task card with a maximum interval of 8 months.66 There was no accompanying flight-hour limit; however, based on airplane utilization rates at that time, 8 months was about 2,550 flight hours. 65 The FAA’s MD-80 MRB Chairman testified at the public hearing that he assumed the absence of any calendar-time interval in the MSG-3 OAMP document was a typographical error.

Factual Information 33 Aircraft Accident Report Jackscrew assembly lubrication was also to be performed at each C check using time-controlled task card No. 28312000. According to the FAA PMI for Alaska Airlines, who reviewed and accepted the 1996 lubrication interval extension, the extended MSG-3 interval (3,600 flight hours or 15 months, whichever comes first) was presented as justification for the interval increase. • In October 1996, jackscrew assembly lubrication was combined with the lubrication of the elevators and elevator tabs. The interval remained at 8 months, or about 2,550 flight hours, and this was the lubrication interval in effect at the time of the accident. • On April 6, 2000, after the accident, the jackscrew assembly lubrication interval was changed from 8 months to 650 flight hours, in accordance with ADs 2000-03-51 and 2000-15-15.67 Table 2 shows a comparison of manufacturer-recommended jackscrew assembly lubrication intervals with Alaska Airlines’ intervals. Table 2. Comparison of manufacturer-recommended jackscrew assembly lubrication intervals with Alaska Airlines’ intervals. 66 A time-controlled task card is a stand-alone maintenance task card that is tracked individually by the operator. 67 For more information about ADs 2000-03-51 and 2000-15-15, see section 1.18.1. MSG-2 MRB MSG-2 OAMP MSG-3 MRB MSG-3 OAMP Not included in logic diagram 600 to 900 flight hours C check (3,600 flight hours or 15 months, whichever comes first) C check (3,600 flight hours) Alaska Airlines 1985 Alaska Airlines 1987 Alaska Airlines 1988 Alaska Airlines 1991 Alaska Airlines 1994 Alaska Airlines 1996 to April 2000 Alaska Airlines April 2000 to Presenta a. All carriers currently meet this requirement. Every other B check (700 flight hours) B check (500 flight hours) Every eighth A check (1,000 flight hours) Every eighth A check (1,200 flight hours) Every eighth A check (1,600 flight hours) Time-controll ed task card— 8 months maximum (About 2,550 flight hours) 650 flight hours

Factual Information 34 Aircraft Accident Report 1.6.3.2.2 Chronology of Grease Type Changes Boeing’s Airplane Maintenance Manual for DC-9, MD-80/90, and 717 series airplanes specifies the use of MIL-G-8132268 grease to lubricate the jackscrew assembly. Initially, Alaska Airlines used Mobilgrease 28, which meets the requirements of MIL-G-81322. On January 16, 1996, Alaska Airlines asked its McDonnell Douglas field representative if Aeroshell 33 could be used in place of Mobilgrease 28 on suitable areas of its MD-80 fleet airplanes, including the jackscrew assembly. Aeroshell 33 was a relatively new type of grease that was developed to meet Boeing Material Specifications 3-33 and subsequently qualified under MIL-G-23827.69 According to Alaska Airlines, this change was part of an effort to standardize and reduce the number of greases used by the airline in its mixed fleet of 737s and MD-80s. On February 23, 1996, McDonnell Douglas engineers replied that laboratory testing would be required to determine whether Aeroshell 33 could be approved for use on Douglas airplanes. Alaska Airlines was informed on January 24, 1997, that laboratory testing of Aeroshell had begun and that the testing could take about a year. On June 19, 1997, Douglas informed its Alaska Airlines field service representative that it was pursuing the possibility of a “no technical objection” for Alaska Airlines to use Aeroshell 33 on Douglas airplanes. However, the message stated, “this is not a sure thing, considering the liability of providing consent for the use of such an important substance…before the substance has been fully evaluated.” The message stated that another possibility was an in-service evaluation of the grease by Alaska Airlines. On June 23, 1997, the Douglas field service representative sent a message to Douglas headquarters noting that Alaska Airlines welcomed the offer to conduct an in-service evaluation of Aeroshell 33 and was awaiting guidelines regarding its use. On July 23, 1997, Alaska Airlines initiated an internal form titled, “Maintenance Programs/Technical Publications Change Request” (ME-01 No. 97-002974), to revise its maintenance lubrication task cards by replacing Mobilgrease 28 with Aeroshell 33 for use on flight controls, including the jackscrew assembly, doors, and landing gear (except wheel bearings), on MD-80 series airplanes in its fleet. This form was signed by the initiator of the request, the manager of maintenance programs and technical publications (dated September 17, 1997), and the director of engineering (dated July 25, 1997). Signature blocks for the director of base maintenance and the director of maintenance planning and production control were blank but struck out by hand. The “special action 68 The “MIL” specification is a U.S. military material specification that defines the requirements for a material. Requirements that are defined for grease MIL specification categories include, in part, viscosity, temperature range, and corrosion protection. A part’s function and exposure to such factors as loads, friction, extreme temperatures, and water and other contaminants determine which grease MIL specification category is appropriate. In 1999, the MIL-G nomenclature (in which G stands for grease) was replaced with MIL-PRF (in which PRF stands for performance); no change in specifications was made. Several products from different manufacturers may meet a specific MIL specification. After testing and qualification, these greases are listed on the Qualified Products List for each MIL specification. For example, greases that meet the specifications for MIL-G-81322 include Mobilgrease 28, Aeroshell Grease 22, and Royco Grease 22. 69 MIL-PRF-23827 superseded MIL-G-23827 in 1998, with no change in specifications.

Factual Information 35 Aircraft Accident Report required”70 section was blank, as was the signature block at the bottom of the form to indicate “Change Request accomplished.” At the Safety Board’s public hearing, Alaska Airlines former director of engineering (who at the time that the grease change was initiated was Alaska Airlines manager of maintenance programs and technical publications) and the current director of engineering indicated that Reliability Analysis Program Control Board approval was required to implement the change. However, neither individual could explain how the change was implemented without the required signatures or Reliability Analysis Program Control Board approval. On September 26, 1997, McDonnell Douglas informed Alaska Airlines in Douglas Communication SVC-SEA-0122/MRL that it had “no technical objection to the use of [Aeroshell 33] grease in place of MIL-G-81322 grease on Alaska Airlines MD-80 aircraft with one known restriction. Aeroshell 33 grease may not be used in areas subjected to temperatures in excess of 250° F including landing gear wheel bearings.” The McDonnell Douglas communication added the following: It should also be noted that the initial results of laboratory testing that compared Aeroshell 33 grease with Mobile grease 28 (MIL-G-81322) indicated that Aeroshell 33 grease is somewhat less resistant to water wash-out than Mobile grease 28. It is not known whether the difference in water wash-out resistance noted in the laboratory will result in any notable difference of the in-service grease performance. However, the potential exists that the required frequency of lubrication could be affected in areas of the aircraft exposed to outside ambient conditions or aircraft washing and cleaning. This no technical objection is provided prior to the completion of a Douglas study intended to determine the acceptability of Aeroshell 33 grease for use in Douglas-built aircraft.[71] As such, Douglas cannot yet verify the performance of this grease. It will be the responsibility of Alaska Airlines to monitor the areas where Aeroshell 33 grease is used for any adverse reactions. Further, it will be the responsibility of Alaska Airlines to obtain any FAA approval required by their principal maintenance inspector for the use of Aeroshell 33 grease in their MD-80 aircraft. The McDonnell Douglas communication concluded with the following: Because the Douglas study of Aeroshell 33 grease will be based on laboratory tests rather than an in-service test, any data we can obtain from in-service aircraft would be valuable to help confirm or refute the laboratory results. Any information Alaska Airlines is able to provide to Douglas, positive or negative, regarding the in-service performance of Aeroshell 33 grease on the MD-80 will be greatly appreciated. 70 The possible choices in this section, each preceded by a block to check off, were “MRB action required,” “[Reliability Analysis Program] Control Board action required,” or “Routine.” 71 According to Boeing, McDonnell Douglas never completed this testing.

Factual Information 36 Aircraft Accident Report On December 18, 1997, Alaska Airlines task card No. 24312000 for lubrication of the horizontal stabilizer components was revised (based on ME-01 No. 97-002974) to reflect the change from Mobilgrease 28 to Aeroshell 33.72 On January 6, 1998, task card No. 28312000 for lubrication of the elevators and horizontal stabilizer components was also revised to reflect the change from Mobilgrease 28 to Aeroshell 33.73 According to Alaska Airlines records, it sent the monthly maintenance task card audit report for December 1997, which included all task card changes since its last report, including revision dates, to the FAA. Although Alaska Airlines notified the FAA of the change in the grease type specified in its maintenance instructions, as required, it did not provide any substantiating justification at that time nor was such action required. The FAA PMI for Alaska Airlines at the time of the lubrication change stated during postaccident interviews that such changes could be made without prior FAA approval under provisions of the airline’s FAA-approved maintenance program.74 As a result of the flight 261 accident, in March 2000, the FAA requested documentation from Alaska Airlines that supported the grease change to lubricate the jackscrew assembly. Alaska Airlines subsequently submitted the requested documentation.75 In an April 5, 2000, response letter, the FAA informed Alaska Airlines that the substantiating documents it had submitted did not support the change, and it disapproved the use of Aeroshell 33 as a substitute for Mobilgrease 28. After receiving this disapproval notification, Alaska Airlines modified its maintenance procedures to again specify the use of Mobilgrease 28 to lubricate the jackscrew assembly. 1.6.3.2.3 July 19, 2002, Alaska Airlines Maintenance Information Letter On July 19, 2002, Alaska Airlines issued Maintenance Information Letter No. 05-00-02-21, “MD-80 Rudder Trim Tab Hinge Support Bearings Lubrication,”76 72 According to Alaska Airlines records, 34 additional lubrication task cards, including lubrication tasks for flaps, slats, spoilers, ailerons, and landing gear components, were revised in December 1997. These task cards also reflected the change to Aeroshell 33. 73 The GMM was not modified to reflect the grease change to Aeroshell 33; it still specified the use of Mobilgrease 28 to lubricate the elevators and horizontal stabilizer components. 74 According to the PMI, changes to “accepted [maintenance] manuals” used as part of an overall FAA-approved maintenance program can be made and then submitted to the FAA as part of a routine change notification process. The PMI stated, “in accepted manuals, they go ahead and make the change, publish it, and send you a copy and you read it. And if you have any objection to it, [you] notify them in writing that you have objections. If you don’t tell them, then it’s accepted.” Referring to the Alaska Airlines lubrication change and the task card change notification in 1997, the PMI stated, “I don’t know that anybody caught that or noticed it or bought off on it or looked into it at all.” 75 The copies provided to the Safety Board of these documents included a trade magazine article on Aeroshell 33, excerpts of Boeing 737 and McDonnell Douglas MD-80 maintenance manuals, Boeing service letters, internal correspondence and messages between Alaska Airlines and Boeing, and existing specifications on MIL-G-81322 and MIL-G-23827 greases. None of the documents provided any information or performance data specifically applicable to the use of Aeroshell 33 on McDonnell Douglas airplanes or these airplanes’ horizontal stabilizer trim systems. 76 Maintenance Information Letter No. 05-00-02-21 is valid for 1 year, expiring on July 19, 2003, or when rescinded.

Factual Information 37 Aircraft Accident Report because of “findings [that] have revealed that the MD-80 rudder trim tab support bearings may not always be receiving adequate lubrication.” Alaska Airlines maintenance task card No. 24612000 specifies lubrication of each of the four bearings that support the MD-80 rudder trim tab at every C check. However, the letter stated that “shop inspection of tabs from two aircraft…only recently out of C-check indicated extreme bearing wear, with little or no evidence of new grease” and that “one bearing fell apart upon removal.” The letter stated that the solution was adherence to the lubrication instruction in task card No. 24612000. In an October 3, 2002, letter to the Safety Board, Alaska Airlines indicated that the “[maintenance information letter] was incorrect when it described these aircraft as ‘only recently out of C-check.’” Alaska Airlines stated that one of the airplanes had last been in for a C check about 6 months before the discovery of the worn bearing and that the other airplane had last been in for a C check about 15 months before the discovery of the worn bearing. In an October 24, 2002, facsimile to the Safety Board, Alaska Airlines stated further that as a result of additional analysis, the rudder trim tab lubrication interval had been reduced “from the current ‘C’ check (approximately 4,350 flight hours) to the Boeing (McDonnell Douglas) MSG-2 On Aircraft Maintenance Planning…‘Low’ end interval of 1,200 flight hours.” 1.6.3.3 Procedures for Monitoring Acme Nut Thread Wear 1.6.3.3.1 Defining and Calculating Wear Rate The only portion of the jackscrew assembly that wears significantly is the aluminum-bronze acme nut. Therefore, the terms “wear” and “wear rate” refer to the wear of the acme nut. As will be discussed in section 1.6.3.3.2, acme nut thread wear can be inferred by measuring the amount of movement, or end play, between the acme nut and screw threads. In other words, end play is an indirect measurement of acme nut wear. End play measurements are typically performed either on-wing or after removal from the airplane during a bench check. The Safety Board conducted a statistical analysis of end play data that concluded that the reliability and validity of the on-wing end play check is very low and is susceptible to measurement error.77 Because the bench end play check is conducted in a more controlled environment, it is presumably less susceptible to measurement error; however, the reliability and validity of the bench end play check was not statistically evaluated. Unless otherwise specified, the term “wear rate” used in this report refers to an approximate wear rate determined by comparing end play measurements from the beginning and the end of an elapsed time. The amount of the change in end play over that period of time is used to calculate the approximate rate of wear. (Wear rate calculations are generally converted so that they can be expressed as an average wear rate per 1,000 flight hours.) The wear rate at any given point during the elapsed time is not known; it may be higher or lower than the approximated wear rate. 77For more information about the Safety Board’s end play data study, see section 1.18.2.

Factual Information 38 Aircraft Accident Report 1.6.3.3.2 Development of End Play Check Procedures The DC-9 jackscrew assembly was originally certified with an expected service life of 30,000 hours. According to Douglas documents,78 after 30,000 hours, the gap between the acme screw and nut threads was expected to be 0.0265 inch. Specifications for newly manufactured jackscrew assemblies stipulate that this gap be between 0.003 to 0.010 inch. No regular inspections to monitor acme nut thread wear were recommended at the time the DC-9 was certified. However, when the DC-9 entered service in 1965, Douglas initiated a program, which closely monitored a sample of DC-9 airplanes. As part of this program, an end play check procedure was used to monitor wear by measuring the gap, or end play, between the acme screw and nut threads.79 This procedure was conducted during bench checks to determine whether the wear rate of the acme nut threads was comparable to the DC-8 wear rate of 0.001 inch per 1,000 hours.80 As a result of excessive wear rates discovered through this sampling program, Douglas issued Douglas Design Memorandum C1-250-DES-DC9-683 in February 1967. The memorandum stated that DC-9 operators had reported six jackscrew assemblies that indicated “a wear rate considerably in excess of that predicted”81 and provided the following information about the flight hours and end play measurements from the six jackscrew assemblies: (The Safety Board calculated the wear rate per 1,000 hours, taking into account the end play measurement of the jackscrew assembly when new. If the end play measurement when new was known, that value was used. Otherwise, a presumed end play measurement of 0.007 inch was used.) 78 The documents were All Operators Letter (AOL) 9-48, dated November 4, 1966, and Douglas Design Memorandum C1-250-DES-DC9-683, dated February 28, 1967. 79 The sampling program ended in 1970. As will be discussed, by this time, Douglas had determined that wear rates for the DC-9 jackscrew assembly made with new materials and manufacturing procedures were 0.001 inch per 1,000 hours or lower. 80 A 1967 Douglas test report on DC-8 jackscrew assemblies indicated an average wear rate of not greater than 0.001 inch per 1,000 hours. 81 The design memorandum also noted, “there is evidence from screws in service, which have been returned to [Douglas], that lubrication practices as defined in the Maintenance Manual have not been followed. Operators should be advised of the importance of relubrication as specified.” Airplane No. Flight Hours End Play (inches) Wear Rate (inches per 1,000 hours) 1 4,086 0.030 0.0056 2 3,300 0.026 0.0058 3 3,322 0.026 0.0057 4 3,390 0.029 0.0065 5 3,400 0.028 0.0062 6 2,200 0.023 0.0073

Factual Information 39 Aircraft Accident Report As a result of these operator reports, Douglas conducted a series of full-scale tests, which involved operating several jackscrew assemblies under varying conditions in a test fixture. The Douglas engineering test report stated that the purposes of the tests were “to simulate a rate of wear in the laboratory that is comparable to that being experienced in service on the DC-9 horizontal stabilizer screw and nut [and to] determine the right material of the jackscrew end nut, and/or lubrication, which would generate a minimum of wear to provide a service life of 30,000 flight hours.” As a result of these tests, Douglas established the end play measurement limit of 0.040 inch after determining that this limit would not create aerodynamic flutter or other structural problems.82 Douglas also changed some of the materials specifications and manufacturing processes for the acme screw (increased heat treating and nitriding) to reduce wear. Douglas conducted laboratory tests of the DC-9 acme screws made with the newly specified materials and manufacturing processes, which revealed that the screws had an average wear rate of about 0.001 inch per 1,000 hours. To allow operators to monitor acme nut wear without removing the jackscrew assembly from the airplane, Douglas developed the on-wing end play check procedure. The procedure calls for pulling down on the horizontal stabilizer by applying a specified amount of torque to a tool known as a restraining fixture to change the load on the acme screw from tension to compression.83 The load reversal allows movement, or end play, between the acme screw and nut threads. This play is measured using a dial indicator, which is mounted on the lower rotational stop (fixed to the screw) with the movable plunger set against the lower surface of the acme nut, that measures the vertical movement of the acme screw when the load is applied. The amount of end play is used as an indication of the amount of acme nut thread wear (and acme screw thread wear, if there is any). The procedure calls for the restraining fixture load to be applied and removed several times until consistent measurements are achieved. Figure 8 shows how the restraining fixture should be placed on the horizontal stabilizer during the end play check procedure. Figure 9 shows a view of a typical dial indicator set up for end play checks. 82 In AOL 9-48A, Douglas stated that jackscrew assemblies could remain in service as long as the end play measurement remained within tolerances (between 0.003 and 0.040 inch). End play checks that indicated measurements within the specified limits were not required to be recorded before the issuance of AD 2000-15-15 in July 2000. 83 For more information about restraining fixtures, see section 1.6.3.3.3.

Factual Information 40 Aircraft Accident Report Figure 8. Depiction of how restraining fixture should be placed on the horizontal stabilizer during an end play check.

Factual Information 41 Aircraft Accident Report Figure 9. View of a typical dial indicator set up for end play checks. On May 29, 1984, McDonnell Douglas issued AOL 9-1526, which reported that “two operators have reported three instances of premature removal/replacement of a horizontal stabilizer actuator assembly” and reiterated the OAMP document’s recommendation that all DC-9 operators lubricate the jackscrew assembly at 600-flight-hour intervals. AOL 9-1526 added, “these assemblies, which had accumulated less than 6,000 flight hours each since new, were replaced due to excessive end play between the acme screw and acme nut.” AOL 9-1526 stated that the jackscrew assemblies were returned to McDonnell Douglas for investigation and that “the acme nut installed in each assembly exhibited severe wear of the thread surfaces. In addition, grease samples taken from the lubrication passages…on two of these [jackscrew] assemblies were dry and without evidence of recent renewal. Accordingly, Douglas is of the opinion that the most probable cause of the observed acme nut thread wear and subsequent excessive end play was inadequate lubrication of the actuator assemblies.”84 The AOL concluded, “In view of the foregoing, Douglas wishes to emphasize the importance of maintaining a conscientious lubrication program to minimize acme nut thread wear and extend the service life of the actuator assembly.” In 1990, another airline reported that a DC-9 acme nut had worn beyond the 0.040-inch end play measurement limit after accumulating 5,780 flight hours, a wear rate

Factual Information 42 Aircraft Accident Report of 0.0057 inch per 1,000 flight hours. In AOL 9-2120, dated December 6, 1990, McDonnell Douglas asked operators of DC-9 and MD-80 airplanes to report on the lubrication frequency of the jackscrew assembly, the mean time between removal (MTBR) and mean time between unscheduled removal (MTBUR), and the average wear rate of the assembly as measured by an on-wing end play check. On the basis of responses from 10 DC-9 operators and 11 MD-80 operators,85 on September 5, 1991, McDonnell Douglas issued AOL 9-2120A, which provided the following results: In AOL 9-2120A, McDonnell Douglas noted that the prematurely worn jackscrew assembly was not typical but, because the assembly was not examined by McDonnell Douglas, the cause of the premature wear was unknown.86 However, McDonnell Douglas again reiterated its 600-flight-hour lubrication interval recommendations.87 On April 13 and November 20, 2000, Boeing issued revisions to the end play check procedure, including the following: • Clarification of which part number (P/N) restraining fixture could be used on specific airplanes; • Clarification of how and where to install dial indicator mounting bracket and probe; 84 According to a McDonnell Douglas field service representative report dated March 13, 1984, the end play measurement of one of the jackscrew assemblies removed and returned to the company was 0.043 inch. The report stated that the acme nut threads were “worn and serrated.” The report added that “it should be noted that lubrication cycle of jackscrew has been sporadic on this and other DC-9 [aircraft] at this location.” The maintenance facility returned the assembly to McDonnell Douglas with a letter attached to the field representative report, which was addressed to product support and asked McDonnell Douglas to compare the returned assembly to drawing specifications and check the “trueness of the screw shaft assembly.” The letter also asked, “What is the hardness spec of the nut?” The letter concluded, “I would appreciate an expeditious response in this matter for I have a later delivered aircraft with only 4,000 hours and within .001 of the maximum backlash [end play] limit.” 85 No information was available about reported wear rates for each of the operators that responded to the survey or for any individual jackscrew assembly that was included in the survey results. Therefore, the variability among operators or assemblies is unknown. Model Lube Interval MTBR MTBUR Wear Rate DC-9 1,329 hours 34,054 hours 34,395 hours 0.0011 inch per 1,000 hours MD-80 804 hours 24,397 hours 28,397 hours 0.0013 inch per 1,000 hours 86 Before issuing AOL 9-1526 in 1984, McDonnell Douglas examined six jackscrew assemblies that had been reported to have excessive wear. However, McDonnell Douglas could not examine the jackscrew assembly removed in 1990 because it was not delivered for inspection. 87 The Safety Board confirmed that Alaska Airlines’ maintenance department had received a copy of AOL 9-2120A from McDonnell Douglas.

Factual Information 43 Aircraft Accident Report • Addition of a note to specify that restraining fixture threads are to be cleaned and lubricated before the procedure is performed; • Addition of a step to apply 100 inch-pounds to the restraining fixture in the lengthening direction and then 300 inch-pounds (instead of a range from 250 to 300 inch-pounds as previously stated in step [8]) on the restraining fixture in the shortening direction to get the end play; and • Specification of the allowable end play limits in step (11) as “not less than 0.003 and not more than 0.040 inch” instead of “between 0.003 and 0.040.” 1.6.3.3.2.1 Alaska Airlines’ End Play Check Procedure The Alaska Airlines maintenance task card for the acme screw and nut end play check, dated October 7, 1996, which was in effect at the time of the accident airplane’s last end play check, described the end play check procedure as follows: (1) Using control wheel trim switches, move horizontal stabilizer to approximately 1 degree airplane noseup position. WARNING:TAG AND SAFETY OPEN CIRCUIT BREAKERS. (2) Open the following circuit breakers. (3) Remove panel and stabilizer fairing to gain access to work area. (4) Install horizontal stabilizer restraining fixture. (5) Clamp dial indicator mounting bracket to jackscrew torque tube restraining nut and position dial indicator probe against acme nut. (6) Clamp dial indicator mounting bracket to upper stop on jackscrew and position dial indicator probe against lower plate of support assembly. (7) Preload indicator probe to a least .100 inch and record dial indicator reading. Circuit Breaker Panel Location Panel Area Autopilot & Alternate upper epc Left Radio Longitudinal Trim (3) AC Bus Primary Longitudinal Trim (2) upper epc Left Radio DC Bus

Factual Information 44 Aircraft Accident Report (8) Apply 250 to 300 inch pounds of torque to horizontal stabilizer by shortening restraining fixture and record dial indicator readings. (9) Relieve torque on restraining fixture. Check that dial indicator has returned to initial reading. (10) Repeat steps (8) and (9) several times to insure consistent results (within .001 inch). (11) Check that end play limits are between .003 and .040 inch. Readings in excess of above are cause for replacement of the acme jackscrew and nut. Should replacement become necessary accomplish E.O. [engineering order] 8-55-10-01 if not previously accomplished. (12) Check that free play between jackscrew and upper support does not exceed .010 inch. If free play exceeds this dimension, upper bearing must be replaced. (13) Remove restraining fixture, dial indicator and attaching brackets and clamps. Install stabilizer fairing and panel. (14) Close circuit breakers identified in step (2). (15) Return horizontal stabilizer to neutral. 1.6.3.3.3 Horizontal Stabilizer Restraining Fixture 1.6.3.3.3.1 General The McDonnell Douglas MD-80 generic task card for the acme screw and nut operation (No. 0855, dated December 1991) describes the end play check procedure and identifies a McDonnell Douglas-manufactured horizontal stabilizer restraining fixture, P/N 4916750-1, for use in the procedure. The task card also noted that equivalent substitutes could be used in place of these tools. The original Douglas engineering drawing for the restraining fixture indicates that the -503 configuration was to be used on MD-80 series airplanes, which would include the accident airplane. 1.6.3.3.3.2 Alaska Airlines-Manufactured Restraining Fixtures The Safety Board’s investigation revealed that up until the time of the accident, Alaska Airlines had only one restraining fixture in its inventory (at its OAK maintenance facility). The fixture was manufactured in-house; it was not manufactured by Boeing.88 Since June 30, 1984, when Alaska Airlines began operating MD-80s, the restraining fixture was tracked through a general component tracking system as P/N 0-1301-0-0169 (manufacturer’s P/N 4916750-1). There were no records of an initial inspection or any recurrent inspections of the restraining fixture. According to Alaska Airlines records, after the accident, it manufactured 11 additional restraining fixtures similar in design to its

Factual Information 45 Aircraft Accident Report original fixture and purchased 7 fixtures manufactured by Boeing. The Alaska Airlines manager of tool control, who participated in the fabrication of the fixtures ordered by airline management after the accident, told Safety Board investigators in an interview that “what they [Alaska Airlines personnel] were making [the 11 restraining fixtures] wasn’t even close” to Boeing’s engineering drawing requirements.89 He added that “we were directed to build the tools, and we did exactly what we were told.” During the investigation, Safety Board investigators conducted several on-wing end play checks using both restraining fixtures fabricated by Alaska Airlines90 and those manufactured by Boeing. Examination of the restraining fixtures indicated that none of the fixtures manufactured by Alaska Airlines met Boeing’s engineering drawing requirements for the fixtures. During several of these tests, the restraining fixtures fabricated by Alaska Airlines yielded lower end play measurements than the measurements obtained using the Boeing-manufactured fixture.91 Figure 10 shows two of the restraining fixtures fabricated by Alaska Airlines and three of the fixtures manufactured by Boeing. After the accident, on April 13, 2000, Boeing sent Message M-7200-00-00975 to all DC-9, MD-80, MD-90, and 717 operators to ensure that horizontal stabilizer inspection tooling conformed to the tool’s engineering drawing requirements. Regarding the restraining fixture, the Boeing message stated the following: recent reports received by Boeing indicate that tooling not manufactured by Boeing is being utilized to perform the subject checks. In some cases, this tooling may not conform to the tool’s drawing requirements...any variation in the tooling thread quality, pitch or amount of thread engagement can [a]ffect the wear check results. The Boeing message asked operators to “ensure the restraining fixtures being utilized fully conform to the tool’s drawing requirements” to “maintain consistent results from wear checks.” 88 In its submission, Alaska Airlines does not dispute that it had only one restraining fixture during this time. However, it contends that this fixture was manufactured by Douglas. As support for this contention, Alaska Airlines cites the July 11, 2002, deposition testimony (taken in connection with civil litigation arising from this accident) of the mechanic who conducted the September 1997 end play check of the accident jackscrew assembly that he thought the restraining fixture at the OAK maintenance facility in 1997 was “a Douglas part.” 89 Alaska Airlines did not have the Boeing engineering drawing requirements. The manager of tool control was given a copy of the engineering drawing for the in-house manufactured fixture for use in fabricating the additional 11 fixtures. 90 The Safety Board did not use the actual restraining fixture that was used for the accident airplane’s last end play check because it was not in serviceable condition. 91 Discrepancies up to a maximum of about 0.005 inch were recorded.

Factual Information 46 Aircraft Accident Report Figure 10. Two Alaska Airlines-fabricated restraining fixtures and three Boeing- manufactured fixtures. On June 26, 2000, Safety Board investigators submitted a written request to Alaska Airlines for information about the restraining fixture it used during the September 1997 end play check on the accident airplane. The Board also requested information and documents regarding the physical properties of all of Alaska Airlines’ in-house fabricated restraining fixtures. Investigators contacted Alaska Airlines on several occasions to follow up on these requests; however, Alaska Airlines did not provide the requested information until August 2, 2000. On August 2, 2000, Alaska Airlines notified the FAA that it was concerned that the restraining fixtures it had manufactured in-house might not be “an equivalent substitute” for a Boeing fixture and, therefore, could produce erroneous measurements. Alaska Airlines thereafter suspended use of its in-house manufactured fixtures and temporarily grounded 18 of its 34 MD-80 series airplanes after determining that these airplanes might have received end play checks with the in-house manufactured tools. Before placing the airplanes back in service, Alaska Airlines performed end play checks on the grounded airplanes using Boeing-manufactured restraining fixtures; all of the rechecked assemblies had end play measurements within permissible limits. According to Alaska Airlines records, on August 4, 2000, it acquired 15 Boeing-manufactured restraining fixtures, all of which conformed to Boeing’s engineering drawing requirements. On December 4, 2000, the FAA issued Flight Standards Handbook Bulletin for Airworthiness 00-20A, “Equivalency of Special Equipment or Test Apparatus as Provided

Factual Information 47 Aircraft Accident Report by Parts 43 and 145,” which provides guidance for PMIs regarding the acceptability for equivalency of special equipment and/or test apparatus used in maintaining aircraft and their components. According to the FAA, the handbook bulletin was issued in connection with AD 2000-03-51, which referenced Boeing Alert Service Bulletin (ASB) DC9-27A362. ASB DC9-27A362, which specified the use of a restraining fixture for the required end play check, stated that the tool was currently unavailable from Boeing but that Boeing would supply the drawing necessary for operators to produce the tool. The ASB included eight items of guidance to PMIs for determining that repair stations and operators complied with the equivalency requirements, but it also stated, “[i]n instances involving the use of equivalent equipment and/or apparatus, the determination of equivalency for such equipment is the primary responsibility of the repair station or the air carrier, not the FAA.” 1.6.3.3.4 End Play Check Intervals 1.6.3.3.4.1 Manufacturer-Recommended End Play Check Intervals In the initial OAMP document for the DC-9, Douglas recommended that end play checks be performed at C-check intervals, or every 3,600 flight hours. Subsequently, in both the MSG-2 and MSG-3 MRB reports and OAMP documents for the DC-9 and MD-80 airplanes, the recommended end play check interval was increased to every other C check. Therefore, the MSG-2 OAMP document recommended that end play checks be performed every 7,000 flight hours, or 30 months, whichever comes first, and the MSG-3 OAMP document recommended that end play checks be performed every 7,200 flight hours, or 30 months, whichever comes first.92 1.6.3.3.4.2 Alaska Airlines’ End Play Check Intervals At the time of the flight 261 accident, Alaska Airlines’ end play check interval was every 30 months, or about every 9,550 flight hours. The following is a chronology of acme screw and nut end play check intervals at Alaska Airlines: • In March 1985, end play checks were scheduled for every other C check, which were accomplished every 2,500 flight hours; therefore, end play checks were to be accomplished every 5,000 flight hours. • By July 1988, C-check intervals had been extended to 13 months, with no accompanying flight-hour limit; therefore, end play checks were to be accomplished every 26 calendar months, or about every 6,400 flight hours. • In April 1996, C-check intervals were extended to 15 months, or about every 4,775 flight hours. Alaska Airlines’ director of reliability and maintenance programs testified at the public hearing that this C-check interval extension was approved after the airline prepared a data package “that looked at five separate tail numbers [airplanes] that we selected as a stratified sample of the 92As stated previously, the MSG-2 recommended C-check interval was 3,500 flight hours, and the MSG-3 recommended C-check interval was 3,600 flight hours.

Factual Information 48 Aircraft Accident Report fleet. At that time I believe there were a little over 40 aircraft. We reviewed in detail all of the nonroutine discrepancies that had been written against the aircraft during those C checks.” He indicated that individual maintenance tasks tied to C-check intervals (such as the end play check) were not separately considered in connection with the extension. However, he stated that based on the history of maintenance discrepancies noted for the five sample airplanes, two lubrication tasks were identified as inappropriate for extension along with the C check, and these tasks were converted to time-controlled (stand-alone) items to be performed at shorter intervals.93 He indicated that all of the information was submitted to the FAA and that, approximately 1 month later, the extension was approved and implemented. The end play check interval remained at every other C check, which was then 30 calendar months, or about 9,550 flight hours. • On April 6, 2000, after the accident, in accordance with ADs 2000-03-51 and 2000-15-15, the end play check became a time-controlled item required to be performed every 2,000 flight hours. Table 3 shows a comparison of manufacturer-recommended end play check intervals with Alaska Airlines’ intervals. Table 3. Comparison of manufacturer-recommended end play check intervals with Alaska Airlines’ intervals. 93 The two tasks identified as requiring shorter intervals based on service history were (1) lubrication of the bent-up trailing-edge wing doors and (2) lubrication of bearings and bushings in the elevator hinges. Task Description Original Douglas-Recommended Interval MSG-2 MRB and OAMP MSG-3 MRB MSG-3 OAMP C Check 3,600 flight hours 3,500 flight hours or 15 months, whichever comes first 3,600 flight hours or 15 months, whichever comes first 3,600 flight hours End Play Check C check (3,600 flight hours) Every other C check (7,000 flight hours or 30 months, whichever comes first) Every other C check (7,200 flight hours or 30 months, whichever comes first) Every other C check (7,200 flight hours)

Factual Information 49 Aircraft Accident Report 1.6.3.4 Accident Airplane’s Maintenance Information Alaska Airlines maintenance records documented that the following maintenance tasks and checks relevant to the jackscrew assembly were performed on the accident airplane: • On May 27, 1993, a C check was accomplished at the OAK maintenance facility. The airplane had accumulated 2,674 flight hours. This C check included an end play check. Four nonroutine discrepancies were noted and corrected. • On April 27, 1994, a C check was accomplished at the OAK maintenance facility. The airplane had accumulated 5,484 flight hours. No end play check was required, and no nonroutine discrepancies related to the horizontal stabilizer were noted. • On May 17, 1995, a C check was accomplished at the OAK maintenance facility, including an end play check. The airplane had accumulated 9,194 flight hours. Five nonroutine discrepancies related to the horizontal stabilizer were noted. Maintenance action taken included cleaning the horizontal stabilizer jackscrew compartment around the vertical stabilizer and the areas around the right and left elevator hydraulic actuators. • On June 20, 1996, a C check was accomplished at the OAK maintenance facility. The airplane had accumulated 12,906 flight hours. No end play check was required. Seven nonroutine discrepancies were noted and corrected. The records indicated that the elevators and horizontal stabilizer, including the jackscrew assembly, were lubricated. Task Description Alaska Airlines 1985 Alaska Airlines 1988 Alaska Airlines 1996 to April 2000 Alaska Airlines Currently C Check 2,500 flight hours 13 months (About 3,200 flight hours) 15 months (About 4,775 flight hours) 15 months End Play Check Every other C check (5,000 flight hours) Every other C check 26 months (About 6,400 flight hours) Every other C check 30 months (About 9,550 flight hours) 2,000 flight hoursa a. All carriers currently meet this requirement.

Factual Information 50 Aircraft Accident Report • On February 27, 1997, according to maintenance records, the elevators and horizontal stabilizer, including the jackscrew assembly, were lubricated at the SFO maintenance facility. • On September 26, 1997, the airplane entered a C check (which was completed on October 1, 1997) at the OAK maintenance facility, which included an end play check.94 The airplane had accumulated 17,699 flight hours. The records indicated that the elevators and horizontal stabilizer, including the jackscrew assembly, were lubricated. The task card (No. 28312000) specified Mobilgrease 28 as the lubricant grease. • On June 26, 1998, according to maintenance records, the elevators and horizontal stabilizer, including the jackscrew assembly, were lubricated at the SFO maintenance facility. The task card specified Aeroshell 33 as the lubricant grease. • On January 13, 1999, a C check was accomplished at the OAK maintenance facility. The airplane had accumulated 22,407 flight hours. No end play check was required. No nonroutine discrepancies related to the horizontal stabilizer were noted. The records indicated that the elevators and horizontal stabilizer, including the jackscrew assembly, were lubricated. The task card specified Aeroshell 33 as the lubricant grease. • On September 24, 1999, according to maintenance records, the elevators and horizontal stabilizer, including the jackscrew assembly, were lubricated at the SFO maintenance facility.95 The task card specified Aeroshell 33 as the lubricant grease. The Safety Board’s review also revealed that, between July 4, 1999, and January 11, 2000, nine A checks were performed on the accident airplane. No nonroutine discrepancies related to the horizontal stabilizer were noted during any of these inspections. The accident airplane’s last walk-around checks were performed at Anchorage International Airport, Anchorage, Alaska, and SEA on January 30, 2000. The airplane’s last service check was also performed at SEA on January 30, 2000. 1.6.3.4.1 Accident Airplane’s Last C Check Requiring an End Play Check As stated previously, the accident airplane entered a C check, which included an acme screw and nut end play check (and several rechecks), at Alaska Airlines’ OAK maintenance facility96 on September 26, 1997. Completion of the C check and estimated time of release was scheduled for September 30, 1997, at 2300. According to Alaska 94 For more details about the September 1997 C check, including the end play measurement, see section 1.6.3.5.1. 95 Alaska Airlines maintenance records indicated that this was the last time that the accident airplane’s jackscrew assembly was lubricated. 96 The Alaska Airlines OAK maintenance facility operates 24 hours a day, 7 days a week. The work day is divided into the following three shifts: the graveyard shift, from about 2230 to 0630; the day shift, from about 0600 to 1430; and the swing shift, from about 1430 to 2300.

Factual Information 51 Aircraft Accident Report Airlines records, on September 30, 1997, the estimated time of release was changed to October 1st at 2300. According to the October 2nd graveyard-shift turnover plan, the accident airplane was released on October 2nd at 2300. The following items were noted during the Safety Board’s review of Alaska Airlines maintenance records for this C check:97 • September 27th (Saturday)—a nonroutine work card (MIG-4) was generated following an initial end play check on the accident airplane by a day-shift mechanic and an inspector. The MIG-4 noted the following discrepancy: “Horizontal Stab—acme screw and nut has maximum allowable end play limit (.040 in.).” The “planned action” box, which was filled out by the day-shift lead mechanic and inspector, stated, “Replace nut and perform E.O. 8-55-10-01.” The swing-shift supervisor also signed off on the planned action. See figure 11. Figure 11. The September 27, 1997, MIG-4. 97All of the shift turnover plans were available except for the September 27 and 28, 2000, day-shift turnover plans. When asked by Safety Board investigators why these shift turnover plans were not available, Alaska Airlines responded that they were most likely not generated because of personnel problems at the time.

Factual Information 52 Aircraft Accident Report • September 28th (Sunday)—according to the day-shift turnover plan, the horizontal stabilizer was lubricated per task card No. 24312000 (which called for Mobilgrease 28).98 The swing-shift lead mechanic made the following entry in the swing-shift turnover plan: “Ref MIG…horz stab:…get copy of E.O. & see what we need to do & order.” The swing-shift turnover plan also contained the following entry related to the tail area: “N/R’s [nonroutines], lube & treat C/W [complied with], still parts to order.” • September 29th (Monday)—the graveyard-shift lead mechanic made several entries in the graveyard-shift turnover plan, including “continue parts ordering (PANIC),”99 “need copy of E.O. 8-55-10-01 for horiz stab acme screw and nut excessive end play,” and “Tuesday [September 30th] departure looks doubtful.” The day-shift turnover plan contained the following entry related to the tail area: “E.O. 8-55-10-01 needed for acme screw nut [excessive] end play.” The swing-shift lead mechanic made the following entry on the swing-shift turnover plan: “re-do acme screw [check] to confirm problem…E.O. # is invalid.[100]…have [dayshift]…follow up.” • September 30th (Tuesday)—the graveyard-shift lead mechanic marked through the line on the MIG-4 that called for replacement of the jackscrew assembly and wrote, “re-evaluate test per WC [work card] 24627000.” A different mechanic and inspector made an entry in the MIG-4’s “corrective action” section, which stated, “Rechecked acme screw and nut end play per WC

1. Found end play to be within limits .033 for step 11 and .001 for step
2. Rechecked five times with same result.” (See figure 11.) The MIG-4 was

then reviewed by the graveyard-shift lead mechanic, who made the following entry in the graveyard-shift turnover plan: “stabilizer jackscrew acme nut C/W.” The day-shift lead mechanic noted in the day-shift turnover plan, “tail close – I/W.”101 The day-shift turnover plan also noted, “partial O.K. to close up.” The swing-shift turnover plan noted, “tail close (I/W).” 98Alaska Airlines maintenance records did not include the task card for the lubrication of the horizontal stabilizer. Because lubrication of the jackscrew assembly was a “repeated” maintenance item, the maintenance records only contained a complete task card for the most recent lubrication on September 24, 1999, at SFO. 99Alaska Airlines officials stated that jackscrew assemblies were not stocked as inventory items at the time of this C check and were only available through third-party vendors. Alaska Airlines’ director of safety, quality control, and training told Safety Board investigators that “we do not believe a jackscrew was ordered. Our procedures call for the creation of a ‘field requisition’ whenever we order aircraft parts that are not in stock, such as the subject jackscrew.” He added that field requisitions are noted in a field request log. He stated that a review of requisitions and logs related to the C check found no “jackscrew components listed in these documents. Based on this information, we do not believe a jackscrew or jackscrew components were ordered.” He added, “we believe that the reference in the planned action to ‘replace nut’ caused some confusion since the nut should only be replaced as part of the jackscrew assembly…We also believe that the incorrect reference in the MIG-4 to perform E.O. 8-55-10-01 caused further confusion and interrupted the normal parts ordering process.” 100The E.O. reference number was incorrect because it applied to another airplane model. 101“I/W” generally means “in accordance with.”

Factual Information 53 Aircraft Accident Report • October 1st (Wednesday)—the graveyard-shift turnover plan noted, “[tail] close up needs work, 2 items closed without QA [quality assurance] OK.”102 The day-shift turnover plan noted, “tail closed up.” • October 2nd (Thursday)—the graveyard-shift turnover plan noted that the accident airplane “departed 0300 local time, so far so good.” 1.6.3.4.2 Maintenance Personnel Statements Regarding the Accident Airplane’s Last End Play Check During postaccident interviews, the Alaska Airlines mechanic who conducted the end play check on September 27, 1997, stated that he did not recall what end play measurements were obtained, adding, “I don’t remember the exact number, but it was below 40 [thousandths of an inch] I believe.” He stated that he had previously accomplished about six end play checks and that “the ones I have done were well below the limits.” He explained that during the procedure, “while I’m torqueing, he’s [the inspector] looking at the dial indicator gauge.” He also stated that he could not recall how many measurements were taken during the procedure. He stated that he noted the discrepancy on the MIG-4, adding that he did not consider the measurement to be beyond allowable limits. Referring to the decision to generate the MIG-4, he stated, “I don’t really remember why. But, you know, maybe…maybe to have somebody take a look…you know, like a second opinion, maybe.” The September 27th day-shift inspector who was working with the mechanic (noting dial indicator readings) and who wrote the “planned action” instructions to replace the jackscrew assembly stated that he considered a 0.040-inch end play check result to be “at the end of the limit.” He added, “It’s not in excess. I would consider anything over 40 thousandths to be excess. So 40 thousandths would be right on the edge. How much further do you have to go before you’re out of limits, especially if you got another two years before you’re going to check it again?” The mechanic stated that he had never encountered similar wear during other end play checks and added the following: I’ve worked on every MD-80 that Alaska Airlines owns extensively. I have never come across any jackscrew that was worn to that extent. And we have aircraft, at that time we had aircraft that were 15 years old. We have what would be a relatively young aircraft [the accident airplane] that, for whatever reason, is, if it’s at its limit or if it’s at the end…it has a significant amount more wear than I’ve ever noticed in the past, and that’s compared against aircraft that are three times its age. The September 30th graveyard-shift lead mechanic who crossed out the planned action to replace the jackscrew assembly stated that he did so “because the MIG should not have been generated to begin with. There shouldn’t have been a[n] MIG at all for the problem because it was within the allowable limits on the work card.” He stated that he 102 The Safety Board’s investigation did not determine which two items were closed without quality assurance approval because Alaska Airlines records did not provide this information.

Factual Information 54 Aircraft Accident Report ordered a recheck of the end play “to take it one step beyond and prove that, in fact, it was as stated in the spec, 0.040 or less.” He added the following: At that point in time, the planned action was inappropriate for the discrepancy. The discrepancy should have never existed. It fell within the work card limits, so, therefore, the discrepancy should have never been written. The planned action was inappropriate and…we could have opted to go ahead and sign it off right then and there. But I opted to re-evaluate to make sure that the limits stated were, in fact, either at 0.040 or below. The inspector who worked with the mechanic who performed the recheck on September 30th stated that he had performed about three end play checks and never encountered results that were not within limits. He stated that the recheck “verified that the jackscrew was within limits.” The mechanic who performed the recheck stated that all five end play measurements of 0.033 inch, as noted on the MIG-4, were “within a thousandths of it.” He stated that the inspector and the lead mechanic were present during the recheck procedure. 1.7 Meteorological Information According to the automatic terminal information service weather information recorded by the CVR at 1559:50, the following LAX weather conditions were current beginning about 1550: Wind two three zero at eight. Visibility eight. Few clouds at two thousand eight hundred. One two thousand scattered. Ceiling two zero thousand overcast temperature one six dew point one one. Altimeter three zero one seven. Simultaneous ILS [instrument landing system] approaches in progress runway two four right and two five left or vector for visual approach will be provided. Simultaneous visual approaches to all runways are in progress and parallel localizer approaches are in progress between Los Angeles International and Hawthorne airports. Simultaneous instrument departure in progress runway two four and two five. 1.8 Aids to Navigation No problems with navigational aids were reported. 1.9 Communications No external communication difficulties were reported.

Factual Information 55 Aircraft Accident Report 1.10 Airport Information Not applicable. 1.11 Flight Recorders 1.11.1 Cockpit Voice Recorder The accident airplane was equipped with a Fairchild model A-100A CVR, S/N 62892. On February 2, 2000, the CVR was transported to the Safety Board’s Washington, D.C., headquarters for readout and evaluation.103 The exterior case was severely damaged by impact forces, but it had not been punctured. The tape and spool were wet but were otherwise intact and in good condition. The recording comprised four channels of good quality audio information:104 one channel contained audio information recorded by the cockpit area microphone (CAM),105 one channel contained audio information recorded by the public address system, and the other two channels contained audio information recorded through the radio/intercom selector panels at the captain and first officer positions. The CVR recording began about 1549:49 during cruise flight and ended about 1620:57, when the airplane impacted the water. A transcript was prepared of the 31-minute recording (see appendix B). 1.11.1.1 CVR Sound Spectrum Study The Safety Board further examined the audio information recorded by the four CVR channels using a spectrum analyzer (which provides a visual representation of the frequency of the sound signals) and a computer signal analyzer (which allows analysis of the analog wave form and frequency content of the sounds and provides detailed timing information of the events). The Safety Board analyzed the sound of two distinct “clicks” recorded on the CVR (referred to as “snaps” in the sound spectrum study report). The first click was recorded at 1549:54.8 and lasted about 0.01 second.106 The first click was compared with a second 103 The CVR was transported to Safety Board headquarters immersed in water in a sealed, plastic container. 104 The Safety Board ranks the quality of CVR recordings in five categories: excellent, good, fair, poor and unusable. In a recording of good quality, most of the crew conversations can be accurately and easily understood. The transcript that was developed might indicate several words or phrases that were not intelligible. Any loss in the transcript can be attributed to minor technical difficulties or momentary dropouts in the recording system or to a large number of simultaneous cockpit/radio transmissions that obscure each other. 105 The CAM is mounted in the overhead panel between the captain and first officer. The CAM is designed to capture sounds and conversations in the cockpit whenever the CVR is powered. 106 According to the FDR, the autopilot disengaged about 1549:56.

Factual Information 56 Aircraft Accident Report click recorded at 1609:14.8 (just before the accident airplane’s initial dive),107 and the Board determined that the two sounds had identical frequency and energy characteristics. The Safety Board also analyzed several distinct, very faint “thump” sounds recorded on the CAM channel. A set of thump sounds was recorded at 1609:16.9 (also just before the accident airplane’s initial dive) and comprised two distinct thumps that were about 0.4 second apart. A series of distinct thumps was recorded at 1619:21.1 and comprised four thumps that were less than 0.1 second apart108 and were recorded about 15 seconds before the second and final dive occurred at 1619:36.6. Analysis determined that all of the thumps had low-to-mid range frequency characteristics, which were not consistent with impulse sounds associated with metal-to-metal tapping or metal failure/tearing sounds. The frequency characteristics were determined to be similar to sounds produced by airflow.109 The Safety Board conducted a test to determine whether the failure of the acme screw torque tube would produce sounds consistent with those recorded on the CVR. In the laboratory, a hydraulic ram was used to pull the torque tube to failure, and the sounds associated with the torque tube failure were recorded.110 The sounds recorded during the test were then compared with the sounds recorded on the accident airplane’s CVR. Comparison of the data determined that the sound signatures recorded during the failure test did not match any of the sound signatures recorded by the accident airplane’s CVR. 1.11.2 Flight Data Recorder The accident airplane was equipped with a Sundstrand Data Control Universal FDR, S/N 9182. The FDR recorded information digitally on eight tracks using a 1/4-inch-wide magnetic tape that had a recording duration of 25 hours. On February 3, 2000, the FDR was transported to the Safety Board’s Washington, D.C., headquarters for readout and evaluation. Although the FDR’s outer protective case was severely damaged by high-impact forces, data were retrieved and analyzed.111 The FDR began recording data from the accident flight about 1332 (after airplane startup and shortly before takeoff). During its examination of the data, the Safety Board determined that two parameters, angle-of-attack and left brake-pressure, were not functioning properly and were recording faulty engineering values. 107According to the FDR, the autopilot disengaged about 1609:16. 108These four thump sounds were referred to as the “sound of faint thump” in the CVR transcript. 109 Although the Safety Board could not determine the direct source of the sounds, they were similar to sounds recorded during previously conducted flight tests involving wake vortex encounters. 110 The data were collected using a calibrated sound pressure transducer and an accelerometer attached to a mount used to hold the torque tube in place during the test. 111 For information on airplane performance studies based on an analysis of the FDR data, see sections 1.16.1 and 1.16.1.1.

Factual Information 57 Aircraft Accident Report 1.12 Wreckage and Impact Information 1.12.1 General The on-site phase of the investigation, including wreckage recovery, examination, and documentation, was accomplished between February 1 and March 15, 2000.112 Throughout most of the on-site investigation, remote-operated vehicles and side-scan sonar equipment were used to search the underwater debris field.113 The majority of the debris field was cleared using the remote-operated vehicles to either load baskets with, or wrap cables around, the wreckage. In the late stages of wreckage recovery, a commercial trawler was used to drag the ocean bottom and recover smaller wreckage pieces.114 All of the recovered wreckage was unloaded at Port Hueneme, California, for examination and documentation. About 85 percent of the fuselage was recovered. The largest sections were from below the airplane’s floor line. The fuselage’s upper crown structure was broken into smaller pieces and had substantial compression damage. The recovered fuselage segments increased in size from the forward section of the airplane (where they were the smallest) to the aft section of the airplane (where they were the largest). No evidence indicated any pre- or postimpact fire damage. Fractures found on pieces of fuselage wreckage were consistent with failures generated by high-energy impact. Examination of the fracture surfaces found no evidence of preexisting cracking or foreign impact damage. The majority of both wings were recovered. The right wing exhibited more damage than the left wing. About 85 percent of the empennage, which comprises the horizontal and vertical stabilizers and the engines, was recovered. Most of the horizontal stabilizer was recovered, including the center box and the left and right outer sections. All of the empennage’s control surfaces were recovered except for a 4-foot section of the left elevator and the geared tab. The Safety Board examined the horizontal stabilizer wreckage for evidence of preimpact failures and structural damage that might have occurred during the accident flight. Damage and/or witness marks on the horizontal stabilizer were visually examined to determine what degree of horizontal stabilizer movement (travel) would have been necessary to create the witness marks or damage. 112 Floating wreckage debris was recovered throughout the on-site phase of the investigation. 113 Side-scan sonar searching preceded the underwater wreckage recovery to determine the boundaries of the underwater debris field, which was spread over a 1/4-mile area of the ocean bottom at a depth of about 700 feet. 114 About 15 percent of the wreckage was recovered using this method. Ten percent of the wreckage was not recovered.

Factual Information 58 Aircraft Accident Report The horizontal stabilizer was found fragmented into several pieces. The right side of the horizontal stabilizer was more fragmented than the left side. A 1.5-foot section of the vertical stabilizer was found attached to the horizontal stabilizer’s pivot fitting lugs. The bottom side of both lugs were scraped, and the grease fittings located on the bottom side of each lug were found sheared off. Examination determined that the leading edge of the horizontal stabilizer would have to rotate up to a position about 16.2° leading edge up for the grease fittings to sheer off. The adjacent vertical stabilizer pivot structure had contact marks (in line with the grease fitting location) consistent with the leading edge of the horizontal stabilizer having rotated to a position of about 80°. The vertical stabilizer was found fragmented, consistent with high-energy impact damage. The vertical stabilizer’s tip fairing was recovered broken into two segments. The recovered segments of the vertical stabilizer’s tip fairing were placed together, and the two fracture surfaces were matched. The forward 25 percent of the vertical tip fairing was not recovered. Examination of the matched fairings portions showed upward deformation damage that was also consistent with the leading edge of the horizontal stabilizer having rotated to a position of about 80°. The horizontal stabilizer front spar lower cap had a 1.5-inch semicircular indentation about 3.5 inches left of the centerline, consistent with contact by the acme screw. The jackscrew assembly side attachment plates were bent about 1.25 inches to the left, and the side plate lugs were partially fractured, consistent with high-energy impact damage. Both engines were recovered separated. The left (No. 1) engine was found separated into three sections at the high-speed compressor.115 No evidence indicated an engine fire or an uncontained engine failure. Examination of the recovered compressor groups from the left engine revealed marks and signatures consistent with the engine producing significant rotational energy at impact. The thrust reverser was found in the stowed position. The right (No. 2) engine was recovered in one piece except for the entire fan front and rear cases, which were not recovered. None of the recovered fan blades exhibited significant blade tip rubbing. No evidence indicated integral fan hub and disk distress or rupture. No evidence indicated an engine fire or an uncontained engine failure. The recovered compressor blades and vanes did not exhibit signs of distress from engine rotation. Examination of the recovered compressor groups from the right engine revealed signatures consistent with the engine producing little rotational energy at impact. The thrust reverser was found in the stowed position. 1.12.2 Horizontal Stabilizer Jackscrew Assembly Components The main supporting elements of the horizontal stabilizer jackscrew assembly were found intact and attached to the horizontal stabilizer’s front spar. The acme screw was found cracked but attached to the support assembly. Metallic filaments were found 115 The high-speed compressor was not recovered.

Factual Information 59 Aircraft Accident Report wrapped around the central part of the acme screw.116 (Figures 12a and 12b show the acme screw immediately after it was brought on board the recovery ship and immediately after it was brought to shore, respectively; figure 12c shows the acme screw during initial inspection.) The acme screw was rinsed with fresh water immediately after its recovery by directing the water from a hose similar to a garden hose over the gearbox and allowing the water to flow down over the screw. To preserve the acme screw and the thread remnants wrapped around the screw in their as-recovered condition, the stream of water used to rinse the screw was not directly sprayed on it. The acme screw might have been rinsed again with a garden-type hose after it was brought to shore. Figure 12a. The acme screw immediately after it was brought on board the recovery ship. 116These metallic filaments were later identified as acme nut thread remnants. After initial mechanical and metallurgical examinations, the acme screw, thread remnants, and acme nut were removed from the surrounding structure and sent to the Safety Board’s Materials Laboratory for examination. For details about the metallurgical examinations of these components, see section 1.16.2.

Factual Information 60 Aircraft Accident Report Figure 12b. The acme screw immediately after it was brought to shore.

Factual Information 61 Aircraft Accident Report Figure 12c. The acme screw during initial inspection. The upper mechanical stop was found attached to the splines of the acme screw, and the clamp bolt for this stop was in place. The lower mechanical stop and its clamp bolt were recovered as a separate unit from the acme screw. Several impact/scrape marks were found on the upper surface of the lower mechanical stop, and a round impact mark was found on the lower surface of the stop. Evidence of damage to the splines on the inside diameter of the lower mechanical stop was observed.117 The portion of the torque tube that extended beyond the lower end of the acme screw was fractured. The lower end of the torque tube, the torque tube nut washer, and the torque tube nut were not recovered. The acme nut and gimbal assembly were found attached in the vertical stabilizer structure. The gimbal assembly was found to be movable on both rotational axes, except in areas distorted by surrounding structure. The primary trim motor was found detached from the differential gearbox, but it was mostly intact. The alternate gearbox was found attached to the primary motor along with a portion of the upper housing of the differential gearbox. Both electrical connectors to the primary motor were present; however, the connection wires were missing. 117For more information about the damage to the splines on the inside diameter of the lower mechanical stop, see section 1.16.2.4.

Factual Information 62 Aircraft Accident Report All recovered pieces of the accident airplane’s primary trim motor were examined. No evidence of any thermal damage was noted. The primary trim motor’s auxiliary gearbox was removed from the motor, disassembled, and examined. No evidence indicated any preimpact mechanical damage.118 All recovered pieces of the accident airplane’s alternate trim motor were examined. Impact damage and gouging were predominantly located toward the left rear portion of the motor. No evidence indicated any preimpact mechanical damage. The primary up-trim relay, the down-trim relay, the up-trim brake relay, the down-trim brake relay, and the trim brake override switch were examined. No evidence of thermal damage or excessive wear was observed on either the down-trim or the up-trim relay contacts. Corrosion was observed on all metal components of both trim relays. No evidence of any preimpact mechanical malfunction was found on either relay. Examination and testing of the up-trim and down-trim brake relays found no evidence of any preimpact mechanical malfunction or abnormal wear. An electrical continuity check of the trim brake override switch determined that it was in the neutral position. No evidence indicated any preimpact mechanical malfunction. 1.13 Medical and Pathological Information Tissue specimens from both pilots were transported to the FAA’s Civil Aerospace Medical Institute laboratory for toxicological analysis. The laboratory performed its routine analysis for major drugs of abuse119 and prescription and over-the-counter medications, and the results were negative. Although the analysis detected ethanol in the tissue specimens of both pilots, the analysis report noted that the ethanol found was consistent with postmortem ethanol production. 1.14 Fire There was no evidence of an in-flight fire. 1.15 Survival Aspects The airplane was destroyed by high-impact forces, and no occupiable space remained intact. The Ventura County, California, Coroner’s report stated that all of the accident airplane’s occupants died as a result of blunt force impact trauma. 118 According to the manufacturer of the primary trim motor (Sunstrand), it had overhauled the accident airplane’s primary trim motor on February 22, 1994, and again on October 4, 1996. 119 The five drugs of abuse tested are marijuana, cocaine, opiates, phencyclidine, and amphetamines.

Factual Information 63 Aircraft Accident Report 1.16 Tests and Research 1.16.1 Airplane Performance The Safety Board used FDR, CVR, ATC transcript, and radar120 data to determine the accident airplane’s motions and performance during the accident sequence. These data (and associated calculations) indicated the following: • The last horizontal stabilizer movement before the initial dive was recorded at 1349:51 (about 2 hours and 20 minutes before the initial dive) during the climbout from PVR when the airplane was climbing through approximately 23,400 feet at 331 KIAS. At that time, the horizontal stabilizer moved from 0.25° to 0.4° airplane nose down. • Following the horizontal stabilizer movement at 1359:51, the airplane continued to climb at 330 KIAS. The airplane began to level off at approximately 26,000 feet and slowed to 320 KIAS. At 1351:51, the airplane began to climb again, and, by 1352:50, it had slowed to about 285 KIAS as it climbed to approximately 28,600 feet and then leveled off. • At 1353:12, the airplane was at approximately 28,557 feet and 296 KIAS, and the autopilot disengaged. • The airplane began to climb at a much slower rate over the next 7 minutes. During this part of the ascent, the elevators were deflected between -1° and -3°, and the airplane was flown manually using up to 50 pounds of pulling force. • By 1400:00, the airplane had reached an altitude of approximately 31,050 feet. For about the next 24 minutes, the airplane was flown manually using approximately 30 pounds of pulling force while maintaining level flight at 280 KIAS. Starting at 1424:30, the airspeed increased, eventually reaching 301 KIAS,121 at which time the airplane was flown using about 10 pounds of pulling force. At 1546:59, the autopilot was re-engaged. • At 1609:16, the autopilot disengaged, and the CVR recorded the sound of a clunk. At 1609:16.9, the CVR recorded the sound of two faint thumps in succession. During the 3 to 4 seconds after the autopilot was disengaged, the horizontal stabilizer moved from 0.4° airplane nose down to a recorded position of 2.5° airplane nose down,122 and the airplane began to pitch down, starting a dive that lasted about 80 seconds as the airplane went from approximately 31,050 feet to between 23,000 and 24,000 feet. During the 120 Air Route Sur\veillance Radar data were obtained from the FAA’s Los Angeles ARTCC, and Airport Surveillance Radar data were collected from several airport facilities in the Southern California Terminal Radar Control area and from the U.S. Air Force 84th Radar Evaluation Squadron. 121 The flight plan called for a cruise speed of 283 knots calibrated airspeed. 122 The horizontal stabilizer remained at the recorded position of 2.5° until the last minute of the flight. For details about simulation studies conducted by the Safety Board to determine the actual position of the horizontal stabilizer during this time, see section 1.16.1.1.

Factual Information 64 Aircraft Accident Report movement of the horizontal stabilizer, the CVR recorded the sound of the stabilizer-in-motion tone for 3 to 4 seconds. During the next several seconds, the load factor oscillated between 0.4 and 1.0 G, and the elevators moved to the trailing-edge-up direction from -0.4° to -7.0°,123 consistent with control inputs being made to bring the nose up. • By 1609:42, the airplane had descended to approximately 29,450 feet and had accelerated to about 322 KIAS. At this time, the airplane’s pitch angle was -7.9° airplane nose down, and the elevators had moved to about a -8° position. The speed brakes deployed 1 second later and remained deployed for the next 1 minute 30 seconds. • At 1610:00, the airplane was accelerating through 343 KIAS (the airplane’s maximum allowable airspeed). At 1610:01.9, the CVR recorded the sound of the overspeed warning. • By 1610:16, the airplane had accelerated to 353 KIAS, the maximum airspeed it reached during the initial dive, and this airspeed remained nearly constant until 1610:23 as the airplane was descending through 24,200 feet. By this time, the airplane’s pitch angle had increased from -8° to -5° airplane nose down, and the elevators had moved to about a -11° position. • About 1611:13, the speed brakes were stowed. By this time, the airplane’s airspeed had decreased to 262 KIAS, and the airplane was maintaining an altitude of approximately 24,400 feet with a pitch angle of 4.4°. During the next 10 seconds, the airplane’s airspeed decreased to 254 KIAS. The airplane remained between 23,000 and 24,000 feet for the next 5 minutes, and the airspeed gradually increased to 335 KIAS. During this period, elevator movements ranged from between -7° to -9°. Airplane performance calculations indicated that a control column force of between about 130 and 140 pounds was required to recover from the dive.124 • At 1614:44, the speed brakes deployed again, and the airplane’s airspeed began to decrease. • At 1617:50, the speed brakes were being stowed. By this time, the airplane had leveled off at approximately 18,000 feet, and the airspeed had decreased to 253 KIAS. At this time, the elevators were operating between -10° and -13°, and the airplane’s pitch angle was between -2° and 0°, with a constant indicated horizontal stabilizer angle of 2.5° airplane nose down. • At 1617:54, the CVR recorded the captain order deployment of the slats. About 1618:00, when the airplane was passing through 17,800 feet at 252 KIAS, the FDR recorded the extension of the leading edge slats. About 1618:05, the CVR recorded the captain order deployment of the flaps. About 3 seconds later, the flaps began extending to 11°, and the airspeed 123 The available range of the airplane’s elevators is from +15° to -25°. 124 As stated previously, this estimated force could be applied by either the captain, the first officer, or both.

Factual Information 65 Aircraft Accident Report decreased about 4 knots. The flaps remained at this value for about 20 seconds, during which time the airplane’s pitch angle was about 0°, with changes of less than 1°. About 1618:26, the CVR recorded the captain order retraction of the slats and flaps. During the 50 seconds after retraction of the slats and flaps, the airplane’s indicated airspeed increased from 245 to 270 knots, and the airplane climbed from approximately 17,400 to 17,900 feet with a pitch angle of about 4°. • Beginning at 1619:09, the FDR recorded small oscillations in elevator angle, pitch angle, and vertical acceleration values for about 15 seconds. • At 1619:21, the CVR recorded the sound of a faint thump. At 1619:21.5, the FDR recorded a 0.09° change, from 2.51° to 2.60°, in the horizontal stabilizer position (this was the first change in recorded horizontal stabilizer position since the one that coincided with the airplane’s initial dive from 31,050 feet about 10 minutes earlier) and elevator deflections increasing from -9° to -13°. Pitch angle and elevator oscillations ceased 2 seconds after the stabilizer position changed. • At 1619:29, the CVR recorded the captain order redeployment of the slats and flaps. At 1619:35, when the airplane was at an altitude of 17,900 feet, an indicated airspeed of 270 knots, and a pitch angle of 2°, the flaps were transitioning from 7° to 11°. • At 1619:36, the left elevator value was -12°, the right elevator value was -11°, and the load factor was 1 G. At 1619:36.6, the CVR recorded an extremely loud noise, and the FDR recorded a right elevator position of -25°.125 By 1619:36.6, the load factor had increased to 1.45 Gs. At 1619:36.9, the pitch angle began to change to the airplane-nose-down direction, and the load factor decreased to 0.67 G. At this time, radar data detected several small primary returns. Within 3 seconds, the load factor quickly decreased to -3 Gs. The next several seconds of FDR data indicated a maximum airplane-nose-down pitch rate of nearly 25° per second. • By 1619:40, the airplane was rolling left wing down, and the rudder was deflected 3° to the right. • By 1619:42, the airplane had reached its maximum valid recorded airplane-nose-down pitch angle of -70°, and the load factor had increased to -1.45 Gs. At this time, the roll angle was passing through -76° left wing down. During the next 2 seconds, the load factor decreased to -2.1 Gs. • By 1619:45, the load factor had increased to -1.75 Gs, the pitch angle had increased to -28°, and the airplane had rolled to a -180° inverted position. Further, the airplane had descended to approximately 16,420 feet, and the indicated airspeed had decreased to 208 knots. 125 All subsequent recorded elevator values exceeded the physical ranges of the airplane’s elevator system and were considered invalid.

Factual Information 66 Aircraft Accident Report • At 1619:54, the left aileron moved to more than 16° (to command right wing down), and, during the next 6 seconds, moved in the opposite direction to -13° (to command left wing down). • At 1619:57, the rudder was returned to the near 0° position, the flaps were retracted, and the airplane was rolling through -150° with an airplane-nose-down pitch angle of -9°. • After 1619:57, the airplane remained near inverted, and its pitch oscillated in the nose-down position until it impacted the ocean. FDR data indicated large rudder and aileron movements during the final minute before impact. Further, engine pressure ratio126 parameters fluctuated erratically during the final dive, which is consistent with airflow disturbances associated with extreme angles-of-attack. 1.16.1.1 Airplane Performance Simulation Studies The Safety Board conducted several performance studies to reproduce, in simulation models, the flight data parameters on the accident airplane’s FDR using the same control inputs recorded on the FDR (for example, aileron, elevator, horizontal stabilizer angle, and engine torque). Additionally, kinematics studies127 using MD-80 aerodynamic data obtained from Boeing calculated the control deflections required to match the airplane response on the FDR. These calculations provided an estimate of control inputs for use in simulations when control inputs recorded on the FDR did not produce the same response in the simulations as those recorded on the FDR. These kinematics calculations also provided the tension load on the jackscrew assembly. The airplane performance studies focused on the airplane’s initial dive (about 1609:16), which occurred after the autopilot was disengaged, and the second and final dive (about 1619:37), which occurred after an extremely loud noise was recorded by the CVR. Results of simulation and kinematics studies indicated that, before the autopilot was disengaged, the values recorded for the horizontal stabilizer, elevator, aileron, and rudder produced the same airplane responses as those recorded on the FDR during cruise flight. After the autopilot was disengaged and the airplane subsequently pitched down, the simulation results showed considerable discrepancies between FDR data and simulated airplane response. With the use of the recorded horizontal stabilizer angle, simulations were conducted using control inputs based on those recorded by the FDR. The simulations showed that the airplane would have recovered quickly and climbed using the stabilizer angle and elevator positions and movements recorded on the FDR, indicating that recorded values of the longitudinal controls were not accurate representations of the actual positions on the accident airplane after the initial dive. 126 Engine pressure is a measure of engine thrust, comparing total turbine discharge pressure to the total pressure of the air entering the compressor. 127 Kinematics is a process that involves fitting curves through available FDR data (such as heading, pitch, and roll) and calculating accelerations, forces, and moments from these rates. The flight control surface positions required to match the FDR angular and position data are then calculated using aerodynamic data for the airplane that have been provided by the manufacturer.

Factual Information 67 Aircraft Accident Report Kinematics studies were conducted to account for the discrepancies between the FDR data and the simulation results. One study assumed that the stabilizer value was accurate and calculated the elevator movement required to match the FDR-recorded values. A second study assumed that the elevator values were accurate and calculated the stabilizer movement required to match the FDR-recorded values. Simulations indicated favorable matching with FDR values using a constant, increased offset in the horizontal stabilizer position compared with the recorded elevator position. On the basis of these findings, further kinematics and simulator studies assumed that the elevator positions recorded by the FDR after the initial dive were accurate and that the recorded horizontal stabilizer positions recorded by the FDR were inaccurate. Results of kinematics and simulation studies indicated that the accident airplane’s performance was consistent with the horizontal stabilizer position moving beyond the 2.5° airplane-nose-down value recorded on the FDR during the initial dive (causing the airplane to pitch nose down as recorded, assuming the elevator positions were as recorded on the FDR). Kinematics study results indicated a relatively steady and consistent airplane-nose-down horizontal stabilizer angle in the 10 minutes between the initial dive and the second dive, followed by a large increase in stabilizer angle at about the time valid elevator data were lost on the FDR and the loud noise was recorded on the CVR. Calculated tension loads on the acme screw between the first and second dives were considerably larger than the loads encountered in the normal operational envelope. The studies indicated that the performance of the accident airplane during the second dive was consistent with the horizontal stabilizer moving quickly to a higher leading-edge-up position (which corresponds to airplane nose down) of at least 14° just after the loud noise was recorded by the CVR. 1.16.2 Metallurgical Examinations The Safety Board’s metallurgical investigation included on-scene and laboratory examinations. Initially, recovered wreckage was examined at a dockside facility at Port Hueneme, California, from February 9 to 11, 2000. Metallurgical examinations focused on the horizontal stabilizer, the jackscrew assembly, and related components. After the on-scene examinations concluded, laboratory examinations were conducted at the Safety Board’s Materials Laboratory, Washington, D.C.; the Boeing Commercial Aircraft Materials and Process Engineering Laboratory, Long Beach, California; and Integrated Aerospace, Santa Ana, California. 1.16.2.1 Horizontal Stabilizer Forward Spar The jackscrew assembly (not including the lower mechanical stop, the lower end of the torque tube, the torque tube retaining nut and washer, and the trim motors) was recovered attached to the front of the horizontal stabilizer forward spar.128 Spar brackets through which the acme screw attachment bolts pass were found severely bent. The lower 128 The jackscrew assembly is attached to spar brackets on the front of the horizontal stabilizer by six bolts, three on each side of the spar.

Factual Information 68 Aircraft Accident Report legs of both brackets were fractured at bend locations. A visual inspection determined that the fractures were consistent with overstress separations. 1.16.2.2 Acme Screw Several contact marks were found on the acme screw surface. A downward-facing, C-shaped contact mark on cadmium plating was found overlaying one end of a crack at the upper end of the acme screw. An inspection of the adjacent horizontal stabilizer structure found a mating dent in the horizontal stabilizer forward spar’s lower flange. The spar flange dent was smoothly curved with a radius that matched the acme screw at the C-shaped contact mark location. A visual inspection also determined that the upper end of the acme screw had contacted the bore of the pass-through hole in the lower gearbox support plate. Marks indicated several major impacts at various aft positions and minor impacts at the forward positions within the bore. Corrosion pitting and red rust areas were found along most of the acme screw’s length, with the heaviest areas of corrosion and rust along its lower half. Large areas of the acme screw were also found covered by white deposits, which chemical analysis determined were consistent with corrosion debris from the magnesium gearbox case attached to the top of the acme screw assembly. Figure 13 shows the acme screw thread remnants wrapped around the screw, the red rust areas, and the white deposits. Figure 13. A photograph of the acme screw thread remnants wrapped around the screw, the red rust areas, and the white deposits.

Factual Information 69 Aircraft Accident Report On-scene visual and tactile inspections by Safety Board metallurgists of the acme screw’s threaded areas found no evidence of grease in any condition, either semi-fluid (that is, fresh) or solid/dry (that is, old or degraded), or other lubricants in the central “working region” of the screw threads.129 Laboratory examinations found small flakes of dried and hardened grease attached to some of the thread remnants in this region. The acme screw’s lower threads (which are outside of the working region) were found partially packed with a mixture consistent with sand and grease. (Figure 14 shows the sand/grease mixture packed between the acme screw’s lower threads.) Parts of the acme screw’s upper six to eight threads had an oily sheen, and small deposits of greaselike material were found between the threads. Figure 14. A photograph of the sand/grease mixture packed between the acme screw’s lower threads. 129The acme screw working region is that part of the screw that can come in contact with the acme nut during its operation between the upper and lower electrical stop limits.

Factual Information 70 Aircraft Accident Report The acme screw was locally bent about 5° at the point of a crack in the area of the C-shaped contact mark above the acme screw threads and below the upper stop splines. The crack was gapped open about 1/16 inch and extended about 270° around the acme screw’s circumference. An initial visual inspection of the crack surfaces and subsequent microscopic laboratory examination determined that the crack was on a 45° plane, consistent with an overstress fracture. No evidence indicated any preexisting cracks. The acme screw was cleaned with soap and water for more detailed laboratory examination. Cleaning removed most of the dried and hardened grease and some of the white magnesium deposits; however, most of the red-rusted, corrosion-pitted areas remained. Laboratory examination revealed that there was less pitting at the upper and lower parts of the acme screw where the screw’s black-oxide coating was more intact.130 No wear was visible on the flanks of the acme screw’s 10 lower and 7 upper threads. The upper flanks of the threads in the working region showed evidence of polishing and removal of the black-oxide coating that increased toward the center of the acme screw. Examination of the surfaces through the black-oxide coating found no machining steps (indentations worn into the surface) or sharp features. Thread flank surfaces in areas that did not have a black-oxide coating appeared circumferentially worn and lustrous with no wear steps or sharp features found in these areas. Surface roughness was measured at four locations on the flanks of the acme screw threads, and all locations recorded a surface finish of 32 root mean squared (RMS) value131 or finer, as required by the manufacturer’s specifications. The lower end of the acme screw, including about 19 threads, was cleaned electrolytically,132 which completely removed the corrosion debris and most of the white magnesium deposits but left the black-oxide coating, paint, and cadmium plating (on the splined areas) intact. Subsequent microscopic examination determined that corrosion had deeply pitted the acme screw surface. Surface finish was measured on the thread flank in the cleaned lower end and determined to be 32 RMS or finer. Chemical and metallurgical tests established that the acme screw met material and process specifications. 1.16.2.3 Acme Screw Torque Tube The acme screw torque tube was fractured approximately in line with the bottom of the screw, through the first full thread just below the external splines at the lower end of the tube. Neither the mating lower piece of the torque tube nor the retaining nut and washer from this area of the assembly were recovered. The upper end of the torque tube 130 A black-oxide coating is a thin surface finish treatment that provides limited corrosion and wear protection. 131 RMS is a numerical measurement of surface roughness. The acme screw’s engineering drawing specifications require a surface finish of 32 RMS or finer in the threaded area. In later specifications, RMS has been replaced by RA (arithmetic average). 132 Electrolytic cleaning is accomplished by applying a small amount of voltage to the part while it is immersed in a mildly caustic solution.

Factual Information 71 Aircraft Accident Report was bent about 5° in a location corresponding to the location of the crack in the acme screw. Macroscopic fracture traces indicated that the torque tube fracture initiated from a broad front at the tube’s right forward quadrant (with the torque tube oriented as recovered) and propagated through the tube’s cross-section. Macroscopic fracture features emanated from a thin reflective fracture band adjacent to the thread root that was determined to be a preexisting fatigue crack. Fatigue striations were identified throughout the band, consistent with low-cycle fatigue cracking.133 The fatigue band followed the first thread root around almost 330° of the torque tube’s circumference and extended about 0.03 inch onto the fracture surface in the initiation area. The remaining fracture area was ductile overstress stemming from the fatigue. Chemical and metallurgical tests established that the torque tube material met material and process specifications. The large diameter upper end of the torque tube displayed a 0.1-inch-wide and 0.028-inch-deep wear band. The band ran completely around the torque tube at the location corresponding to the upper end of the acme screw. 1.16.2.4 Lower Mechanical Stop and Corresponding Spline Area on the Acme Screw The lower mechanical stop of the acme screw assembly was recovered with a section of the vertical stabilizer that had been separated from the jackscrew assembly and related structure. The lower mechanical stop was covered by dark, partially dried grease, and the stop bolt and nut were in place. Numerous dents and mechanical marks were found on the upper and lower surfaces of the lower mechanical stop. Mechanical damage was also found on the lower mechanical stop’s internal splines and on the clamp bolt. The lower mechanical stop’s clamp bolt and nut were found in place. Optical microscopy, scanning electron microscopy (SEM), and x-ray energy dispersive spectroscopy (EDS) examinations identified multiple damage features on the lower mechanical stop’s upper surface, consistent with contact with the lower end of the acme nut and the nut’s lower stop lug that protrudes below the main body of the nut. The features ranged from light marks in the primer paint to severe dents and substantial deformation of the metal. The damage surface was consistent with both clockwise (rotational) scoring and substantial deformation and rotational sliding contact (in both directions) with the acme nut.134 Rotational stripping was observed in circumferential bands at the upper and lower ends of the internal spline teeth in the lower mechanical stop.135 The middle area of the 133 For more information on torque tube testing, see section 1.16.5. 134 In an intact jackscrew assembly, clockwise rotation of the acme screw results in movement of the horizontal stabilizer toward airplane-nose-down pitch, and counter-clockwise rotation of the acme screw results in movement of the horizontal stabilizer toward airplane-nose-up pitch.

Factual Information 72 Aircraft Accident Report splines, which was about 1/4 inch wide, was damaged but not stripped at any circumferential location. Circumferential scoring marks associated with the stripped areas of the spline teeth were on a plane slightly offset from directly circumferential. The stripping pattern and offset circumferential marks were consistent with the lower mechanical stop being at two or more skewed angles to the acme screw’s splines during stripping. Most spline tooth peaks were found smeared in a counter-clockwise direction, consistent with a clockwise rotation of the acme screw (as viewed from above). However, many splines were damaged consistent with acme screw rotation in both directions. Imprint marks created by upward motion of the acme screw spline teeth through the lower mechanical stop were observed across the peaks of the stop’s spline teeth that were not stripped (the middle portion of the splines). The orientation of the marks was consistent with the lower mechanical stop being skewed (at an angle) to the splines of the acme screw as the screw pulled upward through the stop. Damage along the length of the portion of the shank of the lower mechanical stop clamp bolt that was exposed to the interior of the stop was consistent with rotational contact with acme screw spline teeth. The exposed area of the bolt shank also had imprint marks oriented transverse to the length of the bolt, consistent with upward motion of the acme screw relative to the lower mechanical stop. These transverse marks on the bolt shank were superimposed upon the rotational damage, consistent with this damage being created, at least in part, after the rotational damage of the lower mechanical stop spline teeth. 1.16.2.5 Acme Nut The acme nut was recovered attached to vertical stabilizer wreckage in its normal position but separate from the acme screw and the remainder of the jackscrew assembly. On-scene visual inspection of the thread area on the inside diameter of the acme nut showed a relatively smooth, flat surface, with only small ridges of the acme thread remaining. (Figure 15 shows an overall view of the recovered acme nut assembly. Figure 16 shows a closer view of the interior of the acme nut.) In addition, a pattern of dry, black deposits also spiraled around the diameter, following the raised ridges. The inside surface also contained random areas of white deposits. No evidence of grease was found inside the acme nut during on-scene visual and tactile inspections or during high-magnification examination in the laboratory. Various quantities of reddish-brown and black grease were found on the exterior of the acme nut and gimbal ring, and areas of 135 Stripping was considered present in any region where individual spline teeth were indistinguishable from each other.

Factual Information 73 Aircraft Accident Report green-tinted, black and red grease deposits were found on the surrounding airplane structure. Figure 15. A photograph of an overall view of the recovered acme nut assembly. Figure 16. A photograph of a closer view of the interior of the acme nut. The acme nut has a grease fitting on the forward, upper side of the nut through which grease can be applied to the acme nut threads. A solid, black, claylike, dry residue coated with white, powdery material was found in the internal counterbore of the acme nut’s grease passageway where it intersected the inside surface of the nut, as well as in the smaller diameter grease passageway behind the counterbore. When the grease fitting was

Factual Information 74 Aircraft Accident Report removed to allow collection of material samples from the grease passageway, translucent, reddish grease consistent with the appearance of Mobilgrease 28 was observed on the fitting’s external threads. (Figure 17 shows a cross-section through the acme nut’s grease passageway and fitting.) Traces of translucent, reddish grease were also found inside the grease passageway in the acme nut and in the bore of the grease fitting, a section distinct from the grease passageway. (Figure 18 shows the grease passageway and counterbore after the acme nut was sectioned.) Microscopic examination determined that the sample from the counterbore consisted mostly of black powdery material, larger chunks of black and white material, and particles of copper-colored metallic debris identified as acme nut material. Figure 17. A diagram of a cross-section through the acme nut’s grease passageway and fitting. Red areas denote the locations where red grease was found, and gray areas denote the location where the dry residue was found.

Factual Information 75 Aircraft Accident Report Figure 18. A photograph of the grease passageway and counterbore after the acme nut was sectioned. Magnified visual inspections of the acme nut’s interior after the nut was longitudinally sectioned confirmed the presence of the spiraling pattern consistent with the original location of the internal nut threads. For comparison with the accident acme nut interior, an exemplar nut was similarly sectioned.136 The spiral patterns comprised a small raised ridge followed by a lustrous depression with spiral machining or wear marks transitioning into a dark band of surface deposits that rose to the next ridge. Under higher magnifications, longitudinal smearing and shear fractures were identified on the raised edges. The smearing and shearing directions were consistent with upward movement of the acme screw threads in relation to the nut body. Material was observed folded upward and smeared over adjacent surfaces along most of the ridges. Typical ridges were between 0.013 and 0.020 inch wide. Most of the markings observed on the acme nut’s interior surface spiraled around the bore in the same manner as the original thread pattern. However, some circumferential and longitudinal marks were observed in isolated locations overlaying the spiral marks. Two circumferentially oriented bands of scratches were observed partially around the 136 The exemplar nut, which was removed during the overhaul of a jackscrew assembly, had a reported 0.0036-inch end play measurement at the time of overhaul.

Factual Information 76 Aircraft Accident Report inner diameter near the top of the acme nut on the forward side. Several longitudinal scuff marks were also observed on the upper aft side of the acme nut’s interior above the grease passageway. The scuff marks appeared to have been produced by the contacting object moving vertically upward. 1.16.2.6 Acme Nut Thread Remnant Examination Twelve acme nut thread remnants137 were found wrapped around the central part of the acme screw when it was recovered. Most of the thread remnants were found spiraled around the acme screw oriented primarily along the path of the screw threads, although some were found tangled together and bent in multiple directions. The thread remnants were clustered into two closely spaced groups extending about 6 to 8 inches along the acme screw. The thread remnants were copper colored with a greenish tint, consistent with copper-alloy oxidation. After recovery, each thread remnant was numbered, and its width, maximum thickness, estimated length, and number of 360° turns were measured. The accumulated length of the thread remnants was equivalent to about 75 percent of the total length of the original threads. High-magnification optical examinations revealed that all of the thread remnants were roughly rectangular in shape with a mostly flat upper side and a multibeveled lower side. The outer diameter’s edges were fractured, corresponding to the approximate major (outer) diameter of the acme nut. Examination also revealed that some of the thread remnants had corrosion pitting. A representative sample of a thread remnant (No. 4) was further examined by SEM and EDS. EDS examination determined that thread remnant No. 4 was composed of an aluminum-nickel-bronze alloy, consistent with acme nut material specified in the manufacturer’s engineering drawing (unified numbering system [UNS] alloy C95500).138 High-magnification SEM examination revealed smearing deformation and shearing dimples along thread remnant No. 4’s outer edge fracture surface. The orientation of the shear dimples was consistent with thread remnant No. 4 moving upward relative to the body of the acme nut. The following measurements were made at one of the fractured ends of thread remnant No. 4: the shear fracture on the outer edge measured 0.0131 inch, the nearby minimum section thickness measured 0.0076 inch, and the maximum section thickness at the central ridge measured 0.0184 inch. Additionally, two metallographic cross-sections were cut radially through another representative remnant (No. 6). The metallographic sections showed that thread remnant No. 6’s flat face exhibited a slight, concave curvature, which was also identified on thread remnant No. 4. The following measurements were made on one of the metallographic sections of thread remnant No. 6: the shear fracture on the outer edge measured 0.0174 137 One of these acme screw thread remnants was removed by Safety Board investigators on scene. 138 UNS alloy C95500 is a copper alloy containing aluminum, nickel, iron, and manganese. The engineering drawing specified an aluminum-nickel-bronze alloy per QQ-B-671, type 2, class 4 Cond HT. This designation has been superseded with UNS alloy C95500.

Factual Information 77 Aircraft Accident Report inch, the nearby minimum section thickness measured 0.0099 inch, and the maximum section thickness at the central ridge measured 0.0180 inch. 1.16.3 Shear Load Capability of the Acme Nut Threads The ultimate shear load capability of the acme nut threads was approximated by assuming that the thread root cross-section was uniformly at the material’s ultimate shear stress. This calculation was performed for three thread thicknesses: 0.15-inch-thick threads, as measured on newly manufactured threads; 0.0131-inch-thick threads, as measured on thread remnant No. 4; and 0.0174-inch-thick threads, as measured on the metallographic section of thread remnant No. 6. The calculations were based on the specified minimum ultimate strength (Ftu) for the nut material and assumed a shear strength equal to 77 percent Ftu. Table 4 shows the results of the shear load calculations.139 Table 4. Shear load calculations for three acme nut thread thicknesses. 1.16.4 Studies of Thread Stress and Deformation In connection with this investigation, the Safety Board asked Boeing to conduct a study to estimate the maximum wear that the acme nut threads could sustain and still maintain their ultimate load capability. Additionally, the Board, in collaboration with the State University of New York, Stony Brook, New York, initiated a study of the stresses and deformations in the acme nut. Both studies utilized the ABAQUS140 finite element analysis (FEA) code and axisymmetric models of the acme screw and nut to address thread-by-thread distribution of the load transfer from the screw to the nut. The Boeing study also used an axisymmetric model to evaluate the stresses in a loaded thread section of the same geometry as one of the remnants recovered from the accident airplane. The Safety Board/Stony Brook study used a three-dimensional FEA to examine the change in deformation and stress in a single thread revolution as a function of acme nut thread wear. 139 For more information about these calculations, see the Materials Laboratory Group Chairman’s Factual Report in the public docket for this accident. Shear Load Calculations of the Acme Nut Threads Shear load for 0.15-inch-thick thread (newly manufactured) Shear load for .0131-inch-thick thread (as measured on thread remnant No. 4) Shear load for .0174-inch-thick thread (as measured on the metallographic section of thread remnant No. 6) Load for 32 threads 2,200,999 pounds 191,263 pounds 249,782 pounds Load for 1 thread 68,781 pounds 5,977 pounds 6,806 pounds 140 Hibbitt, Karlsson & Sorensen, Inc. ABAQUS/Standard User’s Manual. Version 6.2. Pawtucket, Rhode Island. 2001.

Factual Information 78 Aircraft Accident Report Both studies indicated that the load transfer among the 32 thread revolutions was not uniform along the length of the acme nut, with thread revolutions near the top and bottom of the nut receiving greater loads than those near the center of the nut. Further, the studies showed that the load distribution varied depending on specific temperature and load conditions. The Boeing study concluded that the maximum load carried by any individual thread revolution was approximately 30 percent of the applied load, whereas the Safety Board/Stony Brook study concluded that the maximum load carried by any individual thread revolution was approximately 23 percent of the applied load. On the basis of the results of the thread remnant stress analysis, Boeing concluded that the only way to develop the large plastic bending observed in the thread remnant was for the thread loading to be concentrated near the tip of the thread rather than near the root. The Safety Board/Stony Brook study examined the acme screw-to-nut contact pressure distribution on a single nut thread revolution and determined that the pressure distribution was nonuniform across the thread surface (radial to the nut), with a small region near the thread root (major diameter) having a much higher pressure than the remainder of the contact surface. When material removal was modeled in the region of highest stress, the stress pattern stayed the same with the high-contact pressure region moving radially inward across the thread from the material removal region to the adjacent material on the remaining thread surface. The Safety Board/Stony Brook study concluded that the wear mechanism consisted of material removal proceeding on a layer-by-layer removal process along the thread surface and that, within each layer, wear progressed from the root to the tip (major diameter to minor [inner] diameter). The Safety Board/Stony Brook study ran a series of FEAs to evaluate the effect of the sequential wear process on the stress and deformation in acme nut threads. The study found that the stresses in the acme nut remained low compared to the yield stress141 of the aluminum-bronze acme nut material, even at wear levels exceeding the maximum amount allowed for an acme screw to remain in service. At an axial wear level of approximately 0.090 inch, the maximum stress was beginning to approach the yield stress under a load of 2,000 pounds per thread revolution. When the axial wear level reached 0.09265 inch and approximately 50 percent of the radial thread surface had worn, the bending deflection of the thread tip began to increase rapidly with load increase. When approximately 75 percent of the radial thread surface was removed, the bending reduced the available contact surface to a value too small for the FEA to provide valid data. The study concluded that, at this point, the acme screw thread would begin to slide axially across the thread surface rather than slide during rotation. 1.16.5 Torque Tube Testing Under the Safety Board’s supervision, Boeing conducted static load tests on torque tubes. Torque tube assemblies from MD-80 airplanes other than the accident airplane were 141 Yield stress is the largest value of stress for which all deformation within the material is recoverable when the material is unloaded.

Factual Information 79 Aircraft Accident Report tested to failure in tension to generate the sound signature142 of the predicted torque tube fracture and to validate and generate data for a subsequent FEA. To conduct the static load tests, the threads on two acme nuts were machined away to their roots (the major diameter) so that the acme screw could move freely through the nut vertically (without rotating). The tests were conducted in a computer-controlled hydraulic load frame by pulling the acme screw upward through the altered nuts until the torque tube fractured. In the first static load test, the lower mechanical stop on the acme screw contacted the acme nut in a manner that did not create any bending loads in the torque tube. This produced pure tension loading in the torque tube similar to loading that occurs during normal flight conditions. The first static load test produced a tension failure of the torque tube at a load of 74,400 pounds.143 In the second static load test, the lower mechanical stop on the acme screw contacted the acme nut in a manner that caused the entire load to be applied to one side of the stop in an offset manner. This type of load was similar to that indicated by lower mechanical stop damage on the accident airplane; however, the load was applied on top of the stop lug, creating a moment arm slightly greater than that indicated on the accident lower mechanical stop. This loading condition produced a combination of tension and bending in the torque tube. The second static load test produced a tension failure of the torque tube at a load of 25,576 pounds.144 For the FEA, Boeing generated a numerical model for the geometry and material parameters of the accident acme screw, torque tube, lower mechanical stop and clamp bolt, washer, and lower assembly nut. This model was used to analytically calculate the static offset load capability of the accident torque tube using the loads derived from the two static load tests. The Boeing model predicted that the accident torque tube fractured at a load of 25,500 pounds. Neither of the two static load test conditions accounted for fatigue damage to the torque tube (similar to damage found on the accident torque tube). Low-cycle fatigue testing of small diameter torque tube material specimens was performed to estimate the stress conditions that would generate a similar low-cycle fatigue fracture surface. To test the torque tube material, tensile specimens were machined from torque tubes; threads were added to the center portions of the specimens (simulating the threads at the lower end of the torque tube); and constant-amplitude cyclic loading at calculated stress levels145 of 140,000, 166,000, and 185,000 pounds per square inch (psi)146 were applied to the 142 For more information on the Safety Board’s sound spectrum study, see section 1.11.1.1. 143 When the airplane is subjected to the ultimate design loads specified for certification, the torque tube sustains a 57,000-pound load. 144 According to the Boeing torque tube test report summary, “the fracture load of just over 25,000 [pounds]…is based on a loading configuration that provides for the largest offset moment arm with the nut stop resting directly upon the lower rotational stop.” Boeing’s summary noted that the accident airplane’s “lower rotational stop exhibits evidence that the orientation of the two stops provides a smaller moment arm” and thus had a higher predicted fracture load.

Factual Information 80 Aircraft Accident Report individual test specimens until a fracture was produced. Low-cycle fatigue fractures were created under all three of the test conditions. The fracture surfaces on the accident torque tube were more similar to those produced when 140,000- and 166,000-psi cyclic loads were applied than to those produced when a 185,000-psi cyclic load was applied. The 140,000-psi specimen fractured after application of 1,549 load cycles, the 166,000-psi specimen fractured after application of 389 load cycles, and the 185,000-psi specimen fractured after application of 100 load cycles. 1.16.6 Additional Safety Board Jackscrew Assembly Examinations 1.16.6.1 February 2000 Post-AD 2000-03-51 Jackscrew Assembly Examinations The Safety Board examined eight jackscrew assemblies removed from airplanes shortly after the issuance of FAA AD 2000-03-51 in February 2000,147 including two assemblies from Alaska Airlines’ airplanes.148 The jackscrew assemblies were removed in accordance with AD 2000-03-51 for various reasons, including wear and the presence of metal shavings. In addition, the Board examined five Alaska Airlines acme nuts that had been removed from jackscrew assemblies that were being overhauled. The Safety Board performed a loaded acme nut end play test on all eight of the removed jackscrew assemblies by mounting each jackscrew assembly (in as-received condition) in a frame and attaching the gimbal ring to a moment arm. During the tests, the acme nut was loaded by applying 180 pounds in both directions (up and down). Movement of the acme nut on the screw was measured using a dial indicator and recorded as end play. End play measurements were made with the acme nut positioned in three locations: near the center of the acme screw, near the lower mechanical stop, and near the upper mechanical stop. The free play was also measured at the middle position during the loaded end play test. After lubricating the middle section of the acme screw with Aeroshell 33 by hand and injecting it through the acme nut’s grease fitting (the original grease was not removed), end play measurements were repeated on each jackscrew assembly with the nut in the middle position. The procedures were repeated again after removing by hand all of the grease from the middle section of the acme screw. The test data show that the as-received end play measurements changed slightly in both directions for both the regreased and new grease conditions. 145 The stress level was calculated by dividing the applied load by the measured cross-sectional area in the threaded region of the test specimens. 146 These values were used to ensure that testing occurred in the high-stress region of the torque tube and produced a fracture in a short timeframe. The values were first estimates of the possible stress range that the torque tube might have experienced and were not intended to reproduce actual conditions. 147 For more information about postaccident ADs, see section 1.18.1. 148 These jackscrew assemblies were DCA 3000 from N982AS and DCA 3008 from N981AS.

Factual Information 81 Aircraft Accident Report All eight of the removed jackscrew assemblies were disassembled to separate the gimbal ring from the acme nut, the acme nut from the acme screw, the acme screw from the torque tube, and the torque tube from the spherical bearing. Individual items of each jackscrew assembly were cleaned and visually examined. Visual inspections of the disassembled acme nuts from the eight removed jackscrew assemblies and the other five Alaska Airlines acme nuts identified sharp edges, or burrs, at the minor diameter of all of the threads on all of the nuts. The burrs on all of the acme nuts extended inward from the lower flanks of the threads. Some burrs were partially disconnected, forming long, thin metal slivers. The lower flanks and major diameters of the threads were bright and shiny with a finely scratched and worn appearance. The scratches followed the spiral threads and had obliterated the original surface finish. One of the acme nuts from an Alaska Airlines jackscrew assembly that was being overhauled was cut along its longitudinal axis to inspect its thread surfaces. Burrs and slivers were identified along the entire length of the cut. In many areas, slivers were separating from the threads in thin, wide flakes. The lower flanks and the major diameter of the threads were worn along the entire acme nut. Almost no wear marks were identified on the minor diameters or on the upper flanks. Most of the acme screws from the disassembled assemblies were very similar in wear characteristics, showing only polishing of the lower thread flanks and major diameter. However, the acme screw from one of the removed jackscrew assemblies (S/N DL-96) showed much heavier wear with steps worn into both the upper and lower flanks of the threads. During the disassembly of DL-96, gritty, gray-colored material was noted on the upper surfaces of the gearbox support plates. The torque tubes from all of the jackscrew assemblies were undamaged, except for DCA 3000 from N982AS. The upper end of this torque tube displayed a .0065-inch-deep wear band all around the large diameter section. 1.16.6.2 Examinations of Hawaiian Airlines’ Jackscrew Assemblies On February 17, 2000, a jackscrew assembly, S/N DCA 110, was removed from a Hawaiian Airlines DC-9 (N601AP) after an on-wing end play measurement of 0.043 inch was recorded.149 The assembly had accumulated 2,582 flight hours (6,377 flight cycles) since a 1997 overhaul.150 A bench end play check conducted by Integrated Aerospace151 after the jackscrew assembly was removed and cleaned yielded an end play measurement of 0.048 inch. The acme nut and screw were forwarded to the Safety Board’s Materials Laboratory for examination. 149Before the flight 261 accident, Hawaiian Airlines’ lubrication interval for the jackscrew assembly was every 1,000 flight hours, and its end play check interval was every 3,000 flight hours. 150After the 1997 overhaul, the DCA 110 jackscrew assembly had a recorded end play measurement of 0.010 inch. The jackscrew assembly was sent to Hawaiian Airlines, where it was stored until its installation on N601AP on June 22, 1998. 151Integrated Aerospace, formerly Trig Aerospace, Inc., is the only original manufacturer and supplier of new jackscrew assemblies.

Factual Information 82 Aircraft Accident Report Metallurgical examination of the acme screw identified visible wear steps in both the upper and lower flanks of the threads. No other mechanical or corrosion damage was noted on the acme screw. Examination of the acme nut showed that both flanks of the nut threads were lustrous with circumferential marks consistent with wear. However, no burr was noted at the minor diameter as seen on other acme nuts previously examined. The major diameter of the threads (the root area) was also worn and lustrous with a fine pattern of parallel scratches on both the upper and lower flank surfaces. The parallel scratch pattern ran circumferentially around the thread flanks. The major diameter surfaces also showed heavy localized wear that enlarged the diameter in some areas of the acme nut. The diametrical wear was determined to be nonuniform in both the circumferential and vertical directions, consistent with an angular misalignment of the acme screw axis to the acme nut axis with the upper end of the screw displaced to the right and the lower end to the left. The calculated wear rate of this jackscrew assembly (using the 0.048-inch n end play measurement obtained during the overhaul bench check and accounting for the 0.010-inch end play measurement obtained when the jackscrew assembly was first installed) was 0.0147 inch per 1,000 flight hours. On June 18, 2001, another jackscrew assembly, also partially stamped with S/N DCA 110,152 was removed from the same airplane after an on-wing end play measurement of 0.036 inch. The acme screw and nut had accumulated 2,514 flight hours (6,071 flight cycles). Metallurgical examination at the Safety Board’s Materials Laboratory identified polishing on the acme screw’s upper thread flanks and major diameter in the central part of the screw. No steps in the thread flanks were identified. The lower flanks of the acme nut threads were worn with a circular pattern, and the shape of the acme screw thread major diameter chamfer was worn into the nut threads. Examination of the acme nut’s profile and interior surfaces after sectioning identified small burrs on all threads extending from the lower thread flank into the minor diameter area. The major diameter surfaces displayed some localized contact damage, but the diameter was not enlarged at any location. The calculated wear rate of this jackscrew assembly (assuming a starting end play measurement of 0.006 inch after overhaul and a final bench-check end play measurement of 0.027 inch) was 0.0084 inch per 1,000 flight hours. The Safety Board’s examination also revealed evidence of pink-colored grit material inside the counterbore of the acme nut grease passageway in the jackscrew assembly removed in February 2000. A Hawaiian Airlines maintenance work card dated December 4, 1999, stated, “Grit blast accumulated in vertical stab as seen thru access panel 6401 and panel 3703 (left lower banana fairing). Area to be inspected after cleaning.” The corrective action noted on the card was the following: “Cleaned area. Inspected area. No discrepancies noted.” According to Hawaiian Airlines personnel, the 152Although S/N DCA 110 was stamped on the gearbox support assembly, the S/N stamped on the acme screw and nut was D 3351, indicating that the acme screw and nut from the first DCA 110 assembly were replaced by a new acme screw and nut. Hawaiian Airlines personnel stated that they kept the DCA 110 gearbox support assembly, torque tube, and stop nut with N601AP (after sending the acme screw and nut for overhaul) when they installed the newly acquired D 3351 acme nut and screw in February 2000. Records indicated that the D 3351 assembly was manufactured in 1998 and delivered to Boeing with an end play measurement of 0.006 inch.

Factual Information 83 Aircraft Accident Report area noted on the work card was located inside the vertical stabilizer where the jackscrew assembly is installed. Several grease samples taken from the original acme nut and screw of jackscrew assembly DCA 110 and from the area of the assembly near the inside of the vertical stabilizer contained translucent, pink particles, consistent with the fine grains of a sandlike material. EDS chemical analysis indicated that the grains were composed of iron, silicon, aluminum, calcium, oxygen, and magnesium. Examination of grease samples taken from the D 3351 assembly also revealed pink particles, consistent with those found in the grease sample taken from DCA 110. An on-site inspection of Hawaiian Airlines’ maintenance facilities in August 2001 revealed that it had been using either Australian garnet or glass beads to remove corrosion from airplane structure. Examinations of a sample of the garnet material found that it visually and chemically matched the pink, sandlike material found in the grease of both jackscrew assemblies removed from Hawaiian Airlines. 1.16.6.3 Examinations of Alaska Airlines Reports of Acme Screw “Wobble” On November 26, 2000, Alaska Airlines maintenance personnel observed the acme screw “wobble” while operating the horizontal stabilizer trim system on N965AS. According to the personnel, the wobble appeared as a slight rocking motion of the acme nut as the acme screw was rotated within it. Alaska Airlines removed the jackscrew assembly from N965AS and notified the Safety Board about the wobble. On February 21, 2001, Safety Board investigators observed the jackscrew assembly as it was operated on an Integrated Aerospace fixture and a wobble was noted. The end play of the wobbling acme screw was checked several times (before disassembly) while installed on the Integrated Aerospace fixture. The acme screw was rotated before each end play check to identify any variance in end play caused by wobble-induced acme nut and screw position changes. No differences were noted, and the end play measured 0.018 inch consistently. After the jackscrew assembly was disassembled, the technician who removed the lower torque tube nut indicated that the torque nut was looser than what he considered to be typical.153 A wear band was noted on the large diameter section near the top portion of the torque tube. The depth of the wear band was not uniform around the periphery of the groove and measured 0.035 inch at its deepest point. According to Boeing, a wear band frequently occurs in this area because the clearances are small and, at times, the torque tube contacts the inside wall of the acme screw. The Boeing DC-9 Overhaul Maintenance Manual requires a steel-sleeve repair of the wear band during overhaul if the wear band is deeper than 0.025 inch. 153 The technician used a wrench to remove the torque nut. No measuring device was used to measure the torque required to loosen the nut. The technician’s comments were based on his personal experience of feel.

Factual Information 84 Aircraft Accident Report In a March 27, 2001, letter, Alaska Airlines asked the Safety Board to investigate the wear band. Alaska Airlines noted that the torque tubes from N982AS and the accident airplane had similar wear bands.154 Alaska Airlines also expressed concern that the wobble could produce erroneous end play measurements and/or excessive acme nut wear. The Board collected data from Integrated Aerospace and Boeing to determine if a relationship existed between acme nut wear rate and torque tube wear band depth. The collected data included information about 161 jackscrew assemblies examined by Integrated Aerospace in 2000. Of these assemblies, only 77 had torque tubes. Of the 77 jackscrew assemblies with torque tubes, only 49 had a recorded bench-check end play measurement, a torque tube wear band measurement, and a valid flight-hour total. A Board examination found no statistically significant difference regarding acme nut wear between the torque tubes with no (or a slight) wear band and the torque tubes with deeper wear bands. 1.16.7 Chemical and Microscopic Analyses of Grease Residues from the Accident Jackscrew Assembly The Safety Board contracted the U.S. Navy’s Air System Command’s Aerospace Materials Laboratory, Patuxent River, Maryland,155 to conduct chemical and microscopic analyses of eight grease residue samples taken from the accident jackscrew assembly. An organic analysis method, Fourier Transform Infrared Spectroscopy, was used to compare the grease residue samples taken from the accident jackscrew assembly to control samples of Aeroshell 33 and Mobilgrease 28. The spectra resulting from the residue samples were weak, which was attributed to the degraded quality of the grease. None of the grease residue samples could be matched perfectly to either Aeroshell 33 or Mobilgrease 28. However, the resulting analysis indicated that most of the residue samples displayed infrared spectra consistent with the presence of both Aeroshell 33 and Mobilgrease 28. On the basis of a comparison of the residue samples to the control samples, the Naval laboratory concluded that both greases were likely present on the accident jackscrew assembly. An independent review of this work conducted by a private consultant commissioned by the Board also concluded that the residue samples had infrared signatures consistent with the presence of both Aeroshell 33 and Mobilgrease 28. According to the Naval laboratory report, the microscopic analysis of the residue samples found that the “sample grease was heavily loaded with particles[156] originating from…aluminum bronze” and that “these particles were consistent with wear debris.” The 154 Metallurgical examination determined that the wear band on the torque tube from jackscrew assembly DCA 3000 was 0.0065 inch deep and that the wear band on the accident torque tube was 0.028 inch deep. 155 The U.S. Navy’s Aerospace Materials Laboratory is the Department of Defense’s (DoD) steward of the MIL PRF specifications for both Aeroshell 33 and Mobilgrease 28 and qualifies greases to these specifications. 156The Naval laboratory report stated that “a couple of larger metal particles were extracted from the grease with tweezers and examined individually. One was a large flake and the other was a long shaving. Both were aluminum bronze, equivalent in composition to the smaller particles.”

Factual Information 85 Aircraft Accident Report Naval report stated that “no other particle contamination was found other than that attributed to the environment of the crash site and the recovery operation.” 1.16.8 Additional Grease Testing, Experiments, and Analysis 1.16.8.1 Standardized Grease Testing The Safety Board also contracted the U.S. Navy’s Aerospace Materials Laboratory to conduct a series of standardized grease tests. Pure quantities of Aeroshell 33 and Mobilgrease 28, as well as several mixture ratios of each grease, were tested using several American Society for Testing and Materials standard test methods for lubricating greases. These tests examined the greases’ firmness (when new and after being mixed), storage stability, and oil bleedout caused by elevated temperature and elapsed time. The results of these tests indicated that, in general, the physical properties of Aeroshell 33 and Mobilgrease 28 did not change significantly when mixed; however, the change in the physical properties of the two greases noted in 90/10 and 10/90 mixture ratios exceeded that of the standard for compatibility of mixed greases. The Naval laboratory report concluded that the change in properties was insignificant and would not significantly affect the greases’ performance. The Naval laboratory also conducted seawater immersion tests on control samples of Aeroshell 33 and Mobilgrease 28 and on a 50/50 mixture of the two grease types. The Naval report concluded that, after being immersed in seawater for 2 weeks, the three test samples “exhibited only slight color changes, with no other adverse effects noted.” The report concluded that “deterioration of the aircraft grease sample [from the accident airplane] was not due to exposure to seawater for two weeks following the incident.”157 1.16.8.2 Experiments and Analysis on the Surface Chemistry of Acme Nut Material When Exposed to Various Greases or Grease Mixtures The Safety Board contracted the U.S. Navy’s Aerospace Materials Laboratory and Science Applications International Corporation, San Diego, California, to conduct a series of experiments to examine the surface chemistry of acme nut material when exposed to Mobilgrease 28, Aeroshell 33, and mixtures of the two greases under various conditions that can occur during flight, including exposure to ambient and elevated temperatures and fluid contamination (water, deicing fluid, and anti-icing fluid). During the experiments, it was found that under certain circumstances Aeroshell 33 would produce a visible brownish discoloration to small, localized regions of the acme nut material. The surface chemistry of the discolored regions was analyzed using x-ray photoelectric spectroscopy. The analysis indicated that the discolored region was 157In another example, the Safety Board observed that an acme screw recovered from a China Northern MD-80 airplane that crashed into a salt water bay near Dalian, China, on May 7, 2002, still had a coating of grease clearly visible on it after it had been immersed in seawater for 5 days. According to the Civil Aviation Administration of China, the last scheduled lubrication of the jackscrew assembly was during an A check that took place March 27 through April 2, 2002, and the specified grease was Aeroshell 5 (MIL-G-3545C).

Factual Information 86 Aircraft Accident Report caused by additives in the Aeroshell 33 grease chemically reacting with each other and depositing on the surface of the acme nut material, which is an intended chemical reaction between antiwear additives in the grease. Science Applications International Corporation concluded that this was not a corrosion process and, therefore, would not corrode the acme nut material. 1.16.8.3 Wear Testing Under Various Grease Conditions The Safety Board contracted the Tribological Materials Laboratory at Rensselaer Polytechnic Institute, Troy, New York, and the tribology division of Battelle Memorial Institute, Columbus, Ohio, to conduct a series of wear tests on grease-lubricated, aluminum-bronze and steel couples in sliding wear. The test program concentrated on the American Society for Testing and Materials D3704 Block-on-Ring wear test method, which involves a steel ring sliding in reciprocating motion upon an aluminum bronze block. Contact pressure ranges and sliding speeds used in these tests reflected those experienced in an operational jackscrew under flight and static loads. Additionally, test specimens were fabricated from actual jackscrew assembly steel and aluminum-bronze components. Because Mobilgrease 28 has been demonstrated to effectively lubricate the jackscrew assembly, the wear test program examined the lubricating effectiveness of Aeroshell 33 relative to Mobilgrease 28. The wear tests were run under the following conditions: (1) with a mixture of Aeroshell 33 and Mobilgrease 28; (2) with greases contaminated with water, deicing fluid, and salt water; (3) with aged and wear-debris laden grease; (4) with greases exposed to subzero temperatures; and (5) with a complete lack of lubrication. Over 50 wear tests were performed. During the wear tests, the wear rates were continuously monitored so that the steady-state wear behavior, which governs the long-term jackscrew assembly wear, could be identified separately from the transient wear behavior experienced during the break-in period that began each test. The results of the wear tests showed that, in all ranges of contact pressure, lower wear rates were generated when Aeroshell 33 was used than when Mobilgrease 28 was used. Additionally, the effects of contamination, aging, and subzero temperature exposure were determined to have little effect on the lubricating effectiveness of Aeroshell 33. Only the tests run without any lubrication generated wear rates significantly higher than those generated when Mobilgrease 28 was used. In these cases, wear rates were seen to transition up to 10 times higher than those with equivalent conditions lubricated with Mobilgrease 28. Figure 19 shows a summary of the results of the high-load wear tests, including the contamination and low-temperature tests.

Factual Information 87 Aircraft Accident Report Figure 19. A summary of the results of the high-load wear tests, including the contamination and low-temperature tests. 1.17 Organizational and Management Information 1.17.1 Alaska Airlines, Inc. Alaska Airlines, Inc., was organized in 1932 and incorporated in 1937 and, at the time of the accident, was one of two subsidiaries of Alaska Air Group, Inc., which was incorporated in 1985. At the time of the accident, Alaska Airlines employed about 10,000 people and served more than 40 domestic and international destinations (including 5 cities in Mexico) from hubs in Anchorage, Alaska; Seattle, Washington (the location of the company’s headquarters); and Portland, Oregon. According to FAA documents, at the time of the accident, Alaska Airlines operated a fleet of 88 airplanes, including 49 737s and 39 MD-80 series airplanes.158 158 According to a June 20, 2000, FAA special inspection report on Alaska Airlines, the airline was operating a fleet of 89 airplanes, of which, 55 were 737s and 34 were MD-80 series airplanes. The FAA special inspection report added that Alaska Airlines planned to add 9 737-700 and 10 737-900 series airplanes to its fleet over the next 2 years. For more information about the FAA special inspection report, see section 1.17.3.4. Steady-State Wear Factor (mm 3/N.m) x10 6 Neat Grease Tests Fluid Contaminated Tests Low Temperature Tests (-29C) Used Grease Test Avg. 3 tests 80 70 60 50 40 30 20 10 0 A33 M28 50/50 Mix Avg. 4 Tests Avg. 5 Tests Avg. 3 Tests A33 M28 M28 Dry A33 A33 Grease +5% Salt Water Grease +5% De-Icing Fluid 50/50 Mix Used A33 A33 Grease +5% DI Water DRY

Factual Information 88 Aircraft Accident Report 1.17.2 Alaska Airlines Flight Crew Training According to FAA and Alaska Airlines documents, Alaska Airlines conducted training for its MD-80 fleet under the Advanced Qualification Program, which was effective March 1, 1985. A Safety Board review of the airline’s MD-80 training curriculum indicated that the primary and alternate horizontal trim system components were covered during the airplane-specific ground school. During the second segment of maneuver briefing (before the full-flight simulator session), pilots were asked to describe situations that might require use of the runaway stabilizer checklist and to perform the checklist.159 Application and performance of the runaway stabilizer checklist was also required during the third and fourth segments of the curriculum. Classroom materials for the MD-80 continuing qualification program, which were effective in 1999, included normal and abnormal procedures for flight control systems. Supplemental instructional material given to pilots contained a quiz that included questions addressing electrical failures and associated stabilizer inoperative indications. 1.17.2.1 Stabilizer Trim Check Procedures The stabilizer trim check procedures listed in the Alaska Airlines MD-80 Flight Handbook included checking both the primary and alternate trim systems. Specifically, the “Before Start Expanded Procedures” included the following steps: Move PRIMARY MOTOR BRAKE switch to ‘STOP.’ Operate both Captain’s control wheel trim switches in NOSE UP and NOSE DN [down] directions. Observe stabilizer does not move and aural warning does not sound. Unless stabilizer is running away, NEVER PLACE THE PRIMARY MOTOR BRAKE SWITCH TO ‘STOP’ WITH THE STABILIZER IN MOTION. Damage will result. Move the PRIMARY MOTOR BRAKE switch to NORM and verify guard is down. The PRIMARY MOTOR BRAKE switch does not affect operation of the alternate stabilizer trim system. While observing the stabilizer indicator, hold Captain’s control wheel left trim switch to NOSE UP and then to NOSE DN momentarily. CAUTION – Do not hold single switch position longer than 3 seconds. The stabilizer should not move and aural warning should not sound. Repeat this check using Captain’s control wheel right trim switch. Observe stabilizer does not move and aural warning does not sound. Operate both Captain’s control wheel trim switches in NOSE UP and then NOSE DN directions and note corresponding direction of stabilizer indicator and aural warning. Operate First Officer’s control wheel trim switches and check stabilizer indicator. Moving Captain’s and First Officer’s control wheel trim switches in opposition directions will stop stabilizer movement. This is not a required test. If test is used, do not exceed 3-second limit. 159 For more information about the runaway stabilizer checklist, see section 1.17.2.2.

Factual Information 89 Aircraft Accident Report Operate both LONG TRIM HANDLES in the same direction and check for corresponding trim indicator movement, release handles to neutral. While observing horizontal trim indicator, momentarily operate each ALT LONG TRIM switch individually to NOSE UP and NOSE DN. Observe stabilizer does not move and aural warning does not sound. Operate both ALT LONG TRIM switches and check for direction of travel at slower rate. To obtain maximum service life, do not maintain switch positions longer than necessary to check response. If there is no response, release switches and determine cause. Should either trim handle or any control switch bind, hesitate or stick when released to neutral, it should be corrected before flight. Any time LONG TRIM handles, control wheel trim switches, or ALT LONG TRIM (secondary) controls are used, they should be moved to their fully deflected switch/lever position to ensure both motor and brake circuits are actuated. The “Taxi Expanded Procedures” in the Flight Handbook outlined the following steps: Rotate the FLAP thumbwheel, in the LONG TRIM Takeoff Position Display, until the computed TO (takeoff) FLAP value appears in the FLAP window. Rotate the CG thumbwheel, in the LONG TRIM Takeoff Position Display, until the computed CG value appears in the CG window. • when the FLAP and CG values are set for takeoff, the Stabilizer TAKEOFF CONDTN LONG TRIM Readout window will display the proper trim setting. • using the Primary LONG TRIM Control Wheel Switches, or LONG TRIM Handles, set the LONG TRIM (White) Indicator opposite the Long Trim Takeoff Position (Green) Indicator. • if the indicators are not within specified tolerance, after takeoff flaps have been selected, the aural warning will sound when the throttles are advanced for takeoff. 1.17.2.2 Runaway Stabilizer Checklist Procedures The Alaska Airlines MD-80 Quick Reference Handbook (QRH) included the following checklist procedures to troubleshoot a runaway stabilizer:

Factual Information 90 Aircraft Accident Report

Factual Information 91 Aircraft Accident Report 1.17.2.3 Stabilizer Inoperative Checklist Procedures The Alaska Airlines MD-80 QRH included the following checklist procedures to troubleshoot an inoperative stabilizer:

Factual Information 92 Aircraft Accident Report 1.17.2.3.1 Postaccident Boeing Flight Operations Bulletin on Stabilizer Trim Inoperative/Malfunction Procedures On February 10, 2000, Boeing issued a flight operations bulletin for DC-9, MD-80, MD-90, and 717 airplanes that addressed stabilizer trim inoperative/malfunction procedures. On the basis of information gathered in the flight 261 accident investigation to that date, the bulletin recommended the following: If a horizontal stabilizer trim system malfunction is encountered, complete the flight crew operating manual (FCOM) checklist(s). Do not attempt additional actions beyond that contained in the checklist(s). If completing the checklist procedures does not result in an operable trim system, consider landing at the nearest suitable airport. If an operable trim system is restored, the captain should consider proceeding to an airport where suitable maintenance is available, or to the original destination based on such factors as distance, weather, etc. The Boeing bulletin added the following: The primary and alternate trim motors are each equipped with a thermal cut-off device which interrupts electrical current to the motor if that trim motor overheats. Repeated or continuous use of the trim motor may cause a thermal cutoff. After the motor cools, it will automatically restore trim function when the thermal cutoff resets. Because an overheat cutoff in one trim motor does not affect the functions of the other, if the alternate trim motor overheats, the primary trim system may be used to retrim the stabilizer; the reverse is also true. However, if the flight crew uses the primary trim system repeatedly to resist a runaway in the alternate trim system, the primary motor could overheat, and the crew may be left with a runaway alternate trim if the primary trim thermal cutoff occurs. This action could also cause both trim motors to overheat, and result in a temporarily inoperative stabilizer. Also, if a runaway trim motor overheats and stops, it could again runaway once it has cooled and the thermal cutoff resets. If the crew determines that the stabilizer is inoperative, and suspects that they may have a thermal cutoff, and if flight conditions permit, the captain may delay the diversion to an alternate airfield long enough to allow for a cooling period/thermal reset. After a reset, the crew should refer to the recommendations paragraph above. The Boeing bulletin also advised flight crews that “excessive or prolonged testing of the trim system on the ground before departure may generate enough heat to produce a thermal cutoff during routine trimming shortly after takeoff.”160 160 After the flight 261 accident, there were reports of flight crews overtesting the trim systems, causing them to overheat.

Factual Information 93 Aircraft Accident Report 1.17.3 FAA Oversight of Alaska Airlines 1.17.3.1 General The Alaska Airlines operating certificate was issued in September 1946 and was managed by the FAA’s Certificate Management Office (CMO) in Seattle, Washington. The CMO reported to the Seattle FSDO. The Seattle CMO staffing at the time of the flight 261 accident included a supervisor, five operations inspectors, and three principal inspectors: the PMI, the principal operations inspector, and the principal avionics inspector. The Seattle CMO staffing also included three geographic inspectors to assist with surveillance of Alaska Airlines: one from the Alaska Region, one from the Northwest Mountain Region, and one from the Western Pacific Region. 1.17.3.2 Preaccident FAA National Aviation Safety Inspection Program Inspection From August 13 to August 23, 1995, a nine-member FAA National Aviation Safety Inspection Program (NASIP) inspection team conducted operations and airworthiness inspections at Alaska Airlines. During the inspection, the FAA team found “potential problems [with the airline’s] systems for assuring compliance with FAR requirements” in the areas of “operations training, flight control, maintenance training programs, and contractual arrangements.” The final NASIP inspection report listed 16 noncompliance findings: 8 of the findings were related to operations, and the other 8 findings were related to airworthiness issues. Five of the operations findings were deficiencies in the flight attendant training manual, emergency drill training, and record-keeping procedures. Two operations findings were related to flight dispatcher and preflight briefings and guidance to flight crews related to weather issues. One of the airworthiness findings related to a maintenance action that was contrary to the certificate holder’s manual and the FARs. The report stated that the mechanic tested the wrong system (the system tested was not the one reported to be inoperative) and that the mechanic was “not trained and qualified to perform maintenance on…[low visibility landing] maintenance program systems.” In addition, the report noted several deficiencies related to maintenance record-keeping and replacement part storage and found that the airline’s GMM, which stated that repairs and overhauls could be conducted by another approved carrier, did “not contain a procedure, or a requirement, that will assure that the other carrier must meet the manufacturer’s approved repair procedures.” 1.17.3.3 FAA Air Transportation Oversight System Alaska Airlines transitioned from the FAA’s existing oversight system, the Program Tracking and Reporting System (PTRS), to the Air Transportation Oversight System (ATOS) in October 1998.161 According to the FAA, ATOS was designed to focus 161 The 10 largest U.S. air carriers were selected for the implementation of ATOS.

Factual Information 94 Aircraft Accident Report on “system failures” rather than “random events” and to improve the reporting and evaluation of system failures and trends for more aggressive intervention. Further, ATOS was designed to conduct inspections in 7 air carrier systems (aircraft configuration control, manuals, flight operations, personnel training and qualifications, route structure, flight rest and duty time, and technical administration), 14 air carrier subsystems, and 88 elements. The ATOS program office manager testified that the transition to ATOS at some airlines, including Alaska Airlines, was difficult because of staff levels and training issues. He stated, “I think it would have been real prudent for us maybe to have overlaid some type of transition plan when we did implement ATOS, so that maybe we had a few of those comfortable things that worked well under our traditional surveillance still available when we implemented ATOS…We didn’t really have that transition plan. We shut off the old one and started the new one.” He also stated that, although some ATOS modules were “still at a rudimentary level of development…we’re still far, far above where we were with just a compliance-based, event-based PTRS surveillance system. We have a lot better and a lot richer and a lot more robust data in that ATOS data repository right now than we’ve ever had under our traditional surveillance for these 10 carriers.” The former PMI for Alaska Airlines, who retired from the FAA in November 1999 after 8 1/2 years in that position, stated that the implementation of ATOS resulted “in a terrible transition.” He also stated the following: The first thing that happened was the geographic support that we were accustomed to getting totally disappeared. We ended up with three other offices supporting us geographically; airworthiness, avionics and an operations inspector from each region that Alaska operated into. And between them coming up here and getting training and ATOS training and learning how to understand…all this stuff, they actually…[weren’t] doing any surveillance. None of us were…we were too caught up doing ATOS things to actually go out and do any surveillance, do the system evaluations. They wouldn’t let any geographic inspectors that weren’t assigned to the carrier…look at the carrier. We used to get PTRS reports regularly from all over the field out there. We had about nine officers that were giving us geographic support. And after ATOS we ended up with about three officers, one in each region. And they were too busy doing all these complex…stuff. Nobody was out there looking at the carrier. The Seattle CMO supervisor at the time of the ATOS implementation at Alaska Airlines stated that “the amount of surveillance that we have done since the introduction of ATOS has probably generally decreased. The [ATOS] concept is great. Translating that into some real life implementation is tougher than it sounds.” 1.17.3.3.1 Seattle CMO Memorandum on Staff Shortages for Surveillance of Alaska Airlines A November 12, 1999, memorandum, from the supervisor of the FAA’s CMO in Seattle to the FAA’s Director, Flight Standards Service, stated that staffing at the Seattle CMO “has reached a critical point” and added that “to accomplish our assigned activities,

Factual Information 95 Aircraft Accident Report we require at least four additional airworthiness inspectors and one cabin safety inspector.” The memorandum noted the following: [Alaska Airlines] one of the country’s top ten air carriers, is undergoing a state of aggressive growth and expansion…We are not able to properly meet the workload demands. Alaska Airlines has expressed continued concern over our inability to serve it in a timely manner. Some program approvals have been delayed or accomplished in a rushed manner at the ‘eleventh hour’ and we anticipate this problem will intensify with time. Also, many enforcement investigations, particularly in the area of cabin safety, have been delayed as a result of resource shortages. The memorandum stated that the Seattle CMO had implemented an ATOS comprehensive surveillance plan (CSP) and that the current CSP for airworthiness consists of 50 safety attribute inspections…and 176 element performance inspections...The CSP for operations consists of 50 [safety attribute inspections] and 103 [element performance inspections]. Effective execution of the ATOS inspections requires a significant expenditure of inspector resources. In order for the Seattle FSDO [CMO] to accommodate the significant volume of Alaska Airline’s ‘demand’ work and effectively meet the objectives of the ATOS program, additional inspector staffing must be made available. The memorandum concluded that, if the Seattle CMO “continues to operate with the existing limited number of airworthiness inspectors and without a cabin safety inspector, diminished surveillance is imminent and the risk of incidents or accidents at Alaska Airlines is heightened.” A May 3, 2002, memorandum from the FAA’s Director, Flight Standards Service, in response to the Safety Board’s request for information regarding staffing changes at the Seattle CMO since the flight 261 accident indicated that the authorized staffing level had increased from 15 to 37 and that the on-board staffing level had increased from 12 to 30 and would increase to 32 by May 19, 2002.162 The memorandum indicated that the staffing included an operations research analyst and a cabin safety inspector. 1.17.3.4 FAA Postaccident Special Inspection of Alaska Airlines As a result of the flight 261 accident, the FAA conducted a special inspection of Alaska Airlines from April 3 to April 19, 2000, to determine its compliance with the FARs. The inspection team was headed by a member of the FAA’s System Process Audit staff from Washington, D.C., and team members included several FAA inspectors from the Seattle FSDO and CMO. According to the special inspection report, dated June 20, 162 The Safety Board confirmed that the Seattle CMO on-board staffing level had increased to 32 by May 19, 2002, and determined that, as of September 2002, its on-board staffing level had further increased to 35.

Factual Information 96 Aircraft Accident Report 2000,163 the 15-member inspection team focused on Alaska Airlines maintenance and operations at its SEA and OAK facilities. The special inspection report included the following findings: Lack of Management Personnel: • Director of Maintenance position has been vacant for nearly two years (since 6/12/98). Currently two individuals are sharing the position. • Director of Operations position is currently vacant. • The Director of Safety is also the Director of Quality Control and Training. This position also does not report directly to the highest level of management. Maintenance Training: • Alaska Airlines training] manual does not specify maintenance training curriculums or on-the-job training (OJT) procedures or objectives. • The OJT program is informal, and is administered at the discretion of the appointed instructors. The program is not structured, there is no identification of subjects to be covered, and there are no criteria for successful completion provided. Maintenance Program: • General Maintenance Manual (GMM) does not reflect the procedures that the company is actually using to perform maintenance on its aircraft at the company’s maintenance facilities. • The GMM does not include ‘how to’ procedures regarding heavy check planning and/or production control. • The GMM does not contain complete procedures for the issuance of an airworthiness release to an aircraft coming out of a heavy check. • Two aircraft were released to service from a ‘C’ check without the completion of all necessary paperwork. This causes the inspection team to question the completion of all work on the aircraft before [it is] issu[ed] an airworthiness release and…used in revenue service. • Spot checks of [Alaska Airlines’] shelf-life program for consumables revealed numerous discrepancies with the expiration dates that were exceeded or mislabeled. 163 Details of the FAA special inspection report were officially released in a June 2, 2000, FAA press release.

Factual Information 97 Aircraft Accident Report • Shift turnover forms (MIG-48) are not being used consistently within the company as required by the GMM. Forms that are being used are incomplete and/or missing required signatures. There were also various other methods of shift turnover forms in use within the company that are not listed in the GMM. • Numerous nonroutine work cards (MIG-4) were signed off using a company issued stamp, rather than an actual signature, as required by the GMM. • Numerous MIG-4 forms had the box checked for ‘partial work completed’ but there were no entries on the back of the card for any partial work initiated or completed. • Work cards being used for heavy checks are being modified or deleted without approval of engineering or quality control. Mechanics on the floor are making these changes on their own. • There are no procedures in the GMM on how routine and nonroutine work cards will be distributed and controlled during a heavy check. Continuous Analysis and Surveillance Program: • [Alaska Airlines] manuals do not contain facsimiles of audit checklists to be used to administer the program. • Data gathering is not continuous, but periodic. Audits are performed at 12 or 24-month intervals and an allowance for a six-month extension is available. • Audit methods and techniques do not address compliance with regulatory safety standards. Rather, audit checklists are modeled after the CASE audit program, which is a generic program that is not specifically designed or tailored for [Alaska Airlines].164 The report also stated, “the area that showed the highest potential of systems breakdowns is in the Maintenance Program (15 findings). This is probably because Alaska Airlines maintenance personnel are not following the procedures that the company has in its manuals thereby increasing the probability for errors.” The report added that “by not having a functional [continuing analysis and surveillance program], numerous other areas suffer from the lack of oversight and reform. This was evident within [Alaska Airlines]. It is controlled by the Quality Assurance department, which appears to be understaffed. Audits are not being completed in a timely manner and are incomplete, so problem areas are not being identified.” The special inspection report concluded the following: • The procedures that are in place at [Alaska Airlines] are not being followed. 164 The FAA’s former director of Flight Standards Service stated at the Safety Board’s public hearing that he was “staggered at the results of that inspection that showed that there were broad and systemic problems in the company’s continuous analysis and surveillance program.”

Factual Information 98 Aircraft Accident Report • The controls that are in place are clearly not effective, as measured by the number of findings that the team had during the inspection. • The authority and responsibilities are not very well defined. This situation is aggravated [by] the fact that three positions [the director of maintenance, the director of operations, and the director of safety] are not filled. One of the positions, [director of maintenance], is being filled by two people, but the division of duties and responsibilities has not been made in the GMM; consequently, there is confusion as to who is responsible for what tasks. • Control of the deferral system is missing. Items are being deferred without using the approved MEL [minimum equipment list]/CDL [configurations deviations list], resulting in items not being repaired for long periods of time. • Quality Control and Quality Assurance Programs are ineffective. This is evident through things such as ‘C’ check packages that are missing signatures, open work cards, partial work completed, forms incomplete, etc. The special inspection report’s final assessment of Alaska Airlines’ condition was that “most of the findings can be attributed to (a) the processes (both those in place and those that are missing) at the carrier and (b) ineffective quality control and quality assurance departments. Correcting these areas would eliminate the majority of the issues identified in this report.” The special inspection team also evaluated Alaska Airlines based on FAA criteria “for monitoring operators during periods of growth or major change.” The inspection report stated that the airline planned to add additional aircraft, “which would result in a 20 percent increase over 3 years,”165 and that the “company has a very high utilization rate, particularly with the MD-80 fleet, to accommodate its very aggressive flight schedule.” The report noted that there was an “apparent shortage of [flight] instructors” at the airline, which “will become an even more prominent issue when aircraft are added to the fleet and more flight crews are needed, along with the increase in the summer schedule.” The report further noted that because of a shortage of maintenance personnel at OAK, “contractors will be used more for accomplishing their ‘C’ checks” and that “Quality Assurance…and Quality Control…are not adequately staffed at contract maintenance facilities.” The report suggested that the key elements of Alaska Airlines’ system, including the maintenance deferrals, quality assurance and control, internal evaluation, maintenance control, and GMM “should be monitored to determine if the carrier’s system is able to support additional aircraft.” 1.17.3.4.1 FAA Proposed Suspension of Alaska Airlines’ Heavy Maintenance Authority In its June 2, 2000, press release regarding the special inspection findings, the FAA proposed the suspension of Alaska Airlines’ heavy maintenance authority. The FAA press 165 These criteria are found in handbook bulletins HBAW 98-21 and HBAT 98-36. The inspection team’s report noted that, according to these handbook bulletins, “a growth rate of 10 percent or more is high.”

Factual Information 99 Aircraft Accident Report release stated, “approximately six to seven aircraft, of the airline’s fleet of 89 aircraft, are in heavy maintenance in any given month.” The FAA stated that Alaska Airlines was working with the FAA “to correct the deficiencies outlined in the inspection.” On June 29, 2000, the FAA accepted an Airworthiness and Operations Action Plan submitted by Alaska Airlines, and its authority to conduct heavy maintenance was not suspended. 1.17.3.4.2 Alaska Airlines Airworthiness and Operations Action Plan Alaska Airlines’ June 29, 2000, Airworthiness and Operations Action Plan stated that the airline had “instituted both interim and long-term measures that will ensure that its maintenance operations meet or exceed all Federal Aviation Regulations and that all aircraft released from heavy maintenance are safe and airworthy with all maintenance properly documented.” The action plan stated that the airline had “initiated a top-to-bottom review of all operations” and was developing a continuing analysis and surveillance program “that will not only detect and correct any deficiencies in Alaska’s maintenance program, but will constantly improve the program through a process of data collection, analysis and corresponding changes.”166 The action plan stated that the Alaska Airlines maintenance training program had been reorganized to develop a “training profile for all maintenance personnel by area” and that OJT would be “standardized and formalized.” The action plan stated that Alaska Airlines would take the following actions regarding its maintenance program: audit 100 percent of the maintenance documents produced during a heavy maintenance check, for every airplane, at every location, whether accomplished in house or by an approved vendor. We also conduct random audits on every airplane during each heavy check. We analyze the findings to validate the new heavy maintenance procedures. If the analysis indicates a problem with a new procedure, it is corrected immediately…heavy maintenance procedures contained in our GMM have been completely revised utilizing a meticulous process implemented by Alaska Airlines personnel in conjunction with highly-qualified outside consultants under the supervision of the FAA. Further, the action plan stated that Alaska Airlines had “created an executive level safety position, vice president of safety, that reports directly to our CEO.” In addition, the plan stated that Alaska Airlines had created more than 130 new positions in its maintenance and engineering division, 28 new positions in its flight operations division, and 11 new positions in its safety division. The action plan also stated that new procedures and policies had been implemented to improve monitoring of contract maintenance vendors and “to ensure that all heavy maintenance performed at a vendor meets or exceeds requirements of applicable 166 A Department of Transportation (DOT) Office of the Inspector General report on FAA oversight of continuing analysis and surveillance programs, dated December 12, 2001, concluded that, if the continuing analysis and surveillance program “had been operating effectively, Alaska Airlines’ own internal monitoring process should have identified the deficiencies in its maintenance program.” The FAA acknowledged the findings in the DOT report. For more information about the DOT report, see section 1.17.3.4.4.

Factual Information 100 Aircraft Accident Report FARs and the Alaska maintenance program.” The plan added that a policies and procedures manual was developed for heavy maintenance vendors to “ensure consistency…and consideration of industry best practices. This manual provides the basis for vendor representative accountability, consistency of policies and training of new vendor representatives.” Finally, the action plan stated that Alaska Airlines had developed an internal audit program “to provide oversight of all operating departments within Alaska Airlines…[and] to develop an effective process to validate major changes to process or procedures at Alaska Airlines.” The plan stated that this internal audit would be “mandatory for flight operations, in-flight services, maintenance and engineering and airport operations.” 1.17.3.4.3 FAA Followup Evaluation During the week of September 18, 2000, the FAA conducted a focused followup evaluation of Alaska Airlines’ SEA and LAX maintenance facilities and a contract maintenance facility in Everett, Washington. According to a September 22, 2000, FAA memorandum, the purpose of the evaluation was to “assist the [FAA’s] Alaska Airlines Certificate Management Office (CMO) in completing an assessment of the carrier’s revised heavy maintenance process, nonroutine work cards (MIG-4), vendor maintenance process, quality assurance program, and continuing analysis and surveillance.” The memorandum added that “during the second day of this evaluation it was determined that the new programs were not completely implemented and the scope of the evaluation would be limited to a ‘progress check.’” The September 22, 2000, memorandum listed procedural discrepancies and several recurring findings, including the following: Alaska Airlines does record and transmit information and instructions to their counterparts for shift turnovers as required by the GMM. Two Alaska Airlines forms titled, Priority Items and Engineering Report, are being utilized during shift turnovers. Alaska Airlines has neither identified the aforementioned forms [n]or implemented procedures in their [GMM] for the use of the forms. Not all of the quality assurance (QA) auditors have been trained on the new [continuing analysis and surveillance] procedures, and the company personnel that were explaining the new [continuing analysis and surveillance] procedures to us [the evaluation team] did not appear to understand their own process of qualifying and authorizing QA auditors. There is no formal course or syllabus for [continuing analysis and surveillance] auditor training. The training program consists of only informal instruction accomplished during OJT. There are no checklists or guides being used to standardize the OJT. There are no controls or testing requirements in place to determine how much the students were comprehending and retaining.

Factual Information 101 Aircraft Accident Report The September 22, 2000, memorandum also noted that Alaska Airlines appeared not to have “implemented procedures for documenting the qualifications and authorizations of QA auditors” and that “there was a lack of standardization between facilities, both internal and external, on following the instructions for reference material attached to the MIG-4.” The memorandum concluded that “these [finding] areas should be re-visited after the manuals have been re-written, the programs have been fully implemented, and all personnel have been trained. This is projected to be in January 2001.” A September 25, 2000, FAA memorandum summarized an inspection team evaluation of Alaska Airlines’ maintenance reliability program document, which was the basis of the airline’s reliability analysis program.167 The memorandum listed irregularities concerning the document, which included that the document did not • define all of the aircraft components controlled by the program, • identify the individual responsible for analyzing trend-related information, • address the individuals responsible for conducting further analysis for corrective action of program deficiencies or negative trends as identified by the program’s analytical process, • contain a specific method to follow so that data are routed to the proper organizational element for review, • contain a method for ensuring that changes in operating flight hours or cycles as appropriate to the trend level of reliability experienced occurs, • contain a procedure to assign the appropriate personnel to find the cause of all identified areas that exceed performance standards, • contain a method for establishing extension limits, and • contain a method for determining the analysis of nonroutine maintenance work forms as a significant analytical factor in…maintenance program effectiveness. The September 25, 2000, memorandum concluded the following: Of concern is that the maintenance reliability program [document] adequately depicts an accurate portrait of the maintenance program’s total effectiveness in a single source document. And further, that changes to the maintenance as identified through the reliability program analysis, are reviewed, controlled, and FAA CMO-approved as warranted. The validity of a maintenance reliability program, as reflected in Operations Specifications, does not imply carte blanche to an operator for maintenance program changes without sufficient analytical data presented as justification. The analytical data should accompany any notice or request for a maintenance program change. Sufficient FAA guidance in publications exists in support of this assertion. 167 For a description of Alaska Airlines’ reliability analysis program, see section 1.6.3.1.3.

Factual Information 102 Aircraft Accident Report In July 2001, an FAA 12-member panel again reviewed Alaska Airlines’ progress in implementing its action plan.168 According to an FAA briefing document on the review, the review consisted of presentations by Alaska Airlines representatives, a visit by some of the panel members to Alaska Airlines’ SEA maintenance facility, and discussions about Alaska Airlines’ progress. According to the briefing document, Alaska Airlines “convincingly demonstrated [its] completion of all initiatives and commitments set forth in their action plan.” The briefing document indicated that the panel members who visited the SEA maintenance facility found that, “with one exception, Alaska Airlines technicians [had] an acceptable working knowledge of the automated General Procedures Manual.” Further, the briefing document stated that the panel had “reached a consensus that Alaska Airlines met or exceeded all commitments set forth in their action plan...[and that the airline had demonstrated] strong and visible leadership from the top executives…for safety, compliance and a strong and healthy safety culture.” The FAA briefing document stated that Alaska Airlines had added 341 maintenance positions, enhanced its internal evaluation program, created a Board of Directors’ Safety Committee “that interfaces with the director of safety,” improved General Procedures Manual written procedures, and revised “flight operations procedures and corresponding training that address critical operational control issues and the interface between maintenance and flight operations with emphasis on abnormal and emergency procedures.” The briefing document concluded that Alaska Airlines had “demonstrated…that previously identified systemic deficiencies have been corrected and verified as corrected” and that the FAA had verified “significant changes and improvements at Alaska.” The briefing document was signed by the manager of the FAA’s Northwest Mountain Region Flight Standards Division. 1.17.3.4.4 DOT Office of the Inspector General Report on FAA Oversight of Continuing Analysis and Surveillance Programs In its December 12, 2001, report on FAA oversight of continuing analysis and surveillance programs, the DOT Office of the Inspector General stated that the findings of the FAA’s postaccident inspection of Alaska Airlines “raised questions as to why the FAA’s routine surveillance had not identified the deficiencies in Alaska Airlines’ [continuing analysis and surveillance program] and ensured that they were corrected.” The DOT report stated that the FAA “needs to place greater emphasis on [continuing analysis and surveillance program] oversight” and must “ensure [that continuing analysis and surveillance program] deficiencies identified through its oversight inspections are corrected.” 168 Four of the panel members were participants in the April 2000 special inspection.

Factual Information 103 Aircraft Accident Report The DOT report added the following: The lack of effective oversight of air carriers’ [continuing analysis and surveillance programs] perpetuates a system where [the] FAA relies on its own inspections to ensure carriers maintain their aircraft in an airworthy condition. This system is ineffective because the FAA does not have sufficient resources to physically inspect every aircraft. While it is clearly the responsibility of air carriers to ensure day-to-day safe operation and maintenance of their aircraft, [the] FAA must be more proactive in identifying deficiencies in air carriers’ [continuing analysis and surveillance programs]. The DOT report also noted that to properly evaluate a maintenance program, an airline should have the following: procedures in its [continuing analysis and surveillance program] to assess aircraft mechanical performance. For example, the carrier should review data such as engine removal rates and pilot reports of mechanical disruptions to identify negative trends or premature failures. Mechanical monitoring programs can help carriers maintain reliable aircraft operating rates by identifying [the] cause of maintenance-related delays and cancellations. More importantly, a properly designed and utilized [continuing analysis and surveillance program] establishes a culture of safety with an airline’s operations. The DOT report concluded that FAA inspectors “need to better document their [continuing analysis and surveillance program] inspections” and “better train its inspectors to evaluate carriers’ [continuing analysis and surveillance programs] for systemic weaknesses.” 1.17.4 Other Safety Evaluations of Alaska Airlines 1.17.4.1 DoD Capability Survey of Alaska Airlines In September 1998, the DoD’s Air Carrier Survey and Analysis Office conducted a biennial capability survey of Alaska Airlines’ operations.169 The DoD survey report stated the following: The commendable practices we observed during the survey were Alaska Airlines’ overall training program to include the excellent crew coordination exhibited during DoD cockpit observations. Operations management conducts ongoing internal audits that include effective cross-divisional audits. Alaska’s safety program also exceeds standards with a highly motivated staff and exceptional projects like their flight operational quality assurance…program. Regarding operations management, the DoD survey report stated that Alaska Airlines had a “well-defined organizational structure, with staffing levels commensurate 169 DoD capability surveys of air carriers are part of a routine approval process for participation in the DoD’s air transportation program.

Factual Information 104 Aircraft Accident Report for their scope of operations” and “very experienced personnel in key positions with minimal management turnover.” Regarding maintenance management, the survey report stated that Alaska Airlines management provided “strong oversight of maintenance” and that “company structure and lines of authority [were] satisfactorily defined.” The report added that “excellent communications exist[ed] with both operations and mechanics.” The DoD survey report stated that Alaska Airlines had a “strong safety program that is responsive to employee inputs” and that “interaction between safety, functional managers, and unions occurs frequently through formal meetings, written communications, and informal discussion.” The survey report further stated that Alaska Airlines “[continuing analysis and surveillance] program provides strong oversight of all maintenance activities” and that a formal internal audit program provided “excellent supervision of the company’s internal maintenance functions.” The report noted that “during summer 1998, [the] carrier experienced difficulty accomplishing some heavy checks on time due to high summer operations tempo and fluctuating heavy check flow.” The report concluded that the Alaska Airlines’ operations and maintenance management and operations safety program and training “exceed [DoD] standards.” 1.17.4.2 Criminal Investigation of Alaska Airlines In October 1998, an Alaska Airlines senior lead mechanic alleged to the FAA that maintenance records had been falsified at Alaska Airlines’ OAK maintenance facility. His statements triggered a 3-year criminal investigation into the allegations by a Federal grand jury. In December 2001, Federal prosecutors stated that no charges would be filed against Alaska Airlines as a result of the investigation. 1.17.4.3 Postaccident Independent Safety Assessment of Alaska Airlines After the accident, Alaska Airlines hired a consulting firm to conduct an independent safety assessment of the airline. The firm assembled a 13-member team of subject matter experts in flight operations, hazardous materials handling, security, and maintenance and engineering. These areas included organizational structure and training, flight dispatch, crew scheduling, station and ramp operations, cabin safety, maintenance quality assurance programs, maintenance records systems, mechanical reliability reporting, and maintenance contracting. The assessment team’s inspections of Alaska Airlines were conducted from April 10 to May 19, 2000. The final safety assessment report, dated June 19, 2000, stated that the purpose of the assessment was to examine “the prevailing operational situation from a safety perspective (i.e., the ‘safety culture’) and to identify areas where Alaska Airlines’ overall operational safety and efficiencies could be enhanced or improved through strengthening or modifying existing policies, procedures or practices, or through new initiatives.” The report added that the assessment focused on “examination of safety issues from the standpoint of organizational functionality and management oversight and the evaluation of Alaska Airlines’ internal policies, procedures and practices.”

Factual Information 105 Aircraft Accident Report The safety assessment team made more than 170 recommendations that it stated were intended to “guide both strategic planning and tactical action by Alaska Airlines as they move to strengthen the foundation of an effective safety culture that anticipates the potential for problems and acts swiftly and effectively to mitigate such threats.” The recommendations suggested, in part, that Alaska Airlines develop clearer lines of managerial authority and responsibilities; increase staffing; enhance standardization of operating and training manuals; revise its GMM to clarify and update policies, responsibilities, and procedures; increase maintenance training; and create a new corporate safety department that reports directly to the highest levels of the airline. The report also recommended that Alaska Airlines appoint a vice president of corporate safety to manage the department. 1.18 Additional Information 1.18.1 Postaccident Airworthiness Directives On February 11, 2000, as a result of information gathered immediately after the flight 261 accident, the FAA issued AD 2000-03-51 to all operators of DC-9, MD-90-30, MD-88, and 717-200 series airplanes. AD 2000-03-51 stated the following: [after the Alaska Airlines crash, the] FAA…received a report from an operator that indicated two instances of metallic shavings in the vicinity of the jackscrew assembly and gimbal [acme] nut of the horizontal stabilizer. Metallic shavings in the vicinity of the horizontal stabilizer indicate excessive wear of the jackscrew assembly. Such excessive wear, if not corrected, could result in possible loss of pitch trim capability, which could result in loss of vertical control of the airplane. AD 2000-03-51 required operators to “perform a general visual inspection of the lubricating grease on the jackscrew assembly and the area directly below the jackscrew and surrounding areas for the presence of metal shavings and flakes” and to replace the assembly before further flight if shavings or flakes were found.170 The AD also required inspection and lubrication of the jackscrew assembly, “prior to the accumulation of 650 hours total time-in-service…or within 72 hours” after receipt of the AD and were to be repeated “at intervals not to exceed 650 flight hours.” In addition, AD 2000-03-51 required operators to “perform a general visual inspection of the jackscrew assembly to detect the presence of corrosion, pitting or distress” and to replace the assembly if these conditions were found. Further, the AD required an inspection of the lubrication of the jackscrew assembly, an inspection of the acme screw and nut upper and lower mechanical stops, testing of the horizontal stabilizer shutoff control, and the performance of end play checks “within 2,000 flight hours since 170 On February 11, 2000, Boeing issued ASBs for DC-9, MD-90-30, MD-88, and 717-200 series airplanes that described the “procedures for inspecting the general condition of the jackscrew assembly and the area around the jackscrew assembly to detect the presence of metal shavings and flakes.”

Factual Information 106 Aircraft Accident Report the last acme screw and nut wear check” and, thereafter, to be repeated at intervals not to exceed 2,000 flight hours. On July 28, 2000, the FAA issued AD 2000-15-15, which superseded AD 2000-03-51. AD 2000-15-15, which had an effective date of August 23, 2000, included the same requirements as AD 2000-03-15, but AD 2000-15-15 also required operators to look for the presence of metallic particles in the jackscrew assembly lubrication. The AD stated the following: Since the issuance of AD 2000-03-51, the FAA has received numerous reports of incidents in which metallic particles (including slivers and dust, as well as shavings and flakes) were found [e]mbedded within the grease on the threaded portion of the jackscrew assembly of the horizontal stabilizer actuator and on the area directly below the jackscrew assembly. Findings by the manufacturer indicate that such metallic particles can be identified as a non-magnetic metallic substance which is golden in color...in consideration of new findings by the manufacturer regarding the types of material found in the jackscrew assembly of the horizontal stabilizer since issuance of AD 2000-03-51, the FAA has determined that the required inspections should be expanded to include metallic particles such as slivers and dust, as well as the metal shavings and flakes identified in AD 2000-03-51. AD 2000-15-15 concluded that “the FAA has determined that it is necessary for operators to report the results of the end play checks” performed at the 2,000-flight-hour intervals prescribed in AD 2000-03-51 “to provide information regarding the wear rates of the jackscrew assembly.” The AD stated that the FAA would use this reported end play data “to confirm that the repetitive intervals of 650 flight hours [for the general visual inspection of the jackscrew assembly and lubrication]…and the repetitive intervals of 2,000 flight hours [for the end play checks]…are appropriate compliance times for accomplishment of the end play check and are adequate for ensuring the safety of the fleet.” 1.18.1.1 Safety Board and FAA Correspondence Regarding the 2,000-Flight -Hour End Play Check Interval Specified in ADs 2000-03-51 and 2000-15-15 In a May 14, 2001, letter to the FAA, the Safety Board indicated that the results of a February 17, 2000, end play check on a Hawaiian Airlines DC-9,171 which yielded an end play measurement of 0.043 inch after having accumulated only about 2,500 flight hours, called into question the adequacy of the 2,000-flight-hour end play check interval required by AD 2000-15-15. The Board stated that, because of the wear observed on the Hawaiian Airlines jackscrew assembly and the potential that other assemblies with higher-than-normal wear rates are in service, it was concerned that the 2,000-flight-hour end play check interval might not be adequate to ensure the safety of the fleet affected by AD 2000-15-15. The Board requested any additional information regarding the background data and analysis that the FAA used to establish the 2,000-flight-hour end 171 For more information about the Hawaiian Airlines DC-9 jackscrew assembly, see section 1.16.6.1.

Factual Information 107 Aircraft Accident Report play check interval identified in ADs 2000-03-51 and 2000-15-15 and any final or terminating actions it had identified in this case. In a June 26, 2001, letter, the FAA responded that Boeing initially recommended the 2,000-flight-hour end play check interval in ASB DC-9-27A362. The FAA stated that, while evaluating this recommendation, it had numerous discussions with Boeing regarding the acceptability of the 2,000-flight-hour interval. The FAA added the following: These discussions focused on the robust design of the acme nut, structural test data, structural analysis, existing wear rate data, and the service history of the fleet. The original Boeing wear rate data showed a wear rate of 0.001 inch per 1,000 flight hours when the jackscrew was lubricated at 400-hour intervals. The Boeing data was supplemented with recent wear rate information provided to Boeing by one of the largest MD-80 operators. These new data showed a wear rate which closely correlated with the existing Boeing wear rate but was obtained from aircraft with jackscrews that were being lubricated at approximately 940-flight-hour intervals…analysis showed that a jackscrew worn beyond 0.080-inch end play could still safely carry limit load. Based on FAA review of the analytical data and on the discussions with Boeing, we concluded that Boeing’s recommendation for endplay checks at 2,000-flight-hour intervals supported by lubrication and inspections at 650-flight-hour intervals was sufficient to produce predictable wear rates and detect worn jackscrew assemblies well before their structural capability would be compromised. In response to the Safety Board’s concern that the 2,000-flight-hour end play check interval would be inadequate to identify a jackscrew assembly that is wearing at a higher-than-normal rate, the FAA stated, in part, the following: The FAA is also concerned about jackscrews found with excessive wear rates because these are seen as indicators not only of possible improper lubrication or contaminated grease but also of a potential design problem. With one exception…the current endplay check intervals have shown to be adequate to detect jackscrews with accelerated wear rates….If [the Hawaiian Airlines] jackscrew were to have remained in service…and if it continued to wear at the same rate, the lubrication and inspections requirements of AD 2000-15-15 would have provided at least two opportunities for maintenance personnel to detect excessive wear before the next required endplay check. This is because jackscrews wearing at an excessive rate will produce an excessive amount of debris. The AD requires an inspection for debris at each lubrication interval and, if found, a requirement to perform an endplay check. Were the excessive wear not detected before the next endplay check, the jackscrew assembly with the amount of endplay identified in your letter...would retain sufficient structural capability to safely support limit load. In response to the Safety Board’s query about whether any terminating actions had been identified on this issue, the FAA stated, in part, the following:

Factual Information 108 Aircraft Accident Report The FAA has had discussions with Boeing regarding the effectiveness of the existing inspections and the appropriateness of design changes to the jackscrew assembly. To date, these discussions have yielded no firm conclusions that a design change is either appropriate or warranted. 1.18.2 Safety Board Statistical End Play Data Study The Safety Board statistically examined the end play data collected as a result of ADs 2000-03-51 and 2000-15-15. The Board received a total of 3,174 end play measurements from 1,493 airplanes at 44 operators. Because end play was measured at repeated intervals for individual jackscrew assemblies, it was possible to estimate whether the end play measurement was reliable.172 According to Boeing estimates, very little change in end play was expected to occur over the 2,000-flight-hour interval between checks because end play was expected to increase at a rate of about 0.001 inch per 1,000 flight hours. Because this expected change was small and unidirectional, the Safety Board used the test-retest method to estimate measurement reliability.173 End play measurements reported on three consecutive occasions174 for the same airplanes were compared using a correlation analysis that measures the strength of the relationship between two sets of numbers and produces a value known as the correlation coefficient (represented in notation as “r”). The correlation coefficient ranges between ±1.0.175 The correlation coefficient for the first and second measurements was +0.553 and +0.416 for the second and third measurements. The coefficients of determination, (represented in notation as “R2”), representing shared, or common, variance, were 0.306 for the first and second measurements and 0.173 for the second and third measurements, indicating low measurement reliability.176 In addition to analyzing on-wing end play measurements collected as a result of ADs 2000-03-51 and 2000-15-15, a second portion of the end play data study focused on 172 Reliability refers to the ability of a measurement tool to yield reproducible results. 173 Measurement reliability is often assessed using a test-retest method in which two consecutive measurements are recorded and, if the entity being measured has not changed (or has changed in a consistent manner) during the measurement interval, subsequent correlation of the two measurements should reveal a strong relationship. The absence of such a correlation suggests that other variables, such as measurement error, may have caused variability in the observed measurement. 174 After screening the data for errors (missing data, duplicate cases, multiple measurement conventions, incorrect flight hours, and incorrect fuselage numbers), the resulting set contained 1,388 cases at the first measurement; 852 cases at the second measurement; and 482 cases at the third measurement. 175 A coefficient of +1.0, known as a perfect positive correlation, means that in each case changes in one measurement resulted in an identical change in the other measurement. A coefficient of -1.0, known as a perfect negative correlation, means that changes in one measurement resulted in an identical change in the other measurement but that the change was in the opposite direction. A coefficient of 0 means that no relationship existed between the two measurements and that changes in one measurement had no effect on the second measurement. 176 Two alternative test-retest analyses that accounted for varying time intervals between checks for individual aircraft were performed and yielded similar results.

Factual Information 109 Aircraft Accident Report an examination of a small subset of cases in which both on-wing and bench-check end play measurement data were available. Boeing collected and reported data on jackscrew assemblies that were returned to Integrated Aerospace during 2000. Integrated Aerospace reported that 157 jackscrew assemblies were returned for overhaul during the 2000 calendar year, a marked increase over those received in previous years,177 and likely affected by the AD requiring end play checks for the entire fleet of DC-9, MD-90-30, MD-88, and 717-200 series airplanes. Of the 157 jackscrew assemblies, 49 were removed because of end play measurements that exceeded operators’ criteria for removal. Other reasons for removal included the presence of metal flakes, excessive free play, or damage to the assembly. Jackscrew assemblies returned to Integrated Aerospace are cleaned and then bench end play checks are conducted. Because some of the conditions that can create variation in the end play measurement are controlled during bench checks, they are expected to yield more accurate end play measurements than on-wing checks conducted by maintenance personnel. Of the 157 jackscrew assemblies removed in 2000, bench end play checks for 142 of the assemblies resulted in end play measurements that fell within in-service end play tolerances (between 0.003 and 0.040 inch). Twelve assemblies had bench-check end play measurements greater than 0.040 inch. No bench-check end play measurements were reported for three assemblies. Boeing contacted operators and obtained a matched sample (both on-wing and bench-check end play measurements) for 64 jackscrew assemblies. After correcting documentation errors, the Safety Board calculated the difference in end play measurements between the on-wing and the bench-check settings. In 45 of the 64 cases (70.3 percent), the on-wing end play measurements were higher than the bench-check measurements; in 6 of the 64 cases (9.4 percent), the on-wing and bench-check end play measurements were equal; and in 13 of the 64 cases (20.3 percent), the on-wing end play measurements were lower than the bench-check measurements. After removing one outlier,178 the validity of the on-wing end play measurement was approximated using a correlation analysis between the on-wing and bench-check end play measurements.179 The analysis determined that the resulting correlation coefficient was +0.442 (R2=0.195), suggesting low measurement validity. The Safety Board end play data study report, dated March 18, 2002, concluded, “in the absence of additional information such as the rate of acme nut wear and the thread thickness at which failure may occur, the observed level of measurement error raises doubts about the utility of the existing end play measurement procedure.” 177 According to Integrated Aerospace records, 59 jackscrew assemblies were returned in 1999, 54 in 1998, 59 in 1997, and 42 in 1996. 178 An outlier is an extreme measurement that is not representative of the rest of the data set. 179 This method assumed that the bench-check end play measurement was a criterion, or a standard, that represented the true end play in the jackscrew assembly. If the on-wing end play measurement is valid (representing the actual state of end play), then the correlation coefficient representing the relationship between the on-wing and bench-check end play measurements should be close to +1.0.

Factual Information 110 Aircraft Accident Report 1.18.3 Previous Safety Recommendations Resulting from the Alaska Airlines Flight 261 Investigation On October 1, 2001, the Safety Board issued Safety Recommendations A-01-41 through -48. In the safety recommendation letter, the Board expressed concern that lubrication procedures for the acme screw and nut were not sufficient to ensure thorough lubrications and that end play check procedures were not adequate to ensure accurate measurements of acme screw and nut wear. In addition, the Board expressed concern that use of an inappropriate grease type or a mixture of incompatible grease types could cause adverse effects and that technical information and practical experience about aviation lubrication was not being shared by the aviation industry. Safety Recommendation A-01-41 asked the FAA to do the following: Require the Boeing Commercial Airplane Group to revise the lubrication procedure for the horizontal stabilizer trim system of Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 series airplanes to minimize the probability of inadequate lubrication. In a December 12, 2001, response letter, the FAA stated that it agreed with the intent of Safety Recommendation A-01-41 and that it was “working with the Boeing Commercial Airplane Group to rewrite the lubrication procedures to the optimal standard.” The FAA also stated that it was “evaluating the necessity of an additional task to perform a detailed inspection of the lubricant at a ‘C’ check interval to check for indications of metal shavings.” On June 14, 2002, the Safety Board classified Safety Recommendation A-01-41 “Open—Acceptable Response,” pending the revisions to the lubrication procedure for the horizontal stabilizer trim system of DC-9, MD-80/90, and 717 series airplanes. On July 25, 2002, Boeing representatives provided the Board with a briefing on new lubrication procedures currently being developed and tested. Safety Recommendation A-01-42 asked the FAA to do the following: Require the Boeing Commercial Airplane Group to revise the end play check procedure for the horizontal stabilizer trim system of Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 series airplanes to minimize the probability of measurement error and conduct a study to empirically validate the revised procedure against an appropriate physical standard of actual acme screw and acme nut wear. This study should also establish that the procedure produces a measurement that is reliable when conducted on-wing. In its December 2001 response letter, the FAA stated that it agreed with the intent of Safety Recommendation A-01-42 and that it had asked Boeing to “revise the end play check procedure…to minimize the probability of measurement error.” The FAA further stated that it had asked Boeing “to conduct a study to validate the revised procedure empirically against an appropriate physical standard of actual acme screw and acme nut

Factual Information 111 Aircraft Accident Report wear. The study will also establish procedures that produce a measurement that is reliable when conducted on-wing.” On June 14, 2002, the Safety Board classified Safety Recommendation A-01-42 “Open—Acceptable Response,” pending the revisions to the end play check procedure and the validation of the revised procedure. On July 25, 2002, Boeing representatives provided the Board with a briefing on revised end play check procedures currently being developed and tested. Safety Recommendation A-01-43 asked the FAA to do the following: Require maintenance personnel who lubricate the horizontal stabilizer trim system of Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 series airplanes to undergo specialized training for this task. Safety Recommendation A-01-44 asked the FAA to do the following: Require maintenance personnel who inspect the horizontal stabilizer trim system of Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 series airplanes to undergo specialized training for this task. This training should include familiarization with the selection, inspection, and proper use of the tooling to perform the end play check. In its December 2001 response letter, the FAA stated that it believed that “current regulatory requirements of 14 CFR 121.375 adequately address maintenance training programs.” The FAA added that the agency was “revising [AC] 120-16C, Continuous Airworthiness Maintenance Programs, to expand the intent of the requirement for maintenance training programs.” The FAA stated that the AC revisions would address basic training, initial training, recurrent training, specialized training, vendor training, and competence-based training. In addition, the FAA asserted that “current regulatory requirements of 14 CFR 65.81 and 14 CFR 65.103 adequately address the inspection requirements for maintenance personnel and repairmen.” The FAA concluded that “current regulatory requirements in place to require maintenance training programs and inspection requirements for maintenance personnel and repairmen address the full intent of these safety recommendations.” In its June 14, 2002, response letter to the FAA, the Safety Board stated that it “continues to believe that current FAA regulations do not result in maintenance personnel being properly trained to perform lubrication and end play inspection of the acme screw and nut assembly” and urged the FAA to reconsider its position. The Board classified Safety Recommendations A-01-43 and -44 “Open—Unacceptable Response,” pending accomplishment of the recommended actions.

Factual Information 112 Aircraft Accident Report Safety Recommendation A-01-45 asked the FAA to do the following: Before the implementation of any proposed changes in allowable lubrication applications for critical aircraft systems, require operators to supply to the FAA technical data (including performance information and test results) demonstrating that the proposed changes will not present any potential hazards and obtain approval of the proposed changes from the principal maintenance inspector and concurrence from the FAA applicable [Aircraft Certification Office]. Safety Recommendation A-01-46 asked the FAA to do the following: Issue guidance to principal maintenance inspectors to notify all operators about the potential hazards of using inappropriate grease types and mixing incompatible grease types. In its December 2001 response letter, the FAA stated that it was “issuing a flight standards information bulletin to address these safety recommendations.” The FAA added that the bulletin would do the following: provide inspectors with guidance on processing an operator’s proposed substitution of a lubricant or a lubrication application method change. The bulletin will direct aviation safety inspectors to request that the operator supply technical data on the substitute lubricant or [lubrication application method change] that affects critical aircraft systems and include performance information, along with test results, demonstrating that the proposed change will not present any potential hazard. The bulletin will also direct aviation safety inspectors to have the analysis test data reviewed by the appropriate FAA Aircraft Certification Office to determine if the substitute lubricant meets the required specifications. In addition, the FAA stated that it was “incorporating a revision in Order 8300.10, Airworthiness Inspector’s Handbook, to state that if there is any doubt as to the soundness of the request, the aviation safety inspector should coordinate the request with the appropriate Aircraft Certification Office.” In an April 2, 2002, letter, the FAA further responded to Safety Recommendations A-01-45 and -46, stating that, on February 15, 2002, it had issued Flight Standards Information Bulletin for Airworthiness (FSAW) 02-02, “The Potential Adverse Effects of Grease Substitution” and revised Order 8300.10 per its previous letter. On July 29, 2002, the Safety Board classified Safety Recommendations A-01-45 and -46 “Closed—Acceptable Action” based on the issuance of FSAW 02-02 and the revisions to Order 8300.10. Safety Recommendation A-01-47 asked the FAA to do the following: Survey all operators to identify any lubrication practices that deviate from those specified in the manufacturer’s airplane maintenance manual, determine whether any of those deviations involve the current use of inappropriate grease types or incompatible grease mixtures on critical aircraft systems and, if so, eliminate the use of any such inappropriate grease types or incompatible mixtures.

Factual Information 113 Aircraft Accident Report Safety Recommendation A-01-48 asked the FAA to do the following: Within the next 120 days, convene an industrywide forum to disseminate information about and discuss issues pertaining to the lubrication of aircraft components, including the qualification, selection, application methods, performance, inspection, testing, and incompatibility of grease types used on aircraft components. In its December 2001 response letter, the FAA stated that it agreed with the intent of Safety Recommendations A-01-47 and -48 and had scheduled an FAA/industry forum that would include “representatives from domestic and international airlines [and] will address the issues raised in these safety recommendations.” The FAA/industry forum was held in January 2002. In its June 14, 2002, response letter to the FAA, the Safety Board requested that the FAA provide copies of any proceedings or recommendations that resulted from the FAA/industry forum.180 The Board also requested that the FAA indicate whether it was able to survey all operators’ lubrication practices, as called for in Safety Recommendation A-01-47, and to describe any long-term actions planned as a result of the forum. Pending receipt of the requested information, the Board classified Safety Recommendations A-01-47 and -48 “Open—Acceptable Response.” 1.18.4 Alaska Airlines Fleetwide MD-80 Jackscrew Assembly Data and Tracking History Alaska Airlines and Boeing provided data to the Safety Board so that it could produce a complete inventory of all jackscrew assemblies used in the Alaska Airlines fleet. The data included the tail numbers of the airplanes in which the jackscrew assemblies were installed, information about whether the airplanes were original airline airplanes, the date that the airplanes were delivered to Alaska Airlines, the total flight hours on the jackscrew assemblies, the bench-check end play measurements for the jackscrew assemblies,181 the date of removal and replacement of the jackscrew assemblies, and the computed wear rate of the jackscrew assemblies. The data indicated that three jackscrew assemblies, including the accident assembly and the assemblies from N981AS and N982AS, had excessive wear rates. According to maintenance records and information provided by Alaska Airlines, the 180 FSAW 02-02C, “The Potential Adverse Effects of Grease Substitution,” (amended on May 22, 2002) stated that presentations at the FAA/industry forum indicated that “there have been no equipment failures attributed to changing greases when lubrication practices (lubrication type, frequency, and technique) are per the original equipment manufacturer’s recommendations; and each lubrication point is properly purged” and that “when properly purged, the resulting intermixing of greases does not pose an airworthiness concern. However, the lack of lubrication can result in damage to mechanisms that require lubrication for normal operation.” 181 Most of the end play measurements were taken during bench checks after the jackscrew assemblies were removed. If no bench-check end play measurements could be obtained, the measurement from the most recent on-wing end play check was used.

Factual Information 114 Aircraft Accident Report jackscrew assemblies from N981AS and N982AS received their most recent lubrications at Alaska Airlines’ maintenance facility at OAK (during C checks) and the lubrications before that at its maintenance facility at SFO.182 N981AS On February 9, 2000, metal shavings were found in another Alaska Airlines MD-83, N981AS, during a fleet inspection in Portland, Oregon. An on-wing end play check was performed on N981AS, and the end play measurement was 0.055 inch. At the time of the end play check, the airplane had accumulated 10,201 flight hours. The jackscrew assembly was removed and sent to the Safety Board’s Materials Laboratory for examination. Safety Board investigators found metal shavings, some measuring 1/8 to 1/4 inch long, in the area directly beneath the acme screw and in the grease on the acme screw. Several semicircular shavings about 2 1/5 inches long were also found. After the assembly was cleaned, an end play check was performed; the end play measurement was 0.053 inch in a loaded condition. N982AS Also on February 9, 2000, metal shavings were found in an Alaska Airlines MD-83, N982AS, during a fleet inspection at SEA. Several on-wing end play checks were performed on N982AS, which had accumulated 9,980 flight hours. At a torque of 275 inch-pounds, the end play measurements were 0.0510, 0.0525, and 0.0525 inch on three successive attempts. At a torque of 250 inch-pounds, the end play measurement was 0.082 inch on three successive attempts. The jackscrew assembly was removed and sent to the Safety Board’s Materials Laboratory for examination. Safety Board investigators found metal shavings, some measuring 1/8 inch long, in the area directly beneath the acme screw and in the grease on the acme screw. A semicircular shaving about 2 1/5 inches long was also found. After the assembly was cleaned, an end play check was performed; the end play measurement was 0.048 inch in a loaded condition. The data also indicated that, in 1999, Alaska Airlines had removed and replaced the jackscrew assemblies from the following MD-80s in its fleet: N947AS, N975AS, and N951AS. N947AS Jackscrew assembly S/N DCA 1935 was removed from N947AS in June 1999 at Alaska Airlines’ OAK maintenance facility during a 30,000-flight-hour check because of excessive wear. N947AS was delivered new to Alaska Airlines in December 1990. At the 182 As previously mentioned, the accident jackscrew assembly received its last lubrication at Alaska Airlines’ SFO maintenance facility. According to Alaska Airlines, nearly all of its MD-80s had received at least one jackscrew assembly lubrication at its SFO or OAK maintenance facility during the 3 years before the flight 261 accident.

Factual Information 115 Aircraft Accident Report time of the jackscrew assembly removal, N947AS had accumulated 27,860 flight hours (15,906 flight cycles). No end play measurements were recorded. However, a bench end play check conducted at Trig Aerospace (currently Integrated Aerospace) on February 27, 2000, indicated an end play measurement of 0.029 inch. N975AS Jackscrew assembly S/N DCA 2272 was removed from N975AS on November 17, 1999, at Alaska Airlines’ OAK maintenance facility during a C check because the assembly had a 0.042-inch end play measurement. N975AS was delivered new to Alaska Airlines in May 1994. At the time of the jackscrew assembly removal, N975AS had accumulated 19,960 flight hours (10,786 flight cycles). Mitchell Aircraft Spares had jackscrew assembly DCA 2272 overhauled by Aerotron AirPower on January 17, 2000. Assembly DCA 2272 was repurchased by Alaska Airlines and sent to Trig Aerospace with an order stating that the unit “needs overhaul to bring to serviceable condition.” The assembly was overhauled by Trig Aerospace on February 27, 2000, according to specifications outlined in the Boeing/Douglas Overhaul Maintenance Manual 27-41-1, revision 24, dated April 15, 1998. N951AS Jackscrew assembly S/N “AC951” was removed from N951AS on November 26, 1999, by Aviation Management Systems, Phoenix, Arizona, during a 30,000-flight-hour check because the assembly had a 0.045-inch end play measurement. Alaska Airlines purchased N951AS from JetAmerica in October 1987. At the time of the jackscrew assembly removal, N951AS had accumulated 52,894 flight hours (30,284 flight cycles). No maintenance history or information about the jackscrew assembly before or after the acquisition was found. According to records from a computer-based, statistical component reliability (or alert) program that Alaska Airlines used to track the purchasing of appliances, parts, and components, the airline had not replaced a jackscrew assembly on any airplanes in its MD-80 fleet until 1999.183 The Alaska Airlines director of reliability and maintenance programs testified at the Safety Board’s public hearing that the program, which began in 1995, tracks components “at a rate of 1,000 unit hours in service.” Alaska Airlines’ reliability analysis program database indicated that the airline had purchased three replacement jackscrew assemblies in 1999. After replacement of the first jackscrew assembly in June 1999, Alaska Airlines began tracking jackscrew assemblies as rotable components.184 No earlier maintenance histories (for example, overhaul status, last maintenance, and vendor tear down reports) were available for Alaska Airlines’ jackscrew assemblies. 183 Alaska Airlines started operating MD-80s in 1985.

Factual Information 116 Aircraft Accident Report 1.18.5 MD-11 Jackscrew Assembly Acme Nut Wear History In 1995, five operators of McDonnell Douglas MD-11 (MD-11) airplanes reported excessive wear of acme nuts on these airplanes. Subsequent investigations by McDonnell Douglas and operators determined that the excessive wear was a result of improper acme screw thread surface finish.185 On the basis of this evidence, McDonnell Douglas issued Service Bulletin (SB) MD11-27-067 on July 31, 1997, which provided instructions for measurement, inspection for excessive wear on the actuator assemblies, and repair and replacement, if necessary. In 1998, another MD-11 operator reported that the acme nut threads on one jackscrew assembly had completely worn away. Boeing determined that this excessive wear was also a result of improper acme screw thread surface finish. The trim system was rendered inoperative by the subsequent failure of the shear pins installed in the drive mechanism that connects the two acme nuts. As a result of this incident, on November 19, 1999, SB MD11-27-067 was escalated to an “Alert” status (ASB MD11-27A-067, revision 5). The summary section of the ASB stated, “If not corrected, this condition, in conjunction with a failure of the opposite side jackscrew assembly, could result in a free horizontal stabilizer that would cause loss of airplane pitch control.” On July 30, 1998, the FAA issued an AD that reiterated this concern and required MD-11 operators to comply with ASB MD11-27A-067. 1.18.6 Safety Board Observations of Jackscrew Assembly Lubrications Safety Board investigators observed lubrications of jackscrew assemblies performed by maintenance personnel from two MD-80 operators and discussed the lubrication procedure with these and other maintenance personnel from these operators. Investigators observed that different methods were used by maintenance personnel to accomplish certain steps in the lubrication procedure, including the manner in which grease was applied to the acme nut fitting and the acme screw186 and the number of times the trim system was cycled to distribute the grease immediately after its application. In addition, Safety Board investigators who attempted to perform the lubrication procedure noted that, because of the access panel’s size, it could be difficult to insert a hand into the access panel and that after a hand was inserted, it blocked their view of the jackscrew assembly, thereby requiring them to accomplish the task primarily by “feel.” 184 Before its first jackscrew assembly replacement in June 1999, Alaska Airlines tracked the assemblies as nonstocked items. After the first jackscrew assembly replacement, the assemblies were added to the airline’s reliability program rotable component statistical alerting system. Rotables are parts and appliances that are economically repairable and are periodically overhauled to a fully serviceable condition. These parts and appliances have specific requirements to track time and location at a serialized level. 185 No evidence of improper surface finish was found on the accident acme screw threads. For details about the accident acme screw thread surface finish, see section 1.16.2.2. 186The various grease application procedures included the use of a brush, a grease gun nozzle, a glove, a bare hand, or a rag.

Factual Information 117 Aircraft Accident Report A lubrication test performed under Safety Board supervision determined that, when only the grease fitting was lubricated, grease went into the top six or seven acme nut threads before extruding out of the top of the nut. Grease began to extrude out of the top of the acme nut after seven pumps of the grease gun. Lubricating the acme nut through the grease fitting did not provide lubrication to all of the acme screw and nut pressure flanks. Demonstrations187 designed to compare the effectiveness of various methods of lubricating the acme screw and nut assembly found that a thorough application of grease onto the entire length of the acme screw, followed by the cycling of the trim several times, maximized the distribution of lubrication on the acme nut threads. Several of the methods observed by or reported to Safety Board investigators did not involve either the application of grease to the entire length of the acme screw or cycling of the trim several times. 1.18.7 End Play Check Anomalies 1.18.7.1 Safety Board End Play Check Observations Safety Board investigators observed end play checks performed by maintenance personnel from several MD-80 operators, including Alaska Airlines (at its OAK maintenance facility),188 and observed bench end play checks performed by Integrated Aerospace. Results of hundreds of end play checks submitted to the FAA in accordance with ADs 2000-03-51 and 2000-15-15 were also reviewed.189 In its October 2001 safety recommendation letter, the Safety Board noted that the accuracy of the end play results could be affected by deviations in one or more of the following areas: (1) calibration and interpretation of the dial indicator; (2) installation of the dial indicator; (3) application and direction of the specified torque to the restraining fixture;190 (4) calibration of the torque wrench; (5) fabrication, lubrication, and maintenance of the restraining fixture; (6) rotation of the acme screw within its gearbox during the procedure;191 and (7) the individual mechanic’s knowledge of the procedures. 187 The demonstrations involved the use of acme nuts manufactured from a transparent plastic, which allowed a view of the acme nut threads during lubrication and operation of an acme screw being rotated through the nut under a static load. 188 In March 2000, Safety Board investigators observed jackscrew assembly end play checks on N932AS, which was undergoing a 17-day C check. The end play check was performed by two sets of mechanics and inspectors. 189 As stated previously, AD 2000 15-15 requires all U.S. operators of DC-9, MD-80/90, and 717 series airplanes to perform end play checks every 2,000 flight hours and report the end play measurements to the manufacturer after every check. Before the flight 261 accident, operators performed end play checks at various intervals, all but one of which exceeded 2,000 hours. These intervals were based on each airline’s maintenance program and were approved by the airline’s PMI. For more information about AD 2000-15-15 and the Safety Board’s statistical end play data study, see sections 1.18.1 and 1.18.2, respectively. 190 Torquing the restraining fixture in the wrong direction results in end play measurements of 0. 191 Rotation of the acme screw can effect the movement of the dial indicator plunger and cause higher end play readings.

Factual Information 118 Aircraft Accident Report During some of the end play check observations, Safety Board investigators evaluated different methods of accomplishing the end play check procedure. Investigators observed that, when the dial indicator was mounted above the acme nut instead of below it (as is called for in the current end play check procedure), the dial indicator was easier to install, its face could be seen more easily (without the need for an inspection mirror, as was the case when it was installed below the acme nut), and the end play measurement could be more easily discerned from the movement of the indicator needle.192 Investigators also observed that, when the dial indicator was mounted such that the plunger contacted the canted surface of the acme nut stop lug at a skewed angle to the plunger axis, the end play measurement was lower than it was when it contacted a level surface on the acme nut at a right angle to the plunger axis. On April 13 and November 20, 2000, Boeing issued revisions to the end play check procedure.193 1.18.7.2 Postaccident Alaska Airlines-Reported Near-Zero End Play Measurements In March and April 2002, Alaska Airlines removed two jackscrew assemblies from MD-80 airplanes in its fleet following near-zero end play measurements. One jackscrew assembly was removed after a scheduled end play check at Alaska Airlines’ maintenance facility at OAK, and the other assembly was removed during a scheduled C check at a contract facility near SEA. Both jackscrew assemblies were removed because of reported end play measurements of 0.001 inch during all iterations of the end play check.194 Safety Board investigators examined these jackscrew assemblies and determined that the end play measurements were actually higher (within normal and expected limits) and that the 0.001-inch end play measurements were caused by procedural errors made by maintenance personnel while performing the end play check procedure.195 Specifically, the investigators determined that the maintenance personnel must have torqued the restraining fixture in the wrong direction before measuring the end play. After these two anomalous end play measurements,196 the FAA conducted followup inspections at the two facilities. According to the FAA inspectors, all of the restraining fixtures, torque wrenches, and dial indicators used to perform the end play 192 When the dial indicator was mounted below the acme nut, as called for in the current procedure, the dial indicator plunger moved upward as the acme nut moved, causing the needle to move counter-clockwise, or opposite the intended direction. This movement required maintenance personnel to read the dial indicator backward and interpret the total needle movement to obtain the end play measurement. 193 For more information about Boeing’s revisions to the end play check procedure, see section 1.6.3.3.2.1. 194 The end play check was reiterated about eight times on the jackscrew assembly removed at OAK and about six times on the jackscrew assembly removed at the contract facility near SEA. 195 A Safety Board examination of the bore of the acme nut from one of the jackscrew assemblies revealed the presence of green grease near the grease fitting entrance and red grease along the bore in all other locations. Grease samples taken from the other jackscrew assembly, from various locations along the acme screw threads immediately above and below the acme nut, exhibited the appearance of a mixture of green and red grease. 196 Because the manufacturing specifications require a minimum end play of 0.003 inch, the 0.001-inch end play measurements were considered anomalous.

Factual Information 119 Aircraft Accident Report checks were the correct tools and properly calibrated. Further, FAA inspectors indicated that, before these anomalous end play measurements were reported, Alaska Airlines had provided 4 hours of specialized training to all maintenance personnel who perform end play checks at these two facilities. The specialized training focused on how to properly conduct the end play check procedure. According to Boeing, during the 6-month period from December 2001 to May 2002, six end play measurements of less than 0.004 inch were reported, not including the two 0.001-inch end play measurements reported by Alaska Airlines. 1.18.8 Jackscrew Assembly Overhaul Information 1.18.8.1 Jackscrew Overhaul Specifications and Authority Airlines and maintenance facilities that have been issued class 1 accessory ratings under 14 CFR 145.31(f) can overhaul jackscrew assemblies without additional FAA authorization. A class 1 accessory rating authorizes the holder to repair and alter “mechanical accessories that depend on friction, hydraulics, mechanical linkage, or pneumatic pressure for operation, including aircraft wheel brakes, mechanically driven pumps, carburetors, aircraft wheel assemblies, shock absorber struts and hydraulic servo units.” According to Boeing, Integrated Aerospace is the only contract facility it uses to perform jackscrew assembly overhauls.197 When Integrated Aerospace receives a jackscrew assembly with an end play measurement greater than 0.015 inch,198 it will discard the acme nut and gimbal ring assembly, check that the dimensions of the acme screw are within tolerances, mate a new acme nut and gimbal ring to the acme screw, and assign a new S/N to the nut assembly.199 Following the buildup of the jackscrew assembly, Boeing requires that the overhauled assembly be functionally tested in a weighted fixture after the assembly is temporarily outfitted to additionally support hardware and electric motors. Boeing also requires new jackscrew assemblies to undergo an operational test in the same test fixture. 197 The instructions and specifications Boeing requires of its maintenance facilities are contained in a service rework drawing. Before the flight 261 accident, information collected from numerous production drawings and proprietary documents formed the basis for the rework instructions. Following the accident, the FAA required Boeing to more formally organize the rework procedures, which resulted in Boeing’s publication of the service rework drawing. Integrated Aerospace was the only maintenance facility to possess the drawing. According to Boeing officials, the drawing is proprietary to ensure that the company maintains confidence and control over the precise machining tolerances required. 198 Jackscrew assemblies may also be overhauled because of excessive free play or damage to the lower mechanical stop because of an electric shutoff failure or misrigging. Not all jackscrew assemblies submitted for overhaul have a high degree of acme nut thread wear. 199 According to Boeing, the installation of the gimbal ring supports involves precision machining at tolerances as small as five ten-thousandths of an inch to ensure that the alignment of the fastener bores within the gimbal ring supports, the gimbal rings, and the acme nut are adequate to maintain the integrity of the dual load path design.

Factual Information 120 Aircraft Accident Report 1.18.8.2 Review of the Boeing DC-9 Overhaul Maintenance Manual The Safety Board reviewed the section of the Boeing DC-9 Overhaul Maintenance Manual (in 27-41-1, revision 24, dated April 15, 1998, which was not required to be approved by the FAA) titled, “Horizontal Stabilizer Actuator Control Installation.” The following observations were noted: • The manual contained no requirements to functionally test overhauled jackscrew assemblies in a weighted fixture after the assembly is temporarily outfitted to additionally support hardware and electric motors nor to undergo an operational test in the same test fixture, as was required by maintenance facilities per Boeing’s service rework drawing. • The manual contained no requirement for the use of work cards documenting the tasks for overhaul. • The manual provided no procedures nor equipment listings for bench-check end play measurements. • The manual contained no requirement to document the bench-check end play measurement after overhaul nor to ensure that the receiver of the overhauled unit was provided with the measurement. • The manual contained a requirement that, if the axial end play measurement exceeded 0.040 inch, the “nut assembly” (defined in the manual as “the acme screw, acme nut, and gimbal ring support assembly”) must be replaced. The manual stipulated that the replacement nut assembly could be new (purchased from Boeing with an end play measurement of between 0.003 and 0.010 inch) or used (with an end play measurement of 0.040 inch or lower). The manual also stated that the overhaul shop could send nut assemblies to Boeing for overhaul. • The manual contained instructions to check the jackscrew assembly on-wing every 1,000 flight hours if the measured bench-check end play measurement was “between 0.0340 and 0.0390 inch.” No such requirement exists in the airplane maintenance manual, which is used by operators. • The manual contained no procedures or equipment listings pertaining to the surface finish of the acme screw threads. No mention was made of the importance of proper acme screw thread surface finish. • The manual provided no detail on how to apply grease to the jackscrew assembly. • The manual did not specify which type of grease should be used to lubricate the acme screw and nut or other assembly components, including the torque tube and gearbox. • The manual did not specify how to pack the jackscrew assembly for immediate shipping after overhaul; protective packaging instructions were given only for units going into “storage.”

Factual Information 121 Aircraft Accident Report 1.18.8.3 Safety Board Maintenance Facility Observations Safety Board investigators visited Integrated Aerospace and three other FAA Part 145 maintenance facilities that overhaul jackscrew assemblies. The visits revealed that two of the three maintenance facilities had self-imposed end play measurement limits at which the acme nut had to be replaced. One maintenance facility’s end play measurement limit was 0.025 inch; the other maintenance facility’s limit was 0.030 inch. The third maintenance facility had no self-imposed limit at which the acme nut had to be replaced; however, if the end play measurement was less than 0.040 inch, the maintenance facility would return the overhauled assembly to the customer. The Safety Board’s visits also revealed that the maintenance facilities (except for Integrated Aerospace) performed the end play check using different methods. One maintenance facility used a unique, fabricated, self-contained fixture200 that exerted a force on the acme nut and eliminated acme screw rotation. The end play measurement was taken by a direct dial indicator reading. Another maintenance facility placed the jackscrew assembly on a wooden cradle and moved the acme nut by hand onto the screw while observing a dial indicator. The last maintenance facility used a magnet to hold the dial indicator in place on the acme screw while the nut was held on a table by hand as the end play was checked manually. Only Integrated Aerospace recorded the received and final end play measurements and used a detailed set of work cards to document each step in the overhaul process. The other maintenance facilities documented only that an assembly had been overhauled and used the DC-9 Overhaul Maintenance Manual. Further, two of the four maintenance facilities (not Integrated Aerospace) used subcontractors to apply the black-oxide coating on the acme screw and to ensure that the acme screw thread surface finish met specifications. The FAA PMI assigned to one of the maintenance facilities stated that he was not aware that the maintenance facility performed overhauls of DC-9 jackscrew assemblies until the facility informed him that it had received a suspect assembly from a foreign airline. Representatives of the maintenance facility stated that they overhauled about six jackscrew assemblies per year and that their customers included aircraft parts brokers and foreign airlines. Representatives of another maintenance facility stated that the jackscrew assemblies were not typically lubricated after overhaul.201 Representatives of the last maintenance facility indicated that they did not pack the assembly for storage as specified by the DC-9 Overhaul Maintenance Manual because the overhauled assembly was shipped out immediately and not put into storage.202 This maintenance facility’s operators stated that they did not track assemblies after shipment to determine if overhauled assemblies would be stored for long periods of time by parts brokers or airlines. 200 The fixture was not referenced in the DC-9 Overhaul Maintenance Manual. 201 The DC-9 Overhaul Maintenance Manual instructions call for lubrication of overhauled units. 202 The storage procedures in the DC-9 Overhaul Maintenance Manual stipulated that jackscrew assemblies be wrapped in barrier material and heat sealed and that 80 percent of the air be evacuated from the wrapping. The manual contained no instructions for packing jackscrew assemblies for shipping.

Factual Information 122 Aircraft Accident Report Safety Board investigators also visited an aircraft parts broker in southern California on February 24, 2001. The broker was listed on an “ILS” subscription listing of organizations that sell jackscrew assemblies and other aircraft components.203 Investigators examined a recently overhauled acme screw in stock. The jackscrew assembly was stored in an open cardboard box and was wrapped loosely in plastic. Documents that accompanied the assembly indicated that it had been overhauled by a maintenance facility located in the Los Angeles area in November 2000 because of a broken upper mechanical stop. The documents did not contain end play measurements or information about the overhaul. The assembly had red grease on it. 1.18.8.4 Overhauled Jackscrew Assembly Data From 1996 to 1999 Boeing provided the Safety Board with bench-check end play measurement data of all jackscrew assemblies that had been shipped to Integrated Aerospace for overhaul from 1996 to 1999. A review of the data indicated that, out of a total of 214 jackscrew assemblies, 13 had a recorded bench-check end play measurement of 0.045 inch or greater, and 5 had a recorded bench-check end play measurement of 0.055 inch or greater. One jackscrew assembly had a recorded bench-check end play measurement of 0.075 inch, which was the highest measurement reported to investigators during the investigation. According to Delta Air Lines representatives, the jackscrew assembly (S/N DCA 2239) with the 0.075-inch end play measurement was originally installed on an MD-88 airplane that was delivered new to Delta Air Lines from McDonnell Douglas on March 17, 1993. An on-wing end play check conducted on July 18, 1999, yielded the 0.075-inch end play measurement, and Delta Air Lines removed the jackscrew assembly for overhaul. At the time of the 0.075-inch end play measurement, the airplane had accumulated 18,417 flight hours and 14,520 cycles with the same jackscrew assembly. Integrated Aerospace received the jackscrew assembly on October 29, 1999, and the company also measured a bench-check end play of 0.075 inch. Integrated Aerospace overhauled the jackscrew assembly (with a new acme nut) and returned it to Delta Air Lines on December 17, 1999. According to Delta Air Lines, no further information related to the maintenance history of this jackscrew assembly was found. 1.18.9 Industrywide Jackscrew Assembly Maintenance Procedures The Safety Board surveyed all 13 domestic airlines that operated at least 10 DC-9, MD-80/90, and/or 717 airplanes in their fleets. The airlines were asked to report their jackscrew assembly lubrication and end play intervals before the flight 261 accident. In addition, the airlines were asked to report the type of grease and the internally imposed maximum allowable end play limit they used before the accident and the number of jackscrew assemblies they removed in 1998 and 1999. The airlines were also asked to 203 The ILS subscription listing is used by overhaul shops and brokers to advertise overhauled parts for purchase by airlines.

Factual Information 123 Aircraft Accident Report provide the maintenance work cards for both the lubrication and end play check of the jackscrew assembly. A review of the survey results revealed the following pertinent information: • Alaska Airlines was the only airline that used Aeroshell 33 to lubricate the jackscrew assembly. All of the other operators used an MIL-G-23827-qualified grease, such as Mobilgrease 28, Aeroshell 7, or Aeroshell 22. • Alaska Airlines had the highest MD-80 jackscrew assembly lubrication interval (approximately 2,550 flight hours). • Alaska Airlines had the second highest MD-80 end play check interval (approximately 9,550 flight hours). The highest end play check interval at all of the airlines was approximately 10,500 flight hours. • The lowest MD-80 jackscrew assembly lubrication interval was 600 flight hours. • The operators’ MD-80 end play check intervals varied from 7,000 to 10,500 flight hours. • The operators’ DC-9 jackscrew assembly lubrication intervals varied from 550 to 2,530 flight hours. • The operators’ DC-9 end play check intervals varied from 2,000 to 7,720 flight hours. One operator did not use the end play check and instead had a required a hard-time removal at 15,500 hours. • All of the MD-90 and 717 operators’ jackscrew assembly lubrication intervals were set at 3,600 flight hours. • All of the MD-90 and 717 operators’ end play check intervals were set at 7,200 flight hours. 1.18.10 FAA Commercial Airplane Certification Process Study In February 2002, the FAA issued a report titled, “Commercial Airplane Certification Process Study – An Evaluation of Selected Aircraft Certification, Operation and Maintenance Processes.” The report was based on a study that was led by the FAA and conducted by a team that included representatives from U.S. and non-U.S. airplane manufacturers, the U.S. aviation industry, the National Aeronautics and Space Administration, the Air Line Pilots Association, the DoD, Sandia National Laboratories, the Fed Ex Pilots Association, and an international airworthiness consultant. The airplane certification process study report stated that the study was conducted because “recent accidents such as the Alaska Airlines MD-80 in January 2000, or the Trans World Airways B-747 in July 1996, have brought into question the adequacy of certain processes related to the certification of the airplane.” The report focused on numerous process categories, including human factors in airplane design, operations and maintenance, flight critical systems and structure, safety data management,

Factual Information 124 Aircraft Accident Report maintenance/operations coordination, major repairs and modifications, and safety oversight. The report added, “special emphasis was also placed upon analyzing how the various major certification processes in the airplane’s life cycle relate to each other, and evaluating the relationship between these certification processes and the maintenance and operating processes being applied in service.” The airplane certification process study report’s findings and observations included the following: • Design techniques, safety assessments, and regulations do not adequately address the subject of human error in design or in operations and maintenance. • There is no reliable process to ensure that the assumptions made in the safety assessments are valid with respect to operations and maintenance activities and that operators are aware of these assumptions when developing their operations and maintenance procedures. In addition, certification standards may not reflect the actual operating environment. • Several catastrophic events may have been avoided by use of a more robust design and in-depth safety analysis that challenged the assumptions of the design process. This is particularly important when the catastrophic event is the end-point of a short fault tree (two or three failures) or where very specific human actions are required to prevent an accident. • Processes for identification of safety critical features of the airplane do not ensure that future alterations, maintenance, repairs, or changes to operational procedures can be made with cognizance of those safety features. • Multiple FAA-sponsored data collection and analysis programs exist without adequate interdepartmental coordination or executive oversight. • There is no widely accepted process for analyzing service data or events to identify potential accident precursors. • Adequate processes do not exist within the FAA or in most segments of the commercial aviation industry to ensure that the lessons learned from specific experiences in airplane design, manufacturing, maintenance, and flight operations are captured permanently and made readily available to the aviation industry. The failure to capture and disseminate lessons learned has allowed airplane accidents to occur for causes similar to those in past accidents. • There are currently no industry processes or guidance materials available which ensure that (1) safety-related maintenance or operational recommendations developed by the manufacturer are evaluated by the operator for incorporation into their maintenance or operational programs and (2) safety-related maintenance or operational procedures developed or modified by the operator are coordinated with the manufacturer to ensure that they do not compromise the type design safety standard of the airplane and its systems.

Factual Information 125 Aircraft Accident Report • The lack of adequate formal business processes between FAA Aircraft Certification Service and Flight Standards Service limits effective communication and coordination between the two that often results in inadequate communications with the commercial aviation industry. • Processes to detect and correct errors made by individuals in the design, certification, installation, repair, alteration, and operation of transport-category airplanes are inconsistent, allowing unacceptable errors in critical airworthiness areas. Referring to the lubrication-related safety recommendations the Safety Board issued on October 1, 2001, the report stated that “while the relevance of mixing grease types in this accident has not been determined, both types of grease were discovered in the jackscrew assembly of the accident aircraft. It appears that the communication between operator, [airplane manufacturer,] and the grease manufacturers was not adequate to ensure that the grease mixing recommendations [by Boeing and the grease manufacturers] were communicated and incorporated.”204 1.18.11 Fail-Safe Jackscrew Assembly Designs Representatives of Nook Industries, which manufactures jackscrew assemblies for nonaviation applications, indicated to Safety Board investigators that the jackscrew assemblies it designs for safety-critical functions are equipped with a secondary acme nut. The secondary acme nut, which is also referred to as a “follower nut,” is threaded on the acme screw and follows the primary load-bearing acme nut as it rotates longitudinally along the acme screw. Engineers at the National Aeronautics Space Administration’s (NASA) John F. Kennedy Space Center have developed a similar mechanism for use in the jackscrew assembly used for the gaseous oxygen vent arm on its space shuttle launch pads. The secondary acme nut in both the Nook and NASA designs does not carry any load unless the primary nut threads shear off. If this occurs, the secondary acme nut assumes the load and allows the system to continue to operate. The addition of the secondary acme nut also provides an alternate method for monitoring end play between the acme screw and nut threads that does not require relieving the load on the primary nut. As the threads of the primary acme nut wear, the distance between the primary and secondary nut decreases; therefore, wear of the primary nut threads, or end play, can be gauged by monitoring changes in this distance. 204Boeing service letters issued on August 12, 1993, and June 30, 1997, noted that these grease types were incompatible “and should not be mixed.”

Analysis 126 Aircraft Accident Report 2. Analysis 2.1 General The flight crewmembers on Alaska Airlines flight 261 were properly certificated and qualified and had received the training and off-duty time prescribed by Federal regulations. No evidence indicated any preexisting medical or other condition that might have adversely affected the flight crew’s performance during the accident flight. The airplane was dispatched in accordance with Federal Aviation Administration (FAA) regulations and approved Alaska Airlines procedures. The weight and balance of the airplane were within limits for dispatch, takeoff, climb, and cruise. Daylight visual meteorological conditions prevailed, and weather was not a factor in the accident. Examination of recovered wreckage and cockpit voice recorder (CVR), flight data recorder (FDR), and air traffic control (ATC) data revealed no evidence of a fire or of impact with birds or any other foreign object. No evidence indicated that the airplane experienced any preimpact structural or system failures, other than those associated with the longitudinal trim control system, the horizontal stabilizer, and its surrounding structure.205 FDR and CVR information indicated that both engines were operating normally before the final dive. Examination of the recovered thrust reversers and FDR data indicated that the thrust reversers were stowed at impact. Examination of the wreckage indicated that the left engine was producing significant rotational energy at impact and that the right engine was producing very little rotational energy at impact. Erratic engine pressure ratio data recorded on the FDR during the final dive were consistent with airflow disturbances associated with extreme angles-of-attack. Such extreme angles-of-attack can cause fuel unporting and can interrupt the airflow into the engine inlet, either of which could lead to an engine flameout. Therefore, the lack of rotation on the right engine was likely the result of an engine flameout during the final dive. ATC personnel involved with the accident flight were properly certificated and qualified for their assigned duty stations. ATC radar and communications equipment were functioning properly during the flight. Analysis of the structural damage and FDR data indicated that the airplane was nearly inverted206 and was in a steep nose-down, right-wing-low attitude when it impacted the water, which is consistent with uncontrolled flight. 205 For an analysis of this failure sequence, see sections 2.2.2 through 2.2.4.

Analysis 127 Aircraft Accident Report This analysis examines the accident scenario, including the catastrophic failure of the longitudinal trim control system, flight crew decision-making, possible reasons for the excessive acme nut thread wear, the importance of monitoring acme nut thread wear, jackscrew assembly overhaul procedures and facilities, adequacy of Alaska Airlines’ maintenance program, FAA oversight, and horizontal stabilizer design issues. 2.2 Accident Sequence 2.2.1 Takeoff and Climbout FDR data indicated that the accident airplane’s longitudinal trim control system was functioning normally during the airplane’s descent into Lic Gustavo Diaz Ordaz International Airport (PVR), Puerto Vallarta, Mexico, on the flight just before the accident flight. FDR data indicated that the airplane landed at PVR with a horizontal stabilizer angle of 6º airplane nose up. FDR data indicated that the accident flight crew had trimmed the airplane to a 7º airplane-nose-up position before takeoff from PVR. After the airplane took off about 1337, FDR data indicated that the horizontal stabilizer moved at the normal primary trim motor rate of 1/3º per second from 7º to 2º airplane nose up. Thereafter, as the airplane continued to climb from 6,200 feet to about 23,400 feet, the FDR recorded horizontal stabilizer movement at the normal alternate trim motor rate of 1/10º per second from 2º airplane nose up to 0.4º airplane nose down. Operation of the alternate trim motor during this period is consistent with pitch control being commanded by the autopilot, which was activated at 1340:12 while the airplane was climbing through 6,200 feet. On the basis of these data, the Safety Board concludes that the longitudinal trim control system on the accident airplane was functioning normally during the initial phase of the accident flight. 2.2.2 Jamming of the Horizontal Stabilizer FDR data indicated that the horizontal stabilizer’s last movement during the climbout was to 0.4º airplane nose down at 1349:51 as the airplane was climbing through 23,400 feet at 331 knots indicated airspeed (KIAS). After this, no horizontal stabilizer movement was recorded on the FDR until the airplane’s initial dive 2 hours and 20 minutes later. This cessation of horizontal stabilizer movement is not consistent with a typical MD-80 climb profile, which normally would require additional stabilizer movements to maintain trim. Thus, as the accident airplane continued to climb above 23,400 feet without any horizontal stabilizer movement, the autopilot would have attempted to achieve trim by continuing to add elevator input to compensate for the lack of movement of the horizontal stabilizer. 206 The largest intact sections of the recovered fuselage were from below the airplane’s floor line, indicating that the airplane was rolling toward inverted at impact.

Analysis 128 Aircraft Accident Report After the last horizontal stabilizer movement, the airplane continued to climb at 330 KIAS. The airplane began to level off at approximately 26,000 feet and slowed to 320 KIAS. At 1351:51, the airplane began to climb again. By 1352:50, the airplane had slowed to about 285 knots as it climbed to approximately 28,600 feet and then leveled off. At 1353:12, when the airplane was at approximately 28,557 feet and 296 KIAS, the autopilot was disconnected, most likely by the flight crew in response to the trim annunciator warning light, which would have illuminated to indicate the airplane’s out-of-trim condition.207 In a typical climb profile, a reduction in speed during the ascent would result in an airplane-nose-up stabilizer movement to trim the airplane. At the time of the autopilot disconnect, the airplane was still trimmed for an airspeed of 331 knots (the airspeed when the last horizontal stabilizer movement occurred), 35 knots faster than the airspeed at that time. After the autopilot was disconnected, the elevators were deflected in the airplane-nose-up direction from 0º to approximately -1.5º. For almost 7 minutes after the autopilot disconnect, the airplane continued to climb at a much slower rate than before the disconnect, reaching about 31,050 feet by 1400:00. During this part of the ascent, the elevators were deflected in the airplane-nose-up direction between -1º and -3º, which, according to airplane performance calculations, would have required up to 50 pounds of pulling force on the control column(s).208 The calculations further indicated that, after leveling off at 31,050 feet, only about 30 pounds of pulling force would have been required to maintain level flight for the next 24 minutes while the airplane was flying at 280 KIAS. This was followed by an increase in airspeed209 beginning at 1424:30 that, along with the decreased weight of the airplane because of fuel usage, would have eased the amount of pulling force needed to maintain level flight to roughly 10 pounds until the autopilot was switched back on about 1547. After the autopilot disconnect at 1353:12, the flight crew would have noticed that the airplane was mistrimmed because significant pilot control forces would have initially been needed to maintain the desired climb and cruise configuration, and the flight crew would have likely attempted to correct the problem by manually activating the primary or alternate trim systems to move the horizontal stabilizer. However, the horizontal stabilizer remained at 0.4º airplane nose down, indicating that the flight crew was unable to manually command movement of the horizontal stabilizer. During discussions with Alaska Airlines maintenance personnel at Los Angeles International Airport, (LAX), Los Angeles, California, later in the flight, the captain indicated that the flight crew had tried numerous troubleshooting strategies to move the horizontal stabilizer, including checking the circuit breakers and using the control wheel trim switches and longitudinal trim handles on the center pedestal separately and together.210 The captain told the maintenance 207 The airplane’s speed decreased (from 331 to 296 KIAS) during the minutes preceding the autopilot disconnect, indicating that the airplane was mistrimmed. 208 As stated previously, all estimates of pulling force in this report refer to the combined column forces from both the captain’s and the first officer’s control columns. It is not known whether these forces were applied by the captain, the first officer, or both. 209 Although the flight plan called for a cruise speed of 283 knots calibrated airspeed, FDR data indicated that the airplane’s cruise speed increased, starting at 1424:30, eventually reaching 301 KIAS.

Analysis 129 Aircraft Accident Report personnel, “it appears to be jammed…the whole thing, it spikes out when we use the primary, we get AC load that tells me the motor’s tryin to run but the brake won’t move it. when we use the alternate, nothing happens.”211 In sum, the Safety Board concludes that the horizontal stabilizer stopped responding to autopilot and pilot commands after the airplane passed through 23,400 feet. The pilots recognized that the longitudinal trim control system was jammed, but neither they nor the Alaska Airlines maintenance personnel could determine the cause of the jam. 2.2.2.1 Cause of the Jam As previously mentioned, the horizontal stabilizer’s jackscrew assembly includes an acme screw and nut, both of which have two threads. After the accident, severely worn and sheared remnants of the acme nut threads were recovered wrapped around the acme screw. The condition of the recovered acme nut thread remnants indicated that approximately 90 percent of the thread thickness had worn away before the remainder of the threads sheared off.212 In comparison, a jackscrew assembly with the maximum amount of wear permitted in service, as indicated by an end play measurement of 0.040 inch (that is, 0.030 to 0.037 inch of wear), would only have about 22 percent of the thread thickness worn away.213 The interior of the recovered acme nut contained no intact threads, although there were small ridges where the worn nut thread remnants had previously been attached. The inner diameter of those ridges was almost identical to the outer diameter of the acme screw threads, which is consistent with the worn acme nut threads having been sheared off by the acme screw threads during airplane-nose-down trimming movements. Each of the acme nut threads makes 16 360° spiral revolutions, for a total of 32 360° revolutions. Calculations indicated that loads of more than 190,000 pounds would be necessary to simultaneously shear all 32 360º spiral revolutions of the acme nut threads if they were worn to the same degree as the accident acme nut thread remnants. However, airplane performance data determined that the flight loads on the jackscrew assembly were only 4,000 to 5,000 pounds during the climbout from PVR. Therefore, it is very unlikely that the worn acme nut thread spiral revolutions were simultaneously sheared along their entire length. 210 When Alaska Airlines maintenance personnel asked the captain whether the pilots had tried “the suitcase handles [colloquial term for longitudinal trim handles] and the pickle switches [colloquial term for control wheel trim switches]” in their attempts to troubleshoot the horizontal stabilizer trim problem, the captain replied that they had “tried everything together.” When the maintenance technician subsequently asked again whether the flight crew had tried the control wheel trim switches and longitudinal trim handles, the captain replied, “yea we tried just about every iteration.” 211 The alternate trim motor uses less power than the primary trim motor; therefore, activation of that system does not normally produce enough electrical current to cause any appreciable movement of the needle on the AC load meter. 212 For more information about the condition of the recovered acme nut threads, see section 1.16.3.6. 213 This calculation was based on a comparison with the manufacturing specifications for the thickness of the threads at the major diameter (0.15 inch).

Analysis 130 Aircraft Accident Report The calculations further indicated that approximately 6,000 to 7,000 pounds would be necessary to shear one 360º spiral revolution of an acme nut thread if it were worn to the same degree as the accident acme nut thread remnants. However, the Safety Board’s finite element analysis (FEA) study showed that, at high levels of thread wear, such as those of the accident acme nut threads, bending stresses develop that are significantly larger than the stresses caused by direct contact pressure. The study showed that the bending deformations resulting from a 2,000-pound load on a single highly worn thread spiral caused a drastic change in the thread’s behavior, indicating that a structural failure, rather than shearing failure, is possible. Further, the results of the Safety Board’s and Boeing’s FEA of the stress and deformation in the acme nut threads under loading indicated that the wear process is an incremental one in which the loads and resulting wear shift and move among all of the 32 spiral revolutions in the acme nut.214 Thus, an incremental bending-induced shear fracture of the threads most likely propagated along the thread spiral, eventually leading to complete failure. Figure 20 depicts the stages of acme nut thread wear to the point of fracture. The Safety Board concludes that the worn threads inside the horizontal stabilizer acme nut were incrementally sheared off by the acme screw and were completely sheared off during the accident flight. The Safety Board further concludes that, as the airplane passed through 23,400 feet, the acme screw and nut jammed, preventing further movement of the horizontal stabilizer until the initial dive. Safety Board investigators considered numerous factors that might have played a role in the jamming of the acme screw to the nut, including bending of the worn threads before or during the shearing, distortion of the remnants after they were sheared,215 and loads resulting from the acme screw threads pulling upward across the remaining ridges after the shearing;216 however, the Board could not determine the exact cause of the jam. 214 For more information about these studies, see section 1.16.4. 215 Because the thinnest part of the sheared thread remnants was too large to fit in the space between the crowns of the acme screw threads and the stripped surface of the nut, the remnants themselves probably played only a minor role, if any, in the creation of the jam. 216 It was theorized that, as the last of the acme nut thread remnants shear fractured and the screw threads tried to override the resulting ridges in the nut as the screw was pulled upward by aerodynamic loads and rotated circumferentially by the primary trim motor, the combined pinching and friction loads became greater than the combined aerodynamic and primary trim motor forces.

Analysis 131 Aircraft Accident Report Figure 20. A graphical depiction of the stages of acme nut thread wear to the point of fracture.

Analysis 132 Aircraft Accident Report 2.2.3 Release of the Jam and the Initial Dive At 1608:59, following discussions with Alaska Airlines maintenance personnel about whether the fight crew had tried the longitudinal trim handles and the control wheel trim switches, the captain told the first officer, “I’m going to click it off you got it [the airplane]…lets do that.” At this time, the airplane was cruising at 31,050 feet. At 1609:14.8, the captain stated, “this’ll click it off,” and, about 1609:16, the autopilot parameter on the FDR switched from “engaged” to “off.” FDR and airplane performance data indicated that during the 3 to 4 seconds following the autopilot disconnect, the horizontal stabilizer traveled from its jammed position of 0.4º airplane nose down to beyond the maximum airplane-nose-down position that could be recorded by the FDR and remained beyond this position for the remainder of the flight.217 Analysis of the FDR data showed that the trim movement rate was not uniform, which was inconsistent with normal trim operation commanded by either the primary or alternate trim motor. As the jam was overcome, the acme screw was being pulled upward through the acme nut by aerodynamic loads, causing upward movement of the horizontal stabilizer, resulting in greater airplane-nose-down motion. This upward pulling motion would have continued until the lower mechanical stop on the acme screw contacted the lower surface of the acme nut, preventing further upward motion of the horizontal stabilizer. Boeing engineering data, computer modeling, and ground demonstrations on an actual airplane indicated that the maximum possible horizontal stabilizer position when the acme screw lower mechanical stop is pulling up against the acme nut is about 3.1º airplane nose down. This is consistent with airplane performance studies of the airplane’s movements at this point in the accident sequence that showed the airplane beginning to pitch nose down to nearly -8º. FDR data showed that during this 3- to 4-second period, the elevators were deflected from -0.4º to -4.0º, indicating that the flight crew made control inputs to bring the nose up and counteract the movement of the horizontal stabilizer. The speed brakes were deployed at 1609:43, 27 seconds after the autopilot disconnect, most likely in an attempt by the flight crew to retard the airplane’s rapidly increasing airspeed. The speedbrakes remained deployed for the next 1 minute 30 seconds. The airplane began to recover from this initial dive and leveled off at about 1611 at approximately 24,000 feet. Airplane-nose-up elevator inputs continued for about the next 8 minutes (until the final dive about 1619). Safety Board investigators attempted to determine what caused the horizontal stabilizer to move immediately after the autopilot disconnect. Normally, the autopilot is disconnected by the pilot flying using the autopilot disconnect switch located on the outboard side of the control wheel. However, the autopilot will also disconnect when the primary trim control system is activated by either the control wheel trim switches or the longitudinal trim handles on the center pedestal. After the initial dive, the captain told the 217 The maximum airplane-nose-down position of the horizontal stabilizer during normal operation is 2.1º. The FDR recorded airplane-nose-down positions up to about 2.5º. Airplane performance data indicated that the stabilizer position had to have been beyond 2.5º airplane nose down to result in the airplane’s pitch movements during and after the initial dive.

Analysis 133 Aircraft Accident Report Alaska Airlines LAX maintenance technician, “we did both the pickle switch [control wheel trim switches] and the suitcase handles [longitudinal trim handles] and it ran away full nose trim down [sic].” Based on this comment and those made by the Alaska Airlines LAX maintenance personnel immediately preceding the autopilot disconnect, it appears that the captain disconnected the autopilot when he activated the primary trim control system by using either the control wheel trim switches, the longitudinal trim handles, or both. Consequently, although operation of the primary trim motor as part of troubleshooting attempts earlier in the flight did not release the jam, the torque created by the primary trim motor when the captain activated the primary trim system at 1609:16 apparently provided enough force to overcome the jam between the acme nut and screw. Over the next 3 to 4 seconds, the increasing angle-of-attack of the horizontal stabilizer and the increased elevator deflections would have in turn increased the tension loads on the acme screw, contributing to the motion of the acme screw upward through the acme nut. Therefore, the Safety Board concludes that the accident airplane’s initial dive from 31,050 feet began when the jam between the acme screw and nut was overcome as a result of the operation of the primary trim motor. Release of the jam allowed the acme screw to pull up through the acme nut, causing the horizontal stabilizer leading edge to move upward, thus causing the airplane to pitch rapidly downward. Markings on the recovered jackscrew assembly lower mechanical stop and the lower surface of the acme nut indicated that the nut repeatedly contacted the stop in various positions and that the acme screw and attached lower mechanical stop had rotated in both directions while the stop was in contact with the nut. Further, the rotationally sheared splines on the lower mechanical stop indicated that the acme screw rotated within the lower mechanical stop after the stop contacted the lower surface of the acme nut. Metallurgical analysis determined that the marks on the lower mechanical stop could have been created by rotation of the acme screw only after complete loss of the acme nut threads. Circumferential marks were found in the acme nut bore, also indicating acme screw rotation after the threads had sheared off. Such rotation of the acme screw could only be caused by operation of a trim motor. Therefore, the Safety Board concludes that the acme screw did not completely separate from the acme nut during the initial dive because the screw’s lower mechanical stop was restrained by the lower surface of the acme nut until just before the second and final dive about 10 minutes later. 2.2.4 The Second and Final Dive After the flight crew recovered from the initial dive and leveled off at approximately 18,000 feet, the captain instructed the first officer to deploy the slats and flaps (at 1617:54 and 1618:05, respectively), most likely to evaluate flight control pressures. FDR data indicated that the airspeed decreased about 8 knots and that the airplane remained stable and controllable following the slat and flap deployment. At 1618:26, the captain asked the first officer to retract the slats and flaps for unknown

Analysis 134 Aircraft Accident Report reasons. During the 50 seconds after the slats and flaps were retracted, the airplane accelerated from about 245 to 270 KIAS. Beginning at 1619:09, the FDR recorded small oscillations in elevator angle, pitch angle, and vertical acceleration values for about 15 seconds. At 1619:21, the CVR recorded a series of faint thumps.218 Although the horizontal stabilizer position had already exceeded the maximum position capable of being sensed and recorded by the FDR, the FDR nonetheless indicated an increase in the horizontal stabilizer position at the time of the faint thump.219 This increase was the first horizontal stabilizer movement since the one that precipitated the initial dive about 10 minutes earlier. The FDR contained no direct data about the actual position to which the horizontal stabilizer moved at this time. However, Boeing engineering design data and computer modeling of the horizontal and vertical stabilizers indicated that if the acme screw was free to travel through the acme nut, the horizontal stabilizer would move from the 3.1º airplane-nose-down position it was being held at by the lower mechanical stop and would contact the vertical stabilizer tip fairing brackets at a 3.6º airplane-nose-down angle. Structural examinations determined that this additional movement of the horizontal stabilizer could only result from a fracture of the acme screw torque tube. Metallurgical analysis of the recovered section of the fractured torque tube showed that the final separation initiated from an area of low-cycle fatigue cracking. On the basis of an evaluation of the static loading conditions and performance data, the Safety Board determined that the torque tube was capable of sustaining a single application of the maximum load applied to the torque tube between the initial and final dives.220 However, low-cycle fatigue tests and analysis, performance data, and FEA established that the magnitude and frequency of the loads on the torque tube after complete shearing of the acme nut threads, in combination with an offset loading condition,221 would be sufficient to initiate and propagate low-cycle fatigue cracking in the torque tube. The low-cycle fatigue cracking severely reduced the load capability of the torque tube during the 10-minute period between the initial and second and final dive, causing it to fracture at loads considerably less than it was capable of sustaining if it did not have fatigue damage. At 1619:29, the captain ordered redeployment of the slats and flaps. At 1619:35, the flaps were transitioning from 7º to 11º. At 1619:36.6, the CVR recorded the sound of an “extremely loud noise.” Immediately thereafter, the airplane began its final dive. At the time of this pitchover, radar detected several small primary returns, consistent with parts of the vertical stabilizer’s tip fairing being torn from the airplane as the fairing brackets 218 According to the Safety Board’s sound spectrum study, the “faint thump” noted on the CVR transcript at 1619:21was actually a series of thumps. 219 After the sound of the faint thump, the elevator deflections increased from -9º to -13º, indicating the pilots were making additional airplane-nose-up elevator inputs to maintain level flight with the increased airplane-nose-down horizontal stabilizer angle. 220 For more information about these loads, see section 1.16.5 221 The torque tube was subjected to a combination of bending and tension as a result of an offset loading condition created in the torque tube because the stop lugs on the lower mechanical stop and the acme screw prevented application of equal load around the axis of the tube.

Analysis 135 Aircraft Accident Report broke,222 which would have allowed the horizontal stabilizer to move well beyond the 3.6º airplane-nose-down position it was being held at by the brackets. Therefore, the extremely loud noise recorded on the CVR at 1619:36.6 was likely made as the fairing brackets failed and caused the loss of the tip fairing and structural deformation of the tail under flight loads, resulting in local aerodynamic disturbances.223 Valid airplane performance data do not exist for horizontal stabilizer positions beyond 14º airplane nose down. Although the exact horizontal stabilizer angle required to produce the final pitchover could not be determined, the Safety Board’s airplane performance studies determined that the airplane’s pitch rate during the final dive could only have resulted from a rapid increase to a stabilizer angle significantly beyond 14º airplane nose down.224 In sum, the Safety Board concludes that the cause of the final dive was the low-cycle fatigue fracture of the torque tube, followed by the failure of the vertical stabilizer tip fairing brackets, which allowed the horizontal stabilizer leading edge to move upward significantly beyond what is permitted by a normally operating jackscrew assembly. The resulting upward movement of the horizontal stabilizer leading edge created an excessive upward aerodynamic tail load, which caused an uncontrollable downward pitching of the airplane from which recovery was not possible. 2.2.5 Flight Crew Decision-Making 2.2.5.1 Decision to Continue Flying Rather than Return to PVR Safety Board investigators considered several reasons that might explain the captain’s decision not to return immediately to PVR after he experienced problems with the horizontal stabilizer trim system during the climbout from PVR. Neither the Alaska Airlines MD-80 Quick Reference Handbook (QRH) Stabilizer Inoperative checklist nor the company’s QRH Runaway Stabilizer emergency checklist required landing at the nearest suitable airport if corrective actions were not successful. These checklist procedures were the only stabilizer-related checklist procedures contained in the QRH, and the flight crew most likely followed these checklist procedures in their initial attempts to correct the airplane’s jammed stabilizer. 222 The Safety Board notes that the fairing brackets were not intended to carry the load of the horizontal stabilizer. 223 As discussed in section 1.11.1.1, sound tests indicated that neither this sound nor any of the other sounds recorded by the accident airplane’s CVR were similar to sounds associated with the failure of the torque tube. The investigation could not determine exactly what caused the sound. 224 Structural analysis indicated that the horizontal stabilizer must travel to a position of greater than 15º airplane nose down to allow the acme screw to completely exit the top of the acme nut, as it did during the final dive. Symmetrical structural damage was found on the tail, indicating that the horizontal stabilizer’s hinge fittings contacted the vertical stabilizer’s rear spar, which would occur at a horizontal stabilizer position of 16.2º airplane nose down.

Analysis 136 Aircraft Accident Report The airplane’s takeoff weight of 136,513 pounds was well below the takeoff and climb limits for the departure runway, but it exceeded the airplane’s maximum landing weight of 130,000 pounds. Because the airplane did not have an in-flight fuel dumping system, the airplane would have had to remain in flight for about 45 minutes after takeoff until enough fuel had burned to reduce the airplane’s weight by the 6,500 pounds needed to reach the airplane’s maximum landing weight. A return to PVR to execute an overweight landing would have required higher-than-normal approach speeds for landing and would have created additional workload and risk. An overweight landing at PVR would have been appropriate if the flight crew had realized the potentially catastrophic nature of the trim anomaly. However, in light of the airplane’s handling characteristics from the time of the initial detection of a problem to the initial dive, the flight crew would not have been aware that they were experiencing a progressive, and ultimately catastrophic, failure of the horizontal stabilizer trim system. The flight crew would have been aware that Alaska Airlines’ dispatch and maintenance control in Seattle-Tacoma International Airport (SEA), Seattle, Washington, and LAX could be contacted by radio (via ground-based repeater stations) when the airplane neared the United States. However, even though the last horizontal stabilizer trimming movement was recorded by the FDR about 1349:51, the flight crew did not contact Alaska Airlines’ maintenance until shortly before the beginning of the CVR transcript about 1549,225 which suggests that control problems caused by the jammed horizontal stabilizer remained manageable for some time.226 Further, as previously mentioned, the positive aerodynamic effects of the higher cruise airspeed and fuel burn would have reduced the necessary flight control pressures to roughly 10 pounds and made the airplane easier to control. Therefore, the Safety Board concludes that, in light of the absence of a checklist requirement to land as soon as possible and the circumstances confronting the flight crew, the flight crew’s decision not to return to PVR immediately after recognizing the horizontal stabilizer trim system malfunction was understandable. Although they elected not to return to PVR, later in the flight the flight crew decided to divert to LAX, rather than continue to San Francisco International Airport (SFO), San Francisco, California, where the flight was originally scheduled to make an intermediate stop before continuing to SEA. Comments recorded by the CVR indicated that the flight crew may have felt pressure from Alaska Airlines dispatch personnel to land in SFO.227 However, after discussing the malfunctioning trim system and current and expected weather conditions at SFO and LAX with Alaska Airlines dispatch and maintenance personnel, the captain decided to land at LAX rather than continue to SFO. 225 The FDR indicates that a continuing series of radio transmissions began over the very-high frequency 2 channel (used for all non-ATC radio transmissions) at 1521. These transmissions continued until the end of the FDR recording, which suggests that the flight crew began contacting Alaska Airlines maintenance personnel at this time. 226 The Safety Board notes that the 30-minute CVR recording did not capture the flight crew’s earlier troubleshooting efforts or the beginning of the flight crew’s discussions with maintenance personnel. A longer CVR recording that captured these events would have aided in this investigation. In Safety Recommendation A-99-16, the Board recommended that CVRs on all airplanes required to carry both a CVR and an FDR be capable of recording the last 2 hours of audio. This safety recommendation is currently classified “Open—Unacceptable Response.”

Analysis 137 Aircraft Accident Report The decision to divert to LAX was apparently based on several factors, including more favorable wind conditions at LAX (compared to a direct crosswind at SFO) that would reduce the airplane’s ground speed on approach and landing228 and the captain’s concern, expressed to Alaska Airlines dispatch personnel, about “overflying suitable airports.” The Safety Board concludes that the flight crew’s decision to divert the flight to LAX rather than continue to SFO as originally planned was prudent and appropriate. Further, the Safety Board concludes that Alaska Airlines dispatch personnel appear to have attempted to influence the flight crew to continue to SFO instead of diverting to LAX. 2.2.5.2 Use of the Autopilot After the flight crew had manually flown the airplane for almost 2 hours, the autopilot was engaged about 1547, disengaged at 1549:56, and re-engaged 19 seconds later. The autopilot remained engaged until 1609:16, just before the initial dive. No discussion on the CVR (which began at 1549) indicated why the autopilot was engaged in either instance. As discussed previously, the increased airspeed and reduced weight would have brought the airplane closer to a trimmed condition, thus allowing autopilot engagement to maintain altitude and heading while further troubleshooting was attempted. However, Alaska Airlines’ MD-80 QRH Stabilizer Inoperative checklist states, “do not use autopilot” if both trim systems are inoperative. In light of the autopilot’s inability to maintain trim (using the alternate trim motor) during the climbout from PVR and the flight crew’s subsequent unsuccessful attempts to manually activate the primary trim control system (using the primary trim motor), the flight crew should have known that both the alternate and the primary trim control systems were inoperative. Thus, the flight crew’s use of the autopilot was contrary to company procedures. Because the AC load meter registered electrical spikes when the crew attempted to activate the primary trim system, the flight crew should have realized that the primary trim motor was operational and that the system was jammed beyond the trim motor’s capability. Further, engagement of the autopilot, which would have been making automatic elevator corrections to the airplane’s mistrimmed condition, masked the airplane’s true condition from the flight crew. If the autopilot had subsequently been disconnected without one of the flight crewmembers holding the control wheel and making immediate corrective inputs, the airplane’s out-of-trim condition would have resulted in a severe pitch maneuver immediately after the autopilot disconnect. Therefore, 227 At 1552:02, after the captain had stated his intention to divert to LAX, Alaska Airlines dispatch personnel cautioned that if the flight landed at LAX rather than SFO, “we’ll be looking at probably an hour to an hour and a half [before the airplane could depart again] we have a major flow program going right now.” At 1552:41, the captain responded, “I really didn’t want to hear about the flow being the reason you’re calling us cause I’m concerned about overflying suitable airports.” At 1555:00, the captain commented to a flight attendant, “it just blows me away they think we’re gonna land, they’re gonna fix it, now they’re worried about the flow, I’m sorry this airplane’s [not] gonna go anywhere for a while…so you know.” After a flight attendant replied, “so they’re trying to put the pressure on you,” the captain stated, “well no, yea.” 228 According to Alaska Airlines’ MD-80 QRH Stabilizer Inoperative checklist, 15º of flaps would have been the appropriate flap setting for the accident airplane’s approach and landing with a jammed stabilizer; this reduced flap setting would have increased approach speeds and required a corresponding increase in the amount of runway needed during landing.

Analysis 138 Aircraft Accident Report the Safety Board concludes that the flight crew’s use of the autopilot while the horizontal stabilizer was jammed was not appropriate.229 2.2.5.3 Configuration Changes At 1615:56, after recovery from the initial dive, the captain told the air traffic controller that he wanted to “change my configuration, make sure I can control the jet and I’d like to do that out here over the bay if I may.” As previously mentioned, the captain then ordered extension of the slats at 1617:54 and the flaps at 1618:05. The captain did not brief the first officer about what to expect or what to do if these configuration changes resulted in excessive flight control pressures or loss of control of the airplane. Further, the captain did not specify that the flaps should be extended at a slower-than-normal rate, which would have been a prudent precaution to minimize the possibility of the configuration change causing abrupt airplane movements that could be difficult to control. Nevertheless, at 1618:17, after the slats and flaps were extended, the captain noted that the airplane was “pretty stable right here.” The captain added that the airspeed needed to decrease to 180 KIAS (the airplane was then at 250 KIAS). Nine seconds later, at 1618:26, the captain ordered retraction of the slats and flaps, and the airspeed began to subsequently increase. It was not clear from the CVR recording why the captain ordered retraction of the slats and flaps and allowed the airspeed to increase nor did the CVR recording indicate any discussion about the possible effects of the slat and flap extension. The Safety Board notes that an airplane with flight control problems should be handled in a slow and methodical manner and that any configuration that would aid a landing should be maintained if possible. On the basis of the captain’s comment, the airplane was stable after the slat and flap extension at 1618:05. This configuration would have aided the approach and landing process. The Safety Board concludes that flight crews dealing with an in-flight control problem should maintain any configuration change that would aid in accomplishing a safe approach and landing, unless that configuration change adversely affects the airplane’s controllability. 2.2.5.4 Activation of the Primary Trim Motor At 1618:49, after the slats and flaps were retracted, the captain stated that he wanted to “get the nose up…and then let the nose fall through and see if we can stab it when it’s unloaded.” The first officer responded, “you mean use this again? I don’t think we should…if it can fly.” These statements suggest that the captain may have been indicating his intention to retry the primary trim system after reducing aerodynamic forces on the horizontal stabilizer. However, after the first officer’s statement at 1619:14, “I think if it’s controllable, we oughta just try to land it,” the captain abandoned his plan and responded, “ok let’s head for LA.” 229 The Safety Board also notes that the captain’s disconnection of the autopilot when he was the pilot not flying was also contrary to standard industry procedures. Normally, the pilot flying would use the autopilot disconnect switch on the control column and then assess the airplane’s controllability.

Analysis 139 Aircraft Accident Report The Safety Board notes that the earlier repeated attempts to activate the primary trim system went well beyond what was called for in Alaska Airlines’ checklist procedures and ultimately precipitated the release of the jam of the acme screw and nut, resulting in the lower mechanical stop impacting the bottom of the nut. An additional attempt to use the trim switches at this point would not have been prudent. The severity of the initial dive changed the situation aboard the airplane to an emergency, which required a more deliberate and cautious approach. The Safety Board recognizes that, from an operational perspective, the flight crew could not have known the extent of airplane damage. Although flight crews are trained in jammed stabilizer and runaway stabilizer scenarios, the loss of acme nut and screw engagement exceeded any events anticipated in emergency training scenarios, and the flight crew was not trained to devise or execute appropriate configurations and procedures to minimize further damage to the airplane or to prevent the accident. However, the flight crew’s earlier attempts to activate the trim motor and configuration changes may have worsened the situation. As previously discussed, the captain’s activation of the primary trim motor at 1609:16 precipitated the release of the jam and the initiation of the initial dive. However, it was not clear how many times previous to that the flight crew activated the primary trim motor nor was it clear whether or to what extent the prior activations hastened the release of the jam. Therefore, the Board could not determine the extent to which the activation of the primary trim motor played a role in causing or contributing to the accident. 2.2.5.5 Adequacy of Current Guidance The Safety Board notes that after the flight 261 accident, Boeing issued a flight operations bulletin outlining procedures to be followed in the event of an inoperative or malfunctioning horizontal stabilizer trim system. The bulletin advised flight crews to complete the flight crew operating manual (FCOM) checklist(s). Do not attempt additional actions beyond that contained in the checklist(s). If completing the checklist procedures does not result in operable trim system, consider landing at the nearest suitable airport. The Safety Board agrees that this advice is generally appropriate. However, the Board does not agree that the flight crew should merely “consider” landing at the nearest suitable airport if accomplishing the checklist items does not result in an operational trim system. In such a case, the flight crew should always land at the nearest suitable airport as expeditiously and safely as possible. Further, the bulletin provides additional information regarding the possibility that repeated or continuous use of the trim motors may result in thermal cutoff and states that the motor may reset after a cooling period.230 The Board is concerned that this additional information addressing repeated or continuous use of the trim motors may weaken or confuse the initial guidance to refrain from attempting troubleshooting measures beyond those specified in the checklist procedures. 230 For additional information about the content of the Boeing flight operations bulletin, see section 1.17.2.3.1.

Analysis 140 Aircraft Accident Report The Safety Board concludes that, without clearer guidance to flight crews regarding which actions are appropriate and which are inappropriate in the event of an inoperative or malfunctioning flight control system, pilots may experiment with improvised troubleshooting measures that could inadvertently worsen the condition of a controllable airplane. Accordingly, the Safety Board believes that the FAA should issue a flight standards information bulletin directing air carriers to instruct pilots that in the event of an inoperative or malfunctioning flight control system, if the airplane is controllable they should complete only the applicable checklist procedures and should not attempt any corrective actions beyond those specified. In particular, in the event of an inoperative or malfunctioning horizontal stabilizer trim system, after a final determination has been made in accordance with the applicable checklist that both the primary and alternate trim systems are inoperative, neither the primary nor the alternate trim motor should be activated, either by engaging the autopilot or using any other trim control switch or handle. Pilots should further be instructed that if checklist procedures are not effective, they should land at the nearest suitable airport.The Safety Board also believes that the FAA should direct all Certificate Management Offices (CMO) to instruct inspectors to conduct surveillance of airline dispatch and maintenance control personnel to ensure that their training and operations directives provide appropriate dispatch support to pilots who are experiencing a malfunction threatening safety of flight and instruct them to refrain from suggesting continued flight in the interest of airline flight scheduling. 2.3 Evaluation of Potential Reasons for Excessive Acme Nut Thread Wear As previously mentioned, the condition of the recovered acme nut thread remnants indicated that approximately 90 percent of the threads had worn away before the remainder of the threads sheared off.231 Further, calculations using the 0.033-inch end play measurement from the accident jackscrew assembly’s last end play check in September 1997 and an assumed total wear of 0.133 inch at the time the worn threads were sheared off indicated that the average wear rate of the accident acme nut threads between September 1997 and the time of the accident was 0.012 inch per 1,000 flight hours. As previously discussed, the expected wear rate is about 0.001 inch per 1,000 flight hours.232 Therefore, the Safety Board concludes that the acme nut threads on the accident airplane’s horizontal stabilizer jackscrew assembly wore at an excessive rate. There is, however, no reason to believe that this excessive rate was constant throughout this time period. In evaluating what could have caused the excessive wear of the accident acme nut threads, the Safety Board considered the potential effects of the following factors: (1) the use of Aeroshell 33 for lubrication of the jackscrew assembly, (2) acme screw thread 231 For more information about the condition of the recovered acme nut threads, see section 1.16.2.6. 232 This was the wear rate documented in 1967 test results for DC-8 and DC-9 jackscrew assemblies and was also the rate reported by McDonnell Douglas All Operators Letter (AOL) 9-2120A. For more information on these expected wear rates, see section 1.6.3.3.2.

Analysis 141 Aircraft Accident Report surface finish, (3) foreign debris, (4) abnormal loading of the acme nut threads, and (5) insufficient lubrication of the jackscrew assembly. 2.3.1 Use of Aeroshell 33 for Lubrication of the Jackscrew Assembly Task cards applicable to the lubrication of the accident jackscrew assembly for its last three scheduled lubrications (September 1999, January 1999, and June 1998) specified the use of Aeroshell 33. Findings from laboratory examinations of degraded grease found on the accident acme screw were consistent with the presence of Aeroshell 33, as well as the previously specified grease, Mobilgrease 28. Aeroshell 33 has properties that are different from those of Mobilgrease 28.233 Therefore, Safety Board investigators considered whether Alaska Airlines’ December 1997 switch to Aeroshell 33 might have caused the acme nut threads to wear faster. However, laboratory tests showed no significant adverse effects when Aeroshell 33 was used. Specifically, those tests indicated that the wear rates of test specimens lubricated with Aeroshell 33, or mixtures containing Aeroshell 33, were lower than those of test specimens lubricated with Mobilgrease 28.234 This finding is consistent with the fact that only three of Alaska Airlines’ acme nuts wore at an excessive rate after Aeroshell 33 was introduced in December 1997.235 None of the rest of the MD-80s in Alaska Airlines’ fleet showed any indication of excessive acme nut wear or any other anomalies that could be associated with the use of Aeroshell 33. Standardized grease testing conducted by the U.S. Navy’s Aerospace Materials Laboratory on mixtures of the two greases indicated that the grease mixture did not meet the industry standard for compatibility at the 90/10 and 10/90 ratios. However, test results showed that the incompatibility had an insignificant effect on the lubrication performance of the grease. These results were again confirmed by the limited number of acme nuts that wore at an excessive rate after Aeroshell 33 was introduced in September 1997. These grease mixtures would have been present on all Alaska Airlines MD-80s for some time during the switch from Mobilgrease 28 to Aeroshell 33; if Aeroshell 33 or mixtures containing Aeroshell 33 had a negative effect on acme nut wear, these effects would have been apparent throughout the fleet. Because the recovered accident acme screw and sheared nut thread remnants had some evidence of corrosion, the surface chemistry of aluminum-bronze acme nut material was evaluated. Tests conducted by the U.S. Navy’s Aerospace Materials Laboratory and Science Applications International Corporation determined that Aeroshell 33 was not 233 Boeing’s MD-80 Maintenance Manual specified the use of lubricants that meet the specifications of MIL-G-81322. Mobilgrease 28 meets these specifications, whereas Aeroshell 33 meets the specifications of MIL-G-23827. 234 For more information about these tests, see section 1.16.8.2. 235 Only three Alaska Airlines jackscrew assemblies are known to have worn at a higher-than-expected rate: the accident assembly and the assemblies from airplanes N981AS and N982AS. For more information about the acme nuts from airplanes N981AS and N982AS, see section 1.18.4.

Analysis 142 Aircraft Accident Report corrosive to aluminum bronze.236 It is noteworthy that none of the Alaska Airlines acme screws or nuts examined by the Safety Board that had been lubricated with Aeroshell 33, including those from two other Alaska Airlines airplanes that wore at an excessive rate, revealed evidence of corrosion. However, immersion of unlubricated metal surfaces in salt water is known to cause corrosion. Therefore, the corrosion on the acme screw and nut thread remnants was very likely caused by exposure to seawater during the 7 1/2 days before they were recovered, and the use of Aeroshell 33 to lubricate the jackscrew assembly was not a factor in the excessive wear of the accident acme nut. Nonetheless, because of the potential for improper lubrication practices and inappropriate grease selection to have adverse safety effects, the Safety Board continues to be concerned that Alaska Airlines began using Aeroshell 33, and the FAA did not object to its use, without sufficient research, testing, or followup tracking and evaluation of its in-service performance to demonstrate its acceptability.237 This lack of research, testing, and followup in connection with the December 1997 grease change is all the more disconcerting considering that, in April 1996, Alaska Airlines had significantly extended the lubrication interval for the horizontal stabilizer and associated components from 1,600 flight hours to 8 months (the equivalent of about 2,250 flight hours). That interval extension was presumably based on the conclusion that the previous long-term performance of the grease then in use (Mobilgrease 28) demonstrated that it would remain effective in those areas for the extended interval. However, Alaska Airlines had no previous experience with Aeroshell 33 in those areas and, therefore, could not have known whether this extended interval would also be appropriate for the performance of Aeroshell 33. 2.3.2 Acme Screw Thread Surface Finish Because of previous instances of excessive acme nut thread wear on MD-11 jackscrew assemblies resulting from improper acme screw thread surface finish,238 Safety Board investigators considered this as a possible factor in the excessive wear of the accident nut threads. However, a detailed metallurgical examination of the accident acme screw found no evidence that the thread surface finish was out of production specifications. 2.3.3 Foreign Debris Because the excessive wear of two Hawaiian Airlines DC-9 acme nuts was apparently associated with the presence of abrasive grit-blasting material in the jackscrew assembly,239 Safety Board investigators considered whether the abrasive effects of foreign 236 For more information about these tests, see section 1.16.8.2. 237 For more information about the circumstances regarding and the procedures followed for this grease change, see section 1.6.3.2.2. 238 For more information about these instances of premature wear on MD-11 jackscrew assemblies, see section 1.18.5. 239 For more information about these two acme nuts, see section 1.16.6.1.

Analysis 143 Aircraft Accident Report debris might have been a factor in the excessive wear of the accident acme nut threads. However, examinations and tests of grease samples taken from the accident acme screw found no evidence of foreign debris that would have abraded the acme nut threads during operation. Metallic particles found in grease residue from the acme nut’s grease fitting counterbore were from the nut itself and were consistent with sliding wear, not abrasive wear. Further, although the Hawaiian Airlines jackscrew assemblies showed evidence of abrasive wear on the acme screw threads and the underside of the acme nut threads, which normally do not wear, there was no such evidence on the accident acme screw and nut threads. Although the abrasive effects of foreign debris was not a factor in the excessive wear of the accident jackscrew assembly, the Safety Board remains concerned that this could play a role in the excessive wear of other jackscrew assemblies. This issue, and the related issue of the adequacy of the current end play check interval, are further discussed in section 2.4.2. 2.3.4 Abnormal Loading of the Acme Nut Threads Safety Board investigators also considered the possibility that abnormal loading on the jackscrew assembly may have caused the acme nut threads to wear excessively. This scenario was evaluated following reports from Alaska Airlines of a “wobbling” acme screw.240 The wobble appeared as a slight rocking motion of the acme nut as the screw was rotated within it. The investigators determined that the wobble in that and other jackscrew assemblies, including the accident jackscrew assembly, was associated with a torque tube wear band. It was hypothesized that this wobble might alter the engagement of the acme nut and screw threads, thus accelerating thread wear. However, analysis of the jackscrew assembly revealed that the gimbal rings, which hold the acme nut in place, accommodate any such wobble and prevent wobbling from resulting in any abnormal loading. This was confirmed when comparing wear rates of acme nuts from assemblies that had torque tubes with little or no wear band and those with deeper wear bands. The comparison showed no statistically significant difference in corresponding average wear rates. 2.3.5 Summary of Possibilities Ruled Out as Reasons for the Excessive Acme Nut Thread Wear As a result of the findings discussed in sections 2.3.1 through 2.3.4, the Safety Board concludes that Alaska Airlines’ use of Aeroshell 33 for lubrication of the jackscrew assembly, acme screw thread surface finish, foreign debris, and abnormal loading of the acme nut threads were not factors in the excessive wear of the accident acme nut threads. 240 For more information about the wobbling acme screw, see section 1.16.6.2.

Analysis 144 Aircraft Accident Report 2.3.6 Insufficient Lubrication of the Jackscrew Assembly It is generally understood that a lack of lubrication of moving parts significantly increases wear. Laboratory tests confirmed that the unlubricated wear rate of aluminum-bronze test specimens, under pressure conditions associated with the normal flight loads on the jackscrew assembly, was roughly 10 times higher than the wear rate of test specimens lubricated with any tested grease type or combination of greases.241 As discussed in section 1.6.3.3.2, previous instances of excessive and accelerated wear of DC-9 and MD-80 acme nuts has been attributed to, or associated with concerns about, insufficient lubrication. Thus, the accident acme nut threads’ excessive and accelerated wear is consistent with a lack of sufficient lubrication. Furthermore, as discussed below, there were additional indications that the accident jackscrew assembly had not been adequately lubricated before the accident. First, no evidence of any type of grease in any condition, either semi-fluid (that is, fresh) or dry/solid (that is, old/degraded), was found inside the acme nut or on the working region of the recovered acme screw.242 Further, in photographs taken immediately after recovery and during initial inspection of the jackscrew assembly, no grease is visible on the working areas of the acme screw. (See figures 12a and 12b.) Detailed metallurgical examination revealed only small flakes of dried and hardened grease attached to some of the acme nut thread remnants wrapped around the acme screw, but no evidence of grease capable of providing significant lubrication. These findings contradict the assertions of some Alaska Airlines representatives who stated that they observed or felt a greaselike substance on the surface of the acme screw immediately after it was recovered. However, the Safety Board notes that seawater, fuel, or hydraulic fluid from the accident wreckage could have caused the acme screw to appear shiny and that this sheen might have been mistaken for grease. To preserve the condition of the acme screw and thread remnants, they were rinsed with fresh water immediately after recovery, but that rinsing was accomplished by directing the water from a hose similar to a garden hose over the gearbox and allowing the water to flow down over the acme screw; the stream of water used to rinse the screw was not directly sprayed on it. The acme screw may have been rinsed again with a garden-type hose after it was brought on shore, but it was never subjected to any type of high-pressure wash. It should be noted that photographs of the acme screw taken after these rinses show sand still adhered to the surfaces. (See figure 14.) Although the jackscrew assembly had been immersed in seawater for 7 1/2 days before it was recovered, laboratory tests at the U.S. Navy’s Aerospace Materials Laboratory showed that immersion in seawater does not significantly alter or remove grease.243 This was demonstrated by the fact that semi-fluid grease was found adhered to 241 For more information about these tests, see section 1.16.8.3. 242 As previously stated, the acme screw working region is that part of the screw that can come in contact with the acme nut during its operation between the upper and lower mechanical stop limits. 243 For more information about these tests, see section 1.16.8.1.

Analysis 145 Aircraft Accident Report airplane components on the accident airplane even after they had been immersed in seawater for 7 1/2 days. Specifically, some evidence of semi-fluid grease was found outside the working region on the extreme lower end of the acme screw, and significant amounts of intact semi-fluid grease were visible on other airplane components. The Safety Board notes that a coating of grease was still clearly visible on an acme screw recovered from a China Northern MD-80 airplane that crashed on May 7, 2002, into a bay near Dalian, China.244 The acme screw from that airplane had been immersed in seawater for 5 days. Second, the recovered acme nut’s grease fitting passageway and counterbore contained a dried, black, claylike substance consistent with degraded grease. If the acme nut’s grease fitting had recently been used to lubricate the jackscrew assembly, as it should have been during the jackscrew assembly’s last lubrication on September 14, 1999 (as well as during all previous lubrications), the counterbore should have contained fresh grease. The contents of the counterbore area should not have been affected by impact or salvage damage because the area was protected externally by the grease fitting on one side and was isolated internally from direct contact on the bore side. Third, postaccident interviews with the SFO mechanic who was responsible for performing the last lubrication of the accident airplane’s horizontal stabilizer components, including the jackscrew assembly, revealed his lack of knowledge about how to properly perform the procedure. For example, he indicated that the lubrication task took about 1 hour, whereas Boeing documents and testimony indicated that, when properly done, the task should take more than 4 person hours. The SFO mechanic also stated that he did not recall checking to see if grease was coming out of the top of the acme nut, as specified in the general lubrication guidance. Further, in the recovered wreckage, about 40 percent of the other grease fittings on the elevators and horizontal stabilizer included on the same task card as the acme screw and nut contained either dry or semi-dry grease. In comparison, grease fittings on the rudder that had been lubricated in January 1999 by a different mechanic contained mostly fresh or semi-fresh grease. This suggests that the SFO mechanic who was responsible for lubricating the jackscrew assembly in September 1999 did not adequately perform the task. It is noteworthy that the other two Alaska Airlines jackscrew assemblies with higher-than-expected wear rates had received their last horizontal stabilizer lubrication servicing at OAK during C checks, but both had received the lubrication before that at SFO. The lubrication of one of those two assemblies at SFO was accomplished by the same mechanic who was responsible for the last lubrication of the accident airplane’s jackscrew assembly. On the basis of all of the factors discussed in this section, the Safety Board concludes that there was no effective lubrication on the acme screw and nut interface at the time of the Alaska Airlines flight 261 accident. Further, the Board notes that the inadequate lubrication of the accident jackscrew assembly was not an isolated occurrence. The recent discovery by Alaska Airlines of inadequately lubricated MD-80 rudder trim tab 244 The last scheduled lubrication of the jackscrew assembly on the China Northern airplane was during an A check that took place sometime between March 27 and April 2, 2002, and the specified grease was Aeroshell 5 (MIL-G-3545C).

Analysis 146 Aircraft Accident Report hinge support bearings245 demonstrates that deficiencies continue to exist in Alaska Airlines’ lubrication practices. 2.3.6.1 Analysis of How Many Recently Scheduled Lubrications Might Have Been Missed or Inadequately Performed Before the Accident The service history of Alaska Airlines’ MD-80 fleet indicates that jackscrew assembly lubrications remained effective for the 8-month lubrication interval (equivalent to approximately 2,550 flight hours) in effect before the accident. Otherwise, Alaska Airlines’ entire MD-80 fleet would have experienced excessive acme nut wear, which was not the case. At the time of the accident, only 4 months had elapsed since the accident airplane’s last scheduled jackscrew assembly lubrication in September 1999. The condition of the recovered jackscrew assembly, specifically, the absence of any grease inside the acme nut or on the working areas of the acme screw, and the degraded grease inside the acme nut’s grease fitting passageway and counterbore, indicates that at least that lubrication was missed or inadequate. Then number of lubrication opportunities beyond the one in September 1999 that might have been performed inadequately or missed entirely is less certain.246 However, it is apparent that the abnormally high wear of the accident acme nut threads likely occurred over a period of time that extended beyond the 4 months between the September 1999 lubrication and the accident date. Laboratory tests indicate that the wear rate for unlubricated parts247 cannot account for the amount of wear exhibited by the accident acme nut thread remnants if it had occurred only since the last scheduled lubrication. This indicates that unlubricated wear rates were likely experienced over a longer period of time and, therefore, more than just the last scheduled lubrication was missed or inadequately performed. The Safety Board could not determine exactly how many more scheduled lubrications were missed or inadequately performed. However, the Safety Board concludes that the excessive and accelerated wear of the accident jackscrew assembly acme nut threads was the result of insufficient lubrication, which was directly causal to the Alaska Airlines flight 261 accident. 2.3.6.2 Alaska Airlines’ Lubrication Interval Extension DC-9 test results and DC-8 service history indicated that frequent lubrication of the jackscrew assembly would allow the acme screw to meet its original design life of 30,000 flight hours. DC-9 certification documents, including Douglas Process Standard 3.17-49 (issued August 1, 1964), specified a lubrication interval for the 245 For more information, see section 1.6.3.2.3. 246 Because of the absence of any end play measurements since the October 1997 measurement, there is little upon which to base a wear rate estimate for periods of time beginning after the October 1997 measurement. Further uncertainty is introduced by the amount of wear exhibited by the thread remnants (approximately 90 percent of their original thickness had worn). The Safety Board’s FEA indicated that the load distribution, and thus the associated acme nut thread wear rates, changes dramatically after a wear of approximately 0.095 inch (approximately 74 percent worn), thereby invalidating the traditionally assumed relationship between end play and wear rate. 247 For more information about these tests, see section 1.16.8.3.

Analysis 147 Aircraft Accident Report jackscrew assembly of 300 to 350 flight hours. However, the 300- to 350-flight-hour recommended lubrication interval for the DC-9 was not contained in the manufacturer’s initial on-aircraft maintenance planning (OAMP) documents for the DC-9 or the MD-80. Instead, those documents specified a lubrication interval of 600 to 900 flight hours. As discussed in section 1.6.3.2.1.2, in 1987, Alaska Airlines’ lubrication interval for horizontal stabilizer components, including the jackscrew assembly, was every 500 flight hours, consistent with the manufacturer’s recommendation in the Maintenance Review Board (MRB) report and OAMP documents derived from Maintenance Steering Group (MSG)-2 guidance, which recommended a lubrication interval of 600 to 900 flight hours. In 1988, Alaska Airlines’ lubrication interval increased to every 1,000 flight hours (a 100 percent increase); in 1991, to every 1,200 flight hours (an additional 20 percent increase); and, in 1994, to every 1,600 flight hours (an additional 33 percent increase). In 1996, the interval was changed to 8 months with no specified flight-hour limit. Based on fleet utilization at the time, 8 calendar months equated to about 2,550 flight hours, an additional increase of greater than 59 percent. Thus, at the time of the accident, Alaska Airlines’ lubrication interval for the jackscrew assembly was more than 400 percent greater than it was in 1987. The investigation did not determine what type of information, if any, was presented as justification for the lubrication interval extensions in 1988, 1991, and 1994. However, according to the FAA principal maintenance inspector (PMI) for Alaska Airlines, who reviewed and accepted the 1996 interval extension, Alaska Airlines presented documentation of the manufacturer’s recently extended recommended interval as justification for its increase. (The extended recommended lubrication interval in the MRB report and OAMP document derived from the MSG-3 guidance was every C check, or every 3,600 flight hours.) Testimony at the Safety Board’s public hearing and Boeing documents indicated that the original design engineers’ recommended lubrication interval was not considered during the MRB-3 decision-making process regarding the extension of the manufacturer’s recommended interval. Further, Boeing design engineers were not consulted about nor aware of the extended 3,600-flight-hour MRB-3 recommended lubrication interval. Although Alaska Airlines’ extended lubrication and end play check intervals have now been superseded by the 650-flight-hour lubrication and 2,000-flight-hour end play check intervals specified in Airworthiness Directive (AD) 2000-15-15, the Safety Board is concerned that there is no mechanism in place to prevent similar unsafe interval extensions for other maintenance tasks. This issue and associated safety recommendations are discussed further in section 2.4.1. 2.3.6.2.1 Safety Implications of Lubrication Interval Extension As grease is used in a system, it loses its effectiveness over time and requires replacement. Longer lubrication intervals increase the likelihood that a missed or inadequate lubrication will result in excessive wear. Conversely, shorter lubrication intervals increase the likelihood that, even if a lubrication is missed or inadequately performed, the existing grease will remain effective until the next scheduled lubrication.

Analysis 148 Aircraft Accident Report The Safety Board notes that at the time of Alaska Airlines’ increase to an 8-month lubrication interval, it was the only U.S. airline that had a calendar-time lubrication interval with no accompanying flight-hour limit and no specification, “whichever comes first.” A calendar-time lubrication interval can degrade the margin of safety because wear is directly related to aircraft usage, or flight hours, and not to calendar time. Also, a purely calendar-based interval does not account for increases in flight hours that result from increased airplane utilization. Conversely, intervals based on flight hours, or on calendar time with an accompanying flight-hour time limit and the proviso, “whichever comes first,” ensure that the flight-hour limit will not be exceeded as a result of increased airplane utilization. Thus, unless a maximum utilization is also specified, calendar-time intervals are inappropriate for certain tasks, such as lubrication or inspections for fatigue, when component deterioration is related to usage, not time.248 In sum, at the time of the accident, Boeing’s recommended lubrication interval for the MD-80 jackscrew assembly was every 3,600 flight hours, about 4 to 6 times longer than Douglas’ original recommendation in the MSG-2 OAMP document of every 600 to 900 flight hours. Alaska Airlines’ lubrication interval for the MD-80 jackscrew assembly—although it was still less than the manufacturer’s recommended interval in the MSG-3 OAMP document of 3,600 flight hours—was about 3 to 4 times longer than Douglas’ originally recommended lubrication interval, resulting in a significant decrease in the MD-80 fleet’s ability to tolerate missed or inadequate lubrications. The Board notes that the negative safety implications of the ongoing lubrication interval extensions were magnified by the simultaneous ongoing extensions of the end play check interval in that there would be fewer and fewer opportunities to discover and address any excessive wear resulting from lubrication deficiencies. Therefore, the Safety Board concludes that Alaska Airlines’ extensions of its lubrication interval for its MD-80 horizontal stabilizer components and the FAA’s approval of these extensions, the last of which was based on Boeing’s extension of the recommended lubrication interval, increased the likelihood that a missed or inadequate lubrication would result in excessive wear of jackscrew assembly acme nut threads and, therefore, was a direct cause of the excessive wear and contributed to the Alaska Airlines flight 261 accident. 2.3.6.3 Adequacy of Lubrication Procedures The horizontal stabilizer lubrication procedure specifies that, after the access doors are opened, grease is to be applied to the acme nut grease fitting under pressure. The procedure further specifies the brush application of a light coat of grease to the acme screw threads and operation of the trim system through its full range of travel to distribute the grease over the length of the acme screw. 248 In contrast, some maintenance tasks are intended to prevent or control conditions (such as corrosion or deterioration based on aging) that are based solely on the passage of time. Such tasks might appropriately be tied to calendar-time intervals without any flight-hour limits.

Analysis 149 Aircraft Accident Report Safety Board investigators observed maintenance personnel from two MD-80 operators perform jackscrew assembly lubrications and discussed the lubrication procedure with those and other maintenance personnel from those operators. Investigators noted many differences in the methods used by the personnel to accomplish certain steps in the lubrication procedure, including the manner in which grease was applied to the acme nut fitting and screw and the number of times the trim system was cycled to distribute the grease. Several of the methods observed by or reported to investigators did not involve application of grease to the entire length of the acme screw and cycling the trim system several times. Laboratory demonstrations designed to compare the effectiveness of various methods of lubricating the jackscrew assembly found that application of a complete coating of grease over all exposed threads, filling the thread valleys, followed by the cycling of the trim system several times, maximized the distribution of the grease over the length of the acme screw. In contrast, the observations and demonstrations established that applying grease only through the acme nut grease fitting and then cycling the trim system several times did not distribute an adequate amount of grease over the remainder of the acme screw. Although both methods of grease application are specified in the lubrication procedure, if a mechanic mistakenly believed that lubricating only through the acme nut grease fitting was adequate, the acme screw and nut would receive insufficient lubrication. The extent to which these deficiencies in the lubrication procedure may have played a role in the inadequate lubrication of the accident jackscrew assembly could not be determined. However, in an October 1, 2001, safety recommendation letter, the Safety Board expressed its concern that the current lubrication procedure was not adequate to ensure consistent and thorough lubrication of the jackscrew assembly by all operators and issued Safety Recommendation A-01-41, which asked the FAA to require Boeing to “revise the lubrication procedure for the horizontal stabilizer trim system of Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 series airplanes to minimize the probability of inadequate lubrication.” In a December 12, 2001, letter, the FAA responded that it agreed with the intent of Safety Recommendation A-01-41 and that it was “working with the Boeing Commercial Airplane Group to rewrite the lubrication procedures to the optimal standard.” On June 14, 2002, the Safety Board classified the recommendation “Open—Acceptable Response.” After the issuance of Safety Recommendation A-01-41, Safety Board investigators continued to evaluate the adequacy of the current lubrication procedure and identified three additional areas that should be addressed. First, the Safety Board is concerned about the wear debris produced as a result of the wear process and other foreign debris that may accumulate in the grease over time. Because material that infiltrates the working grease reduces its lubricating effectiveness, it is desirable to flush out these materials before fresh grease is added (that is, to completely replace used, less effective grease with fresh, more effective grease).249 The Board notes that the current jackscrew lubrication procedure does not stipulate the removal of used grease from the acme screw before the application of fresh grease.250 The Board is aware that Boeing is developing a revised lubrication procedure for the jackscrew assembly that

Analysis 150 Aircraft Accident Report includes removal of the used grease before application of the fresh grease. Although the revised procedure, if properly performed, should improve the effectiveness of the lubrication, it is not yet known whether the FAA will require the use of this improved procedure. The Safety Board concludes that when lubricating the jackscrew assembly, removal of degraded grease from the acme screw before application of fresh grease will increase the effectiveness of the lubrication. Therefore, the Safety Board believes that as part of the response to Safety Recommendation A-01-41, the FAA should require operators of DC-9, MD-80/90, and 717 series airplanes to remove used grease from the jackscrew assembly acme screw and flush degraded grease and particulates from the acme nut before applying fresh grease. Second, Safety Board investigators noted that when they attempted to perform the lubrication procedure, it was difficult to insert a hand through the access panel openings because of their size.251 They further noted that after a hand was inserted, it blocked the view of the jackscrew assembly, requiring the task to be accomplished primarily by “feel.” The Board is aware that Boeing is developing a modification for an expanded access panel. The Safety Board concludes that a larger access panel would facilitate the proper accomplishment of the jackscrew assembly lubrication task. Therefore, the Safety Board believes that, as part of the response to Safety Recommendation A-01-41, the FAA should require operators of DC-9, MD-80/90, and 717 series airplanes, in coordination with Boeing, to increase the size of the access panels that are used to accomplish the jackscrew assembly lubrication procedure. Third, this investigation has highlighted the need for improved methods for ensuring that jackscrew assembly lubrications are accomplished properly at scheduled lubrication intervals. Currently, the lubrication procedure is generally performed and signed off by a single maintenance technician, and that technician’s work is not required to be inspected. Although the Safety Board cannot be certain that such a requirement would have prevented the Alaska Airlines flight 261 accident, the Safety Board concludes that if the jackscrew assembly lubrication procedure were a required inspection item for which an inspector’s signoff is needed, the potential for unperformed or improperly performed lubrications would be reduced. Therefore, because of the critical importance of adequately lubricating the jackscrew assembly and the potentially catastrophic effects of excessive acme nut wear resulting from insufficient lubrication, the Safety Board believes that the 249 This finding was further supported by interviews with representatives of the largest manufacturer of nonaviation jackscrew assemblies, Nook Industries. Nook representatives told Safety Board investigators that purging old grease out of the jackscrew assembly, and then refreshing the acme screw with new grease, increases the life of the acme nut. 250 The current jackscrew lubrication procedure does call for the application of new grease into the nut, via the grease fitting, until grease is observed extruding from the nut; however, this does not remove the old grease from the acme screw surface or a large portion of the nut. 251 Two access panel openings (one 4 inches by 6 inches and the other 8 inches by 7 inches) are generally used to accomplish the lubrication procedure.

Analysis 151 Aircraft Accident Report FAA should establish the jackscrew assembly lubrication procedure as a required inspection item that must have an inspector’s signoff before the task can be considered complete. 2.4 Monitoring Acme Nut Thread Wear Because the MD-80 jackscrew assembly’s structural function is critical to the safety of flight, and that structural function cannot be maintained without proper acme nut and screw thread engagement, it is essential that acme nut thread wear be regularly monitored. The failure to adequately monitor acme nut thread wear may result in continued operation of an airplane with excessive nut thread wear. As demonstrated by the Alaska Airlines flight 261 accident, because no other structure performs the function of the jackscrew assembly, the loss of acme nut and screw engagement as a result of excessive wear will most likely have catastrophic results. As previously discussed, in-service acme nut thread wear is monitored by performing an on-wing end play check procedure at specified intervals. Before 1967, there were no required periodic inspections. The jackscrew assembly had an expected service life of 30,000 hours, at which time the end play measurement was expected to be 0.0265 inch. However, as a result of higher-than-expected wear rates reported in 1966, in 1967, Douglas developed the end play check procedure and increased the maximum permissible end play measurement at which a jackscrew assembly could remain in service to 0.040 inch. (The minimum end play measurement remained at 0.003 inch.)252 In AOL 9-48A, Douglas stated that jackscrew assemblies could remain in service as long as the end play measurement remained within these tolerances. 2.4.1 Alaska Airlines’ Preaccident End Play Check Intervals Alaska Airlines has consistently required end play checks at every other C check. However, the length of its C-check interval has changed over time. As a result of those C-check interval changes, between 1985 and 1996 Alaska Airlines increased its end play check interval by almost 200 percent. In 1985, when Alaska Airlines’ MD-80 maintenance program was initially approved by the FAA, C checks were conducted every 2,500 flight hours; therefore, end play checks were performed every 5,000 flight hours. By July 1988, C-check intervals had been extended to 13 months, with no corresponding flight-time limit; therefore, end play checks were performed every 26 months, which was approximately 6,400 flight hours, based on the airplane utilization rate at that time. Although FAA approval would have been required for this C-check interval extension, no information was available regarding what documentation, if any, Alaska Airlines presented to the FAA to justify the extension. 252 As discussed in section 1.6.3.3.2, as a result of these higher-than-expected wear rates, Douglas also changed some of the materials specifications and manufacturing processes for the acme screw (increased heat treating and nitriding) to reduce wear.

Analysis 152 Aircraft Accident Report In 1996, Alaska Airlines’ C-check interval was extended to 15 months; therefore, end play checks were only required every 30 months. Because Alaska Airlines’ airplane utilization had also increased, this 30-month interval was equivalent to approximately 9,550 flight hours. Alaska Airlines sought and obtained advance FAA approval for this C-check interval extension. Alaska Airlines’ director of reliability and maintenance programs testified at the public hearing that Alaska Airlines had presented the FAA with a data analysis package based on the maintenance histories of five sample airplanes to justify the C-check interval extension. He indicated that individual maintenance tasks tied to C-check intervals (such as the end play check) were not separately considered in connection with the extension.253 Thus, the FAA’s approval of the 1996 C-check extension also effectively constituted approval to extend the end play check from 26 to 30 months, a 15 percent increase, and, more importantly, a 55 percent increase in flight-hour intervals, from approximately 6,400 to 9,550 flight hours. Although Alaska Airlines’ extended 30-month end play check interval was consistent with the manufacturer’s recommended calendar-time limit, the resulting 9,550-flight-hour interval far exceeded the manufacturer’s recommended flight-hour interval, which at that time was 7,000 or 7,200 flight hours (depending on whether MSG-2 or MSG-3 guidance was used). At that time, Alaska Airlines had the second highest end play check interval of all operators of DC-9, MD-80/90, and 717 series airplanes. Further, Alaska Airlines was the only U.S. carrier at that time that did not have an accompanying flight-hour limit with the specification, “whichever comes first,” for its end play check interval. As discussed previously in connection with Alaska Airlines’ lubrication interval, use of only a calendar-time interval does not account for increased airplane utilization rates and could result in a lower safety margin than intended. The Safety Board notes that, because of Alaska Airlines’ extended end play check interval of 30 months, or about 9,550 flight hours, after the accident airplane’s last end play check in September 1997, the jackscrew assembly would not have been required to undergo another end play check until March 2000. Between the time that the 0.040- and 0.033-inch end play measurements were recorded in September 1997 and the time of the accident, the airplane had been flown for 28 months, nearly 9,000 flight hours. During this time, the acme nut thread wear progressed to failure. In light of what has been learned in this investigation, it is now apparent that the manufacturer’s previously recommended end play check intervals of 7,000 or 7,200 flight hours were not adequate.254 Nonetheless, the Safety Board notes that if Alaska Airlines had not extended its end play check interval to beyond the recommended interval, the airplane would have been required to undergo an end play check at least 1,800 to 2,000 flight hours before the accident, and the excessive end play could have been identified at 253 However, based on the history of maintenance discrepancies noted for the five sample airplanes, two maintenance tasks were identified as inappropriate for extension, and these tasks were converted to stand-alone items to be performed at shorter intervals. The two maintenance tasks identified as requiring shorter intervals based on service history were (1) lubrication of the bent-up, trailing-edge wing doors and (2) lubrication of the bearings and bushings in the elevator hinges. 254 This issue is discussed further in the next section.

Analysis 153 Aircraft Accident Report that time. Thus, the Safety Board concludes that Alaska Airlines’ extension of the end play check interval and the FAA’s approval of that extension allowed the accident acme nut threads to wear to failure without the opportunity for detection and, therefore, was a direct cause of the excessive wear and contributed to the Alaska Airlines flight 261 accident. 2.4.1.1 Adequacy of Existing Process for Establishing Maintenance Task Intervals The Safety Board is concerned that the absence of any significant maintenance history pertaining to the jackscrew assembly was apparently considered by Alaska Airlines and the FAA as sufficient justification to extend the end play check interval as part of the C-check interval extension. In general, the absence of maintenance history should not be considered adequate justification to extend the interval for the performance of a critical maintenance task. Any significant maintenance change associated with a critical flight control system should be independently analyzed and supported by technical data demonstrating that the proposed change will not present a potential hazard. Therefore, any maintenance task change related to the jackscrew assembly, which is an essential element of a critical flight control system, should be handled in this manner. The Safety Board is further concerned that the MSG and MRB-based process by which manufacturers develop initial and revised recommended maintenance task intervals255 resulted in significant extensions of both the lubrication and end play check intervals without any such analysis or support. As discussed in section 1.6.3.2.1, testimony at the Safety Board’s public hearing and Boeing documents indicated that Douglas’ original recommended lubrication interval of 600 to 900 flight hours was not considered during the MSG-3 decision-making process to extend the recommended interval to 3,600 hours. Further, Boeing design engineers were not consulted about nor aware of the escalated lubrication interval specified in the MSG-3 documents. The FAA’s MD-80 MRB chairman testified at the public hearing that the escalation of C-check intervals in the MSG-3 MD-80 MRB did not involve a task-by-task analysis of each task (such as the jackscrew lubrication task and end play check) that would be affected by the changed interval. The Safety Board concludes that Alaska Airlines’ end play check interval extension should have been, but was not, supported by adequate technical data to demonstrate that the extension would not present a potential hazard. The Safety Board further concludes that the existing process by which manufacturers revise recommended maintenance task intervals and by which airlines establish and revise these intervals does not include task-by-task engineering analysis and justification and, therefore, allows for the possibility of inappropriate interval extensions for potentially critical maintenance tasks. In addition, the Board notes that the FAA plays a limited role in this process compared to the role it plays in the initial certification process. 255 For more information about this process, see section 1.6.3.1.1.

Analysis 154 Aircraft Accident Report Therefore, the Safety Board believes that the FAA should review all existing maintenance intervals for tasks that could affect critical aircraft components and identify those that have been extended without adequate engineering justification in the form of technical data and analysis demonstrating that the extended interval will not present any increased risk and require modification of those intervals to ensure that they (1) take into account assumptions made by the original designers, (2) are supported by adequate technical data and analysis, and (3) include an appropriate safety margin that takes into account the possibility of missed or inadequate accomplishment of the maintenance task. In conducting this review, the FAA should also consider original intervals recommended or established for new aircraft models that are derivatives of earlier models and, if the aircraft component and the task are substantially the same and the recommended interval for the new model is greater than that recommended for the earlier model, treat such original intervals for the derivative model as “extended” intervals. The Safety Board further believes that the FAA should conduct a systemic industrywide evaluation and issue a report on the process by which manufacturers recommend and airlines establish and revise maintenance task intervals and make changes to the process to ensure that, in the future, intervals for each task (1) take into account assumptions made by the original designers, (2) are supported by adequate technical data and analysis, and (3) include an appropriate safety margin that takes into account the possibility of missed or inadequate accomplishment of the maintenance task. The Safety Board also believes that the FAA should require operators to supply the FAA, before the implementation of any changes in maintenance task intervals that could affect critical aircraft components, technical data and analysis for each task demonstrating that none of the proposed changes will present any potential hazards, and obtain written approval of the proposed changes from the PMI and written concurrence from the appropriate FAA Aircraft Certification Office. 2.4.2 Adequacy of Current End Play Check Intervals The Safety Board recognizes that the FAA acted promptly following the Alaska Airlines flight 261 accident by issuing ADs that shortened the end play check interval to 2,000 flight hours. However, evidence collected during this investigation suggests that acme nut thread wear at a higher-than-expected rate could allow a potentially dangerous level of wear to occur in less than 2,000 hours. As previously discussed, two jackscrew assemblies installed sequentially on the same Hawaiian Airlines DC-9 airplane that were removed because of high end play measurements were found to have worn at an unprecedented rate. The first acme nut had an approximate wear rate of 0.015 inch per 1,000 flight hours, and the second had an approximate wear rate of 0.008 inch per 1,000 flight hours.256 These wear rates are about 15 and 8 times greater, respectively, than the expected wear rate of about 0.001 inch per 1,000 flight hours. This accelerated wear was attributed to the presence of grit-blasting 256 For more information about these jackscrew assemblies, see section 1.16.6.1.

Analysis 155 Aircraft Accident Report material that had been introduced inadvertently into the jackscrew assembly and become embedded in the grease on the acme screw. If the first excessively worn jackscrew assembly had measured just within, rather than beyond, the 0.040-inch limit at the last end play check, and assuming the acme nut threads had continued to wear at an approximate rate of 0.015 inch per 1,000 flight hours, the end play measurement would have been about 0.069 inch by the time of its next scheduled end play check 2,000 flight hours later. Further, assuming that this end play check was either missed or improperly accomplished and the jackscrew assembly remained in service despite an end play of 0.069 inch and continued to wear at the same rate, the end play measurement would have been about 0.099 inch by the time of the next scheduled end play check. Moreover, there is no basis for assuming that the wear rate of this Hawaiian Airlines jackscrew assembly represents the maximum possible acme nut thread wear rate. Just as the wear rate and wear mechanism on the Hawaiian Airlines jackscrew assembly was unprecedented and unanticipated, there may be other unprecedented and unanticipated wear rates and mechanisms that could also result in excessive or accelerated wear. Therefore, it is possible that acme nut threads could wear at an even faster rate than the Hawaiian Airlines acme nut threads, possibly even to catastrophic limits257 in 2,000 flight hours. To establish an appropriately conservative end play check interval, the uncertainties regarding possible wear mechanisms and the maximum possible wear rate must be considered in addition to the significant possibility of inaccurate end play measurements. The Safety Board notes that, when failure mechanisms are known and clearly defined, standard industry practice to ensure a damage tolerant design is to have a safety margin that allows for two complete inspection cycles before the predicted failure time.258 Thus, even if one inspection is missed or inadequately performed, there will be at least one other opportunity to detect and correct the condition. However, when uncertainties exist in the failure mechanism, as in the case of acme nut thread wear, standard industry practice is to increase the safety margin to account for the reduced level of confidence in the predicted failure time. In a June 26, 2001, letter to the Safety Board, the FAA stated that it believed the 2,000-flight-hour interval provided an acceptable level of safety, citing the “robust design” of the acme nut and the fact that it could safely carry normal flight loads even when worn beyond 0.080 inch. The FAA also stated that the 650-flight-hour inspection and 257 According to the Safety Board’s study of thread stress and deformation, the acme nut threads will begin to deflect and begin the process of sliding over the acme screw threads at a wear level of about 0.093 inch. 258 According to the FAA’s Damage Tolerance Assessment Handbook, Volume I, issued in February 1999, “damage tolerance refers to the ability of the design to prevent structural cracks from precipitating catastrophic fracture when the airframe is subjected to flight or ground loads. Transport category airframe structure is generally made damage tolerant by means of redundant (‘fail safe’) designs for which the inspection intervals are set to provide at least two inspection opportunities per number of flights or flight hours it would take for a visually detectable crack to grow large enough to cause a failure in flight.” Although this refers to cracks, the Safety Board notes that the damage tolerance principles can be applied to acme nut wear.

Analysis 156 Aircraft Accident Report lubrication interval in AD 2000-15-15 provided frequent opportunities (in addition to the end play check every 2,000 flight hours) to detect wear debris and, therefore, possible excessive wear. Nonetheless, the Safety Board is concerned that significantly higher-than-expected wear—wear even greater than that of the Hawaiian Airlines jackscrew assemblies—could result from foreign-object contamination, such as grit blast, or from other factors that have not yet been identified. The Safety Board concludes that, because of the possibility that higher-than-expected wear could cause excessive wear in less than 2,000 flight hours and the additional possibility that an end play check could be not performed or improperly performed, the current 2,000-flight-hour end play check interval specified in AD 2000-15-15 may be inadequate to ensure the safety of the DC-9, MD-80/90, and 717 fleet. Therefore, the Safety Board believes that, pending the incorporation of a fail-safe mechanism in the design of the DC-9, MD-80/90, and 717 horizontal stabilizer jackscrew assembly, as recommended in Safety Recommendation A-02-49 in this report, the FAA should establish an end play check interval that (1) accounts for the possibility of higher-than-expected wear rates and measurement error in estimating acme nut thread wear and (2) provides for at least two opportunities to detect excessive wear before a potentially catastrophic wear condition becomes possible. To establish an appropriate end play check interval, it is necessary to monitor end play measurements over time to identify any excessive or unanticipated wear rates and to continue evaluating the reliability and validity of end play measurements. Therefore, the FAA, Boeing, maintenance facilities that overhaul jackscrew assemblies, and operators should closely evaluate the measurement data currently being reported pursuant to AD 2000-15-15. The Safety Board concludes that the continued collection and analysis of end play data are critical to monitoring acme nut thread wear and identifying excessive or unexpected wear rates, trends, or anomalies. Therefore, the Safety Board believes that the FAA should require operators to permanently (1) track end play measurements according to airplane registration number and jackscrew assembly serial number, (2) calculate and record average wear rates for each airplane based on end play measurements and flight times, and (3) develop and implement a program to analyze these data to identify and determine the cause of excessive or unexpected wear rates, trends, or anomalies. The Safety Board further believes that the FAA should require operators to report this information to the FAA for use in determining and evaluating an appropriate end play check interval. 2.4.3 Adequacy of End Play Check Procedure As discussed in the Safety Board’s October 1, 2001, safety recommendation letter and its end play data study report, dated March 18, 2002, the current end play check procedure259 is subject to considerable measurement error. Safety Board investigators observed end play checks performed by maintenance personnel from several MD-80 operators and identified numerous potential sources for inaccurate end play measurements. Specifically, it was noted that the accuracy of the results could be affected by deviations in one or more of the following areas: (1) calibration and interpretation of

Analysis 157 Aircraft Accident Report the dial indicator; (2) installation of the dial indicator; (3) application and direction of the specified torque to the restraining fixture; (4) calibration of the torque wrench; (5) fabrication, lubrication, and maintenance of the restraining fixture; (6) rotation of the acme screw within its gearbox during the procedure; and (7) the individual mechanic’s knowledge of the procedures. According to the Board’s end play data study report, end play measurement inaccuracies can be as high as 0.030 inch, and errors can occur in either direction.260 Further, an additional source of end play measurement error was possible at Alaska Airlines before August 2000 because its fabricated end play restraining fixture was not based on Boeing design specifications.261 Although there was only one such fixture at Alaska Airlines’ maintenance facilities at the time of the accident,262 11 additional restraining fixtures were made in-house after the accident despite an April 2000 Boeing message to all DC-9, MD-80, MD-90, and 717 operators asking them to ensure that their horizontal stabilizer inspection tooling conformed “to the tool’s drawing requirements.” The Alaska Airlines manager of tool control, who participated in the fabrication of the restraining fixtures ordered by airline management after the accident, told Safety Board investigators that “what they were making wasn’t even close” to the Boeing drawing. In August 2000, following inquiries from Safety Board staff about which restraining fixture was used during the September 1997 end play check, Alaska Airlines notified the FAA that it was concerned that the restraining fixtures it had manufactured in-house might not be “an equivalent substitute” for the Boeing fixture. Alaska Airlines suspended use of the in-house manufactured restraining fixtures, quarantined all non-Boeing manufactured fixtures, and temporarily removed from service 18 airplanes that had been checked with these fixtures. The results of Safety Board testing indicated that Alaska Airlines’ fabricated restraining fixtures could yield end play measurements that were lower than measurements obtained with a Boeing-manufactured fixture.263 Therefore, it is possible that the 0.040- and 0.033-inch end play measurements obtained during the accident airplane’s September 1997 end play check were less than the actual end play and that the accident jackscrew assembly in fact exceeded the 0.040-inch end play measurement limit 259 As discussed in section 1.6.3.3.2, the end play procedure calls for pulling down on the horizontal stabilizer by applying a specified amount of torque to a tool known as a restraining fixture to change the load on the acme screw from tension to compression. The load reversal allows movement, or play, between the acme screw and nut threads that is measured using a dial indicator, which is mounted on the lower rotational stop (fixed to the screw) with the movable plunger set against the lower surface of the acme nut that measures the relative vertical movement between the acme screw and the nut when the loads are applied. The amount of movement, or end play, is used as an indication of the amount of acme nut thread wear (and acme screw thread wear, if there is any). The procedure calls for the restraining fixture load to be applied and removed several times until consistent measurements are achieved. 260 For more information, see table 5 in the Safety Board’s end play data study report in the public docket for this accident. 261 For more information about Alaska Airlines’ fabricated restraining fixtures, see section 1.6.3.3.3.2. 262 The Safety Board recognizes that Alaska Airlines contends in its submission that the restraining fixture used during the September 1997 end play check was a Douglas fixture. However, evidence gathered in the Board’s investigation does not support this contention.

Analysis 158 Aircraft Accident Report at the time of the 1997 check. It is also possible that a Boeing-manufactured restraining fixture would have yielded a more accurate reading, which could have resulted in the jackscrew assembly being removed from service. However, as discussed previously, even when a restraining fixture manufactured to Boeing specifications is used, there is still a potential for inaccurate measurements. Therefore, the Safety Board concludes that, until August 2000, Alaska Airlines used a fabricated restraining fixture that did not meet Boeing specifications; however, the Board could not determine whether the use of this noncompliant fixture generated an inaccurate end play measurement during the last end play check or whether the use of this fixture contributed to the accident. In Safety Recommendations A-01-42 and -44, the Safety Board asked the FAA to do the following: Require the Boeing Commercial Airplane Group to revise the end play check procedure for the horizontal stabilizer trim system of Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 series airplanes to minimize the probability of measurement error and conduct a study to empirically validate the revised procedure against an appropriate physical standard of actual acme screw and acme nut wear. This study should also establish that the procedure produces a measurement that is reliable when conducted on-wing. (A-01-42) Require maintenance personnel who inspect the horizontal stabilizer trim system of Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 series airplanes to undergo specialized training for this task. This training should include familiarization with the selection, inspection, and proper use of the tooling to perform the end play check. (A-01-44) In its December 12, 2001, response letter, the FAA indicated that it had asked Boeing to revise the end play check procedure, and the Safety Board is aware that Boeing is currently developing improved end play check procedures. Regarding Safety Recommendation A-01-44, the FAA stated that it believed that “current regulatory requirements of 14 CFR [Code of Federal Regulations] 121.375 adequately address maintenance training programs” but that the agency was “revising Advisory Circular [AC] 120-16C, Continuous Airworthiness Maintenance Programs, to expand the intent of the requirement for maintenance training programs.” In addition, the FAA stated that it believed that “current regulatory requirements of 14 CFR 65.81 and 14 CFR 65.103 adequately address the inspection requirements for maintenance personnel and repairmen.” The FAA concluded that “current regulatory requirements in place to require maintenance training programs and inspection requirements for maintenance personnel and repairmen address the full intent of these safety recommendations.” 263 Alaska Airlines’ fabricated restraining fixture did not result in a lower measurement than the Boeing fixture on every occasion during the testing. However, Safety Board investigators determined that the discrepancies, when they existed, could be as high as 0.005 inch and were likely caused by the fabricated restraining fixture’s increased length of thread engagement, which created friction that required more torque than the Boeing-manufactured fixture.

Analysis 159 Aircraft Accident Report On June 14, 2002, the Safety Board classified Safety Recommendation A-01-42 “Open—Acceptable Response,” pending revisions to the end play check procedure. In its letter, the Board classified Safety Recommendation A-01-44 “Open—Unacceptable Response,” stating that it “continues to believe that current FAA regulations do not result in maintenance personnel being properly trained to perform lubrication and end play inspection of the acme screw and nut assembly” and urged the FAA to reconsider its decision. The Safety Board is aware of technologies that could potentially provide more reliable and accurate indications of acme nut thread wear than the end play check procedure. For example, as a result of this accident, Sandia National Laboratories, with FAA funding, began exploring two new methods for monitoring thread wear that involved the use of nondestructive technology. One of these methods used a portable x-ray fixture that could be installed next to the acme screw and nut to provide a graphic depiction of all of the threads. The other method used a small ultrasonic sensor that could be passed over the acme nut to obtain a graphic depiction of the thread crests on a handheld screen. The Safety Board concludes that the on-wing end play check procedure, as currently practiced, has not been validated and has low reliability. In this regard, the Board will continue to monitor the FAA’s and Boeing’s actions in response to Safety Recommendations A-01-42 and -44. 2.5 Deficiencies of Jackscrew Assembly Overhaul Procedures and Practices The accident jackscrew assembly was never overhauled nor was it required to be. However, to determine the adequacy of maintenance and inspection procedures applicable to all DC-9, MD-80/90, and 717 jackscrew assemblies, Safety Board investigators evaluated jackscrew assembly overhaul procedures and practices. Specifically, investigators reviewed the DC-9 Overhaul Maintenance Manual and visited several maintenance facilities that overhaul jackscrew assemblies, including Integrated Aerospace, the only contract facility currently used by Boeing to overhaul acme nut and screw pairs to manufacturing end play specifications.264 Safety Board investigators identified several deficiencies in the DC-9 Overhaul Maintenance Manual procedures and in the practices of several of the maintenance facilities that were visited. Specifically, the overhaul manual did not require the use of work cards documenting each step in the overhaul process, and (with the exception of Integrated Aerospace) the facilities did not use such work cards. Also, the manual called for replacement of the acme nut only if the end play measurement was more than 0.040 inch. Although some overhaul facilities had lower self-imposed end play measurement limits for replacement of the acme nut, at least one facility indicated that it 264 For more information about the DC-9 Overhaul Maintenance Manual and Safety Board investigator visits to maintenance facilities, see section 1.18.8.

Analysis 160 Aircraft Accident Report would return an overhauled jackscrew assembly to a customer as long as the end play measurement did not exceed 0.040 inch. Further, the manual contained no requirement to record or inform the customer of the end play measurement of an overhauled jackscrew assembly. This means that a jackscrew assembly with an end play measurement of up to 0.039 inch could be represented as “overhauled” and returned to service by an operator that might not be aware of the high end play measurement.265 A jackscrew assembly could require overhaul for reasons other than excessive end play; however, it would be reasonable for a customer to expect that an assembly would be returned after an overhaul with an end play close to manufacturing specifications. Further, the required steps for properly conducting the end play check procedure were not well described and the required equipment was not specified in the DC-9 Overhaul Maintenance Manual. During visits to maintenance facilities, Safety Board investigators learned that the facilities used different methods and various tools for measuring end play. (Although investigators saw no evidence that the differences affected the accuracy of the results, the lack of standardization nonetheless increases the potential for error to occur.) The overhaul manual also did not contain detailed instructions on how to apply grease to the jackscrew assembly at the completion of the overhaul nor did it clearly specify which type of grease to use. Further, although the manual does require that an overhauled jackscrew assembly be lubricated before it can be returned to the customer, investigators learned that at least one maintenance facility returns overhauled assemblies without lubricating them first. In addition, the DC-9 Overhaul Maintenance Manual did not contain detailed instructions nor specify appropriate equipment for checking that the proper acme screw thread surface finish had been applied. Many of the maintenance facilities visited by Safety Board investigators indicated that they relied on subvendors to ensure that the proper acme screw thread surface finish was applied and had no standard method for verifying that this action had occurred. Finally, the DC-9 Overhaul Maintenance Manual did not clearly specify appropriate packaging procedures for transporting jackscrew assemblies after overhaul. Although the overhaul manual contained detailed protective packaging instructions for jackscrew assemblies going into “storage,” it did not specify any such protective packaging for jackscrew assemblies being transported. However, it would be prudent to use protective packaging for all overhauled jackscrew assemblies being returned to a customer because a maintenance facility cannot be expected to know what the customer intends to do with an assembly after it is returned. Integrated Aerospace, the only maintenance facility authorized by Boeing to overhaul the acme nut and screw to an “as new” end play condition that meets 265 Although the DC-9 Overhaul Maintenance Manual calls for more frequent end play checks (every 1,000 flight hours) to be conducted on an overhauled unit that was reinstalled with an end play measurement between 0.034 to 0.039 inch, this provision is of limited value because there is no requirement for operators to be informed of this elevated end play measurement. Further, operators receiving an overhauled jackscrew assembly would not be expected to consult the overhaul manual for special maintenance instructions.

Analysis 161 Aircraft Accident Report manufacturing specifications, uses more rigorous and reliable overhaul procedures and significant quality control measures that are not used or required by the other facilities that overhaul jackscrew assemblies. For example, Integrated Aerospace uses detailed work cards to document each step of the overhaul process. Whenever Integrated Aerospace receives a jackscrew assembly with an end play measurement greater than 0.015 inch, it will install a new acme nut, thereby restoring the assembly to the manufacturing specifications for a new jackscrew assembly (0.003 to 0.010 inch). In doing so, Integrated Aerospace must comply with detailed specifications provided by Boeing in a service rework drawing, which are not contained in the DC-9 Overhaul Maintenance Manual. In addition, the investigation revealed that no special authorization beyond a class 1 accessory rating is required for a maintenance facility to overhaul jackscrew assemblies in accordance with the DC-9 Overhaul Maintenance Manual. A class 1 accessory rating allows a facility to perform maintenance and alteration of a number of mechanical accessories. The maintenance facility is not required to demonstrate that it has the necessary capability and equipment to perform jackscrew assembly overhauls. Safety Board investigators found that the PMI of an FAA-certified maintenance facility may not even be aware that the facility is performing overhauls of jackscrew assemblies. The Safety Board concludes that deficiencies in the overhaul process increase the likelihood that jackscrew assemblies may be improperly overhauled. The Safety Board further concludes that the absence of a requirement to record or inform customers of the end play measurement of an overhauled jackscrew assembly could result in an operator unknowingly returning a jackscrew assembly to service with a higher-than-expected end play measurement. Therefore, the Safety Board believes that the FAA should require that maintenance facilities that overhaul jackscrew assemblies record and inform customers of an overhauled jackscrew assembly’s end play measurement. In addition to recording the end play measurement information provided by a maintenance facility when it returns an overhauled jackscrew assembly, it would also be prudent for operators to record end play measurements for the same assembly after it is installed on an airplane. The Safety Board notes that end play measurements recorded by maintenance facilities are likely to be obtained during bench checks. However, after the overhauled assembly is re-installed on an airplane, end play measurements will likely be obtained through use of the on-wing end play check procedure, which may yield a slightly different measurement because of differences in the procedure. A wear rate that is calculated using a bench-check measurement at one point in time compared with an on-wing measurement at a later point in time will not be as informative or useful as a wear rate that is calculated using measurements obtained through use of the same end play check method. Therefore, the Safety Board concludes that operators will maximize the usefulness of end play measurements and wear rate calculations by recording on-wing end play measurements whenever a jackscrew assembly is replaced on an airplane. Accordingly, the Safety Board believes that the FAA should require operators to measure and record the on-wing end play measurement whenever a jackscrew assembly is replaced.

Analysis 162 Aircraft Accident Report Finally, the Safety Board concludes that, because the jackscrew assembly is an integral and essential part of the horizontal stabilizer trim system, a critical flight system, it is important to ensure that maintenance facilities authorized to overhaul these assemblies possess the proper qualifications, equipment, and documentation. Therefore, the Safety Board believes that the FAA should require that maintenance facilities that overhaul DC-9, MD-80/90, and 717 series airplanes’ jackscrew assemblies obtain specific authorization to perform such overhauls, predicated on demonstrating that they possess the necessary capability, documentation, and equipment for the task and that they have procedures in place to (1) perform and document the detailed steps that must be followed to properly accomplish the end play check procedure and lubrication of the jackscrew assembly, including specification of appropriate tools and grease types; (2) perform and document the appropriate steps for verifying that the proper acme screw thread surface finish has been applied; and (3) ensure that appropriate packaging procedures are followed for all overhauled jackscrew assemblies, regardless of whether the assembly has been designated for storage or shipping. 2.6 Horizontal Stabilizer Trim System Design and Certification Issues 2.6.1 Acme Nut Thread Loss as a Catastrophic Single-Point Failure Mode The DC-9 horizontal stabilizer trim system (which was also incorporated in the MD-80/90 and 717 series airplanes) is a critical flight system because certain failures of the system can be catastrophic. One such failure is the loss of acme screw and nut thread engagement. However, as previously mentioned, the designers of the system assumed that at least one set of the jackscrew assembly’s acme screw and nut threads would always be intact and engaged to act as a load path. Therefore, the repercussions of stripped acme nut threads and the corresponding effect on the airplane (including the possibility of the acme screw disengaging from the acme nut) were not considered in the design of the horizontal stabilizer trim system. At the Safety Board’s public hearing, Boeing engineers stated that they considered loss of the acme nut threads to be a “multiple failure event” and that such loss caused by excessive wear was not considered a “reasonably probable single failure” for certification purposes.266 The Boeing engineers indicated that the jackscrew assembly was designed to accommodate thread wear but acknowledged that monitoring and managing thread wear was essential to maintaining the integrity of the design. Similarly, an FAA certification 266 The certification basis for the DC-9, MD-80/90, and 717 horizontal stabilizer trim systems was Civil Aeronautics Regulations (CAR) 4b. CAR 4b.320, “Control Systems,” stated that “an adjustable stabilizer shall incorporate means to permit, after the occurrence of any reasonably probable single failure of the actuating system, such adjustment as would be necessary for continued safety of the flight.” (Current certification regulations specify, in 14 CFR 25.671, that the airplane must be shown to be capable of continued safe flight and landing after “any single failure” of the actuating system.)

Analysis 163 Aircraft Accident Report engineer testified that thread wear “was not considered as a mode of failure for either a systems safety analysis or for structural considerations” and that the “design of the acme nut and screw provided enough over-strength so that regulatory requirements could be met with a significant amount of wear.” However, as the Alaska Airlines flight 261 accident demonstrates, complete loss of the acme nut threads because of excessive wear is possible. Further, the accident jackscrew assembly is not the only jackscrew assembly in which excessive acme nut thread wear has occurred. As discussed previously, excessive wear of acme nut threads has occurred on other occasions as a result of inadequate lubrication, improper acme screw thread surface finish, and contamination. In addition, other potential rapid wear mechanisms may not have yet been identified. The Safety Board notes that the dual-thread design of the acme screw and nut does not adequately protect against excessive acme nut thread wear. Although Boeing contends that the two thread spirals along the length of both the acme screw and nut provide structural redundancy, the Board notes that each set of thread spirals is always carrying loads in flight and that both sets of thread spirals are subject to the same wear mechanisms. Thus, although the dual-thread design may prevent a crack in one thread set from propagating through the other thread set, both sets of threads remain vulnerable to simultaneous wear failure. Therefore, the Safety Board concludes that the dual-thread design of the acme screw and nut does not provide redundancy with regard to wear. The FAA’s certification scheme is intended to protect against catastrophic single-point failure conditions. Specifically, 14 CFR 25.1309 requires that airplane systems and associated components be designed so that “the occurrence of any failure condition which would prevent the continued safe flight and landing of the airplane is extremely improbable.” Further, AC 25.1309-1A, “System Design and Analysis,” defines “extremely improbable” failure conditions as “those so unlikely that they are not anticipated to occur during the entire operational life of all airplanes of one type” and “having a probability on the order of 1 x 10-9 or less each flight hour, based on a flight of mean duration for the airplane type.” AC 25.1309-1A specifies that in demonstrating compliance with 14 CFR 25.1309, “the failure of any single element, component, or connection during any one flight…should be assumed, regardless of its probability,” and “such single failures should not prevent continued safe flight and landing, or significantly reduce the capability of the airplane or the ability of the crew to cope with the resulting failure condition.” An FAA senior certification engineer testified at the public hearing that 14 CFR 25.1309267 did not apply to the jackscrew assembly acme nut because the FAA did not consider it part of a system. Rather, he stated that the jackscrew assembly was a “combination structural element and systems element” and that each category was governed by its respective regulatory requirements. He indicated that those portions of the jackscrew assembly below the gearbox and trim motors carried primary flight loads and, therefore, were covered by regulations pertaining to structure, not systems. He testified that the acme nut met the applicable regulatory requirements pertaining to structure, 267 The predecessor to the current 14 CFR 25.1309 was CAR 4b.606, which required that all systems “be designed to safeguard against hazards to the airplane in the event of their malfunctioning or failure.”

Analysis 164 Aircraft Accident Report specifically, CAR 4b.201(a), “Strength and Deformation,” which states that structure “shall be capable of supporting limit loads without suffering detrimental permanent deformation.”268 He stated that acme nut threads that are within manufacturing specifications far exceed the requirements for ultimate strength and deflection limit load and added that the FAA does not consider deflection of worn acme nut threads to be deformation in the context of this regulation. In addition, a Boeing structures engineering manager testified that the acme nut complied with certification regulations pertaining to fatigue evaluation of structure. Specifically, CAR 4b.270, “Fatigue Evaluation of Flight Structure,” required, for “those portions of the airplane’s flight structure in which fatigue may be critical,” an evaluation of either fatigue strength (also referred to as “safe life”) or fail safe strength (also referred to as “damage tolerance”).269 However, the Boeing manager testified that neither evaluation was performed because the acme nut was not considered “fatigue critical” because of its robust design. It is unclear whether the design and certification of the DC-9 (and MD-80/90 and 717) horizontal stabilizer trim system would have been any different if the certification requirements for aircraft systems, in addition to those applicable to structure, had been applied to the jackscrew assembly acme nut during the design phase. Boeing engineers testified at the public hearing that the horizontal stabilizer trim system design complied with the requirements of 14 CFR 25.1309. However, the FAA certification engineer indicated that, even if section 25.1309 had been applicable to the entire jackscrew assembly, acme nut thread wear would not have been considered in the required systems safety analysis. He explained, “if you refer to a [section 25.1309] type safety analysis to try and determine a failure rate for a wear item, there are not, and there’s really no such thing as a wear-critical item, never has been. The question of wear being a quantifiable element so that one could do a safety-type analysis for structure—it’s not feasible. The data to do such an evaluation is not available. It doesn’t exist.”270 In sum, the Safety Board is concerned that Boeing and the FAA did not account for the catastrophic effects of total acme nut thread loss in the design and certification of the horizontal stabilizer trim control system. The Board is also concerned that the certification requirements for aircraft systems were not considered applicable to the entire jackscrew assembly, particularly the acme nut. Because the loss of acme nut threads in flight most likely would result in the catastrophic loss of the airplane, the Board considers the acme nut to be a critical element of the horizontal stabilizer trim control system; therefore, it should have been covered by the certification philosophy and regulations applicable to all other flight control systems. The Safety Board concludes that the design of the DC-9, MD-80/90, and 717 horizontal stabilizer jackscrew assembly did not account for the loss of the acme nut threads as a catastrophic single-point failure mode. The Safety Board 268 A substantially similar requirement is currently contained in 14 CFR 25.305(a). 269 Substantially similar requirements are currently contained in 14 CFR 25.571. 270 The Boeing manager confirmed that “the condition of wear or wear-out was not included in the original DC-9 fault analysis.”

Analysis 165 Aircraft Accident Report further concludes that the absence of a fail-safe mechanism to prevent the catastrophic effects of total acme nut thread loss contributed to the Alaska Airlines flight 261 accident. 2.6.2 Prevention of Acme Nut Thread Loss Through Maintenance and Inspection Currently, prevention of acme nut thread loss is dependent on regular application of lubrication and on recurrent inspections of the jackscrew assembly to monitor acme nut thread wear. However, this maintenance-based approach to maintaining the horizontal stabilizer trim system’s structural integrity has weaknesses. First, current lubrication and end play check intervals may not be adequate, and their length can change. Research and testing relating to lubrication effectiveness and the prior service history of the MD-80 fleet suggests that the current 650-flight-hour lubrication interval is probably adequate to ensure proper lubrication of the jackscrew assembly. However, because of the potential for additional undiscovered rapid wear mechanisms and uncertainty regarding the maximum possible wear rate even for known wear mechanisms, there is no such basis for assuming that the current 2,000-flight-hour end play check interval is sufficient to ensure fleetwide safety.271 Further, there is no guarantee that these intervals will not eventually be extended, which would further reduce the level of safety. Second, and more importantly, all maintenance and inspection tasks are subject to human error. As previously discussed, this investigation has identified several weaknesses in the lubrication and inspection procedures that could affect their intended results and compromise safety.272 Further, several Safety Board accident investigations, including the Alaska Airlines flight 261 investigation, have demonstrated that even simple maintenance tasks are sometimes missed or inadequately performed and can have catastrophic results.273 Therefore, the current horizontal stabilizer trim system design remains 271 For a more detailed discussion of the Safety Board’s concerns in this area, see section 2.4.2. 272 For more information about the weaknesses in the lubrication and inspection procedures, see sections 2.3.6.3 and 2.4.3, respectively. 273 For example, following the September 11, 1991, crash of a Continental Express Embraer 120 in Eagle Lake, Texas, the Safety Board concluded that the airline’s maintenance inspection and quality assurance programs failed to detect that the upper row of screws on the leading edge of the left horizontal stabilizer had been removed during maintenance and had not been replaced. The partially secured left horizontal stabilizer leading edge separated in flight, causing a severe nose-down pitchover. The airplane broke up in flight, and all 14 people on board were killed. For more information, see National Transportation Safety Board. Britt Airways, Inc., d/b/a Continental Express Flight 2574, In-flight Structural Breakup, EMB-120RT, N33701, Eagle Lake, Texas, September 11, 1991. NTSB/AAR-92/04. In addition, the Board’s investigation of the July 6, 1996, uncontained engine failure on a Delta Air Lines MD-88 in Pensacola, Florida, determined that a fluorescent inspection process used to detect fatigue cracks during maintenance was susceptible to error because it involved multiple cleaning, processing, and inspection procedures dependent on several individuals and because of a low expectation of finding a crack. Shrapnel from the uncontained engine failure pierced the fuselage and entered the rear cabin. Two passengers were killed, and two others were seriously injured. For more information, see National Transportation Safety Board. Uncontained Engine Failure, Delta Airlines Flight 1288, McDonnell Douglas MD-88, N927DA, Pensacola, Florida, July 6,

1. NTSB/AAR-98-01.

Analysis 166 Aircraft Accident Report vulnerable to catastrophic failure if maintenance and inspection tasks are not performed properly. 2.6.3 Elimination of Catastrophic Effects of Acme Nut Thread Loss Through Design The Safety Board concludes that, when a single failure could have catastrophic results and there is a practicable design alternative that could eliminate the catastrophic effects of the failure mode, it is not appropriate to rely solely on maintenance and inspection intervention to prevent the failure from occurring; if a practicable design alternative does not exist, a comprehensive systemic maintenance and inspection process is necessary. In the case of the horizontal stabilizer trim system, such a design would incorporate a reliable, independent means for eliminating, overcoming, or counteracting the catastrophic effects of acme nut thread loss. The Safety Board notes that such a design change would not necessarily need to incorporate dual actuators, or any other form of system redundancy; the design would only need to provide a mechanism for preventing stripped acme nut threads from resulting in unrecoverable movement of the horizontal stabilizer. The Board notes that among the several design concepts listed in AC 25.1309-1A that can be used to avoid catastrophic failure conditions are the following: (1) “designed failure effect limits, including the capability to sustain damage, to limit the safety impact or effects of a failure”; and (2) “designed failure path to control and direct the effects of a failure in a way that limits its safety impact.” The Safety Board concludes that transport-category airplanes should be modified, if practicable, to ensure that horizontal stabilizer trim system failures do not preclude continued safe flight and landing. Therefore, the Safety Board believes that the FAA should conduct a systematic engineering review to (1) identify means to eliminate the catastrophic effects of total acme nut thread failure in the horizontal stabilizer trim system jackscrew assembly in DC-9, MD-80/90, and 717 series airplanes and require, if practicable, that such fail-safe mechanisms be incorporated in the design of all existing and future DC-9, MD-80/90, and 717 series airplanes and their derivatives; (2) evaluate the horizontal stabilizer trim systems of all other transport-category airplanes to identify any designs that have a catastrophic single-point failure mode and, for any such system; (3) identify means to eliminate the catastrophic effects of that single-point failure mode and, if practicable, require that such fail-safe mechanisms be incorporated in the design of all existing and future airplanes that are equipped with such horizontal stabilizer trim systems. Further, the Safety Board is concerned that the FAA certified a horizontal stabilizer trim system that had a single-point catastrophic failure mode. The Safety Board concludes that catastrophic single-point failure modes should be prohibited in the design of all future airplanes with horizontal stabilizer trim systems, regardless of whether any element of that system is considered structure rather than system or is otherwise considered exempt from certification standards for systems. Therefore, the Safety Board believes that the FAA should modify the certification regulations, policies, or procedures to ensure that new horizontal stabilizer trim control system designs are not certified if they have a

Analysis 167 Aircraft Accident Report single-point catastrophic failure mode, regardless of whether any element of that system is considered structure rather than system or is otherwise considered exempt from certification standards for systems. 2.6.4 Consideration of Wear-Related Failures During Design and Certification The Alaska Airlines flight 261 investigation revealed that the FAA certification processes and procedures did not adequately consider and address the consequences of excessive wear in the context of certifying the DC-9, MD-80/90, and 717 horizontal stabilizer trim system. In light of this finding, the Safety Board is concerned that the consequences of excessive wear might not be considered in the contexts of other certifications as well. One way to ensure that such consequences are considered would be to include wear-related failures in the failure modes and effects analyses (FMEA) and fault tree analyses that are required under 14 CFR 25.1309. As stated previously, Boeing and the FAA have accepted the premise that wear cannot be considered a mode of failure in systems safety analyses such as FMEAs and fault trees; however, the Safety Board notes that standards developed by the Society of Automotive Engineers (SAE) specify that wear should be considered in FMEAs.274 Design guidelines should require that a wear-related failure be assumed and that the results of such a failure be evaluated. The Safety Board concludes that the certification requirements applicable to transport-category airplanes should fully consider and address the consequences of failures resulting from wear. Therefore, the Safety Board believes that the FAA should review and revise aircraft certification regulations and associated guidance applicable to the certification of transport-category airplanes to ensure that wear-related failures are fully considered and addressed so that, to the maximum extent possible, they will not be catastrophic. 2.7 Deficiencies in Alaska Airlines’ Maintenance Program 2.7.1 April 2000 FAA Special Inspection Findings As a result of the Alaska Airlines flight 261 accident, the FAA conducted a special inspection of Alaska Airlines in April 2000, which was headed by a member of its System Process Audit staff from Washington, D.C. The FAA’s final report on this special inspection, dated June 20, 2000, stated the following: • procedures in place at the company are not being followed; 274 SAE’s Aerospace Recommended Practices 4761, “Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment,” in paragraph G.3.2.2.1 of appendix G, lists wear among the failure modes to consider in performing an FMEA.

Analysis 168 Aircraft Accident Report • controls in place are clearly not effective; • authority and responsibilities are not well defined; • control of the deferral systems is missing; and • quality control and quality assurance programs are ineffective. The report also noted that the continuing analysis and surveillance program was responsible for “overseeing the operations within the company to ensure that the programs established…are effective” but that because Alaska Airlines did not have a “functional [continuing analysis and surveillance program], numerous other areas suffer from the lack of oversight and reform.” The report concluded that most of the findings could be attributed to Alaska Airlines’ processes, or the lack thereof, and “ineffective quality control and quality assurance departments.”275 Specifically, the special inspection report revealed that the Alaska Airlines General Maintenance Manual (GMM) did “not reflect the procedures that the company is actually using to perform maintenance on its aircraft at the company’s maintenance facilities.” The report documented inadequacies in the GMM procedures for issuance of airworthiness releases of airplanes coming out of heavy checks, incomplete C-check paperwork, discrepancies of shelf-life expiration dates of consumables, a lack of engineering approval and quality control of work card modifications in heavy checks, and inadequate tool calibrations. The special inspection report also stated that the GMM did not “specify maintenance training curriculums or on-the-job training (OJT) procedures or objectives” and cited 14 CFR 121.375, which requires that Part 121 operators have a training program to ensure competency. The report noted that the OJT program was “informal [and] administered at the discretion of the appointed instructors. The program is not structured, there is no identification of subjects to be covered, and there are no criteria for successful completion provided.” As a result of the special inspection team’s findings, the FAA initially proposed the suspension of Alaska Airlines’ authority to conduct heavy maintenance. Instead, the FAA accepted an Airworthiness and Operations Action Plan submitted by Alaska Airlines and did not suspend Alaska Airlines’ heavy maintenance authority. In September 2000, the FAA conducted a followup inspection, which revealed that Alaska Airlines had not satisfactorily resolved many of the deficiencies identified in the special inspection report. After an additional review in July 2001, consisting of presentations by Alaska Airlines representatives and a brief visit by some of the panel members to Alaska Airlines’ SEA maintenance facility followed by discussions about Alaska Airlines’ progress, the FAA found that the airline had “met or exceeded all commitments set forth in their action plan” and “demonstrated…that previously identified systemic deficiencies have been corrected.” The FAA further found that Alaska Airlines had made “significant changes and improvements.” 275 For more detailed information about the FAA special inspection team’s findings, see section 1.17.3.4.

Analysis 169 Aircraft Accident Report 2.7.2 Maintenance-Related Deficiencies Identified During This Accident Investigation In the course of its investigation of the Alaska Airlines flight 261 accident, the Safety Board learned about numerous maintenance-related actions—both general and specific—by Alaska Airlines management and maintenance personnel. These actions supported the overall findings in the FAA’s special inspection report and were indicative of procedural and quality control deficiencies, which concerned the Board. 2.7.2.1 General Policy Decisions Extension of End Play Check Interval As previously discussed, in 1996, Alaska Airlines extended its C-check interval from 13 to 15 months, which resulted in the end play check interval being increased from 26 to 30 months. Although 30 months was the manufacturer-recommended calendar-time interval, because of Alaska Airlines’ increased airplane utilization rate, 30 months was equivalent to 9,550 flight hours, which was well beyond the 7,000- or 7,200-flight-hour interval that was recommended by Boeing at the time.276 As previously noted, the flight 261 accident occurred almost 9,000 flight hours after the accident jackscrew assembly’s last end play check. Therefore, if Alaska Airlines had adopted an interval that complied with either of the flight-hour intervals specified by Boeing, the accident jackscrew assembly would have undergone an end play check 1,800 to 2,000 flight hours before the accident occurred and might have been removed at that time for having an excessive end play measurement. The decision to exceed the manufacturer’s recommended end play check interval was a poor maintenance decision and demonstrated a lack of appreciation for the need to account for flight hours when setting maintenance intervals for those tasks related to airplane usage rather than calendar time. Grease Change from Mobilgrease 28 to Aeroshell 33 The process by which Alaska Airlines replaced Mobilgrease 28 with Aeroshell 33 grease on its work maintenance task cards for the MD-80 was both procedurally and substantively deficient in several respects. First, the grease change was accomplished without following established procedures. The form used to request and obtain internal approval for the grease change was incomplete and inadequate in the following ways: (1) it was missing several required signatures;277 (2) it contained no indication that the required internal approval from Alaska Airlines’ Reliability Analysis Program Control Board had been obtained; and (3) it contained no signature on the line labeled “change request accomplished,” although the 276 As previously mentioned, MSG-2 guidance (which was the basis for Alaska Airlines’ maintenance program) specified an end play check interval of 7,000 flight hours, and the more recent MSG-3 guidance specified an interval of 7,200 flight hours. 277 There was no signature from the manager of reliability, the director of line maintenance, or the manager of quality control.

Analysis 170 Aircraft Accident Report grease change was implemented in December 1997. At the Safety Board’s public hearing, neither Alaska Airlines’ former director of engineering (who at the time the change was processed was Alaska Airlines’ manager of maintenance programs and technical publications) nor the current director of engineering could explain how the change was implemented without the required signatures or Reliability Analysis Program Control Board approval. Further, the GMM was not modified to reflect the grease change to Aeroshell 33; it still specified the use of Mobilgrease 28. This lapse indicates either a lack of procedures or a failure to follow procedures. Second, Alaska Airlines did not conduct any formal followup to evaluate the performance of the new grease (Aeroshell 33). McDonnell Douglas responded to Alaska Airlines’ request to change greases in a letter stating that it had “no technical objection” to the use of Aeroshell 33; however, it also stated that McDonnell Douglas could not “yet verify the performance of this grease” and that it would “be the responsibility of Alaska Airlines to monitor the areas where Aeroshell 33 grease is used for any adverse reactions.” However, Alaska Airlines did not actively monitor the in-service performance of the grease. Although Alaska Airlines asserts that it monitored the performance of Aeroshell 33 through its overall reliability program, the Safety Board notes that there is no evidence that any specific data were collected and evaluated regarding the lubricating effectiveness of Aeroshell 33. For example, it would have been prudent for Alaska Airlines to measure and record end play and calculate the wear rate on a sample of airplanes after the introduction of Aeroshell 33 and perhaps even to shorten the lubrication intervals in order to verify that its performance was at least equivalent to that of Mobilgrease 28. Alaska Airlines’ failure to actively monitor the performance of the new grease is especially significant in light of the extension in lubrication intervals for the horizontal stabilizer components (from 1,600 to 2,550 flight hours) that it had implemented the year before. Third, Alaska Airlines’ technical justification for the grease change was inadequate. When Alaska Airlines notified the FAA in December 1997 of the grease change to Aeroshell 33, it did not provide any substantiating justification at that time nor was such action required. However, when the FAA requested substantiating justification after concerns were raised in connection with the flight 261 investigation, the only documents Alaska Airlines submitted to the FAA were a trade magazine article on Aeroshell 33, excerpts from Boeing 737 and MD-80 maintenance manuals, Boeing service letters, internal correspondence and messages between Alaska Airlines and Boeing, and existing MIL specifications for Aeroshell 33 and Mobilgrease 28. None of these documents contained any information or performance data specifically applicable to the use of Aeroshell 33 on MD-80 airplanes or on the horizontal stabilizer systems of such airplanes. These documents were apparently the only basis Alaska Airlines had for justifying the grease change internally.278 278Alaska Airlines officials did not offer any of the additional information that they claim was used to show internal justification for the grease change. Alaska Airlines’ director of engineering testified at the hearing that he thought that the documents submitted to the FAA provided sufficient justification for the change.

Analysis 171 Aircraft Accident Report The FAA determined that the substantiating documents submitted by Alaska Airlines did not support the change and it disapproved the use of Aeroshell Grease 33 as a substitute for Mobilgrease 28. The Safety Board agrees that the documents submitted to the FAA did not adequately justify the grease change. Even though the use of Aeroshell 33 for lubrication of the horizontal stabilizer system was not determined to be a factor in the Alaska Airlines flight 261 accident, the Board notes that Alaska Airlines disregarded the potential safety impact of a change in grease. Failure to Fill Required Senior Positions As noted in the FAA special inspection report, three required positions—the director of maintenance, the director of operations, and the director of safety—were not filled at the time of the special inspection.279 Although the duties of the director of maintenance were being performed by two people, the division of duties and responsibilities was not clearly defined. The report noted, “consequently there is confusion as to who is responsible for what tasks.” The report also noted that the director of safety did not report “directly to the highest level of management.” The lack of a full-time director of maintenance and director of safety indicates a lack of sufficient emphasis on maintenance and safety. Use of Nonconforming Restraining Fixtures At the time of the accident, Alaska Airlines had only one restraining fixture in its inventory (at its OAK maintenance facility). The fixture was manufactured in-house and it did not meet the manufacturer’s required specifications for this fixture. About 1 month after the accident, Alaska Airlines manufactured 11 additional restraining fixtures similar in design to its original in-house manufactured fixture. Alaska Airlines’ manager of tool control, who participated in the fabrication of the fixtures ordered by airline management after the accident, told Safety Board investigators in an interview that “what they were making [the restraining fixtures] wasn’t even close” to the Boeing drawing. He added that “we were directed to build the tools, and we did exactly what we were told.” On August 2, 2000, in response to Safety Board queries regarding the physical properties of the in-house manufactured restraining fixtures, Alaska Airlines notified the FAA that the restraining fixtures might not be “an equivalent substitute” for the Boeing fixture and, therefore, could produce erroneous measurements. Alaska Airlines thereafter suspended use of its in-house manufactured restraining fixtures and temporarily grounded 18 of its 34 MD-80 series airplanes after determining that these airplanes may have received end play checks with the in-house manufactured fixtures.280 Although use of Alaska Airlines’ in-house manufactured restraining fixture to perform the accident airplane’s last end play check might not have contributed to the 279 Title 14 CFR 119.65 requires airlines to have full-time, qualified personnel in each of these positions. 280 Alaska Airlines performed end play checks on the grounded airplanes using Boeing-manufactured restraining fixtures and found that they had acceptable end play measurements.

Analysis 172 Aircraft Accident Report Alaska Airlines flight 261 accident, the use of this nonconforming fixture is further evidence of a flawed maintenance program. 2.7.2.2 Specific Maintenance Actions In addition to the general policy-related deficiencies outlined above, the Alaska Airlines flight 261 accident investigation also revealed several individual maintenance actions indicative of poor adherence to procedures and/or poor quality control. Inadequate Lubrication of Jackscrew Assemblies The investigation revealed that the jackscrew assemblies from three of Alaska Airlines 34 MD-80 airplanes (the accident assembly and those from N981AS and N982AS discovered in February 2000) had excessively high wear rates. The high wear rates on these jackscrew assemblies could not be explained by contamination, improper acme thread surface finish, or anything other than a lack of lubrication. As previously discussed, at least one lubrication had to have been missed or inadequately performed on the accident assembly.281 However, a scenario in which more than one lubrication was missed or inadequate results in a wear rate more consistent with that which Safety Board testing showed to be the wear rate of unlubricated test specimens. Using the same reasoning, at least one lubrication, and possibly more, must also have been missed entirely or inadequately performed on the jackscrew assemblies on N981AS and N982AS. This indicates either poor training in this task or poor supervision of maintenance personnel performing this task. Inadequate Lubrication of Rudder Trim Tab Hinge Support Bearings On July 19, 2002, Alaska Airlines issued a Maintenance Information Letter stating that “[r]ecent shop findings have revealed that the MD-80 rudder trim tab support bearings may not always be receiving adequate lubrication.” The letter indicated that two airplanes that had recently come out of a C check, during which the bearings should have been lubricated, showed “extreme bearing wear, with little or no evidence of grease” and that one of the bearings “fell apart upon removal.” Alaska Airlines subsequently indicated that, contrary to what was stated in the letter, the airplanes had not recently undergone a C check. However, regardless of how long it had been since the last C check or scheduled lubrication, the condition of these bearings strongly suggests that they were not adequately lubricated at the last scheduled lubrication opportunity. This raises significant concerns about Alaska Airlines’ lubrication practices, especially in light of the findings from this investigation relating to inadequate lubrication of jackscrew assemblies. Failure to Properly Process Order for New Jackscrew Assembly Following the 0.040-inch end play measurement on the accident jackscrew assembly on September 27, 1997, a nonroutine work card (MIG-4) was generated to begin 281 For more information on the analysis of how many lubrications might have been missed or inadequately performed, see section 2.3.6.1.

Analysis 173 Aircraft Accident Report the process of ordering a replacement jackscrew assembly. The “planned action” noted on the nonroutine work card was “Replace nut and perform E.O. [engineering order] 8-55-10-01.” However, a new jackscrew assembly was never ordered. According to Alaska Airlines’ director of safety, Alaska Airlines’ procedures called for the creation of a field requisition to order a nonstocked part, such as a jackscrew assembly, but no such requisition was found. Further, the E.O. referenced in the nonroutine work card (which was also referenced in the Alaska Airlines maintenance task card) was incorrect because it applied to another airplane model. The Safety Board notes that 3 days after the 0.040-inch end play measurement was recorded, a 0.033-inch measurement was recorded, and the accident airplane was thereafter returned to service. The Board recognizes that there was no requirement for Alaska Airlines to order a new jackscrew assembly because it was permissible to return the assembly to service with a recorded end play measurement of either 0.040 or 0.033 inch. Nonetheless, the failure of Alaska Airlines maintenance personnel to process the order for a new part is yet another example of failure to comply with internal procedures. Further, the incorrect E.O. reference is an additional example of poor maintenance quality control. Continued Errors in Performing End Play Checks Finally, the Safety Board notes that even after the attention that has been focused on the end play check procedure as a result of the flight 261 accident, Alaska Airlines maintenance personnel continue to have difficulty properly performing the procedure. In March and April 2002, Alaska Airlines removed two jackscrew assemblies, one at OAK and one at a contract facility near SEA, after reported end play measurements of only 0.001 inch. The manufacturing specifications require a minimum end play of 0.003 inch; therefore, a lower end play measurement is suspect. Safety Board investigators examined these jackscrew assemblies and determined that their end play measurements were within normal and expected limits and that the 0.001-inch end play measurements were caused by maintenance errors in performing the end play check procedure. Specifically, it was determined that such inaccurate measurements would result from applying torque to the restraining fixture in the wrong direction before measuring the end play. According to Boeing, during the 6-month period from December 2001 to May 2002, only six other end play measurements of less than 0.004 inch were reported. Therefore, it appears that Alaska Airlines has experienced a relatively high percentage of such erroneous readings. Further, Alaska Airlines indicated that all maintenance personnel who would be performing end play checks had undergone 4 hours of specialized training on how to properly conduct the end play check procedure. It is noteworthy that, given the heightened awareness resulting from the Alaska Airlines flight 261 accident, and even with this additional training, end play check procedural errors continued to occur at Alaska Airlines.

Analysis 174 Aircraft Accident Report 2.7.3 Summary On the basis of the information in sections 2.7.2.1 and 2.7.2.2, the Safety Board concludes that at the time of the flight 261 accident, Alaska Airlines’ maintenance program had widespread systemic deficiencies. As previously discussed, two specific maintenance-related deficiencies—insufficient lubrication of the accident jackscrew assembly and extension of the end play check interval—were causal to the accident. The Board could not establish whether any of the other maintenance-related deficiencies discovered in connection with this accident investigation were directly related to, or contributed to, the accident. However, these deficiencies are significant departures from expected and established safety standards and, therefore, could well have compromised safety in other ways. Alaska Airlines has made numerous changes in response to the FAA’s postaccident special inspection findings, and an FAA panel has indicated that it is satisfied that the “previously identified systemic deficiencies have been corrected.” Nonetheless, the Safety Board is concerned that these widespread deficiencies existed at Alaska Airlines before the accident and were not identified or corrected until after attention was focused on them as a result of this accident investigation. The Board is also concerned, in light of the recent maintenance errors during end play check procedures and evidence of continued poor lubrication practices, that the deficiencies at Alaska Airlines may not have been fully corrected. 2.8 FAA Oversight The FAA’s April 2000 special inspection uncovered widespread significant deficiencies that the FAA should have identified earlier. The fact that these deficiencies were not discovered until special attention was focused on Alaska Airlines by a headquarters-led team as result of the flight 261 accident indicates that the FAA’s surveillance was ineffective before the accident. Several FAA officials acknowledged that surveillance of Alaska Airlines had been inadequate for at least a year before the accident. The former PMI for Alaska Airlines testified that the replacement of the Program Tracking and Reporting System (PTRS) of oversight at Alaska Airlines with the Air Transportation Oversight System (ATOS) in October 1998 resulted in “a terrible transition” that drastically reduced the amount of time inspectors had for actual surveillance activities. He indicated that as a result of additional workload and other administrative changes associated with the implementation of ATOS, “nobody was out there looking at the carrier.”282 The Seattle Flight Standards District Office (FSDO) CMO supervisor confirmed that “the amount of surveillance that we have done since the introduction of ATOS has probably generally decreased.” His concern about this decrease in oversight is reflected in 282 For more information about the impact of the implementation of ATOS on the FAA’s oversight of Alaska Airlines, see section 1.17.3.3.

Analysis 175 Aircraft Accident Report a November 12, 1999, memorandum that he sent to the FAA’s Flight Standards Division stating that additional staffing would be needed for the Seattle FSDO CMO to carry out its assigned duties. The memorandum stated the following: [staffing at the Seattle FSDO CMO] has reached a critical point…we are not able to properly meet the workload demands. Alaska Airlines has expressed continued concern over our inability to serve it in a timely manner. Some program approvals have been delayed or accomplished in a rushed manner at the ‘eleventh hour’ and we anticipate this problem will intensify with time. Also, many enforcement investigations, particularly in the area of cabin safety, have been delayed as a result of resource shortages…in order for the Seattle FSDO [CMO] to accommodate the significant volume of Alaska Airline’s ‘demand’ work and effectively meet the objectives of the ATOS program, additional inspector staffing must be made available. The memorandum also indicated that if the Seattle FSDO CMO “continues to operate with the existing limited number of airworthiness inspectors…diminished surveillance is imminent and the risk of incidents or accidents at Alaska Airlines is heightened.” Therefore, the Safety Board concludes that the FAA did not fulfill its responsibility to properly oversee the maintenance operations at Alaska Airlines, and that at the time of the Alaska Airlines flight 261 accident, FAA surveillance of Alaska Airlines had been deficient for at least several years. The Safety Board notes that after the accident, PTRS-based oversight of Alaska Airlines was re-instituted, and staffing at the CMO was increased significantly. Therefore, it appears that the FAA has taken steps to increase the level of its surveillance of Alaska Airlines. In July 2001, an FAA panel determined that Alaska Airlines had corrected the previously identified deficiencies. However, in light of (1) the systemic nature and widespread impact of those deficiencies, (2) Alaska Airlines’ failure to demonstrate during the FAA’s first followup inspection (in September 2000) that it had fully corrected the deficiencies, (3) the absence of any in-depth followup inspection by an objective team of FAA inspectors not personally responsible for the oversight of Alaska Airlines to verify that the deficiencies have in fact been corrected,283 and (4) recent maintenance errors by Alaska Airlines maintenance personnel during end play check procedures and evidence of continued poor lubrication practices,284 the Board questions the depth and effectiveness of Alaska Airlines’ corrective actions and remains concerned about the overall adequacy of Alaska Airlines’ maintenance program. 283 The FAA panel’s conclusion that the deficiencies had been corrected was based primarily on briefings from Alaska Airlines officials. 284 The Safety Board notes that these maintenance errors seem to underscore the need for specialized training for personnel who lubricate and perform end play checks, as the Board recommended in Safety Recommendations A-01-43 and -44. Those recommendations are currently classified “Open—Unacceptable Response.”

Conclusions 176 Aircraft Accident Report 3. Conclusions 3.1 Findings 1. The flight crewmembers on Alaska Airlines flight 261 were properly certificated and qualified and had received the training and off-duty time prescribed by Federal regulations. No evidence indicated any preexisting medical or other condition that might have adversely affected the flight crew’s performance during the accident flight. 2. The airplane was dispatched in accordance with Federal Aviation Administration regulations and approved Alaska Airlines procedures. The weight and balance of the airplane were within limits for dispatch, takeoff, climb, and cruise. 3. Weather was not a factor in the accident. 4. There was no evidence of a fire or of impact with birds or any other foreign object. 5. No evidence indicated that the airplane experienced any preimpact structural or system failures, other than those associated with the longitudinal trim control system, the horizontal stabilizer, and its surrounding structure. 6. Both engines were operating normally before the final dive. 7. Air traffic control personnel involved with the accident flight were properly certificated and qualified for their assigned duty stations. 8. The longitudinal trim control system on the accident airplane was functioning normally during the initial phase of the accident flight. 9. The horizontal stabilizer stopped responding to autopilot and pilot commands after the airplane passed through 23,400 feet. The pilots recognized that the longitudinal trim control system was jammed, but neither they nor the Alaska Airlines maintenance personnel could determine the cause of the jam.

1. The worn threads inside the horizontal stabilizer acme nut were incrementally sheared

off by the acme screw and were completely sheared off during the accident flight. As the airplane passed through 23,400 feet, the acme screw and nut jammed, preventing further movement of the horizontal stabilizer until the initial dive.

Conclusions 177 Aircraft Accident Report

1. The accident airplane’s initial dive from 31,050 feet began when the jam between the

acme screw and nut was overcome as a result of operation of the primary trim motor. Release of the jam allowed the acme screw to pull up through the acme nut, causing the horizontal stabilizer leading edge to move upward, thus causing the airplane to pitch rapidly downward.

1. The acme screw did not completely separate from the acme nut during the initial dive

because the screw’s lower mechanical stop was restrained by the lower surface of the acme nut until just before the second and final dive about 10 minutes later.

1. The cause of the final dive was the low-cycle fatigue fracture of the torque tube,

followed by the failure of the vertical stabilizer tip fairing brackets, which allowed the horizontal stabilizer leading edge to move upward significantly beyond what is permitted by a normally operating jackscrew assembly. The resulting upward movement of the horizontal stabilizer leading edge created an excessive upward aerodynamic tail load, which caused an uncontrollable downward pitching of the airplane from which recovery was not possible.

1. In light of the absence of a checklist requirement to land as soon as possible and the

circumstances confronting the flight crew, the flight crew’s decision not to return to Lic Gustavo Diaz Ordaz International Airport, Puerto Vallarta, Mexico, immediately after recognizing the horizontal stabilizer trim system malfunction was understandable.

1. The flight crew’s decision to divert the flight to Los Angeles International Airport,

Los Angeles, California, rather than continue to San Francisco International Airport, San Francisco, California, as originally planned was prudent and appropriate.

1. Alaska Airlines dispatch personnel appear to have attempted to influence the flight

crew to continue to San Francisco International Airport, San Francisco, California, instead of diverting to Los Angeles International Airport, Los Angeles, California.

1. The flight crew’s use of the autopilot while the horizontal stabilizer was jammed was

not appropriate.

1. Flight crews dealing with an in-flight control problem should maintain any

configuration change that would aid in accomplishing a safe approach and landing, unless that configuration change adversely affects the airplane’s controllability.

1. Without clearer guidance to flight crews regarding which actions are appropriate and

which are inappropriate in the event of an inoperative or malfunctioning flight control system, pilots may experiment with improvised troubleshooting measures that could inadvertently worsen the condition of a controllable airplane.

1. The acme nut threads on the accident airplane’s horizontal stabilizer jackscrew

assembly wore at an excessive rate.

Conclusions 178 Aircraft Accident Report

1. Alaska Airlines’ use of Aeroshell 33 for lubrication of the jackscrew assembly, acme

screw thread surface finish, foreign debris, and abnormal loading of the acme nut threads were not factors in the excessive wear of the accident acme nut threads.

1. There was no effective lubrication on the acme screw and nut interface at the time of

the Alaska Airlines flight 261 accident.

1. The excessive and accelerated wear of the accident jackscrew assembly acme nut

threads was the result of insufficient lubrication, which was directly causal to the Alaska Airlines flight 261 accident.

1. Alaska Airlines’ extensions of its lubrication interval for its McDonnell Douglas

MD-80 horizontal stabilizer components and the Federal Aviation Administration’s approval of these extensions, the last of which was based on Boeing’s extension of the recommended lubrication interval, increased the likelihood that a missed or inadequate lubrication would result in excessive wear of jackscrew assembly acme nut threads and, therefore, was a direct cause of the excessive wear and contributed to the Alaska Airlines flight 261 accident.

1. When lubricating the jackscrew assembly, removal of used grease from the acme

screw before application of fresh grease will increase the effectiveness of the lubrication.

1. A larger access panel would facilitate the proper accomplishment of the jackscrew

assembly lubrication task.

1. If the jackscrew assembly lubrication procedure were a required inspection item for

which an inspector’s signoff is needed, the potential for unperformed or improperly performed lubrications would be reduced.

1. Alaska Airlines’ extension of the end play check interval and the Federal Aviation

Administration’s approval of that extension allowed the accident acme nut threads to wear to failure without the opportunity for detection and, therefore, was a direct cause of the excessive wear and contributed to the Alaska Airlines flight 261 accident.

1. Alaska Airlines’ end play check interval extension should have been, but was not,

supported by adequate technical data to demonstrate that the extension would not present a potential hazard.

1. The existing process by which manufacturers revise recommended maintenance task

intervals and by which airlines establish and revise these intervals does not include task-by-task engineering analysis and justification and, therefore, allows for the possibility of inappropriate interval extensions for potentially critical maintenance tasks.

Conclusions 179 Aircraft Accident Report

1. Because of the possibility that higher-than-expected wear could cause excessive wear

in less than 2,000 flight hours and the additional possibility that an end play check could be not performed or improperly performed, the current 2,000-flight-hour end play check interval specified in Airworthiness Directive 2000-15-15 may be inadequate to ensure the safety of the Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 fleet.

1. The continued collection and analysis of end play data are critical to monitoring acme

nut thread wear and identifying excessive or unexpected wear rates, trends, or anomalies.

1. Until August 2000, Alaska Airlines used a fabricated restraining fixture that did not

meet Boeing specifications; however, the Safety Board could not determine whether the use of this noncompliant fixture generated an inaccurate end play measurement during the last end play check or whether the use of this fixture contributed to the accident.

1. The on-wing end play check procedure, as currently practiced, has not been validated

and has low reliability.

1. Deficiencies in the overhaul process increase the likelihood that jackscrew assemblies

may be improperly overhauled.

1. The absence of a requirement to record or inform customers of the end play

measurement of an overhauled jackscrew assembly could result in an operator unknowingly returning a jackscrew assembly to service with a higher-than-expected end play measurement.

1. Operators will maximize the usefulness of end play measurements and wear rate

calculations by recording on-wing end play measurements whenever a jackscrew assembly is replaced on an airplane.

1. Because the jackscrew assembly is an integral and essential part of the horizontal

stabilizer trim system, a critical flight system, it is important to ensure that maintenance facilities authorized to overhaul these assemblies possess the proper qualifications, equipment, and documentation.

1. The dual-thread design of the acme screw and nut does not provide redundancy with

regard to wear.

1. The design of the Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717

horizontal stabilizer jackscrew assembly did not account for the loss of the acme nut threads as a catastrophic single-point failure mode. The absence of a fail-safe mechanism to prevent the catastrophic effects of total acme nut thread loss contributed to the Alaska Airlines flight 261 accident.

Conclusions 180 Aircraft Accident Report

1. When a single failure could have catastrophic results and there is a practicable design

alternative that could eliminate the catastrophic effects of the failure mode, it is not appropriate to rely solely on maintenance and inspection intervention to prevent the failure from occurring; if a practicable design alternative does not exist, a comprehensive systemic maintenance and inspection process is necessary.

1. Transport-category airplanes should be modified, if practicable, to ensure that

horizontal stabilizer trim system failures do not preclude continued safe flight and landing.

1. Catastrophic single-point failure modes should be prohibited in the design of all

future airplanes with horizontal stabilizer trim systems, regardless of whether any element of that system is considered structure rather than system or is otherwise considered exempt from certification standards for systems.

1. The certification requirements applicable to transport-category airplanes should fully

consider and address the consequences of failures resulting from wear.

1. At the time of the flight 261 accident, Alaska Airlines’ maintenance program had

widespread systemic deficiencies.

1. The Federal Aviation Administration (FAA) did not fulfill its responsibility to

properly oversee the maintenance operations at Alaska Airlines, and at the time of the Alaska Airlines flight 261 accident, FAA surveillance of Alaska Airlines had been deficient for at least several years. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was a loss of airplane pitch control resulting from the in-flight failure of the horizontal stabilizer trim system jackscrew assembly’s acme nut threads. The thread failure was caused by excessive wear resulting from Alaska Airlines’ insufficient lubrication of the jackscrew assembly. Contributing to the accident were Alaska Airlines’ extended lubrication interval and the Federal Aviation Administration’s (FAA) approval of that extension, which increased the likelihood that a missed or inadequate lubrication would result in excessive wear of the acme nut threads, and Alaska Airlines’ extended end play check interval and the FAA’s approval of that extension, which allowed the excessive wear of the acme nut threads to progress to failure without the opportunity for detection. Also contributing to the accident was the absence on the McDonnell Douglas MD-80 of a fail-safe mechanism to prevent the catastrophic effects of total acme nut thread loss.

Recommendations 181 Aircraft Accident Report 4. Recommendations 4.1 New Recommendations As a result of the investigation of the Alaska Airlines flight 261 accident, the National Transportation Safety Board makes the following recommendations to the Federal Aviation Administration: Issue a flight standards information bulletin directing air carriers to instruct pilots that in the event of an inoperative or malfunctioning flight control system, if the airplane is controllable they should complete only the applicable checklist procedures and should not attempt any corrective actions beyond those specified. In particular, in the event of an inoperative or malfunctioning horizontal stabilizer trim control system, after a final determination has been made in accordance with the applicable checklist that both the primary and alternate trim systems are inoperative, neither the primary nor the alternate trim motor should be activated, either by engaging the autopilot or using any other trim control switch or handle. Pilots should further be instructed that if checklist procedures are not effective, they should land at the nearest suitable airport. (A-02-36) Direct all certificate management offices to instruct inspectors to conduct surveillance of airline dispatch and maintenance control personnel to ensure that their training and operations directives provide appropriate dispatch support to pilots who are experiencing a malfunction threatening safety of flight and instruct them to refrain from suggesting continued flight in the interest of airline flight scheduling. (A-02-37) As part of the response to Safety Recommendation A-01-41, require operators of Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 series airplanes to remove degraded grease from the jackscrew assembly acme screw and flush degraded grease and particulates from the acme nut before applying fresh grease. (A-02-38) As part of the response to Safety Recommendation A-01-41, require operators of Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 series airplanes, in coordination with Boeing, to increase the size of the access panels that are used to accomplish the jackscrew assembly lubrication procedure. (A-02-39) Establish the jackscrew assembly lubrication procedure as a required inspection item that must have an inspector’s signoff before the task can be considered complete. (A-02-40)

Recommendations 182 Aircraft Accident Report Review all existing maintenance intervals for tasks that could affect critical aircraft components and identify those that have been extended without adequate engineering justification in the form of technical data and analysis demonstrating that the extended interval will not present any increased risk and require modifications of those intervals to ensure that they (1) take into account assumptions made by the original designers, (2) are supported by adequate technical data and analysis, and (3) include an appropriate safety margin that takes into account the possibility of missed or inadequate accomplishment of the maintenance task. In conducting this review, the Federal Aviation Administration should also consider original intervals recommended or established for new aircraft models that are derivatives of earlier models and, if the aircraft component and the task are substantially the same and the recommended interval for the new model is greater than that recommended for the earlier model, treat such original intervals for the derivative model as “extended” intervals. (A-02-41) Conduct a systematic industrywide evaluation and issue a report on the process by which manufacturers recommend and airlines establish and revise maintenance task intervals and make changes to the process to ensure that, in the future, intervals for each task (1) take into account assumptions made by the original designers, (2) are supported by adequate technical data and analysis, and (3) include an appropriate safety margin that takes into account the possibility of missed or inadequate accomplishment of the maintenance task. (A-02-42) Require operators to supply the Federal Aviation Administration (FAA), before the implementation of any changes in maintenance tasks intervals that could affect critical aircraft components, technical data and analysis for each task demonstrating that none of the proposed changes will present any potential hazards, and obtain written approval of the proposed changes from the principal maintenance inspector and written concurrence from the appropriate FAA aircraft certification office. (A-02-43) Pending the incorporation of a fail-safe mechanism in the design of the Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 horizontal stabilizer jackscrew assembly, as recommended in Safety Recommendation A-02-49, establish an end play check interval that (1) accounts for the possibility of higher-than-expected wear rates and measurement error in estimating acme nut thread wear and (2) provides for at least two opportunities to detect excessive wear before a potentially catastrophic wear condition becomes possible. (A-02-44)

Recommendations 183 Aircraft Accident Report Require operators to permanently (1) track end play measures according to airplane registration number and jackscrew assembly serial number, (2) calculate and record average wear rates for each airplane based on end play measurements and flight times, and (3) develop and implement a program to analyze these data to identify and determine the cause of excessive or unexpected wear rates, trends, or anomalies. The Federal Aviation Administration (FAA) should also require operators to report this information to the FAA for use in determining and evaluating an appropriate end play check interval. (A-02-45) Require that maintenance facilities that overhaul jackscrew assemblies record and inform customers of an overhauled jackscrew assembly’s end play measurement. (A-02-46) Require operators to measure and record the on-wing end play measurement whenever a jackscrew assembly is replaced. (A-02-47) Require that maintenance facilities that overhaul Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 series airplanes’ jackscrew assemblies obtain specific authorization to perform such overhauls, predicated on demonstrating that they possess the necessary capability, documentation, and equipment for the task and that they have procedures in place to (1) perform and document the detailed steps that must be followed to properly accomplish the end play check procedure and lubrication of the jackscrew assembly, including specification of appropriate tools and grease types; (2) perform and document the appropriate steps for verifying that the proper acme screw thread surface finish has been applied; and (3) ensure that appropriate packing procedures are followed for all returned overhauled jackscrew assemblies, regardless of whether the assembly has been designated for storage or shipping. (A-02-48) Conduct a systematic engineering review to (1) identify means to eliminate the catastrophic effects of total acme nut thread failure in the horizontal stabilizer trim system jackscrew assembly in Douglas DC-9 (DC-9), McDonnel Douglas MD-80/90 (MD-80/90), and Boeing 717 (717) series airplanes and require, if practicable, that such fail-safe mechanisms be incorporated in the design of all existing and future DC-9, MD-80/90, and 717 series airplanes and their derivatives; (2) evaluate the horizontal stabilizer trim systems of all other transport-category airplanes to identify any designs that have a catastrophic single-point failure mode and, for any such system; (3) identify means to eliminate the catastrophic effects of that single-point failure mode and, if practicable, require that such fail-safe mechanisms be incorporated in the design of all existing and future airplanes that are equipped with such horizontal stabilizer trim systems (A-02-49)

Recommendations 184 Aircraft Accident Report Modify the certification regulations, policies, or procedures to ensure that new horizontal stabilizer trim control system designs are not certified if they have a single-point catastrophic failure mode, regardless of whether any element of that system is considered structure rather than system or is otherwise considered exempt from certification standards for systems. (A-02-50) Review and revise aircraft certification regulations and associated guidance applicable to the certification of transport-category airplanes to ensure that wear-related failures are fully considered and addressed so that, to the maximum extent possible, they will not be catastrophic. (A-02-51) 4.2 Previously Issued Recommendations Resulting From This Accident Investigation As a result of the Alaska Airlines flight 261 accident investigation, the Safety Board issued the following safety recommendations to the FAA on October 1, 2001: Require the Boeing Commercial Airplane Group to revise the lubrication procedure for the horizontal stabilizer trim system of Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 series airplanes to minimize the probability of inadequate lubrication. (A-01-41) On June 14, 2002, the Safety Board classified Safety Recommendation A-01-41 “Open—Acceptable Response.” Require the Boeing Commercial Airplane Group to revise the end play check procedure for the horizontal stabilizer trim system of Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 series airplanes to minimize the probability of measurement error and conduct a study to empirically validate the revised procedure against an appropriate physical standard of actual acme screw and acme nut wear. This study should also establish that the procedure produces a measurement that is reliable when conducted on-wing. (A-01-42) On June 14, 2002, the Safety Board classified Safety Recommendation A-01-42 “Open—Acceptable Response.” Require maintenance personnel who lubricate the horizontal stabilizer trim system of Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 series airplanes to undergo specialized training for this task. (A-01-43) On June 14, 2002, the Safety Board classified Safety Recommendation A-01-43 “Open—Unacceptable Response.”

Recommendations 185 Aircraft Accident Report Require maintenance personnel who inspect the horizontal stabilizer trim system of Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 series airplanes to undergo specialized training for this task. This training should include familiarization with the selection, inspection, and proper use of the tooling to perform the end play check. (A-01-44) On June 14, 2002, the Safety Board classified Safety Recommendation A-01-44 “Open—Unacceptable Response.” Before the implementation of any proposed changes in allowable lubrication applications for critical aircraft systems, require operators to supply to the FAA technical data (including performance information and test results) demonstrating that the proposed changes will not present any potential hazards and obtain approval of the proposed changes from the principal maintenance inspector and concurrence from the FAA applicable aircraft certification office. (A-01-45) On July 29, 2002, the Safety Board classified Safety Recommendation A-01-45 “Closed—Acceptable Action.” Issue guidance to principal maintenance inspectors to notify all operators about the potential hazards of using inappropriate grease types and mixing incompatible grease types. (A-01-46) On July 29, 2002, the Safety Board classified Safety Recommendation A-01-46 “Closed—Acceptable Action.” Survey all operators to identify any lubrication practices that deviate from those specified in the manufacturer’s airplane maintenance manual, determine whether any of those deviations involve the current use of inappropriate grease types or incompatible grease mixtures on critical aircraft systems and, if so, eliminate the use of any such inappropriate grease types or incompatible mixtures. (A-01-47) On June 14, 2002, the Safety Board classified Safety Recommendation A-01-47 “Open—Acceptable Response.” Within the next 120 days, convene an industrywide forum to disseminate information about and discuss issues pertaining to the lubrication of aircraft components, including the qualification, selection, application methods, performance, inspection, testing, and incompatibility of grease types used on aircraft components. (A-01-48) On June 14, 2002, the Safety Board classified Safety Recommendation A-01-48 “Open—Acceptable Response.”

Recommendations 186 Aircraft Accident Report BY THE NATIONAL TRANSPORTATION SAFETY BOARD CAROL J. CARMODY Acting Chairman JOHN J. GOGLIA Member JOHN A. HAMMERSCHMIDT Member GEORGE W. BLACK, JR. Member Adopted: December 30, 2002

Board Member Statements 187 Aircraft Accident Report Board Member Statements Acting Chairman Carol J. Carmody’s Statement I believe that NTSB staff presented a strong case in the draft report on Alaska Airlines Flight 261, and during its presentation to the Board at our December 10, 2002 meeting, for recommending that the FAA should convene a headquarters’-led team to conduct another in-depth, on-site follow-up inspection of Alaska Airlines to evaluate whether adequate corrective measures have been fully implemented to cure the deficiencies identified in the FAA’s April 2000 special inspection report. I did not support the motion to eliminate this recommendation from the report. The accident report thoroughly discusses the maintenance failings, and the support for convening a headquarters’-led team can be summarized as follows:

1. The systemic nature and widespread impact of previously identified

deficiencies;

1. Alaska Airlines’ failure to demonstrate during the FAA’s first follow-up

inspection (in September 2000) that it had fully corrected the deficiencies;

1. The absence of any in-depth follow-up inspection by an objective team of FAA

inspectors not personally responsible for the oversight of Alaska Airlines to verify that the deficiencies have in fact been corrected; and

1. Recent maintenance errors by Alaska Airlines maintenance personnel during

end play checks and evidence of continued poor lubrication practices. The argument made during the meeting that yet another inspection of Alaska Airlines would divert already stretched FAA resources from other important tasks is actually an argument for the FAA to make. The Board’s responsibility is to make recommendations to improve safety. In making these recommendations, we try to avoid specific direction on the means to accomplish any given safety objective. I would expect that a recommendation to the FAA to undertake an inspection would be considered as would any other Board recommendation. The FAA would review the need and the resources available and decide whether or not to pursue the recommendation. I would not expect the FAA to pursue an inspection if that pursuit would divert FAA resources from more important safety accomplishments. Moreover, I would expect that if that were a possibility, the FAA would so advise the Board.

Board Member Statements 188 Aircraft Accident Report There needs to be an assurance that Alaska Airlines has permanently remedied the recurring maintenance problems we have documented in our exhaustive investigation. The public expects and deserves no less. FAA should not have to be coaxed by the NTSB into being more proactive, and I hope that we have not served to perpetuate any problems at Alaska Airlines that the recommended inspection was intended to identify and correct. Member Black concurred with this statement. Member John J. Goglia’s Statement This is a maintenance accident. Alaska Airlines’ maintenance and inspection of its horizontal stabilizer activation system was poorly conceived and woefully executed. The failure was compounded by poor oversight. Lubrication periods were extended, while inspection intervals were simultaneously lengthened, neither with sound technical basis. And, if logic and standard practice dictate that as risk increases so should monitoring, Alaska’s program was otherwise. And in the midst of this, the accident aircraft was dispatched from a C-check with a jackscrew of questionable serviceability that was, in all probability, not greased. And the evidence is that it was never adequately greased again. Had any of the managers, mechanics, inspectors, supervisors, or FAA overseers whose job it was to protect this mechanism done their job conscientiously, this accident cannot happen. The jackscrew is robust. Even at its wear limit condition, it is many times strong enough to carry out its function. And it does not wear quickly when cared for. It is a time-tested mainstay in the fleet, and one major carrier with a diligent approach to its maintenance has never seen one seriously wear, much less wear out. A whole herd of miscues was needed to allow it to fail. Virtually any system on an aircraft treated with the indifference shown to this mechanism will break, many with equally catastrophic effect. Aircraft simply must be maintained, and maintained with care and at all cost. I say these things because I will also admit that it may be possible to design a better jackscrew. If there is an approach that makes this mechanism fail safe, and if the designers feel confident that the dangers of unintended consequences in changing a proven design are zero or less, then yes, let’s by all means add a fail-safe device. But we can easily overdue and over simplify our concern with design issues. We want now to design a safer actuating system and we want to design a better wear measurement system. Fine. But the existing design is safe, it just includes grease as a part of the load transferring system and there wasn’t any grease. And the measuring device we now have, no matter how rudimentary it is thought to be, seems to work well for many airlines, and it identified the fact that this jackscrew was wearing and needed to be replaced. The carrier simply failed to do its job. All the systems in an aircraft that involve large motions under high loads require maintenance. Careful maintenance. And that is a part of the design equation, and once designed, it has to be followed. Certainly we should not rely solely on maintenance where mechanical design can compensate for maintenance failure. Obviously, two hands are better than one. Yet it is seductive error to think that we can engineer out failure permanently. We can’t. Fail-safe components subject to neglect and abuse are themselves susceptible to failure. So we need to be vigilant in our emphasis on both sides of this

Board Member Statements 189 Aircraft Accident Report equation. This was not a design accident. This was a maintenance accident, perhaps more purely so than any others we have seen. It would be sad and ironic indeed if some new and supposedly fail-safe design were to come to lessen the concentration we put to keeping these mechanisms well-maintained. Let me reiterate, aircraft must be maintained with care and at all cost. Alaska Airlines expanded rapidly in the years before this accident. With the goal of becoming more profitable, as they became bigger and busier the pressures to keep their planes on schedule put increasing stress on their maintenance facilities. And this took its toll. The Federal Aviation Administration seemed to know this, but was nowhere effective in preventing the tragic chain of events. So N963AS began its fateful path in a C-check years before falling to the ocean. Its maintainers found a jackscrew that needed to be pulled, but no spare was found and, as the part was arguably acceptable, they pushed the plane back into service, with no watch list, no trailers, or orders to keep track of its condition. There were no specific procedures to do so, and no one thought enough to ask for one. The aircraft was arguably, that is technically, legal, and it was probably safe, if it was carefully greased. It was not, we know that without question. And the lengthened inspection intervals were such that it was not to be looked at again, until it was in our laboratory. When it finally failed, ground support from Alaska Airlines seemed to encourage the crew to proceed with a broken plane on to their scheduled destination, for reasons perhaps of convenience both to passengers and maintenance – we won’t really ever know. But the impression is inescapable. An aircraft that had been hustled out the door three years earlier for the convenience of scheduling was now encouraged to keep to its appointed routing. It is less coincidence than culture. NTSB has made several specific maintenance recommendations, some already accomplished, that will, if followed, prevent the recurrence of this particular accident. But maintenance, poorly done, will find a way to bite somewhere else. Alaska needs to re-constitute its will to performance and perfection on the shop floor. FAA needs to revitalize its Alaska staff and become more intelligent about its efforts to oversee. And if, while all this goes on, the manufacturers can also add greater margins for error, that is icing on the cake. I am interested to see what system enhancements come from this, but I am still left with a mechanic’s perspective -- you either maintain it or it breaks. This is universally applicable. Like the old adage says, “you schedule maintenance, or the maintenance will schedule you.” Acting Chairman Carmody and Members Hammerschmidt and Black concurred with this statement.

this page intentionally left blank

191 Aircraft Accident Report

1. Appendixes

Appendix A Investigation and Public Hearing Investigation The National Transportation Safety Board was initially notified of this accident about 1945 eastern standard time on January 31, 2000. Investigators from the Safety Board’s regional office in Los Angeles, California, went immediately to the scene of the accident. A full go-team was assembled in Washington, D.C., and arrived on scene early the next morning. The go-team was accompanied by Member John Hammerschmidt and representatives from the Board’s Office of Government, Public, and Family Affairs. Parties to the investigation were the Federal Aviation Administration (FAA); the Boeing Commercial Airplane Group; Alaska Airlines, Inc.; the Aircraft Mechanics Fraternal Association (AMFA); the Air Line Pilots Association (ALPA); the Association of Flight Attendants; the National Air Traffic Controllers Association; Pratt & Whitney, and Shell Global Solutions. Public Hearing A public hearing was conducted for this accident from December 13 to 15, 2000, in Washington, D.C. Member John Hammerschmidt presided over the hearing. Parties to the public hearing were the FAA, Alaska Airlines, Boeing, ALPA, and AMFA.

Appendix B 192 Aircraft Accident Report Appendix B Cockpit Voice Recorder Transcript The following is a transcript of the Fairchild A-100A cockpit voice recorder (CVR) serial number 62892, installed on the accident airplane. The CVR transcript reflects the 31 minutes before power was lost to the CVR. All times are Pacific standard time, based on a 24-hour clock. , LEGEND

RDO Radio transmission from accident aircraft, Alaska 261

CAM Cockpit area microphone voice or sound source

PA Voice or sound heard on the public address system channel.

HOT Hot microphone voice or sound source1

For RDO, CAM, HOT, and PA comments:

-1 Voice identified as the Captain

-2 Voice identified as the First Officer

-3 Voice identified as a Flight Attendant

-? Voice unidentified

MZT Radio transmission from Mazetlan Center

LAX CTR1 Radio transmission from the Los Angeles Air Route Traffic Control Center sector 30 controller

LAX CTR2 Radio transmission from the Los Angeles Air Route Traffic Control Center sector 25 controller

LAX-MX Radio transmission from Alaska Airlines Maintenance facility in Los Angeles

LAX-OPS Radio transmission from Alaska Airlines Operations facility in Los Angeles

SEA-DIS Radio transmission from Alaska Airlines Dispatch facility in Seattle

SEA-MX Radio transmission from Alaska Airlines maintenance facility in Seattle

-1 First voice

-2 Second voice

1 This recording contained some audio from one Hot microphone. The voices or sounds heard on this channel were also heard on the CAM channel, and are annotated as coming from the CAM channel in this transcript. The audio from the HOT microphone was used to clarify the CAM audio when possible.

Appendix B 193 Aircraft Accident Report ATIS Radio transmission from Los Angeles airport Automated Terminal Information System

CAWS Mechanical voice or sound source from the Central Aural Warning System, as heard on the Cockpit Area Microphone channel.

Unintelligible word @ Non-pertinent word

Expletive

Break in continuity or interruption in comment

( ) Questionable insertion

[ ] Editorial insertion

... Pause

Note 1: Times are expressed in Pacific Standard Time (PST).

Note 2: Generally, only radio transmissions to and from the accident aircraft were transcribed.

Note 3: Words shown with excess vowels, letters, or drawn out syllables are a phonetic representation of the words as spoken.

Note 4: A non-pertinent word, where noted, refers to a word not directly related to the operation, control or condition of the aircraft.

Appendix B 194 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

Start of Transcript

1549:49.3 [start of recording]

1549:50

SEA-MX um beyond that I have verified no history on your aircraft in the past thirty days.

1549:54.8

CAM [sound of click]

1549:57.7

RDO-1 yea we didn't see anything in the logbook.

1550:14

CAM-2 why don't you pull your your seat forward and I'll just check this pedestal back there. I don't think there's anything be- yond that we haven't checked.

1550:22

CAM-1 see when he's saying pedestal... I believe he's talking about this---

1550:25

CAM-2 oh.

1550:25

CAM-1 ---switch that's on the * that's on the pedestal.

1550:27

CAM-2 yea okay.

1550:31

CAM-1 do you see anything back there?

Appendix B 195 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1550:32

CAM [Sound of click]

1550:33

CAM-2 uh there's *.

1550:40

SEA-MX and two sixty one, maintenance.

1550:42.0

RDO-1 go ahead maintenance two six one.

1550:44

SEA-MX understand you're requesting uh diversion to L A for this uh discrepancy is there a specific reason you prefer L A over San Francisco?

1550:45

MZT Alaska two sixty one radar service terminated... contact uh Los Angeles center frequency one one nine decimal ninety five good day.

1550:54.4

RDO-1 well a lotta times its windy and rainy and wet in San Fran- cisco and uh, it seemed to me that a dry runway... where the wind is usually right down the runway seemed a little more reasonable.

1550:55.0

RDO-2 one one nine ninety five Alaska two sixty one.

1551:01.2

RDO-2 say again the frequency one one nine point eh ninety five?

Appendix B 196 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1551:05

MZT affirm one one nine decimal ninety five.

1551:09.3

RDO-2 roger.

1551:09.9

SEA-MX ok and uh… is this added fuel that you're gonna have in L A gonna be a complication or an advantage?

1551:18.1

RDO-1 well the way I'm reading it uh heavier airplanes land faster... right now I got fifteen five on board, I'm thinking to land with about twelve which is still uh an hour and forty minutes... uh and those are the numbers I'm running up here.

1551:20.6

RDO-2 L A Alaska two sixty one three one zero.

1551:36

SEA-MX ok uh two sixty one standby for dispatch.

1551:38

RDO-2 Los Angeles Alaska two sixty one three one zero.

1551:40

RDO-1 OK the other thing you gotta know is that they're talking about holding and delays in San Francisco um for your maintenance facil- eh you know planning uh it uh L A seemed like a smarter move from airworthy move.

1551:42

LAX-CTR1 Alaska two sixty one L A center roger.

Appendix B 197 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1551:50

RDO-2

• there's two people on the frequency I'm sorry Alaska two

sixty one I didn't hear your response.

1551:58

LAX-CTR1 Alaska two six one squawk two zero one zero.

1552:01

RDO-2 two zero one zero Alaska two sixty one.

1552:02

SEA-DIS two sixty one dispatch... uh current San Francisco weather one eight zero at six, nine miles, few at fifteen hundred bro- ken twenty eight hundred overcast thirty four hundred... uh if uh you want to land at L A of course for safety reasons we will do that uh wu we'll uh tell you though that if we land in L A uh we'll be looking at probably an hour to an hour and a half we have a major flow program going right now. uh that's for ATC back in San Francisco.

1552:31

RDO-1 well uh yu you eh huh... boy you put me in a spot here um….

1552:41

RDO-1 I really didn't want to hear about the flow being the reason you're calling us cause I'm concerned about overflying suit- able airports.

1552:51

SEA-DIS well we wanna do what's safe so if that's what you feel is uh safe we just wanna make sure you have all of the uh… all the info.

Appendix B 198 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1552:59

RDO-1 yea we we kinda assumed that we had... what's the uh the wind again there in San Francisco?

1553:03

SEA-DIS wind at San Francisco currently zero uh one zero eight at six.

1553:08

CAM-2 what runway they landing… one zero?

1553:09

CAM-1 what's that?

1553:10

CAM-2 ask him what runway they're landing.

1553:11

RDO-1 and confirm they're landing runway one zero?

1553:15

SEA-DIS and uh standby I'll confirm that.

1553:17

CAM-2 and see if the runways are dry or wet.

1553:19

RDO-1 and we need to know if they're dry or wet.

1553:21

SEA-DIS eh yup I'll uh find that out and uh correction on that wind one eight zero at six and standby.

Appendix B 199 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1553:28

CAM-1 one eight zero at six... so that's runway one six what we need is runway one nine, and they're not landing runway one nine.

1553:35

CAM-2 I don't think so.

1553:37

CAM-2 we might just ask if there's a ground school instructor there available and and discuss it with him... or a uh simulator in- structor.

1553:40

CAM-1 yea.

1553:46

RDO-1 and uh dispatch one sixty one… we're wondering if we can get some support out of the uh instructernal force---

1553:53

RDO-1 ---instructors up there if they got any ideas on us.

1554:23

CAM-1 you're talkin to ATC huh?

1554:24

CAM-2 yea uh huh.

1554:26

CAM-2 well lets confirm the route of flight its uh, I wasn't totally sure but its uh direct Oceanside?

Appendix B 200 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1554:32

CAM-1 Tijuana Oceanside... Oceanside right... then Santa Cata- lina.

1554:47

CAM-1 ehh somebody was callin in about wheelchairs---

1554:50

CAM-3 oh really?

1554:50

CAM-1 ---when I'm workin a problem.

1554:51

CAM-3 is that why it went static?

1554:53

CAM-1 ok yea now... I just that's something that oughta be in the computers, if they want it that bad they you guys oughta be able to pick up the phone---

1555:00

CAM-3 mmm hmm.

1555:00

CAM-1 ---just… drives me nuts. not that I wanna go on about it… you know I it just blows me away they think we're gonna land, they're gonna fix it, now they're worried about the flow, I'm sorry this airplane's idn't gonna go anywhere for a while.… so you know.

1555:16

CAM-3 so they're trying to put the pressure on you---

Appendix B 201 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1555:18

CAM-1 well no, yea.

1555:19

CAM-3 ---well get it to where it needs to be.

1555:20

CAM-1 and actually it doesn't matter that much to us.

1555:23

CAM-3 still not gonna go out on time to the next *.

1555:24

CAM-1 yea… yea… I thought they'd cover the people better from L A---

1555:29

CAM-3 L A

1555:30

CAM-1 ---then San Francisco.

1555:32

RDO-2 L A Alaska two sixty one just confirm our routing after uh Tijuana is, direct Oceanside?

1555:38

LAX-CTR1 Alaska two sixty one after Tijuana cleared to San Francisco via direct San Marcos jet five zero one Big Sur direct main- tain flight level three one zero.

1555:47

RDO-2 OK uh San Francisco San Marcos J five zero one Big Sur uh direct three one zero Alaska two sixty one.

Appendix B 202 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1555:55

LAX-CTR1 *

1556:03

SEA-DIS Alaska two sixty one dispatch.

1556:06

RDO-1 dispatch Alaska two six one go ahead.

1556:08

SEA-DIS yea I called uh ATIS they're landing two eight right two eight left and uh wasn't able to get the the runway report but uh looking at past uh weather it hasn't rained there in hours so I'm looking at uh probably a dry runway.

1556:21

RDO-1 ok uh.

1556:26

RDO-1 I have with the information I have available to me and we're waitin on that CG update I'm looking at a uh approach speed of a hundred and eighty knots, uh do you have a wind at L A X lax?

1556:50

SEA-DIS its two six zero at nine.

1556:56

RDO-1 ok two six at nine….

1556:59

RDO-1 ...versus a direct crosswind which is effectively no change in groundspeed... I gotta tell you, when I look at it from a safety point I think that something that lowers my ground- speed makes sense.

Appendix B 203 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1557:16

SEA-DIS ok two sixty one that'll uh that'll mean L A X then for you um I was gonna get you if I could to call L A X with that uh info and they can probably whip out that CG for you real quick.

1557:30

RDO-1 I suspect that uh that's what we'll have to do. ok here's uh, my plan is we're gonna continue as if going to San Fran- cisco get all that data then begin our descent back in to L A X, and at a lower altitude we will configure, and check the handling uh envelope before we proceed with the approach.

1558:05

SEA-DIS ok two sixty one dispatch copied that, if you can now keep uh L A ops updated on uh your ETA, that would be great and I'll be talking with them.

1558:15

RDO-1 ok well ah if you'll let them know we're comin here I'll I think they'll probably listen as we talk… were goin to L A X were gonna stay up here and burn a little more gas get all our ducks in a row, and then we'll uh be talking to L A X when we start down to go in there.

1558:29

SEA-DIS ok and if you have any problems with them giving you a CG gimme a call back.

1558:34

RDO-1 ok. break, L A X do you read Alaska two six one?

1558:39

LAX-OPS two sixty one I do copy do you have an ETA for me?

Appendix B 204 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1558:43

RDO-1 well….

1558:45

RDO-1 ...yea I'm gonna put it at about thirty, thirty five minutes, I could actually, the longer the more fuel I burn off the better I am... but I wonder if you can compute our current CG based on the information we had at takeoff for me.

1558:58

LAX-OPS ok you're transmission is coming in broken but uh, go ahead.

1559:02

RDO-1 you know what I'll wait a minute we'll be a little bit closer and that'll help everything.

1559:06

LAX-OPS ok also uh two sixty one just be advised uh because you're an international arrival we have to get landing rights I don't know how long that's gonna take me... but uh I have to clear it all through customs first.

1559:19

RDO-1 ok I unders... I remember this is complicated, yea well, bet- ter start that now cause we are comin to you.

1559:26

LAX-OPS copy.

1559:29

CAM-1 we'll call em back over as we get closer to Catalina.

1559:34

CAM-2 as we get what?

Appendix B 205 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1559:34

CAM-1 closer to L A she's got to get landing rights.

1559:37

CAM-2 were ninety four miles from L A now.

1559:38

CAM-1 oh ok. you wanna listen to the ATIS you can.

1559:42

CAM-2 in fact I switched it once already just kinda late.

1559:44

CAM-1 you got the jet.

1559:44

CAM-2 I got it.

Appendix B 206 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1559:50

ATIS charlie five and charlie six is restricted * taxiway charlie five is restricted to MD eleven and smaller. read back all runway hold short instructions. upon receipt of your ATC clearance read back only your callsign and transponder code unless you have a question. advise on initial contact, you have in- formation mike. Los Angeles international airport informa- tion mike. two two five zero zulu. wind two three zero at eight. visibility eight. few clouds at two thousand eight hun- dred. one two thousand scattered. ceiling two zero thou- sand overcast. temperature one six dewpoint one one. al- timeter three zero one seven. simultaneous ILS approaches in progress runway two four right and two five left or vector for visual approach will be provided. simultaneous visual approaches to all runways are in progress. and parallel lo- calizer approaches are in progress between Los Angeles international and Hawthorne airports. simultaneous instru- ment departure in progress runway two four and two five. notices to airmen.

1601:01

CAM-2 so he wanted us to go to San Fran initially?

1601:06

CAM-1 to keep the schedule alive. I mean it was just... it was I mean he had all the reasons to do it, I stated concern about flying overflying a suitable airport---

1601:15

CAM-2 yea.

1601:16

CAM-1 ---but I was listening, then when he gives me the wind, its it's... the wind was a ninety degree cross at ten knots. two eight and we'd be landing on---

Appendix B 207 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1601:30

CAM-2 and they are using one nine?

1601:33

CAM-1 you know I don't know… I wrote it down there… the winds were… one eighty at six… I don't know.

1601:49

CAM-2 I don't know.

1601:49

CAM-1 I don't care… you know what? I expect him to figure all that

---

1601:53

CAM-2 right.

1601:53

CAM-1 ---he's got it on the screen---

1601:54

CAM-2 that's why I was thinking that an instructor would really uh---

1601:58

CAM-1 yea.

1601:58

CAM-2 ---cut through the crap there.

1601:59

CAM-2 they… not available?

1602:00

CAM-1 well they just don't talk to each other.

Appendix B 208 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1602:02

CAM-2 oh.

1602:02

CAM-1 I mean I * ---

1602:04

CAM-2

• they've always told us they were available you know---

1602:06

CAM-1 yea yea.

1602:07

CAM-2 ---anytime you have a problem.

1602:09

CAM-2 if they get one down there.

1602:12.6

RDO-1 Los Angeles one sixty one do you read me better now?

1602:29

CAM-1 I got the track goin over there.

1602:31

LAX-OPS go ahead two six one.

1602:33.6

RDO-1 two sixty one, I… I know you're busy on us uh, but we're discussing it up here could you give us the winds at San Francisco if you could just pull em up on your screen?

1602:57

CAM-2 I thought they….

Appendix B 209 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1603:00

LAX-OPS ok ahhh San Francisco, ok we've got uh... winds are one seventy at six knots.

1603:15.6

RDO-1 ok thank you that's what I needed. we are comin in to see you… and I've misplaced the paperwork here.

1603:23

CAM-2 there it is.

1603:35

CAM-1 I can't read your writing… can you read her the uh zero fuel weight---

1603:40

CAM-2 yea.

1603:41

CAM-1 ---and all those numbers and CG.

1603:43

LAX-OPS L A operations from two six to two six one.

1603:48

CAM-2 I got it.

1603:48.5

RDO-2 uhhh two sixty one… do you need our uh, our numbers?

1603:52

LAX-OPS yea we just wanna advise that we do not have landing rights as yet.

Appendix B 210 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1603:56

RDO-2 here's our numbers we had uh ten in first class, seventy in coach, zero fuel weight one zero two one one zero point one fuel on board thirty four point niner take off weight one thirty six five one one point eight, CG eleven point eight.

1604:19

LAX-OPS OK I got ten and seventy Z fuel weight one zero two one one zero point one, fuel on board thirty four decimal nine take off weight five one one decimal eight and a CG of eleven decimal eight.

1604:32

RDO-2 yea uh take off one three six five one one point eight and uh CG one one point eight. and we currently have thirteen thousand six hundred pounds of fuel on board.

1604:43

CAM-1 estimate ten thousand on landing.

1604:45

RDO-2 estimating ten thousand pounds on landing.

1604:53

LAX-OPS ok you said your takeoff weight was… one one uhh one five one one decimal eight?

1604:58

RDO-2 one three six five one one point eight.

1605:05

LAX-OPS one three six five one one point eight thank you.

Appendix B 211 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1605:07

RDO-2 and we're currently a hundred and fifteen seven on our weight, and we'll burn another three thousand pounds.

1605:19

CAM [sound of two clicks]

1605:27

CAM-2 I'm back on the uh I'm off of the uh company.

1606:26

CAM-1 no… that's what I was expecting them to do. duh.

1606:47

CAM-2 so our… actually our landing speed will be one forty eight plus… some additive right?

1607:06

CAM-1 lets guess... lets guess one twelve.

1607:10

CAM-2 ok.

1607:10

CAM-1 one forty six… plus… I get a minus two, worst case... twenty four knots... fifty sixty seventy... *.

1607:33

LAX-OPS Alaska two sixty one from operations can you give us your tail number?

1607:38

RDO-1 uh two sixty one, it was ship number nine six three.

Appendix B 212 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1607:43

LAX-OPS copy that two… uh your aircraft number is nine six three.

1607:47

RDO-1 affirmative thank you.

1607:51

LAX-MX-1 and two sixty one maintenance.

1607:53

RDO-1 two sixty one go.

1607:54

LAX-MX-1 yea are you guys with the uh, horizontal situation?

1607:58

RDO-1 affirmative.

1607:59

LAX-MX-1 yea did you try the suitcase handles and the pickle switches right?

1608:03

RDO-1 yea we tried everything together, uh….

1608:08

RDO-1 ...we've run just about everything if you've got any hidden circuit breakers we'd love to know about 'em.

1608:14

LAX-MX-1 I'm off I'll look at the uh circuit breaker uh guide just as a double check and um yea I just wanted to know if you tried the pickle switches and the suitcase handles to see if it was movin in with any of the uh other switches other than the uh suitcase handles alone or nothing.

Appendix B 213 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1608:29.9

RDO-1 yea we tried just about every iteration.

1608:32

LAX-MX-1 and alternate's inop too huh?

1608:35.1

RDO-1 yup its just it appears to be jammed the uh the whole thing, it spikes out when we use the primary, we get AC load that tells me the motor's tryin to run but the brake won't move it. when we use the alternate, nothing happens.

1608:50

LAX-MX-1 ok and you you you say you get a spike when on the meter up there in the cockpit when you uh try to move it with the uh um with the primary right?

1608:59

CAM-1 I'm gonna click it off you got it.

1609:00

CAM-2 ok.

1609:01.5

RDO-1 affirmative we get a spike when we do the primary trim but there's no appreciable uh change in the uh electrical uh when we do the alternate.

1609:09

LAX-MX-1 ok thank you sir see you here.

1609:11

RDO-1 ok.

Appendix B 214 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1609:13

CAM-1 lets do that.

1609:14.8

CAM [sound of click]

1609:14.8

CAM-1 this'll click it off.

1609:16

CAM [sound of clunk]

1609:16.9

CAM [sound of two faint thumps in short succession]

1609:17.0

CAWS [sound similar to horizontal stabilizer-in-motion audible tone]

1609:18

CAM-1 holy #.

1609:19.6

CAWS [sound similar to horizontal stabilizer- in-motion audible tone]

1609:21

CAM-1 you got it?... # me.

1609:24

CAM-2 what are you doin?

1609:25

CAM-1 I it clicked off---

Appendix B 215 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1609:25.4

CAWS [sound of chime] Altitude

1609:26

CAM-1 ---it * got worse… ok.

1609:30

CAM [sound similar to airframe vibration begins]

1609:31

CAM-1 you're stalled.

1609:32

CAM [sound similar to airframe vibration becomes louder]

1609:33

CAM-1 no no you gotta release it ya gotta release it.

1609:34

CAM [sound of click]

1609:34

CAM [sound similar to airframe vibration ends]

1609:42.4

CAM-1 lets * speedbrake.

1609:46

CAM-1 gimme a high pressure pumps.

1609:52

CAM-2 ok.

1609:52

CAM-1 help me back help me back.

Appendix B 216 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1609:54

CAM-2 ok.

1609:55

RDO-1 center Alaska two sixty one we are uh in a dive here.

1610:01.6

RDO-1 and I've lost control, vertical pitch.

1610:01.9

CAWS [sound of clacker] Overspeed. (begins and repeats for approx 33 seconds)

1610:05

LAX-CTR1 Alaska two sixty one say again sir.

1610:06.6

RDO-1 yea were out of twenty six thousand feet, we are in a verti- cal dive… not a dive yet... but uh we've lost vertical control of our airplane.

1610:15

CAM [sound of click]

1610:20

CAM-1 just help me.

1610:22

CAM-1 once we get the speed slowed maybe… we'll be ok.

1610:28.2

RDO-1 we're at twenty three seven request uh.

1610:33

RDO-1 yea we got it back under control here.

Appendix B 217 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1610:34

RDO-2 no we don't, ok.

1610:37

CAM-1 ok.

1610:37

LAX-CTR1 the altitude you'd like to uh to remain at?

1610:40

CAM [sound of click]

1610:45

CAM-2 lets take the speedbrakes off I'm * ---

1610:46

CAM-1 no no leave them there. it seems to be helping.

1610:51

CAM-1

me.

1610:53

CAWS [sound of chime] Altitude

1610:55

CAM-1 ok it really wants to pitch down.

1610:58

CAM-2 ok.

1610:59

CAM-1 don't mess with that.

1611:04

CAM-2 I agree with you.

Appendix B 218 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1611:04

LAX-CTR1 Alaska two sixty one say your condition.

1611:06.6

RDO-1 two sixty one we are at twenty four thousand feet, kinda stabilized.

1611:10

RDO-1 we're slowing here, and uh, we're gonna uh.

1611:15

RDO-1 do a little troubleshooting, can you gimme a block between uh, twenty and twenty five?

1611:21

LAX-CTR1 Alaska two sixty one maintain block altitude flight level two zero zero through flight level two five zero.

1611:27

RDO-1 Alaska two sixty one we'll take that block we'll be monitor'n the freq.

1611:31

CAM-2 you have the airplane let me just try it.

1611:33

CAM-1 ok.

1611:33

CAM-2 uh how hard is it?

1611:33

CAM-1 I don't know my adrenaline's goin… it was really tough there for a while.

Appendix B 219 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1611:38

CAM-2 yea it is.

1611:39

CAM-1 ok.

1611:43

CAM-2 whatever we did is no good, don't do that again.

1611:44

CAM-1 yea, no it went down it went to full nose down.

1611:48

CAM-2 uh it's a lot worse than it was?

1611:50

CAM-1 yea yea we're in much worse shape now.

1611:59

CAM-1 I think its at the stop, full stop… and I'm thinking, we can- can it go any worse… but it probably can… but when we slowed down, lets slow it lets get down to two hundred knots and see what happens.

1612:16

CAM-2 ok?

1612:16

CAM [sound of click]

1612:17

CAM-2 we have to put the slats out and everything… flaps and slats.

Appendix B 220 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1612:20

CAM-1 yea... well we'll wait ok you got it for a second?

1612:23

CAM-2 yea.

1612:25.3

RDO-1 maintenance two sixty one are you on?

1612:30

LAX-MX-2 yea two sixty one this is maintenance.

1612:32.0

RDO-1 ok we did---

1612:33.2

RDO-1 ---we did both the pickle switch and the suitcase handles and it ran away full nose trim down.

1612:39

LAX-MX-2 oh it ran away trim down.

1612:42

RDO-1 and now we're in a * pinch so we're holding uh we're worse than we were.

1612:50

LAX-MX-2 ok uh... geez.

1612:52

LAX-MX-1 you want me to talk to em? (in the background during pre- vious transmission)

Appendix B 221 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1612:55

LAX-MX-1 yea two sixty one maintenance uh uh you getting full nose trim down but are you getting any you don't get no nose trim up is that correct?

1613:04

RDO-1 that's affirm we went to full nose down and I'm afraid to try it again to see if we can get it to go in the other direction.

1613:10

LAX-MX-1 ok well your discretion uh if you want to try it, that's ok with me if not that's fine. um we'll see you at the gate.

1613:20

CAM-2 did it happen went in reverse? when you pulled back it went forward?

1613:22

CAM-1 I went tab down… right, and it should have come back in- stead it went the other way.

1613:29

CAM-2 uh huh.

1613:30

CAM-1 what do you think?

1613:32

CAM-2 uhhh.

1613:32

CAM-1 you wanna try it or not?

1613:32

CAM-2 uhh no. boy I don't know.

Appendix B 222 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1613:33

CAM-1 its up to you man.

1613:35

CAM-2 lets head back toward uh here lets see… well we're---

1613:39

CAM-1 I like where were goin out over the water myself… I don't like goin this fast though.

1613:50

CAM [sound of click]

1613:57

CAM-1 ok you got * [sound similar to short interruption in recording] second?

1613:58

CAM-2 yea.

1613:59

CAM-2 we better... talk to the people in the back there.

1614:03

CAM-1 yea I know.

1614:04

LAX-CTR1 Alaska two sixty one let me know if you need anything.

1614:08

RDO-2 yea we're still workin this.

Appendix B 223 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1614:12

PA-1 folks we have had a flight control problem up front here we're workin it uh that's Los Angeles off to the right there that's where we're intending to go. we're pretty busy up here workin this situation I don't anticipate any big problems once we get a couple of sub systems on the line. but we will be going into L A X and I'd anticipate us parking there in about twenty to thirty minutes.

1614:39

CAM-1 ok… did the, first of all, speedbrakes. did they have any effect?

1614:49

CAM-1 lets put the power where it'll be for one point two, for land- ing. you buy that?

1614:53

CAM-1 slow it down and see what happens.

1614:54

LAX-CTR1 Alaska two sixty one contact L A center one two six point five two they are aware of your situation.

1615:00.0

RDO-2 ok Alaska two sixty one say again the frequency, one two zero five two?

1615:02

CAM-1 I got the yoke.

1615:04

LAX-CTR1 Alaska two sixty one, twenty six fifty two.

Appendix B 224 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1615:06

RDO-2 thank you.

1615:07

LAX-CTR1 you're welcome have a good day.

1615:19.7

RDO-2 L A Alaska two sixty one we're with you we're at twenty two five, we have a jammed stabilizer and we're maintaining altitude with difficulty. uh but uh we can maintain altitude we think... and our intention is to land at Los Angeles.

1615:36

LAX-CTR2 Alaska two sixty one L A center roger um you're cleared to Los Angeles airport via present position direct uh Santa Monica, direct Los Angeles and uh, you want lower now or what do you want to do sir?

1615:54

CAM-1 let me get let me have it.

1615:56

RDO-1 center uh Alaska two sixty one. I need to get down about ten, change my configuration, make sure I can control the jet and I'd like to do that out here over the bay if I may.

1616:07

LAX-CTR2 ok Alaska two sixty one roger that standby here.

1616:11

CAM-2 lets do it at this altitude instead---

1616:11

CAM-1 what?

Appendix B 225 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1616:12

CAM-2 ---of goin to ten lets do it at this altitude.

1616:14

CAM-1 cause the airflow's that much difference down at ten this air's thin enough that that you know what I'm sayin?

1616:20

CAM-2 yea uh I'll tell em to uh---

1616:22

CAM-1 I just made a PA to everyone to get everybody---

1616:24

CAM-2 ok.

1616:26

CAM-1 ---down you might call the flight attendants.

1616:27

CAM [sound similar to cockpit door operating]

1616:32

CAM-3 I was just comin up this way.

1616:32

LAX-CTR2 Alaska two sixty one fly a heading of two eight zero and descend and maintain one seven thousand.

1616:34

CAM-2 uhh.

1616:36

CAM [sound similar to cockpit door operating]

Appendix B 226 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1616:39.0

RDO-1 two eight zero and one seven seventeen thousand Alaska two sixty one. and we generally need a block altitude.

1616:45

LAX-CTR2 ok and just um I tell you what do that for now sir, and con- tact L A center on one three five point five they'll have fur- ther uhh instructions for you sir.

1616:56.9

RDO-2 ok thirty five five say the altimeter setting?

1616:59

LAX-CTR2 the L A altimeter is three zero one eight.

1617:01

CAM-1 I need everything picked up---

1617:02

RDO-2 thank you.

1617:02

CAM-1 ---and everybody strapped down---

1617:04

CAM-3 ok.

1617:04

CAM-1 ---cause I'm gonna unload the airplane and see if we can---

1617:06

CAM-3 ok.

1617:07

CAM-1 ---we can regain control of it that way.

Appendix B 227 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1617:09

CAM-3 ok we had like a big bang back there---

1617:11

CAM-1 yea I heard it---

1617:12

CAM-3 ok.

1617:12

CAM-1 ---the stab trim I think it---

1617:13

CAM-2 you heard it in the back?

1617:13

CAM-3 yea.

1617:14

CAM-2 yea.

1617:15

CAM-3 so---

1617:15

CAM-1 I think the stab trim thing is broke---

1617:17

CAM-3 ---I didn't wanna call you guys… but---

1617:18

CAM-1 no no that's good.

1617:20

CAM-3 ---that girl, they're like you better go up there---

Appendix B 228 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1617:21

CAM-1 I need you everybody strapped in now, dear.

1617:22

CAM-3 ---and tell them.

1617:23

CAM-3 ok.

1617:24

CAM-1 cause I'm gonna I'm going to release the back pressure and see if I can get it... back.

1617:30

CAM [sound similar to cockpit door operating]

1617:33

CAM-2 three zero one eight.

1617:37

CAM-1 I'll get it here.

1617:40

CAM-2 I don't think you want any more speedbrakes do you?

1617:42

CAM-1 uhh no. actually.

1617:46

CAM-2 he wants us to maintain seventeen.

1617:51

CAM-1 ok I need help with this here.

Appendix B 229 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1617:52

CAM-1 slats ext... lets---

1617:54

CAM-2 ok slats---

1617:54

CAM-1 gimme slats extend.

1617:55

CAM-2 got it.

1617:56.6

CAM [sound similar to slat/flap handle movement]

1617:58

CAM-1 I'm test flyin now---

1617:59

CAM-2 how does it feel?

1618:00

CAM-1 it's wantin to pitch over more on you.

1618:02

CAM-2 really?

1618:03

CAM-1 yea.

1618:04

CAM-2 try flaps?… fifteen, eleven?

1618:05

CAM-1 ahh lets go to eleven.

Appendix B 230 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1618:07.3

CAM [sound similar to slat/flap handle movement]

1618:09

CAM-2 ok... get some power on.

1618:10

CAM-1 I'm at two hundred and fifty knots, so I'm lookin….

1618:17

CAM-2 real hard?

1618:17

CAM-1 no actually its pretty stable right here... see but we got to get down to a hundred an eighty.

1618:26

CAM-1 OK... bring bring the flaps and slats back up for me.

1618:32

CAM-2 slats too?

1618:33

CAM-1 yea.

1618:36.8

CAM [sound similar to slat/flap handle movement]

1618:37

CAM-2 that gives us... twelve thousand pounds of fuel, don't over boost them.

1618:47

CAM-1 what I'm what I wanna do...

Appendix B 231 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1618:48

CAM [sound similar to slat/flap handle movement]

1618:49

CAM-1 is get the nose up... and then let the nose fall through and see if we can stab it when it's unloaded.

1618:54

CAWS [sound of chime] Altitude (repeats for approximately 34 sec- onds)

1618:56

CAM-2 you mean use this again? I don't think we should... if it can fly, its like---

1619:01

CAM-1 it's on the stop now, its on the stop.

1619:04

CAM-2 well not according to that its not.

1619:07

CAM-2 the trim might be, and then it might be uh, if something's popped back there---

1619:11

CAM-1 yea.

1619:11

CAM-2 ---it might be * mechanical damage too.

1619:14

CAM-2 I think if it's controllable, we oughta just try to land it---

Appendix B 232 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1619:16

CAM-1 you think so? ok lets head for L A.

1619:21.1

CAM [sound of faint thump]

1619:24

CAM-2 you feel that?

1619:25

CAM-1 yea.

1619:29

CAM-1 ok gimme sl--- see, this is a bitch.

1619:31

CAM-2 is it?

1619:31

CAM-1 yea.

1619:32.8

CAM [sound of two clicks similar to slat/flap handle movement]

1619:36

CAM-? *

1619:36.6

CAM [sound of extremely loud noise] [increase in background noise begins and continues to end of recording] [sound similar to loose articles moving around in cockpit]

1619:37

CAM-? *

Appendix B 233 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1619:37.6

PA [sound similar to CVR startup tone]

1619:43

CAM-2 mayday.

1619:49

CAM-1 push and roll, push and roll.

1619:54

CAM-1 ok, we are inverted... and now we gotta get it….

1619:59

CAM [sound of chime]

1620:03

CAM-1 kick *

1620:04

CAM-1 push push push... push the blue side up.

1620:14

CAM-1 push.

1620:14

CAM-2 I'm pushing.

1620:16

CAM-1 ok now lets kick rudder... left rudder left rudder.

1620:18

CAM-2 I can't reach it.

1620:20

CAM-1 ok right rudder... right rudder.

Appendix B 234 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1620:25

CAM-1 are we flyin?... we're flyin... we're flyin... tell 'em what we're doin.

1620:33

CAM-2 oh yea let me get *

1620:35

CAM-1 *

1620:38

CAM-1 gotta get it over again... at least upside down we're flyin.

1620:40.6

PA [sound similar to CVR startup tone]

1620:42

CAM-? *

1620:44

CAM-? *

1620:49

CAM [sounds similar to compressor stalls begin and continue to end of recording]

1620:49

CAM [sound similar to engine spool down]

1620:54

CAM-1 speedbrakes.

1620:55.1

CAM-2 got it.

Appendix B 235 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION

TIME and TIME and SOURCE CONTENT SOURCE CONTENT

1620:56.2

CAM-1 ah here we go.

1620:57.1

[end of recording]

End of transcript

this page intentionally left blank

FD07249 ｜ 2002_美国_HAB0210.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2002 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/HAB-02/10 E

P L U R I B U S UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N

National Transportation Safety Board Washington, D.C. 20594

Highway Accident Brief

Accident No.: HWY-98-SH-007 Accident Type: Highway-rail grade crossing collision Location: Blum, Texas Date and Time: November 13, 1997; 8:45 a.m. Vehicle 1 (V1): 1998 Ford tank truck hauling propane Vehicle 2 (V2): Freight train Fatalities: 2 fatalities

Accident Description The truckdriver drove onto the railroad tracks at a passive grade crossing on Hill County Road 1130 and was struck by a freight train. (See figure 1.) The propane tanks and the truck’s fuel tank ruptured at impact, causing a fire. The truckdriver and codriver were ejected and fatally injured. The truckdriver had been taking prescription medicine for diabetes. The train’s horn had been sounding; audibility testing revealed that it could not be heard in the truck cab. Sight distance was limited at this crossing; however, because the driver was hauling hazardous materials, he was required to stop, look, and listen for trains.

State/Federal Oversight Texas adopted the Federal Motor Carrier Safety Regulations with some variances; none of the variances were pertinent to the carrier or driver at the time of the accident. Following unrated compliance reviews in 1992 and 1993, the carrier was fined $2,500 for violations of hazardous materials regulations.

NTSB/HAB-02/10 2

V2 at impact V1 at impact V1 at final rest Hill County Road 1130 Source: NTSB (not to scale) N Blum, Texas

Figure 1. Accident diagram.

Probable Cause The National Transportation Safety Board determines that the probable cause of the accident was the truckdriver’s failure to yield to the approaching freight train.

Adopted: September 17, 2002

FD07250 ｜ 2002_美国_HAB0213.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2002 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/HAB-02/13 E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N

National Transportation Safety Board Washington, D.C. 20594

Highway Accident Brief

Accident No.: HWY-98-SH-013 Accident Type: Head-on collision Location: Killeen, Texas Date and Time: January 10, 1998; 3:10 a.m. Vehicle 1 (V1): 1988 Peterbilt tractor-semitrailer, empty Vehicle 2 (V2): 1988 Chevrolet Blazer sports utility vehicle Fatalities/Injuries: 5 fatalities, 1 serious injury

Accident Description The Chevrolet Blazer sports utility vehicle (SUV) traveled across the centerline of the roadway on State Highway 195, and its left front struck the left front of the tractor- semitrailer. (See figure 1.) The SUV was destroyed, and the tractor was extensively damaged. The driver and four occupants of the SUV were fatally injured, and the truckdriver sustained serious injuries. The SUV occupants had a significant blood alcohol content; the four passenger’s levels measured 0.05, 0.10, 0.17, and 0.18 percent, and the driver’s level was 0.09 percent. The level for being legally drunk at the time of the accident was 0.10 percent; now it is 0.08 percent.

State/Federal Oversight Texas adopted the Federal Motor Carrier Safety Regulations with some variances; none of the variances were pertinent to the carrier or driver at the time of the accident.

NTSB/HAB-02/13 2

V1 at impact V2 at impact V2 pre-crash V1 pre-crash State Highway 195 Source: NTSB (not to scale) N Killeen, Texas (shoulder) (shoulder)

Figure 1. Accident diagram.

Probable Cause The National Transportation Safety Board determines that the probable cause of the accident was the failure of the sports utility vehicle driver to stay in his travel lane due to alcohol impairment.

Adopted: September 17, 2002

FD07251 ｜ 2002_美国_HAB0214.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2002 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/HAB-02/14 E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N

National Transportation Safety Board Washington, D.C. 20594

Highway Accident Brief

Accident No.: HWY-98-SH-018 Accident Type: Rear-end collision Location: Bothell, Washington Date and Time: February 17, 1998; 4:00 p.m. Vehicle 1 (V1): 1990 White/Volvo tractor with a double semitrailer hauling lumber Vehicles 2–7 (V2–V7): 1994 Dodge Ram van, 2 passenger cars, 2 pickup trucks, and 1 tractor-semitrailer Fatalities/Injuries: 3 fatalities, 7 minor injuries

Accident Description The driver of the tractor-double semitrailer stated that she noticed traffic on Interstate Highway 405 slowing in front of her and began applying the brakes. She then noticed the air pressure for the brake system depleting rapidly. The tractor-double semitrailer subsequently rear-ended the first vehicle stopped in traffic ahead, a Dodge van, pushing it into five other vehicles. (See figure 1.) The tractor-double semitrailer and van erupted in fire. Three van occupants were fatally injured; seven others involved in the collision sustained minor injuries.

State/Federal Oversight Washington has adopted the Federal Motor Carrier Safety Regulations with variances; none of the variances were pertinent to the carrier or driver at the time of the accident. The U.S. Department of Transportation (DOT) conducted a compliance review in April 1991, giving the carrier an unsatisfactory rating for deficiencies in compliance with general regulations (Part 390), driver qualifications (Part 391), reporting of accidents (Part 394), and hours-of-service regulations (Part 391). DOT conducted another compliance review in 1992; the carrier received an overall satisfactory rating with a conditional rating for hours-of-service compliance.

NTSB/HAB-02/14 2

V1 at impact V2 at impact V5 at impact V1 pre-crash Interstate 405 (northbound lanes) Source: NTSB (not to scale) N Bothell, Washington (shoulder) (shoulder) V3 at impact V4 at impact V6 at impact V7 at impact

Figure 1. Accident diagram.

Probable Cause The National Transportation Safety Board determines that the probable cause of the accident was the inability of the truckdriver to stop for traffic because of inoperable truck brakes.

Adopted: September 17, 2002

FD07252 ｜ 2002_美国_HAB2002.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2002 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

National Transportation Safety Board Washington, DC 20594 Highway Accident Brief Multivehicle Work Zone Crash on Interstate 84, Boise, Idaho, June 16, 2018 Accident Number: HWY18FH015 Accident Type: Multivehicle collision in work zone Location: Interstate 84, near milepost 47, Boise, Idaho Date and Time: June 16, 2018; about 11:32 p.m., mountain daylight time Vehicle 1: 2019 Volvo truck-tractor in combination with 2015 Great Dane refrigerated semitrailer Vehicle 2: 2008 Jeep Wrangler Vehicle 3: 2003 Volvo truck-tractor in combination with 2008 Great Dane refrigerated semitrailer Vehicles 4–7: 2006 Ford Fusion, 2014 Ford F-150, 2015 Ford Escape, 2010 Ford Focus Fatalities: 4 Injuries: 4 (minor) Crash Description On Saturday, June 16, 2018, about 11:32 p.m., local time, a multivehicle collision occurred involving a 2019 Volvo truck-tractor in combination with a 2015 Great Dane refrigerated semitrailer, operated by Krujex Freight Transport Corporation (Krujex), which was traveling east on Interstate 84 (I-84), near Boise, Idaho (see figure 1).1 The truck, occupied by a 42-year-old driver, had departed Yakima, Washington, and was en route to Methuen, Massachusetts, on a multiday trip. Work zone lane closures began on eastbound I-84 ahead of the initial crash location, resulting in a traffic queue. The traffic queue extended from the beginning of the work zone back over a mile into the advance warning area for the zone, with most of the traffic in the queue either stopped or traveling at a slow speed. The driver of the 2019 Volvo combination vehicle, traveling in the third lane from the left (lane 3) did not apply brakes or otherwise respond to the traffic queue 1 Throughout this report, this truck-tractor in combination with the semitrailer, which initiated the crash sequence, is interchangeably referred to as the “2019 Volvo truck” or the “2019 Volvo combination vehicle.” 1 NTSB/HAB-20/02 65196

Multivehicle Work Zone Crash on Interstate 84, Boise, Idaho, June 16, 2018 ahead.2 His vehicle collided with the rear of a slow-moving 2008 Jeep Wrangler at milepost (MP) 47.007, near the Cloverdale Road overpass, at an estimated speed of 62 mph.3 Figure 1. Map showing route of 2019 Volvo truck from origin to crash location. After being struck by the 2019 Volvo truck, the Jeep was pushed forward so that it underrode the trailer of a 2003 Volvo truck-tractor in combination with a 2008 Great Dane refrigerated semitrailer in the same lane. The 2003 Volvo combination vehicle moved forward and collided with the rear of a 2006 Ford Fusion, pushing it into the rear of a 2014 Ford F-150 and sideswiping a 2015 Ford Escape. Debris from the collision also damaged a 2010 Ford Focus. A postcrash fire ensued that consumed the Jeep, most of the 2003 Volvo combination vehicle’s semitrailer, and a portion of the 2019 Volvo truck’s cab and semitrailer, as well as severely damaging the Cloverdale Road overpass.4 Figure 2 shows a diagram of the crash area and the locations of the vehicles at final rest, and figure 3 shows the postcrash condition of the two combination vehicles and the Jeep. 2 For the purposes of this report, the eastbound lanes are identified, in the direction of travel from left to right, as lanes 1 through 4. 3 Normally, the speed limit at this location is 65 mph; the speed limit had been reduced to 55 mph for the work zone. The 62 mph impact speed was calculated based on an onboard video recorded by a Garmin device installed on the 2019 Volvo truck-tractor. 4 The fire originated in the Jeep’s fuel system. 2 NTSB/HAB-20/02

Multivehicle Work Zone Crash on Interstate 84, Boise, Idaho, June 16, 2018 Figure 2. Diagram of crash area on I-84. The right side of the figure shows part of the advance warning area for the work zone and the locations of the signage on I-84 between MP 46.148 and slightly beyond MP 47.07. The left side of the figure is an expanded view of the immediate crash area, which is represented from MP 47 to just beyond MP 47.07. 3 NTSB/HAB-20/02

Multivehicle Work Zone Crash on Interstate 84, Boise, Idaho, June 16, 2018 Figure 3. Postcrash photograph of vehicles under Cloverdale Road overpass; view is looking west, toward the 2019 Volvo truck that began the crash sequence. (Source: Idaho State Police) The Jeep was occupied by a 23-year-old male driver and two passengers. The three occupants of the Jeep died as a result of the collision and postcrash fire. The driver of the 2019 Volvo truck died as a result of the postcrash fire. The drivers of the 2003 Volvo truck, Ford F-150, Ford Escape, and Ford Focus received minor injuries. At the time of the crash, it was dark (nighttime) with clear weather and a dry road surface. Vehicles 2019 Volvo Truck-Tractor in Combination with 2015 Great Dane Semitrailer The 2019 Volvo truck-tractor sustained severe impact and thermal damage to all areas, which affected its major mechanical and operational systems. The impact damage was primarily located forward of the drive axles (axles 2 and 3). Most of the combustible material from the front bumper to the tail lamps was either consumed by the postcrash fire or badly damaged. The 2015 Great Dane semitrailer experienced less significant damage. The 2019 Volvo truck-tractor was equipped with an aftermarket onboard Garmin camera system. This system recorded vehicle speed, interior audio, and forward-facing video when triggered.5 An image taken by the onboard camera system shows the position of the Jeep 1.3 seconds before the crash impact (see figure 4). Taken from the perspective of the 2019 Volvo truck driver, the image shows the end of the traffic queue, with the Jeep in lane 3 immediately 5 In addition to recording the video, the Garmin device recorded the global positioning system (GPS) location of the tractor, and the tractor’s speed was computed based on the GPS locations. 4 NTSB/HAB-20/02

Multivehicle Work Zone Crash on Interstate 84, Boise, Idaho, June 16, 2018 ahead of the recording truck-tractor, and beyond it, the rear of the 2008 Great Dane refrigerated semitrailer ahead of the Jeep.6 Figure 4. Screenshot from Garmin forward-facing video camera on 2019 Volvo truck-tractor taken shortly before crash. (Source: Garmin Dash Cam) Although the 2019 Volvo truck-tractor had been marketed with a collision avoidance system, the Volvo Active Driver Assist (VADA) system, as part of the standard vehicle equipment package, the purchaser requested that this truck be delivered without the VADA system, providing a purchase savings of $2,524.7 2008 Jeep Wrangler The 2008 Jeep Wrangler sustained impact and thermal damage to both its front and rear, with most of the combustible materials consumed by the postcrash fire. As a result of the Jeep being pushed into the semitrailer ahead of it, the Jeep’s engine was displaced rearward into the firewall and passenger compartment. The frame rails at the front of the vehicle were also displaced rearward and were distorted and bent. The intrusion into the Jeep’s passenger compartment resulting from the Jeep first striking and then under-riding the trailer of the 2003 Volvo truck 6 As the 2019 Volvo truck approached the traffic queue, a Ford pickup truck that had been ahead of the 2019 Volvo truck moved from lane 3 to lane 4, exposing the rear of the Jeep. 7 In some circumstances, the VADA system can automatically apply braking when it identifies a vehicle ahead of the vehicle on which it is installed. Because the speed differential between the 2019 Volvo truck and the Jeep was high, and another vehicle was moving out of the Volvo truck’s lane of travel immediately before the impact, the NTSB cannot definitively assess whether the VADA system could have prevented this crash. The NTSB has previously recommended that collision avoidance systems be required technology for all commercial vehicles and continues to advocate for these recommendations (see Safety Recommendations H-15-5 and -8, which are both currently classified “Open—Acceptable Response” in the NTSB Safety Recommendations database). 5 NTSB/HAB-20/02

Multivehicle Work Zone Crash on Interstate 84, Boise, Idaho, June 16, 2018 caused a total loss of occupant survivable space. Data from the Jeep’s airbag control module indicated that the vehicle was traveling 3–4 mph moments before the 2019 Volvo struck it. 2003 Volvo Truck-Tractor in Combination with 2008 Great Dane Semitrailer Because the 2003 Volvo truck was struck by the Jeep from the rear, its truck-tractor sustained little damage in the crash. The 2008 Great Dane refrigerated semitrailer’s rear impact guard remained securely mounted, but the rear bumper rotated downward, which allowed the rear impact guard to rotate upward into the floor of the semitrailer.8 The right and left tail lamp mounting locations in the bumper were displaced rearward and rotated upward. There was considerable thermal damage to the semitrailer, especially at the rear. Highway Factors In the area of the crash, I-84 is a controlled-access highway with four eastbound and four westbound lanes divided by a 32-inch-tall concrete median barrier.9 Traveling eastbound, the median shoulder is delineated from the far left lane, lane 1, by a solid yellow pavement stripe. The far right lane, lane 4, is delineated from the right shoulder by a solid white pavement stripe. The average daily traffic count for I-84 in 2017 was 85,270 vehicles per day; heavy-truck traffic accounted for 8.5 percent (7,280 trucks per day) of the total. The posted speed limit for I-84 east was 65 mph; the speed limit in the work zone area had been reduced to 55 mph, beginning at MP 46.885, before the site of the initial impact at MP 47.007. When measured in 2017, the 85th percentile speed for this area was 74 mph.10 In the 5-year period 2012–2016, a total of 1,849 work zone crashes occurred in Idaho; 7 of those crashes resulted in fatalities.11 The most common harmful event in the work zone crashes was a rear-end collision involving multiple vehicles. The crash history for the 6-mile-long east– west segment of I-84 centering on the crash site showed that, between July 2015 and July 2018, two other fatal crashes occurred in this area. Neither crash was related to work zone activity. 8 Vehicle underride protection equipment may not be capable of withstanding high-energy collisions such as this one, which involved a heavy vehicle traveling at a relatively high speed. 9 The concrete median barriers were cast in place and met the requirements of National Cooperative Highway Research Program 350 test level 4. 10 The 85th percentile speed is the speed at, or below which, 85 percent of the vehicles are traveling. (See Highway Attachment–ITD Engineering and Traffic Investigation Study, in the docket for this investigation, HWY18FH015.) 11 This information is from table 46 (and associated text) of Idaho Traffic Crashes 2017, published by the Idaho Transportation Department Office of Highway Safety. (See Highway Group Chairman’s Factual Report in the docket for this investigation, HWY18FH015.) 6 NTSB/HAB-20/02

Multivehicle Work Zone Crash on Interstate 84, Boise, Idaho, June 16, 2018 Work Zone General The crash occurred in the advance warning area of an active work zone. The work zone project involved pavement repair and resealing, and it included diamond grinding of concrete pavement, resealing concrete pavement joints, repairing concrete pavement cracks, and repairing pavement spalls.12 The work zone on I-84 extended from MP 48.32 to MP 51.30, while the advance warning area for the work zone extended from MP 46.148 to MP 48.32. The initial impact between the 2019 Volvo truck-tractor and the Jeep occurred in the advance warning area, at MP 47.007. The placement, dimensions, colors, and retro-reflectivity of the traffic control devices for the work zone and advance warning area met the specifications of the Manual on Uniform Traffic Control Devices for Streets and Highways (MUTCD). Preparations for Work Zone The Idaho Transportation Department (ITD) contracted with Penhall Company to perform the pavement repair and resealing work on I-84. ITD contracted with Parametrix, a traffic engineering firm, to develop a construction staging and traffic control plan that included special provisions requiring nighttime work and limiting lane closures. Penhall Company subcontracted with two firms: Specialty Construction Supply Company, Inc. (Specialty Construction), to perform on-site traffic control, and Diamond Drilling and Sawing, to perform some pavement repair work. Parametrix used the Highway Capacity Manual 2010 for its evaluations and determined that the capacity of I-84 in this area was 1,450 vehicles per lane per hour.13 Based on these numbers, the traffic control plan required that at least two lanes remain open to traffic in either direction on four-lane sections of the highway during all phases of the work, including on the work zone ahead of the crash location. The ITD provided these special provisions and the traffic control plan to Penhall Company in the contract documents. The special provisions detailed the process by which contractors could change the construction staging and the traffic control plan. Proposed changes required a written amended plan to be completed by an engineer licensed in Idaho. The amended plan had to be submitted for approval to ITD at least 14 days in advance of any intended changes. The special provisions stated that the existing plan would remain in place until ITD approved any proposed changes. NTSB investigators reviewed the Parametrix construction staging and traffic control plan as originally submitted and found that the documents complied with MUTCD standards. Additionally, investigators found that the ITD preparations for the work zone complied with 23 Code of Federal Regulations (CFR) Part 630, Subpart J, “Work Zone Safety and Mobility.” According to Penhall Company, in a May 31, 2018, meeting with the ITD project engineer, it made a verbal request to close three (rather than two) lanes for the work zone. ITD told 12 Diamond grinding consists of cutting grooves into pavement and grinding down damaged areas and minor cracks. Pavement spalls are typically cracking, chipping, or breaks in the pavement. 13 The manual, which is the fifth edition of this reference work, is published by the Transportation Research Board. It provides engineers and planners with information to help them assess the traffic and environmental effects of highway projects. 7 NTSB/HAB-20/02

Multivehicle Work Zone Crash on Interstate 84, Boise, Idaho, June 16, 2018 investigators that this topic was discussed at the May 31 meeting, but no meeting minutes were kept. Penhall Company did not make a written request to deviate from the existing plan, and the ITD did not review or approve such a written request. The traffic control subcontractor Specialty Construction was not represented at the May 31 meeting but was later told by Penhall Company to close three lanes. Work Zone on the Day of the Crash On June 16, 2018, at the time of the crash, Diamond Drilling and Sawing was working on the eastbound lanes, and Penhall Company was working on the westbound lanes in the I-84 work zone. Specialty Construction was providing temporary traffic control. ITD work zone inspectors were also on the scene to oversee the project. Despite the construction staging and traffic control plan requiring that two lanes remain open at all times during construction, lanes 1, 2, and 3 in the eastbound direction were all closed; only lane 4 (the far right lane) was open.14 Data recorded by the ITD automatic traffic recorders that were positioned in the transition area for this work zone indicated that, before the crash, the traffic speed had slowed to about 18 mph and had resulted in a lengthy queue forming, due to the vehicle stop-and-go situation. The ITD work zone inspectors noted the lane closures in their traffic control maintenance diaries, but they did not take any action to address the fact that the lane closures exceeded those permitted by the traffic control plan or to resolve the resulting hazards associated with the traffic queue.15 Work Zone Summary To summarize, the traffic control plan for the work zone on I-84 was designed to have two lanes in each direction always open to allow for safe traffic flow. Sometime before the day of the crash, the lead contractor, Penhall Company, told the traffic control subcontractor, Specialty Construction, to close three eastbound lanes, leaving only one through lane. This change in the traffic control plan was not submitted in written form to the ITD, as required by the special provisions of the construction staging and traffic control plan. Neither Specialty Construction nor any of the ITD work zone inspectors objected to this deviation from the plan, which, based on information found in work zone inspector diaries, was practiced for several days before the crash. As a result of the additional closed lane, a traffic queue formed that extended into the eastbound advance warning region of the I-84 work zone, which led to slow-moving and stopped traffic. Eastbound vehicles approaching the area encountered a traffic queue more than 1 mile long. The additional lane closure and the extension of the queue into the advance warning region resulted in inadequate warning to motorists and insufficient speed reduction for approaching traffic for this work zone. 14 The first taper area to close lane 1 began 2,329 feet ahead of the initial crash location at MP 47.007. The distance from the impact location to where lane 1 was closed was 3,229 feet. 15 For more information, see the Highway Group Chairman factual report in the docket for this investigation, HWY18FH015. 8 NTSB/HAB-20/02

Multivehicle Work Zone Crash on Interstate 84, Boise, Idaho, June 16, 2018 By merely noting, and not preventing, the contractor’s deviation from the traffic control plan, the ITD work zone inspectors failed to conduct the oversight for which they had been placed on the scene in the construction area. The ITD also failed by not ensuring that its inspectors fulfilled their oversight duties. The NTSB has previously issued safety recommendations regarding traffic queue management in work zones. For example, in 2001, in its special investigation report on rear-end collisions, the NTSB issued Safety Recommendation H-01-11 to the Federal Highway Administration (FHWA).16 This safety recommendation led to revision of the MUTCD standards for work zone safety and mobility on December 16, 2009.17 The MUTCD revisions included providing guidance and resources to assist states in evaluating work zone safety and determining ways to reduce risks. More recently, as a result of its investigation of a 2014 work zone crash involving a truck striking the rear of a traffic queue in Cranbury, New Jersey, the NTSB issued Safety Recommendation H-15-16 to the FHWA.18 Safety Recommendation H-15-16 called on the FHWA to amend the MUTCD guidance for work zone projects on freeways and expressways to advise traffic engineers on the use of supplemental traffic control strategies and devices to mitigate crash events involving heavy commercial vehicles.19 In its response to the NTSB recommendation, the FHWA stated that it is proposing changes to the next revision of the MUTCD to address this recommendation. Motor Carrier Operations Krujex, the operator of the 2019 Volvo combination vehicle, began operations in 2012, entered the Federal Motor Carrier Safety Administration (FMCSA) New Entrant Program in July 2013, and exited the program after successfully completing an FMCSA safety audit on April 23, 2014.20 The FMCSA did not conduct a compliance review of Krujex before the crash. Based on its roadside inspection data, before the crash, Krujex’s driver out-of-service rate was 16.7 percent, which was above the national average of 5.5 percent.21 16 See Vehicle- and Infrastructure-Based Technology for the Prevention of Rear-End Collisions, Special Investigation Report NTSB/SIR-01/01 at SIR0101. 17 Safety Recommendation H-01-11 was classified “Closed—Acceptable Alternate Action” in 2010. 18 For more information, see Multivehicle Work Zone Crash on Interstate 95, Cranbury, New Jersey, June 7, 2014, Highway Accident Report NTSB/HAR-15/02 at HAR1502. 19 Safety Recommendation H-15-16 is currently classified “Open—Acceptable Response.” 20 This program consists of a maximum 18-month-long safety-monitoring period for new entrant carriers. During this period, the FMCSA conducts a safety audit of the carrier and evaluates its crash and roadside inspection data. According to the FMCSA, the safety audit should cover the following areas: driver qualifications, driver duty status, vehicle maintenance, accident register, and controlled substance and alcohol use testing requirements. If the FMCSA identifies deficiencies during the audit, the carrier must provide evidence that it is correcting the faults. 21 This driver out-of-service rate was below the threshold to trigger an alert in the Federal Motor Carrier Census to quantify performance in the Behavior Analysis and Safety Improvement Categories (BASICs). See additional information at the FMCSA SAFER website. 9 NTSB/HAB-20/02

Multivehicle Work Zone Crash on Interstate 84, Boise, Idaho, June 16, 2018 The FMCSA conducted a postcrash comprehensive compliance review of Krujex and, on July 19, 2018, gave the carrier an unsatisfactory rating due to violations.22 On August 21, 2018, the carrier submitted a request for, and was granted, an upgrade to a conditional rating after providing a corrective action plan to the FMCSA. As of the date of this report, Krujex’s status remains conditional. 2019 Volvo Truck Driver Driving Experience and Medical Information At the time of the crash, the 42-year-old truck driver had a class A commercial driver’s license that had been issued by the state of New York in August 2017. The license showed no restrictions, and the driver had endorsements for hauling double and triple trailers. The driver had been operating commercial vehicles since 2009 and was hired by Krujex in May 2018. He had previously worked as a driver for motor carriers (including Krujex) transporting fruit from the Pacific Northwest to eastern destinations; he was familiar with this route and had completed many similar trips. A review of the driver’s record in the Commercial Driver’s License Information System (CDLIS) showed numerous convictions for 2009–2016 and several license withdrawals from 2009 to 2017. The driver had been subject to two license withdrawals from New York: one beginning on February 1, 2017, and the other on April 3, 2017. Both were reinstated on August 2, 2017. These withdrawals were for having two and three serious violations within 3 years, respectively. The CDLIS indicated no previous crashes for the driver. FMCSA data showed a November 14, 2014, crash for this driver on I-84 in Idaho involving a multivehicle collision during icy road conditions. The Idaho State Police did not find him at fault. The driver’s most recent commercial driver fitness determination medical examination had taken place in December 2016. He received an unrestricted medical certificate for 2 years. A postcrash toxicology sample taken from the driver was negative for alcohol and other drugs.23 Hours of Service The truck driver was required to maintain a record-of-duty status, including hours of service, via an electronic logging device (ELD).24 Krujex management told NTSB investigators that the driver had told them that the ELD for the 2019 Volvo truck was not functioning; 22 Violations included the following: using drivers who have not completed an application; failing to conduct driver record inquires; failing to maintain a copy of the driver’s medical certificate; not requiring electronic logging device usage; making false report of duty status; failing to preserve driver’s record-of-duty status for 6 months; and lacking appropriate alcohol and controlled substance testing, record maintenance, and provision of education materials. 23 The analysis for drugs included, but was not limited to, barbiturates, benzodiazepines, cannabinoids, cocaine metabolites, methamphetamine, opiates, and phencyclidine. 24 An ELD is a device or technology that automatically records a driver’s driving time, facilitates the accurate recording of the driver’s hours of service, and meets the requirements set forth in subpart B of 49 CFR 395.2. 10 NTSB/HAB-20/02

Multivehicle Work Zone Crash on Interstate 84, Boise, Idaho, June 16, 2018 consequently, the driver had been filling out paper logbook forms.25 Investigators recovered and examined two paper logbooks from the remains of the 2019 Volvo truck. The first logbook covered June 8–16, 2018, with off-duty entries for June 8–14, 2018. For June 15, the driver recorded being off duty until 8:30 p.m., on duty but not driving until 9:00 p.m., and then driving from 9:00 p.m. until 12:00 a.m. The logbook also recorded driving time on June 16 from 12:00 a.m. until 1:00 a.m., off-duty time in the sleeper berth until 2:00 p.m., and driving time until 7:00 p.m. The second logbook documented a period from May 27 through June 11, 2018, with entries for 11 hours of driving on June 9 and 10, as well as 4 hours of driving on June 11. NTSB investigators obtained data from Tec Equipment, the company that leased the 2019 Volvo truck to Krujex, for the ELD installed in the vehicle. The data showed that the ELD was functional at the time of the crash. The data from the ELD were not consistent with the 2019 Volvo truck driver’s paper logbook entries. According to the ELD data, on June 15, the day before the crash, the driver began driving at 5:54 a.m. and drove for various intervals of time until 1:00 a.m. on June 16. The ELD data showed that the vehicle was stationary from 1:00 a.m. until 7:15 a.m. on June 16. According to the ELD data and bills of lading, after having the truck loaded with apples in Yakima, Washington, the driver began his eastbound trip at 7:15 a.m. on June 16.26 The driver drove a series of relatively short segments (ranging in length from 15 minutes to 3.5 hours) as he headed to Boise, Idaho, on this leg of his cross-country journey to Massachusetts. During the trip on June 16, the driver stopped the vehicle several times, with the ELD recording non-moving periods that were 2.5 hours long or less, and he continued driving until the crash at 10:32 p.m.27 The distance from where the truck was loaded to the crash scene was about 360 miles. Figure 5 shows the ELD data, indicating when the 2019 Volvo truck was moving and when it was stopped. 25 Title 49 CFR 395.34(a) addresses “Recordkeeping during ELD malfunctions.” The use of paper logbook forms is not permitted under the CFR requirements. A carrier must have special permission from the FMCSA to use paper logbooks if an ELD is nonfunctional. Krujex had not requested and did not have such permission. 26 The FMCSA provides carriers an hours-of-service exemption when transporting agricultural products. Current FMCSA interpretations allow a driver an hours-of-service exemption when traveling to and from the source of agricultural products, defines what is considered “the source,” and clarifies that drivers may use the exemption during the first 150 air miles (172 statute or “road” miles) of a trip that delivers outside of the 150-air-mile radius. Investigators asked the owner of Krujex about his knowledge of the agricultural exemption. He said that he was not aware of this FMCSA guidance and did not know what it allowed. He said that he was not aware that his operation was permitted under the exemption. 27 The times given in this paragraph and the next, as well as in figure 5, are in Pacific daylight time, based on the driver’s starting point of Yakima, Washington, in the Pacific time zone. The crash, however, occurred in Boise, which is in the mountain time zone. Consequently, the crash time in this paragraph and the chart is represented as 1 hour earlier than the corresponding crash time in mountain daylight time. 11 NTSB/HAB-20/02

Multivehicle Work Zone Crash on Interstate 84, Boise, Idaho, June 16, 2018 Figure 5. ELD data for the 5 days preceding the crash, showing when the 2019 Volvo truck was moving and stopped. (Note: The trip began in Yakima, Washington, which is in the Pacific time zone, but the crash occurred in Boise, Idaho, which is in the mountain time zone. The crash time of 10:32 p.m. Pacific daylight time used in figure 5 corresponds to the crash time of 11:32 p.m. mountain daylight time.) Investigators were unable to obtain complete information about the truck driver’s sleep/wake history preceding the crash, including information from his cell phone. However, based on the ELD data, in the 48-hour period before the crash, the longest opportunities the driver had for rest were two 6-hour-long segments: one from about 11:30 p.m. on June 14 to 5:45 a.m. on June 15 and another from about 1:00 a.m. to 7:15 a.m. on June 16. The remaining periods during which the truck was stationary were fragmented into short increments with insufficient time to have provided the driver opportunity for restful sleep.28 Precrash Actions Video segments from the Garmin unit installed in the 2019 Volvo truck showed numerous instances preceding the crash where the driver allowed the truck to drift from its lane (both onto the shoulder and into other lanes) and to straddle the painted lane markings.29 Specifically, between 11:15 p.m. and the crash, the Garmin unit recorded the following movements by the 2019 Volvo truck:30 • 11:15:00—During the next 2 minutes 30 seconds, while traveling in lane 4, the truck drifted onto the shoulder and was corrected back into lane 4 about 10 times. • 11:17:40—The truck continued to drift from lane 4 to the shoulder and back again, while traveling 60–65 mph. Over the next 1 minute 30 seconds, the truck drifted onto the shoulder about 5 times. • 11:23:49—While traveling in lane 3, the truck began to drift into lane 4. • 11:24:56—During the next 1 minute 30 seconds, the truck made three incursions from lane 4 onto the right shoulder. 28 See J.J. Pilcher and A.I. Huffcutt. 1996. “Effects of Sleep Deprivation on Performance: A Meta-Analysis.” Sleep 19(4): 318–326. 29 For more information, see the Onboard Image Recorder Group Chairman factual report in the docket for this investigation, HWY18FH015. 30 Times in this section are in mountain daylight time. 12 NTSB/HAB-20/02

Multivehicle Work Zone Crash on Interstate 84, Boise, Idaho, June 16, 2018 • 11:26:00—From lane 4, the truck drifted to the left and entered lane 3. • 11:26:50—The truck drifted from lane 4 onto the shoulder and then returned to lane 4. • 11:27:47—The truck drifted to the left and straddled lanes 2 and 3 before returning to lane 3. Summary of Fatigue Indications Based on the ELD recording of the movements of the 2019 Volvo truck, the driver had limited chances for rest preceding the crash. His lengthy on-duty hours in the 2 days before the crash, and the relatively short windows of opportunity for sleep, indicate that he most likely did not obtain adequate sleep during this period. The crash occurred at night when people are more disposed to exhibit fatigue.31 Moreover, the driver’s inability to maintain his vehicle’s lane position, as well as his complete lack of response to the traffic queue as he came upon it, are consistent with a fatigue-related lapse in vigilance.32 Probable Cause The National Transportation Safety Board determines that the probable cause of the Boise, Idaho, crash was the Krujex Freight Transport Corporation driver’s failure to respond to the slow-moving traffic queue ahead, most likely due to performance decrements associated with fatigue. Contributing to the crash were the (1) inadequate traffic control and queue management procedures employed by Penhall Company and its subcontractor Specialty Construction Supply Company, Inc., and (2) lack of proper oversight by the Idaho Transportation Department, which allowed an additional lane closure that was not part of the approved traffic control plan, resulting in a traffic queue that extended into the advance warning area of the work zone. Report Date: June 11, 2020 For more details about this crash, visit the NTSB public docket and search for NTSB accident ID HWY18FH015. The docket includes such information as police reports, photographs, manuals, and interview transcripts. 31 The driver was a New York resident, and the time difference between New York and Idaho may have compounded his fatigue. 32 See R.R. Knipling and J. Wang. 1994. “Crashes and Fatalities Related to Driver Drowsiness/Fatigue.” Research Note. Washington, DC: US Department of Transportation, National Highway Traffic Safety Administration. 13 NTSB/HAB-20/02

Multivehicle Work Zone Crash on Interstate 84, Boise, Idaho, June 16, 2018 The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties . . . and are not conducted for the purpose of determining the rights or liabilities of any person” (Title 49 Code of Federal Regulations, Section 831.4). Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report (Title 49 United States Code, Section 1154[b]). 14 NTSB/HAB-20/02

FD07253 ｜ 2002_美国_HAR0201.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2002 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/HAR-02/01 PB2002-916201 National Transportation Safety Board Washington, D.C. A A N T I O N L T R A S P O R A T I O N B O A R D S A F E T Y N T E

P L U R IB US UN U M

Washington, D.C. Work Zone Collision Between a Tractor-Semitrailer and a Tennessee Highway Patrol Vehicle Jackson, Tennessee, July 26, 2000 Highway Accident Report

this page intentionally left blank

Highway Accident Report Work Zone Collision Between a Tractor-Semitrailer and a Tennessee Highway Patrol Vehicle Jackson, Tennessee, July 26, 2000 NTSB/HAR-02/01 PB2002-916201 National Transportation Safety Board Notation 7465 490 L’Enfant Plaza, S.W. Adopted May 14, 2002 Washington, D.C. 20594

National Transportation Safety Board. 2002. Work Zone Collision Between a Tractor-Semitrailer and a Tennessee Highway Patrol Vehicle, Jackson, Tennessee, July 26, 2000. Highway Accident Report NTSB/HAR-02/01. Washington, DC. Abstract: About 8:52 a.m. on July 26, 2000, an eastbound 1999 International truck tractor pulling a loaded semitrailer, and traveling at a driver-estimated speed of 65 mph in a 55-mph work zone, collided with a Tennessee Highway Patrol (THP) vehicle trailing construction vehicles. Witnesses reported that the patrol car exploded and caught fire at impact. The patrol car was pushed approximately 192 feet before it came to rest in the median. The tractor-semitrailer continued through a 61-foot depressed earthen median and into the westbound lanes, where it collided with a 1997 Chevrolet Blazer. The tractor-semitrailer then continued across the travel lanes and came to rest in a wooded area on the north side of I-40. The State trooper in the THP vehicle was killed, and the Chevrolet driver was seriously injured. The following major safety issues were identified in this accident: • Lack of communication between the Tennessee Department of Transportation, its contractors, and the Tennessee Highway Patrol. • Inadequate planning and coordinating of traffic control responsibilities between highway construction personnel and law enforcement officers before engaging in work zone activities. • Need to train officers in safe traffic control procedures within highway work zones. As a result of this accident investigation, the Safety Board makes recommendations to the Federal Highway Administration, the National Highway Traffic Safety Administration, the Tennessee Department of Transportation, the National Sheriffs’ Association, the International Association of Chiefs of Police, and the American Association of State Highway and Transportation Officials. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2002-916201 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Highway Accident Report Contents Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iv Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Preaccident Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Construction Project . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Driver Medical Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 TDOT Construction Project . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Preconstruction Conference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Contract Provisions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Work Zone Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Work Zone Safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Project CAR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 THP Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Postaccident Training Initiatives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Training Programs in Other States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 FHWA Report on Police Use in Work Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 FHWA Rulemaking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Work Zone Accident Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Medical Certification Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Driver Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Past Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Communication, Planning, and Coordination Between TDOT and the THP . . . . . . . . . . . 22 Training Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Role of Law Enforcement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Past Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Work Zone Safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Configuration Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Use of TMAs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Work Zone Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Appendixes A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 B: Jackson, Tennessee, Driver Medical Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

iv Highway Accident Report Acronyms and Abbreviations AAMVA American Association of Motor Vehicle Administrators AASHTO American Association of State Highway and Transportation Officials ANPRM advance notice of proposed rulemaking FARS Fatality Analysis Reporting System FHWA Federal Highway Administration FMCSA Federal Motor Carrier Safety Administration I-40 Interstate Highway 40 MMUCC Model Minimum Uniform Crash Criteria MUTCD Manual on Uniform Traffic Control Devices NHTSA National Highway Traffic Safety Administration NIOSH National Institute for Occupational Safety and Health OCPS Office of Capital Project Safety Project CAR Construction Accident Reduction Project TDOT Tennessee Department of Transportation THP Tennessee Highway Patrol TMA truck-mounted attenuator

v Highway Accident Report Executive Summary About 8 a.m. on July 26, 2000, a work zone project began near milepost 85.6 on eastbound Interstate Highway 40 (I-40) in Jackson, Tennessee. This was the third day of an operation that consisted of milling rumble strips into the shoulder pavement. The three construction vehicles that were involved were positioned along the outside shoulder of the interstate. Two Tennessee Highway Patrol vehicles, with their emergency lights flashing, were also present to assist with enforcement and traffic control. The THP vehicles were stopped 450 feet and 950 feet, respectively, behind the construction vehicles along the right lane. About 8:52 a.m., an eastbound 1999 International truck tractor pulling a loaded semitrailer, and traveling at a driver-estimated speed of 65 mph in a 55-mph work zone, collided with the trailing Tennessee Highway Patrol vehicle. Witnesses reported that the patrol car exploded and caught fire at impact. The patrol car was pushed approximately 192 feet before it came to rest in the median. The tractor-semitrailer continued through a 61-foot depressed earthen median and into the westbound lanes, where it collided with a 1997 Chevrolet Blazer. The tractor-semitrailer then continued across the travel lanes and came to rest in a wooded area on the north side of I-40. The State trooper in the Tennessee Highway Patrol vehicle was killed, and the Chevrolet driver was seriously injured. The National Transportation Safety Board determines that the probable cause of this accident was the driver’s incapacitation, owing to the failure of the medical certification process to detect and remove a medically unfit driver from service. Contributing to this accident were the lack of planning and coordination between the Tennessee Department of Transportation, its contractors, and the Tennessee Highway Patrol regarding work zone projects; the lack of traffic control training, specific to highway work zone operations, provided to Tennessee Highway Patrol officers; and the failure of the Tennessee Department of Transportation and its contractors to protect all work zone personnel and road users. The following safety issues were identified in this accident: • Lack of communication between the Tennessee Department of Transportation, its contractors, and the Tennessee Highway Patrol. • Inadequate planning and coordinating of traffic control responsibilities between highway construction personnel and law enforcement officers before engaging in work zone activities. • Need to train officers in safe traffic control procedures within highway work zones.

vi Highway Accident Report As a result of this accident investigation, the Safety Board makes recommenda- tions to the Federal Highway Administration, the National Highway Traffic Safety Administration, the Tennessee Department of Transportation, the National Sheriffs’ Asso- ciation, the International Association of Chiefs of Police, and the American Association of State Highway and Transportation Officials. Executive Summary

1 Highway Accident Report Factual Information Accident Narrative About 8 a.m. on July 26, 2000, a work zone project began near milepost 85.6 on eastbound Interstate Highway 40 (I-40) in Jackson, Tennessee. This was the third day of an operation that consisted of milling rumble strips1 into the shoulder pavement. The three construction vehicles that were involved were positioned along the outside shoulder of the interstate. Two Tennessee Highway Patrol (THP) vehicles, with their emergency lights flashing, were also present to assist with traffic control. The THP vehicles were stopped 450 feet and 950 feet, respectively, behind the construction vehicles along the right lane. About 8:52 a.m., an eastbound 1999 International truck tractor pulling a loaded semitrailer and traveling at a driver-estimated speed of 65 mph in a 55-mph work zone, collided with the trailing THP vehicle. Witnesses reported that the patrol car exploded and caught fire at impact. The patrol car was pushed approximately 192 feet before it came to rest in the median. The tractor-semitrailer continued through a 61-foot depressed earthen median and into the westbound lanes, where it collided with a 1997 Chevrolet Blazer. The tractor-semitrailer then continued across the travel lanes and came to rest in a wooded area on the north side of I-40. (See figures 1 through 4.) The State trooper in the THP vehicle was killed, and the Chevrolet driver received serious injuries.2 The officer in the lead THP vehicle tried to extinguish the flames from the burning THP vehicle with a fire extinguisher but was unable to do so. A witness reported an attempt was made extricate the officer from the burning vehicle, but that the heat from the fire was too intense. At the time of the accident, the weather was clear and the temperature was 78 degrees. 1 Rumble strips or “audible roadway delineators” are incorporated into shoulders to help prevent drift- off-the-road accidents. Rumble strips may be created by either rolling indentations into the pavement surface or by milling (grinding) depressions into the pavement. 2 The Chevrolet driver’s serious injuries included a fractured arm and multiple lacerations, abrasions, and contusions. She was belted, and the vehicle air bags deployed, during the accident.

Factual Information 2 Highway Accident Report Figure 1. Accident diagram.

Combination vehicle at rest THP vehicle at rest Chevrolet Blazer at rest Westbound traffic lanes Center median Eastbound traffic lanes

Factual Information 3 Highway Accident Report Figure 1. Accident scene. Figure 2. Wreckage of patrol car. Figure 2. Figure 3.

Factual Information 4 Highway Accident Report Preaccident Events Driver According to the driver’s logs and to statements made to the THP after the accident,3 the driver departed Long Beach, California, with a load of computer supplies on July 20, 2000. He reached Moriarty, New Mexico, on July 23 and rested in the tractor- semitrailer’s sleeper berth from 10:00 p.m. to 7:00 a.m. On July 24, he drove for 9 hours and 30 minutes, performing an additional 45 minutes of on-duty activities upon arriving in Oklahoma City, Oklahoma. He entered the tractor-semitrailer’s sleeper berth at 10:00 p.m. On July 25, he logged in as “on duty” at 7:00 a.m. He drove 9 hours and 15 minutes, performing an additional 30 minutes of on-duty activities upon arriving in West Memphis, Arkansas. He entered the sleeper berth at 11:00 p.m. The driver stated to the THP that he had “a pretty good night’s sleep” that night. His last log entry indicated that he returned to duty on July 26, the day of the accident, at 7:00 a.m. The driver told the THP that this was the second time he had driven through the construction area near Jackson, Tennessee, in the last 2 months and that he recalled seeing Figure 3. Wreckage of trailer and Chevrolet Blazer. 3 The driver declined to speak to Safety Board investigators. Figure 4.

Factual Information 5 Highway Accident Report signs about the construction before reaching Jackson. He also recalled that the eastbound traffic was moderate and that the westbound traffic was heavier. The driver did not remember seeing the patrol car or its flashing blue light until immediately before hitting it. He stated that he may have tried to swerve, but he did not remember whether he had time to apply the brakes. Witnesses driving behind the tractor-semitrailer before the accident stated that they observed the tractor-semitrailer drifting to the right of the roadway. One witness stated that he had observed the accident driver drift off the road twice. Another witness stated that the accident driver drifted off the road several times within a 5-mile span, and that, on one occasion, the driver ran completely off the road. This witness said he tried to contact the accident driver on his citizen band radio but could not reach him. He stated that before the collision, the accident driver had hit his brakes and veered to the left, as if someone had stopped in front of his vehicle. Construction Project The milling of rumble strips on the south shoulder of eastbound I-40 began on July 25th and was scheduled to be completed the next day. The construction vehicles involved were a milling machine, a sweeper with flashing yellow lights, and a protection vehicle with flashing yellow lights and a towed arrow board (see figure 5).4

4 The arrow display was a panel type C, which is defined in the Manual on Uniform Traffic Control Devices as having a minimum panel dimension of 96 by 48 inches, a minimum legibility distance of 1 mile, and a minimum of 15 lighting elements. Such displays are intended for use on high-speed, high-volume traffic control projects.

Factual Information 6 Highway Accident Report Figure 1. General configuration of THP vehicles and milling operations work caravan based on THP statements and evidence at accident scene. Eastbound lanes of Interstate 40 THP vehicles blocking right traffic lane (emergency lights are operational) Construction vehicles involved in the milling operation Left Traffic Lane Right Traffic Lane 450' 500' Figure 5.

Factual Information 7 Highway Accident Report Under the terms of the construction contract, Dement Construction Company was responsible for maintaining traffic control during the milling operation. Dement used two variable message signs, truck-mounted flashing yellow lights, a single portable arrow direction board, and two marked THP vehicles to accomplish traffic control. The two vari- able message signs had been placed east of the project in the center median—one at mile- post 82 and the other near exit 85. (See figure 6.) The signs had been configured to alternate between three messages: 1) USE CAUTION, 2) ONE LANE TRAFFIC AHEAD, and 3) WORKERS IN ROAD AHEAD. The variable message signs did not specify which traffic lane was closed. The THP assigned two officers to the work zone site to provide enforcement and traffic control support in accordance with the Construction Accident Reduction Project (Project CAR).5 Each officer drove a marked patrol vehicle with flashing lights to assist with traffic control duties. Both vehicles were positioned in the right traffic lane behind the milling operation. The first vehicle attempted to maintain a distance of about 500 feet from the rear of the operation, while the second vehicle attempted to maintain a separation of about 500 feet from the first marked patrol vehicle, or about 1,000 feet from the rear of the operation. All of the construction vehicles were positioned on the roadway shoulder. According to the construction foreman, the only construction vehicle that encroached into Figure 4. Map of work zone and accident location. 5 The Tennessee Department of Transportation and the THP created Project CAR in 1998 to increase motorist compliance with work zone traffic control devices. For further information, see the Work Zone Safety section later in this report. Figure 6.

Factual Information 8 Highway Accident Report the traffic lanes of the interstate was the milling machine, which extended approximately 1 to 1.5 feet into the traffic lane and left 10.5 to 11 feet of the lane available for the passage of traffic. He stated that he believed that the amount of construction vehicle encroachment into the traffic lane did not warrant a lane closure and that the operation complied with the guidance provided by the Manual on Uniform Traffic Control Devices (MUTCD).6 The foreman also stated that he believed the THP presence in the traffic lane was unsafe but assumed that the officers were familiar with traffic control operations and did not need his advice. According to the THP, the sweeper that trailed the milling machine also encroached into the traffic lane by 2 to 3 feet and generated a considerable amount of dust as it performed its operation. The Tennessee Department of Transportation (TDOT) Regional Safety Coordinator stated that he received complaints throughout the day of July 25th that the messages displayed on the two variable message signs were confusing because motorists did not know which traffic lane was closed ahead.7 Additionally, TDOT personnel had also complained on the previous day to the Regional Safety Coordinator regarding the unprotected THP vehicles being positioned within the traffic lane. Based on the complaints he had received, the TDOT Regional Safety Coordinator stated that he planned to inspect the operation on the following day. The accident occurred before he reached the work zone. During a postaccident interview, the construction foreman told Safety Board investigators that when the milling operation began, he had advised the THP officers who were assisting with traffic control that the operation would involve a “mobile lane closure.” By his definition, a mobile lane closure meant that all of the construction vehicles would be positioned on the shoulder of the highway and that traffic control efforts would be directed toward informing motorists ahead of time of the operation and keeping them away from the shoulder and a safe distance from the milling operation. He stated that despite the minor encroachment of the construction vehicles into the right traffic lane, he intended to keep both eastbound traffic lanes open. When the foreman observed the THP vehicles in the roadway blocking the right traffic lane, he said it made him extremely nervous. However, he stated that he felt too intimidated to advise the officers that it was not his intent to have the traffic lane blocked, and he also believed that the officers knew what they were doing. The construction foreman further stated that he believed an additional arrow board, used in conjunction with the existing one, would have enhanced the safety of the operation. He had intended to include the additional arrow board on the morning of the accident, but at the time of the accident had not yet incorporated it. The construction diary for the day before the accident indicated that it was a State work zone inspector who had suggested incorporating a second arrow board. 6 Federal Highway Administration, Part VI of Standards and Guides for Traffic Controls for Street and Highway Construction, Maintenance, Utility, and Incident Management Operations. Manual on Uniform Traffic Control Devices, 1988 edition, revision 3 (Washington, DC: FHWA, 1993). 7 The number of complaints was not tabulated.

Factual Information 9 Highway Accident Report According to Part VI of the MUTCD,8 routine inspection of traffic control elements should be performed to ensure acceptable levels of operation. Individuals trained in the principles of safe traffic control should be assigned responsibility for the safety of the work sites to ensure that the traffic control measures in use are necessary, that they conform to the traffic control plan, and that they provide safe conditions to motorists, pedestrians, and workers alike. The THP sergeant responsible for scheduling Project CAR officers informed investigators that when the construction foreman told him that he wanted a mobile lane closure, the sergeant and his officers understood this to mean that the lane next to the shoulder was to be closed off. To accomplish this closure, they positioned their marked THP vehicles within the lane and proceeded to pace the work operation, maintaining a distance of about 500 feet behind the last vehicle, which was the truck towing the arrow board. Driver Medical Information The investigation revealed that the 50-year-old tractor-semitrailer driver was involved in a similar accident in July 1997, when he struck a stopped highway patrol car in Utah, seriously injuring two troopers. The patrol car had been parked on the roadway to prevent other vehicles from running into a load of spilled gravel.9 After the Jackson, Tennessee, accident, the driver stated to the THP that he might have fallen asleep immediately before the accident. The tractor-semitrailer driver’s medical records from a Denver Veteran’s Administration hospital indicated that in December 1996, during in-patient treatment for a severe infection of his legs, he was evaluated as possibly having obstructive sleep apnea. His physician recommended that he take part in a formal sleep study; the driver stated that he needed to return to work and would follow up promptly when he returned to Boise, Idaho. He did not formally undergo a sleep study until August 1997, the month following his involvement in the motor vehicle accident that seriously injured two troopers. He was diagnosed with obstructive sleep apnea and given a device10 to treat his condition. He was not able to tolerate the device and, in September 1997, underwent surgery to try to correct the disorder. His hospital records indicated that he suffered complications11 from the surgery. He failed to keep a postsurgery appointment in the pulmonary clinic and never scheduled a followup sleep study. The driver did not indicate that he had been diagnosed or treated for obstructive sleep apnea on any of his commercial driver medical examination forms. 8 MUTCD, Part VI, 1988 edition, revision 3 (1993). 9 The driver was charged with a misdemeanor and fined. 10 A continuous positive air pressure mask that holds the airway open and keeps oxygen flowing freely during sleep. 11 Postoperative swelling of the neck, resulting in difficulty swallowing and anxiety.

Factual Information 10 Highway Accident Report In September 1998, the driver was diagnosed with hypothyroidism12 and placed on replacement thyroid hormone. He noted this condition on his October 1998 commercial driver medical examination form and was found by the physician performing the examination to have markedly diminished deep tendon reflexes.13 The physician noted that the driver had just begun replacement therapy but did not limit or deny the medical certificate. On his August 1999 commercial driver medical examination form, the driver made no mention of hypothyroidism or his history of sleep apnea. Although he had been prescribed medication for his hypothyroidism, he indicated that he was not on any medication. Following the accident, a pill bottle was found in the driver’s truck cab. The bottle contained 85 of 90 pills of levothyroxine, a thyroid hormone replacement. The prescription date was 1998, with an expiration date of December 1999. The labeling noted that the prescription was the first of four available for refill of the medication. A blood test performed by the THP following this accident indicated that his thyroid hormone level was markedly low. Symptoms of untreated hypothyroidism may include fatigue, lethargy, constipation, cold intolerance, stiffness and cramping of the muscles, carpal tunnel syndrome, and, over time, a slowing of intellectual and motor activity, a decrease in appetite, and an increase in weight. Obstructive sleep apnea is also associated with untreated hypothyroidism.14 Neither obstructive sleep apnea nor hypothyroidism is specifically disqualifying for commercial drivers, although nonbinding Federal Motor Carrier Safety Administration (FMCSA) advisory criteria note that “there are many conditions that interfere with oxygen exchange … including … sleep apnea. If the medical examiner detects a respiratory dysfunction that in any way is likely to interfere with the driver’s ability to safely control and drive a commercial motor vehicle, the driver must be referred to a specialist for further evaluation or therapy.”15 No FMCSA guidelines address hypothyroidism. TDOT Construction Project The work zone project underway at the accident site was part of a TDOT rehabilitation construction project along a portion of I-40 traversing the city limits of Jackson, Tennessee. This section of I-40 consists of a four-lane divided highway, with the eastbound and westbound lanes separated by a 61-foot depressed grassy median. Heavy vehicles (over 10,000 pounds) constitute approximately 37 percent of the vehicle traffic. 12 A condition of decreased activity of the thyroid gland. 13 Diminished cognitive and motor functions are typical symptoms of hypothyroidism. 14 Leonard Wartofsky, “Diseases of the Thyroid,” eds. Kurt J. Isselbacher, Eugene Braunwald, and Jean D. Wilson, et. al., Harrison’s Principles of Internal Medicine, 13th edition (New York: McGraw Hill, Inc., 1994) 1931-1953. 15 For further information, see http://www.fmcsa.dot.gov/rulesregs/fmcsr/medical.htm.

Factual Information 11 Highway Accident Report When no construction is being performed on this section of I-40, 85 percent of the vehicles travel at speeds of up to 76 mph. The project, which began on May 11, 2000, was located within Madison County, encompassing the section of I-40 beginning at Lower Brownsville Road and continuing east to State Highway 70.16 The project comprised three phases: pavement resurfacing and the installation of snowplowable reflective markers and guardrails (phase I), the milling of rumble strips (phase II), and the placement of lane markings (phase III). Preconstruction Conference On February 14, 2000, TDOT held a preconstruction conference. Personnel from TDOT, Dement Construction,17 and Traf-Mark18 attended the meeting. The attendees’ list did not show that any THP personnel had attended the conference. In a postaccident interview, a TDOT representative19 explained to investigators that TDOT had not invited the THP to its preconstruction meetings because it assumed that the THP did not have the manpower to participate, given the extensive amount of roadway construction being performed within the State. Contract Provisions The TDOT construction contract included the following traffic control plans: • Advance Road Work Signing on Divided Highways and Freeways • Traffic Control for One Lane Closure on Multi-Lane Divided Highway (No Portable Barrier Rail Setup) • Traffic Control for Two Right (or Two Left Inside) Outside Lane Closure on Freeway or Expressway • Traffic Control for Two Right Outside (or Two Left Inside) Lane Closure on Freeway or Expressway (With Interconnected Portable Barrier Rail) Although the contract contained traffic control plans for lane closure operations, it did not contain traffic control plans applicable to mobile operations or to shoulder work with minor encroachment, such as milling rumble strips, pavement striping, and other lane marking operations. The contract did not specify THP duties with regard to traffic control within the work zone. 16 Project number 57201-8111-44 comprised 6.13 miles of I-40; project number 57201-8110-44, 6.26 miles. 17 The primary contractor. 18 Subcontractor responsible for placing lane markers and performing pavement scoring operations within the construction project. 19 Regional Safety Coordinator, Tennessee Department of Transportation, Region 4, telephone conversation, February 2002.

Factual Information 12 Highway Accident Report Work Zone Standards Tennessee used the MUTCD as its standard when creating traffic control plans. At the time of the accident, the 1988 MUTCD was the most recent edition.20 It was supplemented by a 1993 revision to one of its chapters (Part VI),21 which provided additional traffic control guidelines for different types of construction projects. Two such guidelines pertained to the operational circumstances at the time of the accident: (1) shoulder work with minor encroachment22 and (2) lane closure on a divided highway.23 The milling operation in Jackson, Tennessee, required at least one construction vehicle to encroach upon the 12-foot-wide right lane. Under circumstances such as this, Part VI of the MUTCD allows the encroached lane to stay open as long as there is at least 10 feet of travel space. A traffic sign reading “road work ahead” should be placed in advance of the construction, and additional signs, with a message such as “road narrows,” may also be appropriate. Channelizing devices, such as traffic cones, are optional if the protection vehicle24 used is equipped with an activated flashing yellow light. Truck- mounted attenuators (TMAs), which are compact crash cushions attached to the rear of protection vehicles, are also optional. Part VI states that for high-speed traffic conditions, a lane closure should be considered. The variable message signs in advance of the milling operation alternated between three messages: (1) USE CAUTION, (2) ONE LANE TRAFFIC AHEAD, and (3) WORK- ERS IN ROAD AHEAD. In the case of a lane closure on a divided highway, Part VI states that the work zone should include advance road signs that indicate which lane is closed, accompanied by a corresponding lane reduction symbol sign. Furthermore, channelizing devices and a protection vehicle with an activated flashing yellow light should be used to separate the work zone from the through traffic. TMAs are not required, but recom- mended. The purpose of TMAs is to reduce the acceleration forces experienced by occupants of striking and struck vehicles. They are designed to decelerate and stop vehicles weighing as much as 4,400 pounds during head-on impacts up to a differential velocity of 62 mph.25 The American Association of State Highway and Transportation Officials (AASHTO) Roadside Design Guide provides standards on the proper use of 20 A newer version of the MUTCD (Millennium Edition) was published in December 2000. States have until January 17, 2003, to reach substantial conformance with the Millennium Edition of the MUTCD. 21 MUTCD, Part VI, 1988 edition, revision 3 (1993). 22 MUTCD, Part VI, 1988 edition, revision 3 (1993) 18-19. 23 MUTCD, Part VI, 1988 edition, revision 3 (1993) 172-173. 24 Protection vehicles include shadow vehicles, barrier vehicles, and advance warning trucks weighing at least 18,000 pounds. 25 See Recommended Procedures for the Safety Performance Evaluation of Highway Features for more detailed information on attenuator testing requirements. Transportation Research Board, National Research Council, Recommended Procedures for the Safety Performance Evaluation of Highway Features, National Cooperative Highway Research Program Report 350, research sponsored by the American Association of State Highway and Transportation Officials in cooperation with the Federal Highway Administration (Washington, DC: National Academy Press, 1993).

Factual Information 13 Highway Accident Report TMAs. The Roadside Design Guide “very highly” recommends that TMAs be used in mobile lane operations having no formal lane closure. It also “highly” recommends that TMAs be used in mobile shoulder operations and in formal lane closures that involve exposed personnel working in high-speed environments. In 2001, the National Institute for Occupational Safety and Health (NIOSH) issued a report on work zone safety that discussed the use of TMAs.26 It recommends that when worker exposure cannot completely be eliminated, positive protective barriers, such as TMAs, should be used to shield workers from traffic vehicles. The report adds that TMAs may be particularly useful in mobile work zones, where they can move forward as work progresses to protect workers from being struck from behind by traffic vehicles. TMAs are not designed to stop heavy vehicles, such as trucks and motorcoaches, although anecdotal evidence exists that, in a few instances, TMAs have reduced the severity of injuries suffered by construction workers and heavy truck occupants.27,28 Typical TMAs are approximately 12 feet long and are mounted on the back of protection vehicles. To effectively stop a heavy truck without injuring the occupants of either vehicle, a TMA would have to be roughly twice as long, leading to weight and transport issues.29 No federally funded research is currently underway on developing TMAs that would decelerate and stop heavy commercial vehicles. Work Zone Safety In late 1997, the Federal Highway Administration (FHWA), in conjunction with TDOT and the THP, began an assessment project to promote motorist compliance with traffic control devices and speed limits in and around work zones. Issues identified during this project included the utilization of police for traffic control and enforcement within work zones and the ability of law enforcement agencies to gather and report accurate work zone accident data. Project CAR Between 1995 and 1996, 5,140 vehicles were involved in accidents in Tennessee work zones. With extensive roadway renovations underway near Nashville, Chattanooga, Memphis, and Knoxville, construction worker fatalities increased 52 percent, from 19 to 29, during that period. In response to the hazardous conditions being experienced at these and other sites throughout the State, and in order to increase motorist compliance with 26 National Institute for Occupational Safety and Health, Building Safer Highway Work Zones: Measures to Prevent Worker Injuries From Vehicles and Equipment, DHHS/NIOSH Publication No. 2001-128 (Washington, DC: DHHS/NIOSH, 2001). 27 National Transportation Safety Board, Highway Work Zone Safety, Safety Study NTSB/SS-92/02 (Washington, DC: NTSB, 1992). 28 Project Engineer, Exodyne Technologies, Incorporated, telephone conversation, February 2002. 29 Safety and Structural Systems Associate Research Engineer, Texas Transportation Institute, telephone conversation, February 2002, and e-mail correspondence, March 2002.

Factual Information 14 Highway Accident Report work zone traffic control devices, TDOT and the THP formed a partnership in 1998 known as Project CAR. This initiative provides funds for TDOT to contract with the THP to station State troopers at work zones experiencing hazardous driving behavior. Project CAR’s stated objectives are to:30 • Reduce work zone fatalities. • Encourage State troopers to maintain a goal of two hazardous moving violations for each hour worked. • Ensure that disabled vehicles are expeditiously removed from work zones. • Ensure that, upon request, State troopers assist TDOT workers in routing and directing traffic. Project CAR does not specify lines of authority or how enforcement and traffic control are to be conducted. In addition, it does not provide THP officers with training or guidance on traffic control procedures for work zone operations. THP Training The THP’s General Order 405 establishes the department’s policies and procedures for traffic direction and control. The four pages of guidance contained in the General Order are presented to THP recruits while attending basic academy training. General Order 405 provides instruction for departmental procedures, the use of emergency lighting, and the use of hand signals during the manual direction of traffic. It does not contain procedures or terminology specific to work zone operations. Postaccident Training Initiatives Following this accident, the THP reassessed its training on traffic control procedures and identified the need to better train its personnel. The THP developed a 1-hour pilot class that was presented to supervisors from January through April 2001. In addition, from April through August 2001, a 2-hour course was presented to THP officers as part of their in-service training. The THP plans to incorporate this training into its academy curriculum by August 2002.31 The FHWA Tennessee Division office in Nashville provided engineering input into the incident management training that the THP adopted. Building on the THP’s program and working in conjunction with the University of Tennessee Center for Transportation Research, the FHWA began a project entitled Temporary Traffic Control During Law Enforcement Incident Management. This project is designed to supplement existing law enforcement training by incorporating and adapting MUTCD work zone temporary traffic control elements, safe roadside design practices, and accident reporting procedures. The initial target group for the training is the THP, but it may be expanded to include other law 30 http://www.nhtsa.dot.gov/people/outreach/safedige/Fall1999/fall-1499.html. 31 Office of Planning and Research, Tennessee Highway Patrol, telephone conversation, March 2002.

Factual Information 15 Highway Accident Report enforcement agencies within the State if successful.32 The FHWA Tennessee Division office scheduled a pilot training course for May 9, 2002. Training Programs in Other States The Safety Board contacted the State police departments of Maryland, Delaware, Connecticut, and New Jersey to determine whether any of these States train their officers in work zone safety strategies. Like Tennessee, these States utilize police officers to increase motorist compliance with work zone traffic laws. Connecticut has a 4-hour-long work zone training program but does not use it because the State has not recently had a work zone accident involving a State trooper.33 Delaware34 and Maryland35 do not offer training specific to work zone safety. In the last three police academy classes, the Maryland State Police briefly addressed work zone safety as part of a 3-hour incident management training block. Since 1994, the New Jersey State Police have specifically trained officers in work zone safety and traffic control for highway construction areas. Officers in its construction unit are required to attend a 4-day workshop that teaches MUTCD work zone principles and procedures. The course also includes Occupational Safety and Health Administration training about on-the-job risks associated with roadway construction. This training course is a collaborative effort between the New Jersey State Police, international and local labor unions, the Utilities and Transportation Contractors’ Association, Rutgers University, local and county police, and the New Jersey Department of Labor. According to the New Jersey State Police Web site,36 once training is completed, construction unit officers work to enforce the rules and regulations governing traffic control and safety in highway work areas. The officers may inspect construction sites to ensure contractors comply with the traffic control plans established for their project. The officers may also provide work zone safety training for local police agencies and for other governmental and private organizations. New Jersey also provides a 4-hour basic work zone safety course for officers not assigned to the construction unit. New Jersey established the construction unit in 1994 to increase the level of performance of law enforcement personnel in work zones and to provide enforcement consistency statewide. Among the benefits of the construction unit are more uniform implementation of approved traffic control plans, better control of the construction project, and increased safety for workers and the traveling public.37,38 From 1984 to 1993, New Jersey averaged almost 21 work zone-related fatalities per year.39 32 Safety and Operations Research Team, Federal Highway Administration, Tennessee Division office, telephone conversation, February 2002. 33 Connecticut State Police, telephone conversation, March 2002. 34 Delaware State Police, telephone conversation, March 2002. 35 Maryland State Police, telephone conversation, March 2002. 36 http://www.njsp.org/about/traffic.html. 37 Work Zone Safety Information Clearinghouse, Texas Transportation Institute, in cooperation with the American Road and Transportation Builders Association http://wzsafety.tamu.edu. 38 Supervising Engineer, NJDOT Office of Capitol Project Safety, telephone conversation, March 2002.

Factual Information 16 Highway Accident Report Since 1994, the State has averaged 12 work zone-related fatalities per year.40 Because work zone data on the frequency, type, length, duration, and location of work zone projects in New Jersey are not available, it is not possible to determine whether the reduction in work-zone fatalities can be attributed to the training program. In addition, New Jersey recently established an Office of Capital Project Safety (OCPS) to enhance safety in construction work zones and improve the safety awareness of contractors, construction workers, motorists, and New Jersey Department of Transportation employees. As problems are identified in work zones, the OCPS plans to evaluate and resolve the problems and then develop a process to prevent them from recurring.41 FHWA Report on Police Use in Work Zones In October 2001, the FHWA published a report summarizing the results of a survey that it conducted with AASHTO on the use of uniformed police officers for federally funded highway construction projects.42 Forty-six State transportation agencies responded to the survey, along with a number of law enforcement agencies and organizations, highway industry associations, State legislators, and contractors. About two-thirds of the States responding indicated that they use uniformed police officers in at least some work zones, most often where particular traffic safety concerns exist, such as in work zones with high speed and high traffic volume and in work zones with lane closure or nighttime operations unprotected by a concrete barrier. Funds to pay for the police presence are generally factored into the overall construction costs by the State transportation agencies. As with Project CAR in Tennessee, police funding for work zone projects is generally administered through an interagency agreement or a memorandum of understanding between the State transportation agency and the State police. The FHWA report states that it is not clear from the responses gathered whether police officers are always familiar with MUTCD procedures. Roughly a quarter of respondents indicated that their State had a program in place or under development to train uniformed police officers working in construction projects. One-fifth of the respondents indicated that officers are trained in traffic operations and traffic management as part of basic training but are not given specific training on traffic management in work zones. The responses also suggested that officer supervision arrangements vary; officers are sometimes supervised by the State department of transportation project engineer, 39 1984 through 1993 data requested from the National Highway Transportation Administration. 40 1994 through 2000 data obtained from the Work Zone Safety Information Clearinghouse Web site http://wzsafety.tamu.edu. 41 Supervising engineer, OCPS, New Jersey Department of Transportation, telephone conversation, February 2002. 42 Federal Highway Administration, A Study on the Use of Uniformed Police Officers on Federal-Aid Highway Construction Projects, docket number FHWA-1999-5387 (Washington, DC: FHWA, 2001).

Factual Information 17 Highway Accident Report sometimes by the contractor, and other times by the law enforcement agency supervisor on duty. In response to these findings, the FHWA made the following recommendations to State agencies that use Federal highway funds to assign uniformed police officers to highway work zones: • Develop guidelines addressing (a) when to use uniformed police officers, (b) the traffic control planning process, and (c) officer pay, work procedures, and supervision. • Provide training in MUTCD requirements to police officers assigned to federally funded highway work zones. (Note: Federal regulations require the use of MUTCD signing and flagging procedures in federally funded highway work zones.) • Gather data on traffic safety incidents occurring in federally funded highway work zones to better assess the effectiveness of traffic control techniques. • Consider using new traffic control technologies, such as automated enforcement and intrusion alarms. FHWA Rulemaking On February 6, 2002, the FHWA released an advance notice of proposed rulemaking (ANPRM) regarding improvements to its regulations on Traffic Safety in Highway and Street Work Zones.43 In the ANPRM, the FHWA identified a set of issues that may be addressed, including general policy and regulatory considerations, transportation planning and programming, project design for construction and maintenance, managing for mobility and safety in and around work zones, public outreach and communications, and analyzing work zone performance. The ANPRM does not address the need for training for law enforcement officers involved in work zone operations. Work Zone Accident Statistics In the past 5 years, the number of traffic fatalities occurring in work zones has risen. In 1996, 717 individuals were killed in work zone-related accidents; by 2000, that number had increased to 1,093. (See figure 7.) The number killed in work zones located in principal arterials, where travel speeds are normally higher, also increased from 483 in 1996 to 641 in 2000. During that 5-year period, the number of work zone fatalities in which heavy vehicles were involved increased from 153 to 219.44 Commercial vehicles account for 7 percent of all vehicle miles driven per year. They are involved in 3 percent of 43 Work Zone Safety, 67 Federal Register (FR) 5532. 44 Data obtained via the Fatality Analysis Reporting System (FARS) Web-based Encyclopedia http://www-fars.nhtsa.dot.gov.

Factual Information 18 Highway Accident Report all injury accidents, 9 percent of all fatal accidents, and 20 percent of all fatal work zone accidents.45 The number of work zone projects is increasing due to maintenance required on the Nation’s aging roadway infrastructure.46 Exposure data on the frequency, type, length, duration, and location of work zone projects are not available, and the extent to which the rise in fatalities may be due to the increase in driver exposure to work zones is not known. 47 What is known is that vehicle miles traveled have steadily increased,48 as have capital outlays for highway maintenance projects.49 45 Federal Motor Carrier Safety Administration, Large Truck Crash Overview, 1998 and 1999 editions, http://www.fmcsa.dot.gov/factsfigs/formspubs.htm (Washington, DC: FMCSA, 1998 and 1999). Figure 5. Annual work zone fatalities (1996-2000). 46 Safety Study NTSB/SS-92/02. 47 Recently published research on a limited dataset of California interstate work zones indicates that accidents increase significantly on roadways where work zones are present. Additionally, there is a positive correlation between work zone lengths and accident frequencies. See Asad J. Khattak, Aemal J. Khattak, and Forrest M. Council, “Effects of Work Zone Presence on Injury and Non-injury Crashes,” Accident Analysis and Prevention, Vol. 34 (1) (2002) 19-29. 48 http://www-fars.nhtsa.dot.gov. 49 Federal Highway Administration, Highway Statistics 2000, http://www.fhwa.dot.gov/ohim/hs00/index.htm (Washington, DC: FHWA, 2000). 0 200 400 600 800 1000 1200 1996 1997 1998 1999 2000 Figure 7.

19 Highway Accident Report Analysis This analysis recounts the events leading to the Jackson, Tennessee, accident, examines related medical certification issues and then focuses upon the factors that led to the unsafe conditions for both motorists and workers: (1) the planning and coordination between TDOT, its contractors, and the THP regarding the work zone operation underway at the time of the accident and (2) the degree of traffic control training in highway work zone operations received by THP officers. Finally, the analysis examines whether TMAs might have ameliorated the severity of this accident. The Accident About 8 a.m. on July 26, 2000, two THP officers positioned their vehicles, with their emergency lights flashing, within the right eastbound lane of a high-speed roadway in order to warn motorists away from the milling machine and the sweeper on the roadway shoulder. Although variable message signs warned motorists of the roadwork ahead and of a lane closure, the signs failed to specify which lane was closed. No channeling devices were positioned behind the officers to direct motorists to the left lane. In addition, the protection vehicle towing the flashing arrow board was positioned behind the sweeping machine, 950 feet ahead of the trailing police vehicle. Less than an hour after the work zone project began, a loaded tractor-semitrailer entered the 55-mph work zone, traveling in the right lane at a driver-estimated speed of 65 mph. The tractor-semitrailer collided with the trailing THP vehicle, causing the smaller vehicle to explode upon impact and to be dragged approximately 192 feet before coming to rest in the highway median. The tractor-semitrailer continued through the highway median into the westbound lanes, collided with a 1997 Chevrolet Blazer, and finally came to rest in a wooded area on the north side of I-40. After the accident, a THP officer and a witness attempted to extinguish the flames from the burning THP vehicle and extricate the officer inside, but were unable to do so because of the intense heat. The Safety Board concludes that the severity of the tractor- semitrailer’s impact with the trailing police car and the subsequent explosion and fire made this accident unsurvivable for the officer in the trailing THP vehicle. The situation that confronted motorists as they entered the work zone was challenging. On the previous day, vague messages displayed on the variable message signs had prompted motorists to complain to TDOT that they could not tell which lane was closed. The unprotected positions of the THP vehicles had generated sufficient complaints by TDOT personnel to the Regional Safety Director to merit an inspection of the work zone operation. The accident occurred before this inspection could take place.

Analysis 20 Highway Accident Report The tractor-semitrailer driver, who had been diagnosed with obstructive sleep apnea in 1997 and hypothyroidism in 1998, had continued to drive after the diagnoses. A subsequent investigation revealed that it was unclear whether the driver’s chronic and potentially incapacitating medical conditions had been treated successfully. Witnesses reported that before the collision, the driver had drifted off the road at least twice. The driver himself told the THP that he might have fallen asleep at the time of the accident. Medical Certification Issues Driver Factors The tractor-semitrailer driver’s medical records indicate that in August 1997, he was formally diagnosed with sleep apnea, 1 month after colliding with a police vehicle and injuring two officers. Although he underwent surgery for his condition, he failed to keep postsurgical appointments. He did not schedule a followup sleep study, making it difficult to assess the success of the surgery. The driver also suffered from hypothyroidism, but he did not mention this or his history with obstructive sleep apnea to the examiner during his August 1999 commercial driver medical examination. Moreover, he had been prescribed medication for his hypothyroidism, but indicated that he was not on any medication. Following the accident, a pill bottle nearly full of thyroid hormone medication was found in the truck cab. A postaccident blood test performed by the THP indicated that his thyroid hormone level was markedly low. Apparently, the driver took only a few pills of the last prescription filled in 1998 for thyroid hormone and never followed up on his thyroid condition. The Safety Board concludes that the driver’s obstructive sleep apnea, his untreated hypothyroidism, or complications from either or both conditions predisposed him to impairment or incapacitation, including falling asleep at the wheel, while driving. Past Recommendations This accident investigation raises many of the same medical certification issues that the Safety Board addressed in its report50 on a 1999 motorcoach accident in New Orleans that killed 22 passengers and injured 22 others. The motorcoach driver involved was able to renew his commercial driver medical certificate, and thereby retain his commercial driver’s license, despite suffering from several life-threatening medical conditions of the kidneys and heart that affected his ability to perform his duties and required him to undergo 3- to 4-hour-long clinical treatments 6 days a week. The New Orleans report details several factors that contributed to the failure of the medical certification process to prevent unfit drivers from operating a commercial vehicle. As a result of its investigation, the Safety Board made recommendations to the FMCSA and 50 National Transportation Safety Board, Motorcoach Run-off-the-Road Accident, New Orleans, Louisiana May 9, 1999, Highway Accident Report NTSB/HAR-01/01 (Washington, DC: NTSB, 2001).

Analysis 21 Highway Accident Report other organizations to develop a comprehensive medical oversight program for interstate commercial drivers that contains the following program elements: H-01-17 Individuals performing medical examinations for drivers are qualified to do so and are educated about occupational issues for drivers. H-01-18 A tracking mechanism is established that ensures that every prior application by an individual for medical certification is recorded and reviewed. H-01-19 Medical certification regulations are updated periodically to permit trained examiners to clearly determine whether drivers with common medical conditions should be issued a medical certificate. H-01-20 Individuals performing examinations have specific guidance and a readily identifiable source of information for questions on such examinations. H-01-21 The review process prevents, or identifies and corrects, the inappropriate issuance of medical certification. H-01-22 Enforcement authorities can identify invalid medical certification during safety inspections and routine stops. H-01-23 Enforcement authorities can prevent an uncertified driver from driving until an appropriate medical examination takes place. H-01-24 Mechanisms for reporting medical conditions to the medical certification and reviewing authority and for evaluating these conditions between medical certification exams are in place; individuals, health care providers, and employers are aware of these mechanisms. The Safety Board also issued Safety Recommendation H-01-26 to the American Association of Motor Vehicle Administrators (AAMVA) to urge its member States to develop a comprehensive medical oversight program for intrastate commercial drivers that contains the same elements. The FMCSA responded to Safety Recommendations H-01-17 through –24 in an April 11, 2002, letter; that response was under review at the

Analysis 22 Highway Accident Report time this report went to publication. The AAMVA has not yet responded to Safety Recommendation H-01-26. Considerable effort will be required to create a comprehensive medical oversight program that is both effective and feasible. However, the Jackson, Tennessee, accident again demonstrates how easily unfit drivers are able to take advantage of the inadequacies of the current medical system, resulting in potentially fatal consequences. The Safety Board therefore concludes that had a comprehensive medical oversight program been in place at the time of the accident, this driver, who had known and potentially incapacitating medical conditions, would have been considerably less likely to be operating a commercial vehicle. The Safety Board urges both the FMCSA and AAMVA to act quickly to develop a comprehensive medical oversight plan for commercial drivers. Communication, Planning, and Coordination Between TDOT and the THP Project CAR was a mechanism for TDOT to contract with the THP to provide enforcement and traffic control assistance on this construction project. Despite the THP’s role in the project, it was not invited to attend the TDOT preconstruction conference meetings. Typically, participants in a preconstruction conference discuss the scope of a construction project; the time, resources, and procedures needed to complete it; and the traffic control plan that best suits each phase of the project. Large projects, such as the one in Jackson, Tennessee, usually involve the State’s department of transportation and several contractors and subcontractors. Because of the number of parties involved, communication and coordination are vital in establishing a work zone strategy that is both effective and safe. Not seeking THP representation resulted in a lost opportunity for Dement Construction and THP representatives to coordinate traffic control duties. It also meant that TDOT could not clarify to all involved who was in charge of traffic control in the work zone. This clarification would have been helpful, given the natural assumption that police officers are in charge of traffic control. The end result was a disjointed traffic control effort between the TDOT contractor and the THP that was inherently unsafe. The Safety Board concludes that had TDOT invited the THP to the preconstruction conferences, lines of communication may have been established, enabling the parties to agree upon traffic control responsibilities and clarify the manner in which they should be performed. At the time of the accident, TDOT was employing a traffic control strategy that was not covered in the construction contract. In fact, the contract did not contain a traffic control plan that was applicable to mobile operations such as milling rumble strips or performing pavement striping and other lane marking operations. Furthermore, the contract did not specify the THP’s duties with regard to traffic control within the work zone.

Analysis 23 Highway Accident Report The failure to define a specific traffic control plan for the milling operation suggests that too little planning had been devoted to that operation, which may have led to the ambiguous information displayed on variable message signs and to other questionable safety practices discussed below. The lack of a specific traffic control plan, in conjunction with the absence of the THP in the preconstruction conferences, quite likely added to the contractor’s uncertainty with regard to the THP’s role in the milling project. These circumstances may have fostered the misconception that the THP officers did not need additional guidance on work zone operations. The Safety Board concludes that the traffic control and safety aspects of the work zone operation would have been improved had the construction contract incorporated traffic control plans for all aspects of the work zone operation and assigned specific responsibilities to each party. The Safety Board believes that the Tennessee Department of Transportation should conduct preconstruction conferences with all parties involved in a work zone project. Further, as a result of such conferences, TDOT should produce a written traffic control plan or project plan agreed to by all parties that defines the lines of authority and how traffic control and enforcement will be performed for all types of work zone configurations to be utilized. According to the FHWA’s 2001 study on the Use of Uniformed Police Officers on Federal-Aid Highway Construction Projects, a majority of the States use uniformed police officers in at least some work zones, most often where particular traffic safety concerns exist, such as in work zones with high speed and high traffic volume and in work zones with lane closure or nighttime operations unprotected by a concrete barrier. Part VI of the MUTCD encourages the use of police officers in work zone operations, stating that the “use of police in vulnerable work situations, particularly those of relatively short duration, heightens the awareness of passing traffic and will likely cause a reduction in travel speed.” Although the use of police officers is promoted as a way to increase work zone safety, no specific guidance exists that addresses the need to coordinate traffic control and enforcement activities with the officers. The MUTCD, which codifies the principles and procedures used by all States when designing and implementing work zones, does not provide guidance on this issue. The accident in Jackson, Tennessee, illustrates the importance of a coordinated effort in creating a safe work zone environment for workers and the traveling public. The Safety Board concludes that the widespread use of police officers at highway work zones underscores the need for standard guidance to assist construction and maintenance workers in coordinating traffic control, enforcement, and other safety-related tasks with police officers assigned to work zones. The Safety Board believes that the Federal Highway Administration should review and revise the Manual on Uniform Traffic Control Devices to provide guidance on coordination with law enforcement personnel used in traffic control strategies at highway work zones.

Analysis 24 Highway Accident Report Training Issues Role of Law Enforcement Law enforcement personnel typically perform short-term traffic control functions for specific events. These functions include providing enforcement and traffic control support at accident scenes, at intersections with malfunctioning or missing traffic control devices, in work zones, when escorting permitted (oversize) vehicles, and during special events that generate heavy traffic. However, THP General Order 405, which governs traffic direction and control, does not provide guidance for the unique situations found in long-term work zone environments. For this reason, the THP officers lacked the guidance and training necessary to provide safe and effective traffic control for work zone operations. As part of its investigation, the Safety Board conducted a limited survey of the police work zone training practices in Maryland, Delaware, Connecticut, and New Jersey. Among those surveyed, only New Jersey had officers who are trained in Part VI of the MUTCD and other traffic control safety standards. New Jersey State Police assigned to the construction unit are authorized to enforce the rules and regulations governing traffic control and safety in highway work areas. The officers may even inspect construction sites to ensure that contractors comply with the traffic control plans established for their projects. According to the supervising engineer of the New Jersey Department of Transportation Office of Capitol Project Safety, having trained officers patrolling New Jersey work zones has resulted in more uniform implementation of traffic control plans, better control of construction projects, and increased safety for workers and the traveling public. Instruction and training similar to that given to the New Jersey construction unit would have benefited the THP officers assigned to the milling operation in Jackson, Tennessee. Prior to the milling operation, the Dement construction foreman advised the THP officers that the operation would involve a “mobile lane closure.” By this, he meant that all of the construction vehicles would be positioned on the shoulder of the highway and that traffic control efforts would be directed toward informing motorists ahead of time of the operation and keeping them away from the shoulder and a safe distance from the milling operation. Although the construction foreman indicated that he did not intend that the THP close the right lane, the phrase “mobile lane closure” could easily be construed to mean “close the lane.” “Mobile lane closure” is not a term used in the MUTCD, nor was a mobile operation mentioned in the Jackson traffic control plan. Yet, the THP did not ask for clarification and proceeded to position their vehicles behind the construction vehicles in an unsafe manner. The Safety Board concludes that had the THP officers received work zone traffic control training, they may have asked the construction foreman for clarification on the traffic control strategy to be used that day. The Safety Board further concludes had the THP officers received work zone traffic control training, they would have realized the hazards of positioning their vehicles in the lane behind the highway construction vehicles.

Analysis 25 Highway Accident Report Since the Jackson, Tennessee, accident, the THP has worked with the FHWA to develop training programs on MUTCD traffic control strategies for its supervisors and officers. The Safety Board supports the efforts of the THP and the FHWA to reduce work zone-related accidents through training. This effort places Tennessee in the forefront on the work zone training issue because, as the FHWA’s survey on the use of uniformed police officers indicates, three-fourths of responding State agencies do not have a program in place or under development to train police officers on work zone safety standards. New Jersey has adopted such a training program and believes that it has contributed to the implementation of more uniform traffic control plans and better controlled construction projects and has also led to a significant reduction in work zone-related fatalities. Therefore, the Safety Board believes that the FHWA, in cooperation and consultation with the National Highway Traffic Safety Administration (NHTSA), the International Association of Chiefs of Police, the National Sheriffs’ Association, and AASHTO should develop a model training program for law enforcement personnel that addresses traffic control strategies at highway work zones, and encourage the States to adopt it. At a minimum, the training program should incorporate material from Part VI of the MUTCD and information concerning procedures and terminology typically used by highway engineers in establishing and evaluating work zone operations. Past Recommendations Other recent accident investigations have raised concerns that law enforcement officers sometimes lack the training to conduct activities that are not a part of their normal duties. In December 2001, the Safety Board adopted a report51 that described the events leading to the collision between a commuter train and a tractor combination vehicle carrying an oversized/overweight load. As a result of its investigation, the Safety Board recommended that the International Association of Chiefs of Police and the National Sheriffs’ Association: H-01-36 Notify your members of the circumstances of the Glendale, California, accident and encourage them to train their officers to make sure (1) that documentation regarding permits is reviewed and verified; (2) that safety briefings to discuss routings and special conditions, including the hazards associated with moving oversize/overweight vehicles over grade crossings, are conducted; (3) that provisions for handling off-route loads are in place; and (4) that necessary notification to the railroads is made before an oversize/overweight vehicle is escorted across a highway-railroad grade crossing. 51 National Transportation Safety Board, Collision Between Metrolink Train 901 and Mercury Transportation, Inc., Tractor-Combination Vehicle at Highway-Railroad Grade Crossing in Glendale, California, on January 28, 2000, Highway Accident Report NTSB/HAR-01/02 (Washington, DC: NTSB, 2001).

Analysis 26 Highway Accident Report The report also recommended that the FHWA, in cooperation and consultation with the FMCSA and trade associations:52 H-01-31 Develop model oversize/overweight vehicle movement guidelines. The guidelines should address, at a minimum, issues such as (1) when pilot cars and police escorts are required; (2) the training, testing, and certification of pilot car operators, police officers, and truck drivers in the movement of oversize/overweight loads; (3) the use of height poles and traffic controls; (4) how to conduct route surveys; (5) the maneuvering limitations of heavy-haul vehicles; (6) the effects of fatigue on performance; (7) the need to assess the dangers at railroad crossings, particularly for low-clearance vehicles; and (8) the need and requirements to notify the railroads before an oversize/overweight vehicle is escorted across a highway-railroad grade crossing. In addition, the Safety Board issued a companion recommendation (H-01-33) urging the FMCSA and trade associations to work with the FHWA to accomplish Safety Recommendation H-01-31. Owing to the relatively short time since these recommendations were issued, as of April 2002, they are classified “Open—Await Response.” The Safety Board looks forward to learning about the results of joint Government, industry, and law enforcement initiatives to ensure the safety of vehicles in unique traffic situations. Work Zone Safety Configuration Criteria The construction foreman stated to Safety Board investigators that he had advised the THP officers who were assisting with traffic control that the operation would involve a mobile lane closure. The construction foreman further stated to Safety Board investigators that when he advised the THP officers who were assisting with traffic control that the operation would involve a mobile lane closure, his intent was to keep both traffic lanes open. The foreman noted that the configuration used in the work zone met MUTCD requirements.53 Some disagreement exists regarding the extent to which the construction vehicles encroached upon the roadway. Nonetheless, the presence of the THP vehicles in the right lane effectively made this a lane closure operation. TDOT contracted with the THP to assist with traffic enforcement and traffic control during the construction project. As such, the THP officers were part of the construction crew. The 1993 Part VI revision of the MUTCD indicates that certain traffic control elements should be present for a lane closure 52 AASHTO, the AAMVA, the Commercial Vehicle Safety Alliance, the Specialized Carriers and Rigging Association, the California Professional Escort Car Association, the Texas Pilot Car Association, and the United Safety Car Association. 53 MUTCD, Part VI, 1988 edition, revision 3 (1993).

Analysis 27 Highway Accident Report on a divided highway, including advance road signs indicating that the appropriate lane is closed, a corresponding lane reduction symbol sign, a protection vehicle with an activated flashing yellow light, and channelizing devices to separate the work zone from the through traffic. Several of these traffic control elements were missing in the Jackson work zone. The variable message signs used did not specify which lane ahead was closed, and they were not accompanied by a corresponding lane reduction symbol sign. Channelizing devices to separate the work zone from the through traffic were not used. Although a protection vehicle with a flashing arrow board was present, it was not positioned to warn vehicles away from the THP vehicles. Therefore, the Safety Board concludes that the traffic control configuration used by TDOT and its contractors did not meet MUTCD requirements for a lane closure on a divided highway. The precautions taken by TDOT, its contractors, and the THP were insufficient to protect the officers, construction workers, and road users. The most obvious problem was the unprotected position of the patrol cars on the roadway. Although lines of communication had not been established for this project, and although the foreman’s statements suggest that he had some trepidation in advising the officers on traffic control, these factors do not relieve TDOT or its contractors of their responsibility to clarify their traffic control intent to the officers, to voice their concerns regarding the officers’ presence in the travel lane, and to follow the prescribed traffic control plans. These factors also should not have kept the THP from recognizing that, as members of the construction crew, they have a responsibility to coordinate activities with TDOT and its contractors. Had the THP vehicles not been positioned in an active lane during the milling operation, TDOT and its contractor would not have been required, under the MUTCD, to close a traffic lane. However, the presence of the THP vehicles in the right lane obligated TDOT and its contractors to adopt a lane closure strategy to protect the exposed vehicles. This strategy should have included changing the variable message signs to indicate that the right lane was closed ahead and accompanying them with corresponding lane reduction symbol signs. In addition, channelizing devices should have been put in place to separate the construction and police vehicles from the through traffic, and a protection vehicle with an arrow board and a TMA should have been positioned to trail the police vehicles within the channelizing devices. Therefore, the Safety Board concludes that TDOT, its contractors, and the THP failed to take the precautions necessary to protect all workers and road users within the work zone. Use of TMAs In the Jackson accident, the police vehicles were, in effect, acting as protective barriers for the construction workers in the milling operation, a practice not sanctioned by either the MUTCD or the AASHTO Roadside Design Guide. Given the hazardous nature of this practice, the Safety Board examined whether having a TMA positioned behind the THP vehicles would have reduced the severity of this accident. As mentioned previously, TMAs are compact crash cushions attached to the rear of protection vehicles that are intended to protect construction workers and the occupants of a striking vehicle. They are

Analysis 28 Highway Accident Report designed to decelerate and stop vehicles as heavy as 4,400 pounds, traveling at speeds of up to 62 mph. In the Jackson accident, the weight (48,000 pounds)54 and speed (65 mph) of the striking tractor-semitrailer far exceeded the design parameters of a TMA. Had a TMA-equipped protection vehicle been positioned behind the police vehicles, it would quite likely have been destroyed and its driver killed or seriously injured. The protection offered by TMAs has improved since the Safety Board published its 1992 safety study55 on highway work zone safety. At that time, TMAs were designed for an impact speed of up to 45 mph. In the 1992 study, the Safety Board evaluated several accidents involving both cars and heavy trucks in which TMAs were used and concluded, “Truck-mounted attenuators used on vehicles in moving maintenance operations and on barrier vehicles at stationary work zone sites can substantially reduce the severity of accidents in these work zones.” The Safety Board recommended that the FHWA: H-92-36 Conduct research, in conjunction with industry, to determine the effectiveness of truck-mounted attenuators when struck at various angles and offsets and at speeds in excess of 45 mph, and analyze the safety benefits and shortcomings of using truck-mounted attenuators in such high-speed environments. Since receiving this recommendation, the FHWA has published a report defining the testing parameters for TMAs,56 including crash tests at speeds up to 62 mph. The report also defines the parameters for 10-degree-offset crash tests, but considers these types of tests to be optional, noting “there is no assurance that new TMA designs can be made to meet these test requirements without significant increases in cost or without detrimental effects on truck handling.” Nonetheless, the report encourages manufacturers to design with this goal in mind. Consequently, on September 16, 1994, the Safety Board classified Safety Recommendation H-92-36 “Closed—Acceptable Alternate Action.” Approximately 80 percent of work zone accidents involve smaller passenger vehicles, and TMAs are designed to dissipate the energy of impacts involving such vehicles. In the absence of more definitive data, the recent increase in overall work zone fatalities suggests that greater use of work zone TMAs may be warranted. The Safety Board concurs with NIOSH that when worker exposure cannot be eliminated completely, positive protective barriers, such as TMAs, should be used to shield workers from traffic. Work Zone Data During its investigation, the Safety Board attempted to find exposure data57 that would help clarify the increase in work zone fatalities. Exposure data are necessary 54 The tractor-semitrailer was fully loaded with computers and computer supplies at the time of the accident. The average weight of such vehicles, when fully loaded, is between 70,000 and 75,000 pounds; they can weigh as much as 80,000 pounds without having to be permitted. 55 Safety Study NTSB/SS-92/02. 56 Recommended Procedures for the Safety Performance Evaluation of Highway Features, National Cooperative Highway Research Program Report 350, 1993.

Analysis 29 Highway Accident Report because risk cannot be fully determined using fatality data alone, since fatality data do not account for changes in the frequency, duration, and length of work zones, nor do they account for the location and type of construction being performed. Exposure data might also have helped the Board determine whether the issues identified in the Jackson, Tennessee, collision were isolated to this accident or were more far reaching. However, investigators found that work zone-related exposure data are not gathered nationally. In its 1992 study on work zone safety,58 the Safety Board concluded that the lack of exposure data for work zone accidents makes it difficult to compare accident rates in work zones with accident rates on roads elsewhere. Therefore, the Safety Board issued the following recommendations to NHTSA and the FHWA: H-92-33 Review, in conjunction with the Federal Highway Administration, all State accident report forms, select the data elements that comprehensively document work zone accidents, and encourage the States to incorporate these data elements into their accident report forms. H-92-34 Review, in conjunction with the National Highway Traffic Safety Administration, all State accident report forms, select the data elements that comprehensively document work zone accidents, and encourage the States to incorporate these data elements into their accident report forms. NHTSA created the Model Minimum Uniform Crash Criteria (MMUCC) in response to Safety Recommendation H-92-33. The MMUCC is a voluntary set of guidelines that help States collect consistent, reliable accident data that are more effective for identifying traffic safety problems, establishing goals and performance measures, and monitoring the progress of programs. These guidelines include a data element for work zone accidents, which allows police officers to specify where in a work zone an accident occurred. Officers can also specify the work zone type and whether construction workers were present at the time of the accident. NHTSA has encouraged the States to adopt the MMUCC through training and educational programs in conjunction with the FHWA, the National Association of Governors’ Highway Safety Representatives, and others. Consequently, the Safety Board classified this recommendation “Closed—Acceptable Action” on April 5, 2001. Although NHTSA does not track the number of States that have adopted all or part of the MMUCC, it believes that about 40 percent of the States have altered their accident reports to incorporate MMUCC data elements. NHTSA is currently hosting a State compatibility working group to address general concerns with the MMUCC and plans to 57 Data with a common characteristic, such as vehicle miles traveled, that enable better comparison of data from disparate sources. 58 Safety Study NTSB/SS-92/02.

Analysis 30 Highway Accident Report hold a workshop for State representatives in August 2002. NHTSA expects to publish an updated version of the MMUCC by 2003.59 In response to Safety Recommendation H-92-34, the FHWA determined that a standard definition for a work zone had to be developed first. In December 2000, the FHWA revised the Millennium edition, Section 6C.02, of the MUTCD to include the following definition: A work zone is an area of a highway with construction, maintenance, or utility work activities. A work zone is typically marked by signs, channelizing devices, barriers, pavement markings, and/or work vehicles. It extends from the first warning sign or rotating/strobe lights on a vehicle to the END ROAD WORK sign or the last temporary traffic control device. This definition provides public safety personnel with a baseline for recording accidents in and around work zones, and the FHWA has requested that the States include specific data elements on their accident reporting forms that account for work zones.60 As a result of these efforts, the Safety Board classified this recommendation “Closed— Acceptable Action.” In addition to pointing out the lack of exposure data available on work zone accidents, the Board’s 1992 study noted deficiencies in its collection. Therefore, the Safety Board recommended that the FHWA: H-92-35 Develop a program to collect exposure data for construction work zones on the interstate system. The FHWA has two research efforts underway to determine the influence of work zones on crash rates, the sources of information now available to generate exposure data, and the availability of other types of exposure data that might further benefit the safety and performance assessment of work zones. Exposure data are being gathered on a limited basis for these efforts; those data include the annual percentage of the Nation’s highways with at least 1 day of work zone activity, the number of vehicles that traverse work zones annually, the total worker-hour exposure in work zones, traffic density, and work zone length, type, and duration. Current work zone crash and fatality statistics will also be assessed with respect to the exposure measures developed for this task. The results from one of these research efforts are expected in spring 2002 and the other in fall 2002. While the MMUCC provides a mechanism for the States to collect more accurate and detailed information on work zone accidents, little can be learned from the number of work zone injuries and fatalities without first knowing more about the conditions in which 59 Team Leader, State Data and Quality Assurance Branch, National Center for Statistics and Analysis, NHTSA, telephone conversation, April 16, 2002. 60 Transportation Specialist, Safety Core Business Unit, Federal Highway Administration, e-mail correspondence, April 2002.

Analysis 31 Highway Accident Report they occurred. An accounting of work zone characteristics, including types, frequency, duration, length, and location of operations, is needed to permit researchers to determine accident rates under differing conditions, thereby allowing for better assessments of safety procedures and equipment. Therefore, the Safety Board expects that the FHWA report will allow the agency to quickly act upon the Board’s decade-old recommendation to collect work zone exposure data. In the meantime, this recommendation remains “Open— Acceptable Response.”

32 Highway Accident Report Conclusions Findings 1. The severity of the tractor-semitrailer’s impact with the trailing police car and the subsequent explosion and fire made this accident unsurvivable for the officer in the trailing Tennessee Highway Patrol vehicle. 2. The driver’s obstructive sleep apnea, his untreated hypothyroidism, or complications from either or both conditions predisposed him to impairment or incapacitation, including falling asleep at the wheel, while driving. 3. Had a comprehensive medical oversight program been in place at the time of the accident, this driver, who had known and potentially incapacitating medical conditions, would have been considerably less likely to be operating a commercial vehicle. 4. Had the Tennessee Department of Transportation invited the Tennessee Highway Patrol to the preconstruction conferences, lines of communication may have been established, enabling the parties to agree upon traffic control responsibilities and clarify the manner in which they should be performed. 5. The traffic control and safety aspects of the work zone operation would have been improved had the construction contract incorporated traffic control plans for all aspects of the work zone operation and assigned specific responsibilities to each party. 6. The widespread use of police officers at highway work zones underscores the need for standard guidance to assist construction and maintenance workers in coordinating traffic control, enforcement, and other safety-related tasks with police officers assigned to work zones. 7. Had the Tennessee Highway Patrol officers received work zone traffic control training, they may have asked the construction foreman for clarification on the traffic control strategy to be used that day. 8. Had the Tennessee Highway Patrol officers received work zone traffic control training, they would have realized the hazards of positioning their vehicles in the lane behind the highway construction vehicles. 9. The traffic control configuration used by the Tennessee Department of Transportation and its contractors did not meet Manual on Uniform Traffic Control Devices requirements for a lane closure on a divided highway.

Conclusions 33 Highway Accident Report

1. The Tennessee Department of Transportation, its contractors, and the Tennessee

Highway Patrol did not take the precautions necessary to protect all workers and road users within the work zone. Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the driver’s incapacitation, owing to the failure of the medical certification process to detect and remove a medically unfit driver from service. Contributing to this accident were the lack of planning and coordination between the Tennessee Department of Transportation, its contractors, and the Tennessee Highway Patrol regarding work zone projects; the lack of traffic control training, specific to highway work zone operations, provided to Tennessee Highway Patrol officers; and the failure of the Tennessee Department of Transportation and its contractors to protect all work zone personnel and road users.

34 Highway Accident Report Recommendations To the Federal Highway Administration: Review and revise the Manual on Uniform Traffic Control Devices to provide guidance on coordination with law enforcement personnel used in traffic control strategies at highway work zones. (H-02-02) In cooperation and consultation with the National Highway Traffic Safety Administration, the International Association of Chiefs of Police, the National Sheriffs’ Association, and the American Association of State Highway and Transportation Officials, develop a model training program for law enforcement personnel that addresses traffic control strategies at highway work zones, and encourage the States to adopt it. At a minimum, the training program should incorporate material from Part VI of the Manual on Uniform Traffic Control Devices and information concerning procedures and terminology typically used by highway engineers in establishing and evaluating work zone operations. (H-02-03) To the National Highway Traffic Safety Administration: Work with the Federal Highway Administration to develop a model training program for law enforcement personnel that addresses traffic control strategies at highway work zones. At a minimum, the training program should incorporate material from Part VI of the Manual on Uniform Traffic Control Devices and information concerning procedures and terminology typically used by highway engineers in establishing and evaluating work zone operations. (H-02-04) To the Tennessee Department of Transportation: Conduct preconstruction conferences with all parties involved in a work zone project. As a result of such conferences, produce a written traffic control plan or project plan agreed to by all parties that defines the lines of authority and how traffic control and enforcement will be performed for all types of work zone configurations to be utilized. (H-02-05)

35 Highway Accident Report To the National Sheriffs’ Association, the International Association of Chiefs of Police, and the American Association of State Highway and Transportation Officials: Work with the Federal Highway Administration to develop a model training program for law enforcement personnel that addresses traffic control strategies at highway work zones. At a minimum, the training program should incorporate material from Part VI of the Manual on Uniform Traffic Control Devices and information concerning procedures and terminology typically used by highway engineers in establishing and evaluating work zone operations. (H-02-06) BY THE NATIONAL TRANSPORTATION SAFETY BOARD MARION C. BLAKEY Chairman CAROL J. CARMODY Vice Chairman JOHN A. HAMMERSCHMIDT Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: May 14, 2002 Recommendations

37 Highway Accident Report Appendix A Investigation The National Transportation Safety Board was notified of the Jackson, Tennessee, accident on July 27, 2000. Investigators were dispatched from the Parsippany, New Jersey, and Arlington, Texas, offices. Groups were established to investigate highway factors and motor carrier operations. Participating in the investigation were representatives of the Tennessee Highway Patrol and Tennessee Department of Transportation. No public hearing was held; no depositions were taken.

38 Highway Accident Report Appendix B Jackson, Tennessee, Driver Medical Information Table 1. Information extracted from the driver’s medical records by the Medical Officer, National Transportation Safety Board. Date Information Source 10/8/96 A form titled “Physical Examination Form” indicates “No” for the health history categories “Seizures, fits, convulsions, or fainting,” “Extensive confinement by illness or injury,” and “Permanent defect from illness, disease, or injury.” The form indicates “Yes” for “Suffering from any other disease” and notes “Crohn’s disease – no recent problem.” The form notes no abnormalities and is signed by a physician indicating that the driver is “qualified only when wearing corrective lenses.” Driver’s employer 11/26/96 Admission history notes “…truck driver admitted for recent onset left lower swelling, pain, and erythema after driving 10 hours/day for 10 days. … 2 nights ago patient was napping, woke up – when got up to stand noted pain in left groin all the way down to the left foot – along with left lower extremity swelling (pants were very tight around left lower extremity – tight and painful enough that patient didn’t change his pants for last 2 days, and didn’t stop to eat anywhere because it hurt too much to put weight onto his lower extremity – also left foot swelling to point couldn’t wear shoes) continued to drive 10 hours/day over last 2 days with intermittent stops every couple of hours to elevate leg and rest.…” Past medical history notes “Crohn’s disease – treated with meds in past none currently, intermittent diarrhea about once per month.” Temperature was noted as 101.8, weight as 358, and height as 5’11”. Denver VA Medical Center 11/30/96 Interim summary notes admission diagnoses of “1. Left lower extremity cellulitis. 2. History of Crohn’s disease. 3. Possible obstructive sleep apnea.…” History notes that the driver “…presented to the Denver VA emergency room (ER) with a 2-day history of left lower extremity swelling, fever to 100.7 in the ER, and positive cough with yellow sputum. The patient notes pain in his left lower extremity beginning 2 days before and then swelling. He did continue to drive his truck for 2 days but would pull off to the side of the road because he would have such pain. He did not stop to eat during those 2 days because it was too painful to leave his truck. He noted subjective fevers.…” Denver VA Medical Center

Appendix B 39 Highway Accident Report 12/2/96 Addendum notes indicate that the driver “…on admission, gave a history consistent with potential obstructive sleep apnea with the presence of snoring as well as some daytime somnolence and had obesity as well as hypertension…underwent a nighttime pulse oximetry study which showed significant desaturations. The patient was to have a formal sleep study; however, he reported that he is in need of returning to his home in Boise so that he can return to his employment. We would have preferred that the patient remain an inpatient to complete this evaluation; he stated that he needed to be discharged for financial reasons and that he would follow up promptly in Boise.…” Denver VA Medical Center 12/2/96 Discharge instructions note diagnoses of “(1) left lower extremity cellulitis (2) suspected obstructive sleep apnea with documented nocturnal desaturations,” discharge medication of “Augmentin 500 mg by mouth 3 times a day for 10 days,” and employment status of “No work for 1 week secondary to need to elevate left leg.” Denver VA Medical Center 12/4/96 Emergency clinic notes indicate that the driver “…presents after admit to Denver VA for left lower extremity cellulitis…night time desats by pulse ox? sleep apnea… resents to re-establish care at BVAMC and secondary rash from Augmentin” and that he “… needs followup for sleep apnea diagnosis (sleep study).” He was prescribed azithromycin and “Benadryl for rash.” Boise VA Medical Center 12/10/96 Emergency clinic notes indicate that the driver’s “leg is getting worse…Assessment: cellulitis – improved, but with continuing symptomatology…Plan: azithromycin…return tomorrow…” Boise VA Medical Center 12/11/96 Emergency clinic notes indicate “…cellulitis – resolving well on azithromycin…continue azithromycin…whirlpool…doppler study…followup…12/18…” Boise VA Medical Center 12/18/96 Physician note indicates “…schedule pulmonary consult – sleep apnea…schedule…clinic 4 months.” Boise VA Medical Center 4/30/97 Physician note indicates “…resolved cellulitis…return to clinic 5 months.” Boise VA Medical Center 7/16/97 Physician note indicates “truck driver – status post motor vehicle accident after ‘blackout’ 1 week ago.…had motor vehicle accident while driving his truck on 7/14/97. Can’t remember a 1 mile distance just before accident. Doesn’t know whether blacked out or fell asleep…was told he might have sleep apnea…Plan…consult for sleep apnea…follow up in 2 weeks.” Boise VA Medical Center 7/24/97 Pulmonary clinic note indicates “…patient is a truck driver…history of very loud snoring for all of his adult life. Patient’s brother has witnessed apneas in past.…does have daytime sleepiness…Assessment: Probable obstructive sleep apnea syndrome…his profession makes him high risk for disease-related mortality. Plan 1) I will schedule sleep study as high priority…2) No driving until sleep study is done and treatment started…return to clinic with me in pulmonary clinic in 3 months.” Boise VA Medical Center

Appendix B 40 Highway Accident Report 8/13/97 Sleep study results indicate “Severe obstructive sleep apnea. During second half of this study, patient was placed on CPAP mask and titrated up to maximum of 10 cm H20. This was associated with no significant improvement and complaints by the patient of the mask causing complete obstruction of the airway. BiPAP mask was attempted and titrated up to 12/5, with similar results. Recommendations: Referral to ENT to consider surgical therapy for this patient’s sleep apnea.” Boise VA Medical Center 8/21/97 Pulmonary clinic note indicates “please refer to ENT clinic ASAP – patient with severe obstructive sleep apnea. Unable to tolerate CPAP mask. Please evaluate for uvulopalatopharyngoplasty.’” Boise VA Medical Center 9/4/97 A note signed by the same physician who signed the 10/8/96 physical examination form indicates that the driver “was examined and found to be free of any disability. He is physically and mentally fit for safe operation of a commercial transportation vehicle.” Driver’s employer 9/19/97 Discharge note following surgery 9/16/97 for obstructive sleep apnea (uvulopalatopharyngoplasty, genioglossus advancement, hyoidpexy) notes: “Discharge diagnoses: 1. Obstructive sleep apnea. 2. Obesity.” and indicates “On postoperative day number one…He complained of difficulty swallowing…he reported complaints of food getting stuck in his throat…On 9-19-97…it was found that the patient had inadequate laryngeal elevation…this left him unable to protect his airway…he…was then taught to use a modification of a supraglottic texture…could tolerate liquids…had some moderate problems with pureed texture … discharged home … scheduled followup to the Boise Fly-In Clinic on 9-23-97.… should he have difficulties maintaining…hydration level he was instructed to report to the Boise VA…Discharge Medications: Tylenol No. 3 elixir…instructed to avoid heavy lifting…for the next 2 weeks…instructed to avoid driving while taking narcotics…” Social Work note on 9/18/97 indicates “…Patient may be discharged tomorrow. His brother will drive him home.…” Salt Lake City VA Medical Center 9/19/97 Emergency Department note indicates “3 days ago had surgical procedure for sleep apnea – discharged from hospital 5:00 – driving back to Boise and at about 6:30 pm developed pain in anterior neck and throat, feeling of swelling in anterior neck and difficulty swallowing secretion…diagnostic impression: postoperative swelling…transferred to 3E to lodge…” ENT note indicates “…breathing easily, incision intact, airway widely patent, incisions clean dry intact with steristrips – no hematoma…admit as lodging status…recheck in AM.” Salt Lake City VA Medical Center 9/21/97 Emergency Notes indicate that driver is “unable to take antibiotics, feels like he’s choking.…discharged 9/19. Readmitted 9/19 with difficulty swallowing/anxiety. Discharged 9/20. Doing well yesterday morning drank water without difficulties.… During the day it became more difficult to drink water.… Plan – prop head of bed, sit in Lazyboy recliner. Liquid Tylenol #3 or Tylenol Elixer.…Follow-up appointment already scheduled 9/23.” Boise VA Medical Center

41 Highway Accident Report 9/23/97 ENT follow-up note indicates that driver is “starting to feel better. Swallowing improved but still only taking liquids.…still poor laryngeal elevation…able to clear secretions.…” Boise VA Medical Center 11/24/97 Pulmonary clinic note indicates that the driver “failed to follow up with me. Still needs repeat sleep study…” Boise VA Medical Center 8/10/98 Physician note indicates the driver complained of “malaise and fatigue…fatigue for 1 month. Diarrhea for 18 years unchanged.…history of apnea but after surgery in Salt Lake City Utah VA, he is sleeping better and feeling rested.… Assessment: low energy, fatigue etiology unclear…” Boise VA Medical Center 9/16/98 Physician note indicates the driver “has increased TSH slightly. He has increased weight. He has had increased sensitivity of heat. He has diarrhea (Crohn’s disease).…weight 358…deep tendon reflexes sluggish…also has pseudomyotonia.…Assessment: Probable mild hypothyroidism, sleep apnea, resolved status post ENT surgery. Plan: begin L-thyroxine 0.025 mg…return to clinic …in 3 months…TSH in 2 months.” Boise VA Medical Center 10/5/98 A form titled “Physical Examination Form” indicates “No” for the health history categories “Seizures, fits, convulsions, or fainting,” “Extensive confinement by illness or injury,” and “Permanent defect from illness, disease, or injury.” The form indicates “Yes” for “Suffering from any other disease” and notes “Crohn’s disease, remission since 1990, hypothyroidism.” The form also notes “knee jerks not elicited even against reinforcement – likely related to hypothyroid state – just started replacement.” It is signed by a physician (a different physician than signed the other examinations noted here) indicating that the driver is qualified with no restrictions. Driver’s employer 8/9/99 A form titled “Physical Examination of Drivers” indicates “No” for all health history categories, including “Seizures, fits, convulsions, or fainting,” “Suffering from any other disease,” and “Permanent defect from illness, disease, or injury.” A note indicates “No known allergies, on no medications.” The form notes no abnormalities, and is signed by a physician (the same physician who signed the 10/8/96 and 9/4/97 examinations) indicating that the driver is “qualified only when wearing corrective lenses.” Driver’s employer Appendix B

this page intentionally left blank

FD07254 ｜ 2002_美国_HAR0202.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2002 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Highway Accident Report Collision Between Amtrak Train 97 and Molnar Worldwide Heavy Haul Company Tractor-Trailer Combination Vehicle at Highway-Rail Grade Crossing in Intercession City, Florida, on November 17, 2000 National Transportation Safety Board Washington, D.C. A A N T I O N L T R A S P O R A T I O N B O A R D S A F E T Y N T E

P L U R IB US UN U M

NTSB/HAR-02/02 PB2002-916202

this page intentionally left blank

Highway Accident Report Collision Between Amtrak Train 97 and Molnar Worldwide Heavy Haul Company Tractor-Trailer Combination Vehicle at Highway-Rail Grade Crossing in Intercession City, Florida, on November 17, 2000 NTSB/HAR-02/02 PB2002-916202 National Transportation Safety Board Notation 7480 490 L’Enfant Plaza, S.W. Adopted July 23, 2002 Washington, D.C. 20594

National Transportation Safety Board. 2002. Collision Between Amtrak Train 97 and Molnar Worldwide Heavy Haul Company Tractor-Trailer Combination Vehicle at Highway-Rail Grade Crossing in Intercession City, Florida on November 17, 2000. Highway Accident Report NTSB/HAR-02/02. Washington, DC. Abstract: On November 17, 2000, near Intercession City, Florida, a heavy-haul vehicle, operated by Molnar Worldwide Heavy Haul Company, was delivering a condenser to the Kissimmee Utility Authority Cane Island Power Plant. The private access road to the plant crossed over a single railroad track owned by CSX Transportation, Inc. As the vehicle crossed the tracks, the crossing warning devices activated and the gates came down on the load. Seconds later, Amtrak train 97 collided with the right side of the rear towed tractor. No injuries occurred. The collision destroyed the tractor and caused over $200,000 damage to the train and crossing signals. The following safety issues are discussed in this report. • The ineffective execution of the roles and responsibilities of the power company and its contractors and subcontractors, the Florida Department of Transportation, the motor carrier, the truckdriver, and pilot car drivers in planning and effecting the movement of this oversize load; • The adequacy of the railroad notification requirement; • The consistency and availability of information regarding railroad notification; and • The lack of low-clearance warning signs and standard 1-800 emergency number signs. As a result of this accident investigation, the National Transportation Safety Board issued recommendations to the Federal Highway Administration, the Federal Motor Carrier Safety Administration, the American Association of State Highway and Transportation Officials, the National Committee on Uniform Traffic Laws & Ordinances, the Kissimmee Utility Authority, and all class 1 and regional railroads. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2002-916202 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Highway Accident Report Contents Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Truck Events Preceding the Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Train Events Preceding the Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Damages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Truck Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Train Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Truckdriver Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Pilot Car Drivers/Truck Crew Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Motor Carrier Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Motor Carrier Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Truckdriver Training Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Train Crew Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Railroad Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Accident Site Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Roadway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Grade Crossing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Emergency Signs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Toxicological Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Cane Island Power Park . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Permit Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Florida’s Railroad Notification Requirement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Railroad Grade Crossing Notification Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 CSXT Railroad Notification Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Other Railroad Notification Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 New York’s Permit Policy Regarding Railroad Notification . . . . . . . . . . . . . . . . . . . . 31 Other Kissimmee Utility Authority Oversize/Overweight Shipments . . . . . . . . . . . . . 31 Pertinent Florida State Statutes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Federal Highway Administration’s Contracts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Contents iv Highway Accident Report Past Safety Board Recommendations Regarding Low-Clearance or Slow-Moving Vehicles at Highway-Rail Grade Crossings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Intercession City, Florida—November 30, 1993 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Passive Grade Crossing Safety Study—1998 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Portage, Indiana—June 18, 1998 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Sycamore, South Carolina—May 2, 1995 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Glendale, California—January 28, 2000 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Movement of the Oversize/Overweight Load . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Shipper and Receivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Motor Carrier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Florida Department of Transportation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Truckdriver Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Railroad Notification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Pilot Car Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Adequacy of Uniform Vehicle Code Railroad Notification Requirement . . . . . . . . . . . . . . 44 Adequacy and Consistency of Railroad Notification Requirements and Information . . . 45 Safety of Accident Crossing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Appendixes A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 B: Previous Recommendations Relating to Slow-Moving, Low-Clearance Vehicles at Highway-Rail Grade Crossings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 C: Florida Department of Transportation Brochure and Applicable State Statutes for Railroad Authority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 D: State Railroad Notification Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

v Highway Accident Report Acronyms and Abbreviations AASHTO American Association of State Highway and Transportation Officials ASLRRA American Short Line and Regional Railroad Association BNSF Burlington Northern Santa Fe CDL commercial driver’s license CFR Code of Federal Regulations CP Canadian Pacific CSXT CSX Transportation, Inc. FHWA Federal Highway Administration FLDOT Florida Department of Transportation FMCSA Federal Motor Carrier Safety Administration FRA Federal Railroad Administration FSS Florida State Statute Hz hertz KCS Kansas City Southern KUA Kissimmee Utility Authority Molnar Molnar Worldwide Heavy Haul Company MUTCD Manual on Uniform Traffic Control Devices NCUTLO National Committee on Uniform Traffic Laws & Ordinances NS Norfolk Southern NYDOT New York Department of Transportation OLI Operation Lifesaver, Inc. psi pounds per square inch SC&RA Specialized Carriers & Rigging Association TEi Thermal Engineering International UP Union Pacific

vi Highway Accident Report Executive Summary On November 17, 2000, about 4:35 p.m., eastern standard time, near Intercession City, Florida, a 23-axle, heavy-haul vehicle, operated by Molnar Worldwide Heavy Haul Company, was delivering a condenser to the Kissimmee Utility Authority Cane Island Power Plant. The private access road to the plant crossed over a single railroad track owned by CSX Transportation, Inc. As the vehicle, traveling between 1 and 3 mph, crossed the tracks, the crossing warning devices activated and the gates came down on the load. Seconds later, Amtrak train 97, operated by the National Railroad Passenger Corporation, collided with the right side of the rear towed four-axle tractor. No injuries occurred. The collision destroyed the tractor and caused over $200,000 damage to the train and crossing signals. The National Transportation Safety Board investigated a similar accident that occurred on November 30, 1993, at the same location (Highway Accident Report NTSB/HAR-95/01). In that accident, an overdimenson, low-clearance vehicle operated by Rountree Transport and Rigging, Inc., was en route to deliver an 82-ton turbine to the electricity generating plant. The cargo deck of the transporter bottomed out on the roadway surface as the vehicle moved across the tracks. To gain sufficient clearance, the four-member truck crew shimmed the transporter while the cargo deck was on the tracks. About 12:40 p.m., the lights and bells at the grade crossing activated; the crossing gates descended, striking the turbine. Seconds later, Amtrak train 88, carrying 10 crewmembers and 89 passengers, struck the side of the cargo deck and the turbine. Six people sustained serious injuries and 53 suffered minor injuries. The vehicle and turbine were destroyed; the locomotive and first three railcars were damaged extensively. Total damage exceeded $14 million. The National Transportation Safety Board determines that the probable cause of the November 2000 collision of Amtrak train 97 with the tractor-combination vehicle was the failure of the Kissimmee Utility Authority, its construction contractors and subcontractors, and the motor carrier to provide for the safe passage of the load over the grade crossing. The following safety issues were identified in this accident. • The ineffective execution of the roles and responsibilities of the power company and its contractors and subcontractors, the Florida Department of Transportation, the motor carrier, the truckdriver, and pilot car drivers in planning and effecting the movement of this oversize load; • The adequacy of the railroad notification requirement; • The consistency and availability of information regarding railroad notification; and

vii Highway Accident Report • The lack of low-clearance warning signs and standard 1-800 emergency number signs. As a result of this accident investigation, the National Transportation Safety Board makes recommendations to the Federal Highway Administration, the Federal Motor Carrier Safety Administration, the American Association of State Highway and Transportation Officials, the National Committee on Uniform Traffic Laws & Ordinances, the Kissimmee Utility Authority, and all class 1 and regional railroads. Executive Summary

this page intentionally left blank

1 Highway Accident Report Factual Information Accident Narrative On November 17, 2000, about 4:35 p.m., eastern standard time, near Intercession City, Florida, a 23-axle, heavy-haul vehicle, operated by Molnar Worldwide Heavy Haul Company (Molnar), was delivering an 82-ton condenser to the Kissimmee Utility Authority (KUA) Cane Island Power Plant. The private access road to the electricity- generating facility crossed over a single railroad track owned by CSX Transportation, Inc. (CSXT).1 As the vehicle, traveling between 1 and 3 mph, crossed the tracks, the crossing warning devices activated and the gates came down on the load. Seconds later, Amtrak train 97, operated by the National Railroad Passenger Corporation, collided with the right side of the rear towed four-axle tractor. Amtrak train 97 was traveling approximately 57 mph at the time of the collision. Two train crewmembers and three passengers were taken to area hospitals for observation; no injuries occurred. The collision destroyed the tractor and caused over $200,000 damage to the train and crossing signals. The tractor-combination vehicle and load (see figures 1 and 2) measured 225 feet long, 15 feet 11 inches wide, and 13 feet 6 inches high; ground clearance was 8 inches; and gross vehicle weight was 380,420 pounds.2 The load, valued at $330,000, was being transported from Salt Lake City, Utah, to the KUA power plant. The truckdriver possessed specialized moving permits for the load that required escort vehicles (pilot cars). At the time of the accident, three private pilot cars were escorting the load. Additionally, KUA representatives were present at the site for the delivery of the condenser. The Amtrak train was bound from New York City to Miami, Florida, with 83 passengers and 4 crewmembers on board. 1 “CSXT” is a recognized abbreviation for CSX Transportation, Inc., which is a division of CSX Corporation. 2 A typical tractor-semitrailer is made up of a tractor (18 to 20 feet long) and a semitrailer (40 to 53 feet long), both 8 feet 6 inches wide and 13 feet 6 inches to 14 feet high, which together weigh a maximum of 80,000 pounds.

Factual Information 2 Highway Accident Report Figure 1. Diagram of accident vehicle.

Factual Information 3 Highway Accident Report Truck Events Preceding the Accident The transportation of this oversize/overweight load covered over 2,800 miles through 10 States (see figure 3) and had been under way for 28 days at the time of the accident.3 Employees of the manufacturer, Mark Steel Company, loaded the generator onto the Molnar semitrailers, and the accident driver secured the generator onto the vehicles. On October 20, 2000, the truck left Salt Lake City accompanied by two company pilot cars. The convoy crew comprised the truckdriver, an auxiliary operator who steered the rear of the vehicle when necessary, and the two pilot car drivers. According to the truckdriver, the trip was uneventful until November 9, 2000, when the 1998 Mack tractor being driven had a transmission failure in Mister City, Mississippi.4 The tractor was towed to a repair shop in Memphis, Tennessee. According to the driver’s hours-of-duty service status (logbook), he stayed in Memphis for 3 1/2 days and then returned with a pilot car driver to the Molnar headquarters in Athens, Texas, to get another tractor. On November 12, 2000, he drove the replacement tractor, a 2001 Peterbilt model, to Mississippi. On November 13, 2000, the truckdriver “hooked up” the tractor to the semitrailers and resumed the trip. Figure 1. Photograph of tractor-trailer combination vehicle and load. 3 Safety Board investigators reconstructed the route using the permits issued by the 10 States and the driver’s hours-of-duty status (log books). 4 A truck stop just over the Arkansas border. Figure 2.

Factual Information 4 Highway Accident Report During the remainder of the trip, the combination vehicle was involved in two traffic collisions. On November 13, 2000, in Webster County, Mississippi, the truck struck the left side of a passenger vehicle that was stopped on the opposite side of the road to allow the truck to pass. On November 17, 2000, in Wildwood, Florida, a passenger vehicle was attempting to pass the combination vehicle, tried to move back into the lane behind it, and struck the left side of the semitrailer. According to the truckdriver, the combination vehicle was traveling about 4 mph at the time. The truckdriver estimated that the combination vehicle crossed approximately 15 highway-rail grade crossings, including 3 in Florida, during the trip. The truckdriver also indicated that he did not notify the railroad before traversing these crossings and was not aware that it was a requirement in any of the States through which he had traveled. Of the three crossings in Florida, two on U.S. 27 were protected by active warning devices, including lights, gates, and bells: one in Archer (DOT/AAR # 622512K)5 and the other in Williston (DOT/AAR # 622535S). The third crossing was a passive crossing6 on State Route 44 in Wildwood (DOT/AAR # 625319J). (See figure 4.) He added that if he had to stop to raise the modular-trailer before traversing a crossing, he could cross at a speed between 1 and 3 mph; if the crossing was “smooth,”7 he could cross at 30 mph. The truckdriver indicated that the normal operating speed of the accident vehicle exceeded 10 mph. Figure 2. Map indicating convoy route through States. 5 The Federal Railroad Administration and the American Association of Railroads maintain a highway-rail grade crossing inventory. The crossings are numbered. 6 A passive crossing is equipped with a railroad “crossbucks” sign (R15-1 in the Uniform Manual on Traffic Control Devices). Figure 3.

Factual Information 5 Highway Accident Report Just before the accident, the convoy (combination vehicle and three private pilot cars) was traveling eastbound on Old Tampa Highway and made a left turn onto the private roadway leading up to the KUA Cane Island Power Park. (See figure 5.) The truckdriver stated that to maneuver the vehicle over the highway-rail grade crossing, he stopped and adjusted the vehicle’s cargo deck to its highest position (32-inch ground clearance from a normal 8-inch ground clearance). The truckdriver also stated that because of the combination vehicle’s extensive length, the convoy spent a “considerable amount of time” in the intersection attempting to make the left turn. The unique configuration and length of the combination vehicle required an auxiliary operator who was responsible for steering the combination vehicle’s rear. (A control station located at the trailer’s rear [see figure 1] enabled the auxiliary operator to steer and to regulate the load’s height.) The convoy stopped to avoid a guide wire for a utility pole in the southwest corner. The truckdriver had to back up and move forward while the auxiliary driver steered the trailer around the guide wire. Crewmembers also removed a stop sign located at the northwest corner of the intersection. (See figure 6.) Once the trailer was properly aligned, the truckdriver proceeded to cross the tracks without stopping.

7 A Safety Board investigator drove the Florida permitted route and estimated that the three grade crossings were on level ground. Figure 3. Map indicating highway-rail grade crossing locations traversed by combination vehicle. Figure 4.

Factual Information 6 Highway Accident Report Figure 4. Schematic of accident site. Figure 5.

Factual Information 7 Highway Accident Report The auxiliary operator stated that as the center portion of the trailer traversed the crossing, the frame rails scraped the surface of the roadway. (See figure 7.) The vehicle did not hang up on the crossing. Convoy crewmembers stated that the crossing lights flashed and the bell activated. The auxiliary operator observed a train approaching from the east and then heard the train horn. The vehicle had not yet cleared the crossing, and the auxiliary operator notified the truckdriver by radio of the approaching train. The auxiliary operator then jumped from the rear control station. The train struck and sheared off the pusher truck tractor, which was located directly behind the rear control station. (At the time of the accident, this truck tractor was being towed.) The rear portion of the trailer swung toward the east, left the paved surface of the roadway, and struck a concrete stanchion supporting an electrical tower, where it came to rest. The truckdriver stated that he proceeded across the tracks at 1 mph until the auxiliary operator notified him of the approaching train. He attempted to change gears in an effort to increase speed to 3 mph, and he believed he was in fourth gear-low when the train struck the combination vehicle. Figure 5. Photograph indicating utility pole guide wire and stop sign. Figure 6.

Factual Information 8 Highway Accident Report Figure 1. Accident grade crossing profile showing where trailer scraped pavement. Figure 7.

Factual Information 9 Highway Accident Report Train Events Preceding the Accident According to the train crew, the 168-mile trip from Jacksonville, Florida, was uneventful before the accident. The engineer stated that as the train approached milepost 816, he observed highway traffic stopped on the parallel roadway (Old Tampa Highway). He became concerned that something was wrong at the next grade crossing (accident crossing), which was out of sight beyond a curve to the left. He said that he thought that automobiles might be stopped on the crossing due to an accident. He was also aware of the 1993 highway-rail grade crossing accident8 at the entrance to the power plant. The engineer made a service application of the train brakes and sounded numerous short blasts on the locomotive horn. The engineer stated that he looked through the trees on the left side of the track and saw a large red truck, moving in the direction of the crossing, which he thought might be near the crossing. The engineer said that he made an application of the train brakes before he could directly see the crossing or the truck on the crossing, and locomotive event recorder data indicated that the engineer began braking about 1,592 feet before the crossing. Postaccident laser transit mapping of the area showed that an unobstructed view of the crossing did not become available until about 1,152 feet before the crossing. With the train in emergency braking, the engineer saw that the truck was moving slowly on the crossing as the locomotive came out of the curve. The engineer stated that he and the assistant engineer, believing a collision was imminent, got onto the cab floor and braced for the impact. After the collision, the locomotive and all train cars remained upright on the rail, and the train remained coupled. After the train came to a stop, the engineer used the CSXT emergency “tone 9” radio procedure to contact the CSXT train dispatcher. Emergency Response The CSXT train dispatcher contacted the CSXT Police Communications Center, which contacted the local emergency services. All crewmembers indicated that emergency responders arrived at the accident scene quickly. The Osceola County (Florida) emergency services were notified of the accident at 4:40 p.m. The Osceola County Sheriff’s Department dispatched 16 officers and 2 Florida Highway Patrol police vehicles. The fire department dispatched three fire engines, seven ambulances, two hazardous materials specialty units, five staff/supervisors, and two service vehicles (one with portable light towers and one food service truck). The first law enforcement officer arrived at 4:47 p.m.; three fire department vehicles and the first ambulance arrived at 4:52 p.m. 8 National Transportation Safety Board, Collision of Amtrak Train No. 88 With Rountree Transport and Rigging, Inc., Vehicle on CSX Transportation, Inc., Railroad Near Intercession City, Florida, November 30, 1993, Highway Accident Report NTSB/HAR-95/01 (Washington, DC: NTSB, 1995).

Factual Information 10 Highway Accident Report Two emergency medical technicians boarded the locomotive and examined the engineer and assistant engineer. Emergency medical technicians also searched the train cars for injured passengers. One passenger fell as the train passengers were being evacuated and was transported to an area hospital. The Osceola County Fire Chief reported that of the 83 passengers and 4 crewmembers on the train, 3 were transported to area hospitals for observation. At 5:05 p.m., firefighters requested that power to the train be turned off. Hazardous materials units cleaned up approximately 600 gallons of spilled diesel fuel. The fire department officially completed its duties at 3:42 a.m. on November 18, 2000, and departed the accident site. The Osceola County Fire Chief stated that the Osceola County Fire Department has a railway plan that specifically addresses railway transportation accidents. He further indicated that the response plan was written in the early 1990s and has not been updated. Injuries No injuries occurred as a result of this accident. (See table 1.) Table 1. Injuries. Damages The collision resulted in moderate damage to the locomotive (see figure 8) and brake rigging damage to the baggage car. The pusher tractor was destroyed. (See figure 8a.) (See table 2.) Table 2. Damages. Injuries Truckdriver Convoy crew Train crew Train passengers Total None 1 4 4 83 92 Total 1 4 4 83 92 Equipment Amount Locomotive and baggage car $125,000 Signal and crossing warning devices $ 77,000 1993 Peterbilt tractor (pusher tractor) $ 25,000 Total $227,000

Factual Information 11 Highway Accident Report Figure 6. Amtrak locomotive after collision. Figure 7. Rear view of pusher tractor after collision. Figure 8. Figure 8a.

Factual Information 12 Highway Accident Report Truck Information The 23-axle tractor-combination vehicle consisted of a truck tractor, a heavy-haul trailer, and a pusher tractor. (See figure 1.) The 4-axle tractor was a 2001 Peterbilt equipped with a Caterpillar 600 horsepower diesel engine and an Eaton/Fuller 18-speed transmission. The 15-axle, 2000 model heavy-haul trailer, manufactured by Diamond Trailers, Inc., of Shandon, Ohio, consisted of a three-axle “jeep”;9 a three-axle “wing dolly;” a cargo deck (attached to the wing dollies by hydraulic towers [lift station]); a six-axle “steerable dolly,” which contained a 25-horsepower motor and hydraulic pump to steer the unit and the operator’s control platform; and another three-axle wing dolly. The four-axle rear pusher tractor was a 1993 Peterbilt equipped with a concrete counterweight that was attached to the tractor’s fifth wheel by a kingpin. The counterweight was approximately 8 feet by 9 feet 6 inches high, with an 18-inch-high steel cage on top for storage. The tractor weighed about 23,000 pounds and the counterweight weighed about 20,000 pounds. The normal operating height of the cargo deck was 8 inches; the deck could be elevated an additional 24 inches to provide a total ground clearance of 32 inches. The vehicle’s measured length was: tractor (22 feet), trailer (168 feet), tow bar (6 feet), and pusher tractor (29 feet). The normal operating speed of the combination vehicle was greater than 10 mph. No mechanical deficiencies were noted on the truck-tractor combination vehicle during the Safety Board’s postaccident inspection. The 1993 Peterbilt tractor was extensively damaged following impact with the Amtrak locomotive. The right front tire/wheel and the suspension of the rearmost three-axle steerable dolly were damaged when the dolly struck the concrete base of a utility pole. The counterweight separated from the tractor at impact and struck the Amtrak locomotive in the front between the headlight and coupler device. Train Information The 10-car train was powered by a single P-42 locomotive10 AMTK 65 and consisted of Heritage baggage car 1242; dorm lounge 2505; Amtrak Viewliner sleepers 62035 and 62026; Heritage diner 8509; Amfleet lounge 28007; and Amfleet 59-passenger coaches 25070, 25037, 25106, and 25060. The train, including the locomotive, was about 904 feet long. 9 The term jeep denotes various configurations of long-frame and short-frame dollies when they are combined to accommodate the weight of a load. A jeep dolly unit is usually positioned at each end of the cargo bed. 10 General Electric Transportation Systems manufactured the P-42 in Erie, Pennsylvania, in 1997.

Factual Information 13 Highway Accident Report Truckdriver Information The 46-year-old truckdriver held a valid Texas class A commercial driver’s license (CDL) with endorsements11 for tank vehicles and vehicles required to be placarded for hazardous materials. (No special endorsement was required for the accident vehicle.) His CDL contained corrective lens restrictions. His valid medical certificate was due to expire May 6, 2002. His 5-year driving record indicated no traffic collisions and two traffic violations. Both violations, failure to obey a traffic control device in Michigan (August 21, 1998) and speeding in Georgia (April 22, 2000), were while operating a commercial vehicle. The truckdriver began working for Molnar in December 1998. His employment application listed five previous employers for whom he had operated heavy-haul vehicles from 1995 to 1998. Before 1995, he owned his own trucking business (Bartles, Inc.). According to the truckdriver, he had 27 years of truck driving experience, including 18 years in heavy-haul driving. Since working for Molnar, he had been subject to one random drug screen on November 19, 2000, with negative results. The Safety Board reviewed the driver’s logbook. The entries for 30 days before the collision indicated no violation of the hours-of-service rules under 49 Code of Federal Regulations (CFR) 395. He said that he had driven the accident combination vehicle (tractor and semitrailers) on “several” other occasions. Pilot Car Drivers/Truck Crew Information At the time of the accident, three pilot cars were part of the convoy. An auxiliary driver was operating the controls at the rear of the semitrailer. A driver from Larry’s Escort Service was the lead pilot car driver during the trip from the Florida/Georgia border to the accident site. Molnar hired him when the convoy reached the border and Florida Office of Motor Carrier Compliance Weight Enforcement Program officials found that one of two Molnar pilot car drivers escorting at the time did not have Florida pilot car certification. The lead pilot car driver stated that he had been in the pilot car business for 2 years and had completed the Florida certification course.12 That course did not cover railroad notification. He led the convoy over three other highway-rail grade crossings in Florida but did not notify the railroad prior to any of the crossings. He stated that he was unaware of the Florida requirement that vehicles in a certain configuration contact the railroad before crossing the tracks (Florida State Statute [FSS] 11 Under 49 Code of Federal Regulations 383.93, the endorsements for a commercial driver’s license include (1) double/triple trailers, (2) passenger-carrying vehicles, (3) tank vehicles, or (4) vehicles required to be placarded for hazardous materials. 12 The Florida pilot car certification program consisted of completing an 8-hour defensive driving class and an 8-hour pilot/escort driving class. The University of Florida Transportation Safety Transfer Center administered a test.

Factual Information 14 Highway Accident Report 316.170). He said he had escorted “numerous” loads over railroad tracks and had never known of the railroad being notified by the transporting company or of the railroad sending a flagger to permit the vehicle and load to cross the tracks. At the time of the collision, the lead pilot car driver was performing traffic control functions as the combination vehicle negotiated the turn onto the grade crossing. A full-time Molnar employee operated a Molnar pilot car (pickup truck) during the accident trip from Utah to Florida. She had pilot car certificates from Virginia, Utah, Colorado, Kansas, Florida, and Oklahoma. She also had a valid Texas class A CDL and occasionally drove the second tractor during this trip. A second full-time Molnar pilot car driver, who has since left the company, also operated a pilot car. He held pilot car certificates from Colorado and Kansas and was driving a pilot car at the time of the collision. He was not performing pilot car functions because he did not have Florida pilot car certification. Another Molnar employee (the auxiliary driver) was operating the hydraulic levers at the rear of the semitrailer that activate the ground clearance devices for the semitrailers and the steerable dolly. A permanent resident of Budapest, Hungary, he was the nephew of the owner and was staying with his uncle on a work visa. He had a valid international truckdriver’s license but did not drive a truck during this trip. He has returned to Hungary. Motor Carrier Information Molnar, headquartered in Athens, Texas, was registered with the Federal Motor Carrier Safety Administration (FMCSA) as an interstate carrier of general freight (machinery and oversize/overweight objects). The owner started the company in 1973. For the first 24 years, the company leased itself to other transporters; in 1996, it began independent operations. Molnar employed eight full-time drivers and operated a fleet of 17 trailers and semitrailers and 13 power units (tractors). The company also owned three pickup trucks used in pilot car operations. It employed one full-time mechanic, who had been with the company for 15 years. According to the Molnar Safety Director, the company hired only drivers that were experienced in heavy hauling. The safety director provided the following information about Molnar operations. Drivers were paid by the week. They were required to stay in a motel each night while on the road and given $45 per diem for the expense. The company experienced a 50-percent driver turnover rate each year due to the stress of long absences from home and the difficult work of driving and securing the loads. Most of the remaining Molnar truckdrivers had been employed for more than 10 years. The company did not have a formal training program for its drivers. It evaluated new drivers by sending an experienced driver with them for a few weeks to determine how they drove the vehicles. Safety information was passed along periodically to individual drivers at the home terminal.

Factual Information 15 Highway Accident Report Motor Carrier Oversight The FMCSA conducted two compliance reviews on Molnar. The first, on July 21, 1999, resulted in a “Satisfactory” rating. On February 17, 2001, after the accident, the FMCSA conducted a second compliance review, which also resulted in a “Satisfactory” rating. The remarks section of part C of the compliance review, dated February 27, 2001, stated: Molnar received Permit #033803 from the Florida Department of Transportation [FLDOT] to transport an oversize/overweight load (based on the carriers description of the load and vehicle). Item one of the permit specified, “Movement shall be in compliance W/FS 316.08, 316.170 & F.A.C. 14-26.” Molnar explained that before entering Florida, it attempted to find out what the item one statement meant by calling its permitting service, State Permit of Canton, Ohio. (Note: Molnar did not receive the Florida permit through State Permit, but rather directly from the FLDOT. State Permit could not secure this permit for Molnar because of the size of the load.) Molnar called his permitting service instead of the FLDOT because they were easier to get a hold of and they had provided Molnar with reliable information for over 10 years. Molnar said that State Permit advised them that FSSs 316.08 and 316.170 pertained to Molnar giving “truthful information about the load dimensions and description.” After the collision with the train, Molnar was advised by the Florida Highway Patrol that these statutes actually required Molnar to notify an authority of the railroad of an intended crossing so that the railroad could provide proper protection at the crossing. Molnar was subsequently cited for the violation and fined by the governing jurisdiction of the location of the crash. In the February 2001 review, the FMCSA cited the company for violating 49 CFR 392.2 – Violating a Local Law or Ordinance, specifying FSS 316.170, which pertained to large vehicles crossing railroad tracks. According the safety director, Molnar was appealing this citation. The SAFER report,13 dated June 2, 2001, indicated that the company had a vehicle out-of-service rate of 23.4 percent (national average is 25.4 percent) and a driver out-of- service rate of 7.5 percent (national average is 8.2 percent). Molnar had three reportable collisions in the previous 24 months (two injury and one tow away). Truckdriver Training Module The development of a truckdriver training tool is the subject of discussions between the FMCSA Southern Service Center and the Federal Railroad Administration (FRA) Office of Safety in Atlanta, Georgia. According to FMCSA and FRA officials, they plan to develop a brochure, video, or Web site that addresses the dangers of grade crossings and the new FMCSA regulations regarding disqualification for highway-rail grade crossing violations. The new regulations, found in subpart D–Driver Disqualifications and Penalties (49 CFR 383.51), list six disqualifying offenses at 13 The SAFER report was created by the Federal Motor Carrier Safety Administration to provide basic carrier information for the public. Access is through or .

Factual Information 16 Highway Accident Report highway-rail grade crossings. The regulations at section (vi), “For all drivers, failing to negotiate a crossing because of insufficient undercarriage clearance,” state that the first violation carries a 60-day disqualification, the second violation within a 3-year period carries a 120-day disqualification, and the third violation within a 3-year period carries a disqualification penalty of at least 1 year. This regulation becomes effective October 2002. Train Crew Information The train crew consisted of an engineer, an assistant engineer, a conductor, and an assistant conductor, all of whom were regularly assigned to Amtrak train 97. Each crewmember was qualified on the route over which train 97 operates. The engineer and assistant engineer met the requirements of Federal regulations for certified locomotive engineers and were in possession of the current CSXT Operating Bulletin and the CSXT Job Briefing Checklist, which was completely filled out. The train was operating under CSXT Train Bulletin 18803. Railroad Information Amtrak operates six scheduled passenger trains daily, including holidays, on the CSXT Sanford Subdivision. Four trains (New York City to Miami) operate over the accident crossing. Two originate or terminate in Orlando, which is north of the crossing. These trains usually contain the same number of cars and similar equipment. According to the DOT-AAR Highway-Rail Grade Crossing Inventory, 10 freight trains also operate over the crossing daily. Accident Site Information Roadway The accident occurred on KUA Power Road (also known as Bobroff Road), which is a rural, private access, undivided, 22-foot-wide, two-lane, asphalt roadway about 3 miles northwest of the Intercession City city limits. On April 26, 1993, KUA entered into an agreement with CSXT to provide access to its new combustion turbine power plant. The agreement enabled KUA to construct, use, and maintain a private road from Old Tampa Highway across the CSXT track and right of way to the power plant. According to the agreement, CSXT installed active warning devices at the grade crossing. KUA Power Road opened on August 5, 1993, and is the only entrance into the power plant.

Factual Information 17 Highway Accident Report The November 1993 Intercession City accident14 involved a 184-foot-long vehicle, loaded with an 82-ton turbine, which was stopped on the private crossing while the crew was raising the height of the cargo deck. An Amtrak train carrying 89 passengers struck the side of the cargo deck and the turbine. Six people sustained serious injuries, and 53 people suffered minor injuries. Damages exceeded $14 million. Investigators found that the carrier had not notified the railroad of its intent to cross the track before the accident. The crossing active warning devices included railroad crossbucks signs, a bell, flashing light units, and two reflectorized gates, which were approximately 11 feet from the north and south edges of the track. The pavement markings included a series of 4-inch- wide broken reflectorized yellow lines, which separated the northbound and southbound lanes, and 3-inch-wide solid reflectorized white edge lines. In addition, about 20 feet north and south of the grade crossing were two 12-inch-wide solid white stop bars. The pavement markings did not show any irregularities and met the line width and space requirements of the Manual on Uniform Traffic Control Devices (MUTCD).15 A stop sign was at the northwest corner of the intersection of KUA Power Road and Old Tampa Highway. The DOT-AAR Highway-Rail Grade Crossing Inventory16 estimated the average daily traffic count at 11 vehicles, 6 percent of which were estimated to be trucks. According to KUA, 30 employees worked at the plant. The posted speed limit on the private roadway was 35 mph. The maximum authorized track speed was 79 mph for passenger trains and 60 mph for freight trains. Grade Crossing The centerline of the active grade crossing (DOT No. 643879N) was 111 feet north of the north edge of Old Tampa Highway and 350 feet south of the gate into the KUA power plant. The northbound approach grade was 3.3 percent, and the departure grade was -4.5 percent. The superelevation at the crossing was 5.36 percent. At a point 30 feet from the south rail, the roadway was 2.53 inches above the plane of the crossing. At a point 30 feet from the north rail, the roadway was 6.34 inches below the plane of the crossing. (See figures 9 and 10.) When built in 1993, the grade crossing was within the American Association of State Highway and Transportation Officials (AASHTO) guidelines. The American Railroad Engineering Association guideline and the 1990 edition of the AASHTO guidelines for roadway vertical profiles at highway-rail grade crossings17 state: 14 NTSB/HAR-95/01. 15 The Manual on Uniform Traffic Control Devices is approved by the Federal Highway Administration as the standard for all streets and highways in accordance with 23 United States Code sections 109 (b), 109 (d), 402 (a) and 23 Code of Federal Regulations 1204.4. 16 Accessed November 28, 2000, and December 12, 2001. 17 A Policy on Geometric Design of Streets and Highways, American Association of State Highway and Transportation Officials, 1990, adopted as a Federal Highway Administration standard in April 1993 at 23 Code of Federal Regulations 625.4.

Factual Information 18 Highway Accident Report Acceptable geometrics necessary to prevent drivers of low-clearance vehi- cles from becoming caught on the tracks would provide the crossing sur- face at the same plane as the top of the rails for a distance of 2 feet outside the rails. The surface of the highway should also not be more than 3 in. higher nor 6 in. lower than the top of the nearest rail at a point 30 feet from the rail unless track superelevation dictates otherwise. Figure 8. Photograph of accident highway-rail grade crossing. Figure 9. Photograph of accident highway-rail grade crossing. Figure 9. Figure 10.

Factual Information 19 Highway Accident Report In April 2001, AASHTO revised its guidelines18 for roadway vertical profiles at rail grade crossings. They now state: In some instances, the roadway alignment may not meet acceptable geometrics for a given design speed because of restrictive topography or limitations of right-of- way. To prevent drivers of low-clearance vehicles from becoming caught on the tracks, the crossing surface should be at the same plane as the top of the rails for a distance of 0.6 meter (2 feet) outside the rails. The surface of the highway should also not be more than 75 millimeters (3 inches) higher or lower than the top of nearest rail at a point 9 meters (30 feet) from the rail unless track superelevation makes a different level appropriate as shown in figure 6. [See figure 11.] Vertical curves should be used to traverse from the highway grade to a level plane at the elevation of the rails. Rails that are superelevated, or a roadway approach section that is not level, will necessitate a site-specific analysis for rail clearances. Based on the 2001 guidelines, the crossing is a humped crossing.19 Because it was built in 1993, it is not required to conform to the current guidelines. (See figure 11.) 18 A Policy on Geometric Design of Highway and Streets, Fourth Edition, American Association of State Highway and Transportation Officials, 2001. 19 The Manual on Uniform Traffic Control Devices refers to humped crossings as highway profile conditions sufficiently abrupt to create a “hang–up” situation for long wheelbase vehicles or low-ground clearance trailers. Figure 10. Schematic illustrating AASHTO guidelines and accident grade crossing profile. Figure 11

Factual Information 20 Highway Accident Report Emergency Signs Metal emergency call number signs, approximately 12 by 6 inches, were mounted on each crossing gate vertical pole. (See figures 12 and 13.) Figure 11. Photograph of metal emergency call number sign. Figure 12. Photograph of metal emergency call number sign. Figure 12. Figure 13.

Factual Information 21 Highway Accident Report According to CSXT, the signs were installed in 1997. The signs read as follows: CSX TRANSPORTATION TO REPORT STALLED VEHICLE BLOCKING CROSSING OR OTHER EMERGENCY CALL 1-800-232-0144 Ref. Crossing - ID #643 879N Located at mile post A 816.27 Until the 2000 edition, the MUTCD provided no guidance for emergency call number signs. Signs I-13 and I-13a, created in response to Safety Recommendation H-96- 003 (see appendix B), were authorized in January 2001 and are required to have a blue background with white lettering. (See figure 14.) According to the Federal Highway Administration (FHWA) Office of Transportation Operations, the size criteria for sign I-13 are 29.5 inches high and 29.5 inches wide and for sign I-13a, 17.7 inches high and 29.5 inches wide. No criteria for placement have been developed. Signals The crossing was equipped with gates, eight 12-inch diameter flashing lights, and a bell. The warning devices were controlled by a Harmon phase motion detector designed to provide a minimum of 25 seconds of warning time for trains traveling at the maximum authorized speed of 79 mph. The north approach track circuit (for southbound trains) extended approximately 3,356 feet from the center of the crossing and was terminated with a narrow band shunt (326 hertz [Hz]). A whistle board was positioned by the wayside, approximately 1,898 feet from the center of the crossing. The south approach track circuit (for northbound trains) extended approximately 3,344 feet from the center of the crossing and was also terminated with a narrow band shunt (326 Hz). A whistle board for northbound trains was positioned 2,186 feet from the center of the crossing. (See figure 15.) Figure 13. Signs I-13 and I-13a. TO REPORT STALLED VEHICLE ON TRACK OR OTHER EMERGENCY CALL 1-XXX-XXX-XXXX AND REFER TO CROSSING #XXX-XXXX ON STREETNAME RD REPORT EMERGENCY TO 1-XXX-XXX-XXXX CROSSING #XXX-XXXX ON STREETNAME ROAD I-13 I-13a Figure 14

Factual Information 22 Highway Accident Report Track The CSXT Sanford Subdivision of the Jacksonville Service Lane was predominately a single-track main line with passing sidings. The track structure consisted of 122-pound continuous welded rail laid in 1988. At the grade crossing, the track had a grade of 0.07 percent, descending to the south, with a 1-degree left curve and 3 inches of elevation (5.36-percent superelevation). CSXT maintains the track to meet FRA Class 4 Track Safety Standards. The last track inspection before the accident occurred earlier on the day of the accident. The inspection records did not show any defects or conditions that required repair or slow orders. Toxicological Tests The truckdriver was not tested for alcohol and drugs until 36 hours after the accident.20 The Molnar Safety Director stated that the regulatory time limits were not met because a testing facility that had a drug testing kit21 could not be located near the accident site. (Molnar drivers are now required to carry a drug testing kit in their vehicles.) The truckdriver’s toxicological test results were negative for alcohol and drugs. Under 49 CFR 219.201 (B), the train crew was not tested, nor were they required to be tested. Train crews are not normally tested as a result of highway-rail grade crossing collisions. Figure 14. Crossing signals. 20 Under 49 Code of Federal Regulations 382.303, a driver shall be tested for alcohol within the first 2 hours and for drugs within the first 32 hours after a qualifying incident. Testing is required when a traffic collision occurs involving a commercial motor vehicle that results in (1) fatality, (2) an injury requiring treatment away from the scene, and (3) the truckdriver receives a citation by the police, or (4) a vehicle sustains damage requiring it to be towed from the scene. 21 A drug testing kit includes the required items for conducting a drug test, such as a sterile specimen bottle, tamperproof seals, and shipping container. (See 49 Code of Federal Regulations 40.49 and 40 Subpart E.) Figure 15

Factual Information 23 Highway Accident Report Tests and Research After the accident, the Safety Board conducted operational tests on the active crossing traffic control devices (signals, bells, lights, and gates) and found no anomalies.22 The north approach circuit measured 3,356 feet. The testing showed that trains traveling at the maximum authorized speed of 79 mph would take 29 seconds to traverse the approach circuit and occupy the crossing. The train detection equipment required approximately 3 to 4 seconds to recognize an approaching train and activate the warning devices. This configuration provided a minimum warning time of 25 seconds before the arrival of a train at the crossing. Slower trains received longer warning times. Train locomotive 65 had a Pulse Integrated Function Control solid-state recorder (part number 17853B and serial number 0172201). Amtrak personnel downloaded the recorder in the presence of Safety Board investigators, and the floppy diskette was loaded into the Safety Board rail recorder readout station for further study. The data from the recorder indicate that at recorder time 16:39:53 the train speed was 76 mph, the airbrake pressure was 110 pounds per square inch (psi), the brake cylinder pressure was 0 psi, the independent brake was released, the throttle position was 5, the horn was on and was intermittent throughout the rest of the accident trip, the bell was on, the pneumatic control switch was closed, and the airbrake handle was in the released position. At 16:39:54, the airbrake handle was placed into the minimum application position. At 16:39:55, airbrake pressure decreased to 109 psi, and the airbrake handle was placed into the suppression position. Between 16:39:54 and 16:40:01, airbrake pressure decreased from 110 psi to 0 psi. At 16:39:57, the throttle position changed from 5 to idle. At 16:39:59, the train speed was 74 mph, the brake cylinder pressure changed from 0 psi to 1 psi, the engineer-induced emergency was activated, and the airbrake handle was placed in the emergency position. At 16:40:00, the pneumatic control switch was opened. Between 16:39:58 and 16:40:04, the brake cylinder pressure increased from 0 psi to 90 psi. At 16:40:02, the throttle position changed from idle to dynamic/idle. Between 16:39:59 and 16:40:09, the train speed decreased from 74 mph to 57 mph. All further speed data indicate a train speed of 0 mph. Other Information Cane Island Power Park The KUA Cane Island Power Park in Intercession City is owned by the KUA and the Florida Municipal Power Agency. The 1,027-acre facility currently has three power generation units. Construction for units one and two started in May 1993 (cost $121 million) and commercial operation began in January and May 1995, respectively. 22 See 49 Code of Federal Regulations 234.223, “Gate Arm,” and 49 Code of Federal Regulations 234.22, “Activation of Warning System,” for the operating standards.

Factual Information 24 Highway Accident Report Construction for unit three started in October 1999 (cost $136 million) and commercial operation began in June 2001. KUA contracted with Black & Veatch23 to serve as architect-engineer and construction manager for both construction projects. The November 30, 1993, and November 17, 2000, accidents involved oversize/overweight loads that were part of the construction process. After the 1993 accident, according to a May 7, 2002, e-mail from KUA, the following changes were made to its procedures: KUA, by contract, requires that suppliers of equipment to the site observe and comply with all applicable laws, including state and federal statutes. Suppliers are also required to obtain all licenses and permits necessary to the performance of their work under the contract. Additionally, KUA, through its Site Manager, Black & Veatch, established a construction management system which required all suppliers to provide to the Site Manager production, scheduling, and shipment information for all equipment to be delivered to the site. Finally, KUA, through its Site Manager, Black & Veatch, contacted the supplier prior to delivery, in order to ensure that all necessary permits, including the CSX crossing permit, had been obtained by the supplier and/or its transport company prior to delivery of the equipment to the site. Black & Veatch was informed that all permits necessary for delivery of the equipment to the site had been obtained. The generator involved in the November 17, 2000, accident was built by Mark Steel, Salt Lake City, Utah, and later installed by Thermal Engineering International (TEi), Joplin, Missouri. TEi hired Molnar to haul the generator from Salt Lake City to the construction site. Safety Board investigators found that TEi and Molnar disagreed with one another about whether they exchanged information on railroad notification requirements; the fact is that no one notified the railroad. Permit Information Molnar obtained specialized moving permits from 10 States: Utah, Wyoming, Colorado, Kansas, Oklahoma, Arkansas, Mississippi, Alabama, Georgia, and Florida. Molnar used State Permits Company, Akron, Ohio, a private permit service, for the Georgia and Mississippi permits24 and obtained the remaining permits directly from the 23 According to facsimile letter from Black & Veatch senior attorney, dated April 30, 2002: The “contract between KUA and Black & Veatch” began as a contract between Black & Veatch, Engineers- Architects and the City of Kissimmee, Florida, dated January 17, 1984. In October of 1985, Kissimmee Utility Authority assumed all of the City of Kissimmee’s rights and responsibilities under the Contract. On February 12, 1998, Black & Veatch, Engineers-Architects was dissolved and all services under the contract were assigned to Black & Veatch LLP. On January 1, 1999, all of Black & Veatch LLP’s interest and obligations under the contract were assigned to Black & Veatch Corporation. Therefore, the contract is currently between KUA and Black & Veatch Corporation. The contract is in the form of a “Contract for Engineering Services,” under which Black & Veatch Corporation was to act as the owner’s engineer and perform construction management. Under the contract, Black & Veatch Corporation had no contractual responsibility for on-site safety. 24 Private permit services are often used to obtain permits by transporters moving loads interstate when the permit process is complicated or the transporting company is unfamiliar with the permitting process for a particular State.

Factual Information 25 Highway Accident Report other eight States. Each permit specified the authorized routes, dates, and times for movement of the load. (Table 3 shows the date of issue, maximum dimensions, and fees for the 10 State permits; the size and weight information listed on the permits are maximum allowable dimensions and may not be actual vehicle/load dimensions.) Table 3. Permit information. Florida’s Railroad Notification Requirement Some States, including Florida, require that slow-moving (less than 10 mph) or low-clearance (8 to 9 inches) vehicles notify railroads before crossing their tracks. FSS 316.170 states: State Date of issue Maximum dimensions Fee Utah Permit number 028139223 October 11, 2000 Length - 189 feet Width - 15 feet 11 inches Height - legal* Weight - 375,000 pounds $450 Wyoming** Permit number 083010107546 October 21, 2000 Length - not specified Width - not specified Height - not specified Weight - not specified $3,723.07 Colorado Permit number S065427 October 13, 2000 Length - 188 feet 2 inches Width - 15 feet 11 inches Height - legal Weight - 357,000 pounds $127 Kansas Permit number 00065322 October 18, 2000 Length - 188 feet 2 inches Width - 15 feet 11 inches Height - 13 feet 6 inches Weight - 355,000 pounds $5 Oklahoma Permit number 2000 111571 October 24, 2000 Length - 188 feet Width - 15 feet 11 inches Height -13 feet 6 inches Weight- 355,000 pounds $1,367 Arkansas Permit number 80022 October 27, 2000 Length - 188 feet Width - 15 feet 11 inches Height - legal Weight - 355,000 pounds $2,849 Mississippi Permit number K344959 November 11, 2000 Length - 188 feet 2 inches Width - 15 feet 11 inches Height - 13 feet 6 inches Weight - 355,000*** $3,997.50 Alabama Permit number 044128 November 14, 2000 Length - 188 feet 2 inches Width - 15 feet 11 inches Height - 13 feet 6 inches Weight - 183,997.8 pounds $110 Georgia Permit number S171243 November 15, 2000 Length - 230 feet Width - 15 feet 11 inches Height - not specified Weight - 405,000 pounds $500 Florida Permit number MB033803 November 15, 2000 Length - 189 feet Width - 16 feet Height - legal Weight - 355,000 pounds $195 *A legal designation for height indicates the vehicle/load is under the State maximum height requirement. **Issued at the Evanston Port of Entry. ***The vehicle was weighed without the second tractor attached at a Mississippi State inspection facility, which showed a gross weight of 337,420 pounds. The vehicle was inspected and weighed only this time during the trip.

Factual Information 26 Highway Accident Report No person shall operate or move any crawler-type tractor, steam shovel, derrick, or roller, or any equipment or structure having a normal operating speed of 10 or less miles per hour or a vertical body or load clearance of less than 1/2-inch per foot of the distance between any two axles or in any event of less than 9 inches, measured above the level surface of a roadway, upon or across any tracks at a railroad grade crossing without first complying with this section. Notice of any such intended crossing shall be given to a station agent or other proper authority of the railroad, and a reasonable time shall be given to the railroad to provide proper protection at the crossing. Before making any such crossing the person operating or moving any such vehicle or equipment shall first stop the same not less than 15 feet nor more than 50 feet from the nearest rail of the railroad and while so stopped shall listen and look in both directions along the track for any approaching train and for signals indicating the approach of a train, and shall not proceed until the crossing can be made safely. The Florida ordinance was modeled on the Uniform Vehicle Code, Section 11-703, published by the National Committee on Uniform Traffic Laws and Ordinances (NCUTLO).25 According to the “Forward” of the 1987 edition of the Uniform Vehicle Code,26 the set of motor vehicle laws was first published in 1926 and was designed and advanced as a comprehensive guide or standard for State motor vehicle and traffic laws. The NCUTLO general counsel said that the railroad notification model law has been in effect for more than 30 years and no information is available concerning the history of the law or how vehicle speed and ground clearance criteria were first determined. The only information on the Florida permit regarding railroad notification requirements was a statement that the “movement shall be in compliance with W/FS 316.08, 316.170, and F.A.C. rule 14-26.” Neither the text of the referenced statutes was on the permit (or on an attachment) nor was a telephone number listed for contacting the railroad. According to the Molnar Safety Director, the company made several attempts to determine the text of these sections. Molnar called the permit office of the FLDOT and the CSXT and stated that it was unable to get any information from either source. According to Molnar, one agency told the company “go look it up in the local library.” Safety Board investigators called several FLDOT offices (permit, highway, and railroad) and were unable to obtain information regarding the Florida railroad notification requirement. The Safety Board’s report of the investigation of the November 30, 1993, accident in Intercession City found that when FLDOT issues permits, “it does not advise applicants that Florida law requires operators of certain low-clearance vehicles to provide railroads with advance notification of the applicant’s intent to travel over grade crossings.” The Safety Board recommended that AASHTO encourage the States to revise their permit 25 The National Committee on Uniform Traffic Laws and Ordinances is a private, nonprofit membership organization dedicated to providing uniformity of traffic laws and regulations. Reference: . 26 Uniform Vehicle Code and Model Traffic Ordinance 1987, National Committee on Uniform Traffic Laws and Ordinances, Evanston, Illinois.

Factual Information 27 Highway Accident Report documents to state that compliance with this notification requirement is a condition of permitting. On June 28, 1996, Florida revised its permit form to include the reference to the applicable statute. In addition, the FLDOT Railroad Division published the brochure Florida Department of Transportation Low-Clearance Information – Don’t Get Hung Up On The Tracks.27 The brochure lists the railroad contact telephone numbers and emergency police and highway patrol telephone numbers and also includes the text of FSS 316.170. A FLDOT Railroad Division representative said that the brochure was provided to permit applicants through the FLDOT permit office. According to a representative of the FLDOT permit office, the brochure was available at one time only, some time before 1997, and, not being in stock, is not sent to permit applicants. This representative also indicated that from May to July 2001, the permit office sent a one-page document with the text of FSSs 316.170 and 316.550 (requirement to obtain a permit for oversize vehicles) to the private permit service companies with which they conduct business. In addition, the permit office attaches this document to each issued permit. (See appendix C for the text of the FLDOT brochure and the one-page document.) According to Florida law: • fines for violating permit dimensions range from $40 to $1,000 (FSS 316.516). • maximum fine for operational or safety permit violation [such as being off route] will not exceed $1,000 (FSS 316.550). • fine for violating FSS 316.170 is $60 (FSS 318.18). Railroad Grade Crossing Notification Requirements The Safety Board examined the railroad notification requirements of the 10 States traversed by the slow-moving, low-clearance vehicle convoy during the movement of this oversize/overweight load. Investigators reviewed four separate sources of information available to a motor carrier when planning the movement of an oversize/overweight load: (1) the permit offices from the 10 States that issued permits for this accident load; (2) the Specialized Carriers & Rigging Association (SC&RA) guide entitled Oversize/Overweight Permit Manual28 (updated quarterly, according to the SC&RA, from information provided by the individual State permit offices); (3) the FRA publication entitled Compilation of State Laws and Regulations Affecting Highway-Rail Grade Crossings29 (also available on the FRA Web site); and, (4) the text of each State’s motor vehicle laws. As shown in table 4, this examination revealed inconsistencies in the information available regarding the railroad notification requirements for the 10 States. 27 Florida Department of Transportation, revised December 1997. 28 Specialized Carriers & Rigging Association, Oversize/Overweight Permit Manual (Fairfax, Virginia: September 2000). 29 U.S. Department of Transportation, Federal Railroad Administration, Compilation of State Laws and Regulations Affecting Highway-Rail Grade Crossings, 3rd edition, January 6, 2000.

Factual Information 28 Highway Accident Report Table 4. Comparison of information from four sources regarding railroad notification requirements. Eight of the 10 States have statutes in their motor vehicle codes requiring railroad notification. Of the eight, only one State permit office indicated that the State had such a requirement. The SC&RA publication indicated that four States had a requirement, and the FRA document listed six States as having such a requirement. The Safety Board also contacted the remaining 40 States in February 2002 about their railroad notification requirements. Among all 50 States, 34 have statutes in their motor vehicle codes that require railroad notification. Of these 34, only 10 State permit offices indicated that a requirement existed in their States. (See appendix D.) No State requires information about ground clearance or normal operating speed as part of the permit application process. Several State permit office representatives indicated that because such information is not gathered as part of their permit process, they do not know whether a vehicle is a low-clearance or slow-moving vehicle that meets the requirements of the railroad notification statutes. Alaska, Montana, New York, Utah, and Washington have requirements for notifying the railroad before traversing a highway-rail grade crossing based on size or weight dimensions, but not for low-clearance vehicles. Oregon adopted a regulation in 2002 that makes it an offense to obstruct a highway-rail State State permit office response SC&RA permit guide FRA compilation of State laws State motor vehicle code Utah No* No No Yes - section 41-6-98 Wyoming No No No Yes- section 31-18-602 Colorado No Yes Yes Yes - section 42-4-708 Kansas No Yes** Yes Yes - section 8-1554 Oklahoma No No No None Arkansas No No Yes Yes - section 27-51-705 Mississippi No No Yes Yes - section 63-3-1-13 Alabama No No No None Georgia No Yes Yes Yes - section 40-6-143 Florida Yes*** Yes Yes Yes - section 316.170 *Utah indicated that only a vehicle/load exceeding 16 feet in height, traversing a highway-rail grade crossing having railroad warning lights on a cantilever over a grade crossing, would require the company to notify the railroad. ** Applies only to slow-moving vehicles–speed not specified. However, the text of the Kansas law does include a low- ground clearance provision. *** The Florida Permit Office indicated that it does not, as a routine, verify that an oversize vehicle will traverse a grade crossing.

Factual Information 29 Highway Accident Report grade crossing if a vehicle “fails to negotiate the rail grade crossing because of insufficient undercarriage clearance.” (ORS [Oregon Statute] 811.475) All States have a provision on their permits indicating that transporters are required to comply with all State laws and regulations and that the transporter is responsible for the safe movement of the load on the highways. CSXT Railroad Notification Program The CSXT railroad has a program to grant permits to oversize vehicles to pass over railroad crossings in Florida. According to a CSXT project manager, the CSXT has an agreement with the permit section of the FLDOT, under which the FLDOT informs any trucking company applying for a State permit that the company needs to contact the CSXT to obtain the required railroad permits. (According to an FLDOT representative, none of the supervisors in the FLDOT permit offices was aware of any oral or written agreement with the CSXT to provide any information related to the railroad.) The CSXT project manager stated that the CSXT has no other method of receiving notification when oversize vehicles operate over CSXT tracks at grade crossings. After receiving notice from a trucking company (the railroad requires a minimum 2-week notice), the CSXT issues a permit to the hauling company, charging $350 for this service, and sends an e-mail to the roadmaster, supervisor-train control, chief dispatcher, train master, and manager-billable expenditures, notifying them of the proposed date and time of the oversize/overweight vehicle move. The appropriate CSXT personnel then make arrangements to protect the move across CSXT tracks. The CSXT railroad further requires the trucking company to contact the roadmaster and the supervisor-train control at least 48 hours before the date of the planned move to verify all arrangements. Other Railroad Notification Programs To determine railroad notification practices of other railroads, the Safety Board contacted representatives from the Burlington Northern Santa Fe (BNSF), Canadian Pacific (CP), Norfolk Southern (NS), Union Pacific (UP), and Kansas City Southern (KCS) railroads. All five railroads had programs to ensure the safe crossing of a slow- moving or low-clearance vehicle when notified of the intended crossing. The BNSF indicated that it also issued a permit to cross when a carrier supplied proof of insurance and release of liability forms. Most railroads indicated that they preferred a week’s notice of an intended crossing but could be flexible depending on the circumstances. Some railroads had internal procedures for alerting those that needed to know about a crossing and sent a flagger to the crossing. Others had the motor carrier or truckdriver call the dispatcher directly when at the crossing and either remain on the telephone until across the tracks or call after completing the crossing. The KSC said that a vehicle operator can call the 1-800 number posted at the crossing or the number listed on the Web page, both of which are staffed 24 hours a day.

Factual Information 30 Highway Accident Report The NS representative indicated that unless a motor carrier knew the correct telephone number, finding and contacting the right person in the railroad would be difficult. None of these class 1 railroads indicated that a charge is made to the motor carrier for providing safe passage. CP indicated that if it does not have to move signal wires or appliances, a $500 deposit is required and that if signal devices must be moved and reinstalled, a $1,000 deposit is required. Once the move is completed, CP returns the balance. All railroads indicated that they charged for damages to track, signal, or warning devices. The Safety Board compiled the distribution of at-grade highway-rail crossings nationwide. Table 5 shows the number of States in which the railroads operate, the miles of track the railroads own and maintain, the number of at-grade crossings, and the proportion of total at-grade crossings (both public and private) for each railroad.30 Table 5. Distribution of at-grade highway-rail crossings. New York’s Permit Policy Regarding Railroad Notification New York is the only State that requires the carrier to demonstrate contact with the railroad before it issues a permit. As part of its investigation of the November 30, 1993, Intercession City accident, the Safety Board interviewed staff members of the New York Department of Transportation (NYDOT) heavy-hauling permit program. As a result of 30 In addition to the railroads’ Web sites, the Safety Board consulted the Railroad Safety Statistics Annual Report 2000, published by the U.S. Department of Transportation, Federal Railroad Administration, July 2001. Railroad In number of States* Miles of track* Number of at-grade crossings Proportion of total at-grade crossings BNSF 28 33,500** 35,229 13.7% CP 08 2,303*** 5,357 2.1% CSXT 24 42,700 29,821 11.6% KCS 11 2,728 4,295 1.7% NS 22 31,900 33,540 13.1% UP 23 38,654 50,844 19.8% Other 97,155 38.0% Total 256,241 100% *From railroads’ Web sites. **Route miles. ***Miles of track in the United States.

Factual Information 31 Highway Accident Report these discussions, according to the program supervisor, the NYDOT examined its program and decided to adopt additional permit requirements to prevent a similar accident from occurring in New York. The NYDOT adopted a policy requiring that trucking companies moving a vehicle 100 or more feet long over railroad crossings provide proof that they had made arrangements with the railroad(s) for safety at those crossings; the State will not grant a permit for movement of the load without such proof. The State reviews the railroad contact information and maintains file copies of the paperwork. The heavy-haul operator is also required to obtain an emergency telephone number for the railroads and to provide this number to the State police who accompany the load. The NYDOT imposes a $5,000 penalty on a trucking company that uses such a vehicle to transverse a railroad crossing without making prior arrangements for safe passage. Other Kissimmee Utility Authority Oversize/Overweight Shipments According to KUA representatives, Black & Veatch arranged for the delivery of oversize shipments involved in the plant construction. Black & Veatch records indicate that 20 oversize shipments arrived in 2000. To arrive at the Black & Veatch construction site, these highway shipments had to pass over the accident crossing. CSXT received notification of seven oversize/overweight shipments before those loads traversed the accident crossing. (See table 6.)

Factual Information 32 Highway Accident Report Table 6. Oversize/overweight loads that traversed the accident crossing in 2000.

Black & Veatch description of equipment Black & Veatch record of arrival CSXT description of equipment Date that CSXT provided protection at crossing Combustion turbine August 8 Turbine generator components August 8 Combustion turbine generator August 10 Turbine generator components (two different shipments) August 11 Tube bundle 7L August 17 Tube bundle 6L August 21 August 21 Tube bundle 7R August 25 Tube bundle 6R August 29 Turbine generator components August 29 Tube bundle 5L August 31 Tube bundle 4L September 5 Tube bundle 5R September 8 Turbine generator components September 8 Tube bundle 4R September 11 September 11 Tube bundle 3L September 13 Combustion turbine generator step-up transformer September 14 Steam turbine generator step-up transformer September 15 Tube bundle 3R September 19 September 19 Tube bundle 2L September 21 September 21 Tube bundle 2R September 23 Tube bundle 1L September 25 September 25 Surface condenser tubes* November 17 Power plant equipment** November 21 Expansion joint December 15 Steel tank December 18 Steam turbine generator December 29 *Accident shipment. ** On November 20, the driver of this oversize shipment attempted to proceed over the crossing without making arrangements with the railroad. CSXT employees at the crossing who were making inspections and repairs due to the collision 3 days earlier turned the driver away. This shipment proceeded over the crossing, with protection provided by CSXT, on November 21.

Factual Information 33 Highway Accident Report The September 14 and 15 transformer shipments were transported by Rountree Transport & Rigging, Inc., which operated the truck involved in the November 30, 1993, Intercession City accident. CSXT records indicate that the company did not notify the railroad before traversing this grade crossing in September 2000. On at least 5 of the 12 occasions during 2000 for which CSXT provided protection, the same trucking company delivered the shipments;31 the remaining two arrangements involved two different trucking companies. After the oversize shipments were unloaded, the empty vehicle again passed over the accident crossing when departing the facility. According to the CSXT railroad, its flaggers commonly remained at the crossing to provide protection for the return move of the empty vehicle. Pertinent Florida State Statutes The FLDOT Deputy General Counsel’s interpretation of FSS 316.06 is that it limits State jurisdiction for enacting vehicle laws to public roads and highways and restricts local agencies’ jurisdiction to public roads and highways and to those private roadways for which a contract exists between the owner of the private roadway and the local jurisdiction. KUA did not enter into any such contract with a local authority for the accident grade crossing. In its 1998 Passive Grade Crossing Safety Study, the Safety Board issued Safety Recommendation H-98-35 to the States, including Florida, to determine within 2 years, in conjunction with the U.S. Department of Transportation, governmental oversight responsibility for safety at private highway-rail grade crossings and ensure that traffic control on these crossings meets the standards within the Manual on Uniform Traffic Control Devices. Florida stated in a June 7, 2000, letter that it did not have jurisdictional authority over private crossings. The Safety Board, in its October 16, 2000, response, encouraged Florida to introduce legislation to expand its authority to include private crossings. Because Florida responded in a November 9, 2000, letter that it would consider a legislative initiative to expand its highway-rail crossing authority when developing its legislative package the following year, the Safety Board classified Safety Recommendation H-98-35 “Open–Acceptable Response” on April 30, 2001, pending receipt of further information on the subject. As of June 19, 2002, according to the Florida Office of Legislative Information, no legislation regarding State authority over private crossings had been introduced. Federal Highway Administration’s Contracts The FHWA Office of Safety has contracted for development of a system to warn low-clearance vehicles of any incompatibility with a humped crossing. The objective of the contract is to develop concepts using sensor technology, signage, warning devices, and education to alert drivers of low-ground clearance vehicles to a humped crossing ahead and to provide information for an alternative route. The first phase of the project, 31 The company’s Safety Director told Safety Board investigators that he notified the railroad because he was “familiar with the circumstances of the November 1993 collision at the crossing and wanted to be sure that the movement of oversize shipments could travel over the crossing in a safe manner.”

Factual Information 34 Highway Accident Report “Evaluation of Sensors for Measurement of Low-Clearance Vehicles,” began in September 2001 and was completed in June 2002. The FHWA is seeking funding for the second phase, which involves testing two of the detector concepts at the FHWA’s Turner Fairbank Research Center. In addition, the FHWA Office of Safety is funding a project with the NCUTLO to develop a model law on grade crossing safety. The NCUTLO plans to conduct research to determine which current State laws are effective and why and to set up a task force charged with formulating a model law.

35 Highway Accident Report Analysis General Although accidents involving oversize/overweight vehicles and loads happen infrequently, this accident and others investigated by the Safety Board demonstrate that when they occur, such accidents can cause extensive damage to the infrastructure and, particularly at highway-rail grade crossings, have the potential for catastrophic consequences. This accident was similar to the November 30, 1993, Intercession City accident. Both accidents involved oversize/overweight loads, and both occurred during a construction phase at the Cane Island Power Park owned and operated by the KUA and the Florida Municipal Power Agency. In neither instance was the CSXT railroad notified to arrange safe passage for the long and slow-moving vehicles. In the following analysis, the Safety Board will exclude those factors that did not cause or contribute to the accident, identify the factors that led to the accident, and determine which factors were contributory. This analysis will also address the status of past Safety Board recommendations regarding low-clearance or slow-moving vehicles at highway-rail grade crossings. Discussion will focus specifically on the movement of this oversize load, including the actions of the power company, its contractors, and subcontractors; the FLDOT; the motor carrier; the truckdriver; and pilot car drivers. It will also focus on the adequacy of the railroad notification requirement, the consistency and availability of information regarding railroad notification, and the configuration of the accident crossing. Finally, the analysis will consider measures that can be taken to prevent similar accidents. Exclusions The Amtrak crew was qualified to perform their duties in accordance with operating rules and hours-of-service requirements. The truckdriver had a valid CDL and medical certification. His postaccident toxicological tests were negative for alcohol and drugs, although the delay in testing limited the usefulness of the results for alcohol. However, no evidence indicated that the truckdriver was impaired. The highway-rail grade crossing active warning devices functioned as designed. Postaccident mechanical inspections of the combination vehicle and the train revealed no defects or deficiencies. The Safety Board concludes that neither the design nor the operation of the active rail grade crossing warning devices nor the mechanical condition of the truck or the train contributed to the cause of this accident.

Analysis 36 Highway Accident Report The engineer of the train initiated the standard emergency tone 9 radio procedure to contact the CSXT train dispatcher after the train came to a stop and shortly after the engineer had communicated with the conductor. The train dispatcher contacted the CSXT Police Communications Center, which contacted the local emergency services without delay. The Osceola County emergency services responded quickly and with sufficient personnel and equipment. Therefore, the Safety Board concludes that the CSXT emergency notification procedures were adequate and effective in alerting local emergency services, that the train crew’s actions after the collision were consistent with the best efforts to summon emergency assistance, and that the emergency response was adequate and timely. The Accident This accident was very similar to the 1993 accident at the same location. Although the motor carrier was different, the KUA was not only the owner of the crossing and the receiver of both loads, it also had representatives at the crossing during both collisions. Additionally, no one contacted the railroad in either accident to determine whether it was safe to cross the tracks. In 1993, the Amtrak train hit the truck near the center of its load, and as a result, the locomotive and three railcars were damaged extensively, 59 people were injured, and damages exceeded $14 million. In 2000, by contrast, the Amtrak train hit the rear of the combination vehicle at the pusher truck. The train essentially pushed the truck and its 82- ton load out of the way, and the train remained upright and on the tracks. However, had the truck started to cross the tracks several seconds later or the train arrived several seconds sooner, the collision may have occurred near the center of the 82-ton load, and the consequences could have been quite different. In this accident, due to the intersection’s proximity to the crossing and the elevated configuration of the vehicle, the maximum speed the vehicle could maintain near the crossing was between 1 and 3 mph. Based on this speed, the minimum time the vehicle would occupy the crossing was between 57 seconds and 2 minutes 50 seconds. Active railroad grade crossing devices are required to provide a minimum of 20 seconds of warning time to motorists before the arrival of a train, and typically these devices provide between 20 and 25 seconds of warning. The warning devices at this crossing provided a warning time of 25 seconds. Thus, the accident truck required at least two and as much as seven times more warning of an approaching train than the active warning devices provided, effectively neutralizing the active warning devices. Additionally, although the train engineer applied the brakes prior to actually identifying the truck on the crossing, he had no opportunity to avoid the collision. His brake application and throttle reduction during the approximately 16 seconds before the accident reduced the train speed by 19 mph, delaying his arrival at the crossing by about 1.73 seconds. While the train’s reduced speed and slightly delayed arrival at the crossing may have altered the collision dynamics, there was still not enough time to avoid the

Analysis 37 Highway Accident Report collision. The truck would have needed an additional 3.4 seconds to 10.25 seconds to clear the tracks. The vehicle created a hazard at this crossing, since it occupied the tracks well beyond the standard minimum warning time provided for a vehicle to cross safely. The only prudent way to minimize the risk was to notify the railroad sufficiently in advance of crossing to ensure that train traffic was stopped or not present at the time the vehicle traversed the tracks. The Board concludes that neither the KUA, nor its contractors, nor the motor carrier properly considered the risks of crossing the tracks without first notifying the railroad to arrange safe passage. Past Safety Board Recommendations Regarding Low-Clearance or Slow-Moving Vehicles at Highway-Rail Grade Crossings In addition to the two accidents that occurred at the same highway-rail grade crossing in Intercession City on November 30, 1993,32 and November 17, 2000, the Safety Board has investigated five other accidents at highway-rail grade crossings involving four low-clearance or slow-moving vehicles (Sycamore, South Carolina;33 Glendale, California;34 Sumner, Washington;35 and Milford, Connecticut36) and a long combination vehicle (Portage, Indiana37) and published a safety study38 on passive grade crossings. During these accident investigations, the Safety Board discovered that few of the participants involved were aware of the hazards associated with maneuvering oversize/overweight, low-clearance, slow-moving vehicles over highway-rail grade crossings or of the need or a requirement to notify the railroad before attempting such maneuvers. 32 NTSB/HAR-95/01. 33 National Transportation Safety Board, Highway-Rail Grade Crossing Collision Near Sycamore, South Carolina, May 2, 1995, Highway Accident Report NTSB/HAR-96/01 (Washington, DC: NTSB, 1996). 34 National Transportation Safety Board, Collision Between Metrolink Train 901 and Mercury Transportation, Inc., Tractor-Combination Vehicle at Highway-Railroad Grade Crossing in Glendale, California, January 28, 2000, Highway Accident Report, NTSB/HAR-01/02 (Washington, DC: NTSB, 2001). 35 On December 23, 2000, a truck, towing a house, had stopped on the tracks to adjust tow dollies when it was struck by an Amtrak train. The load was being escorted by a pilot car and three uniformed, off-duty county police officers. No permit had been obtained to cross the tracks. (National Transportation Safety Board Docket No. Highway-01-IH013). 36 On October 3, 1995, a low-bed semitrailer, transporting an excavator, was struck by a commuter train after becoming lodged on the railroad tracks; the truckdriver attempted to raise the semitrailer for 3 or 4 minutes before the train arrived. No one contacted the railroad before attempting to cross the tracks or after the accident. (National Transportation Safety Board Docket No. Highway-SRH-96-MH001). 37 National Transportation Safety Board, Collision of Northern Indiana Commuter Transportation District Train 102 With a Tractor-Trailer, Portage, Indiana, June 18, 1998, Railroad Accident Report, NTSB/RAR-99/03 (Washington, DC: NTSB, 1999). 38 National Transportation Safety Board, Safety at Passive Grade Crossings, Safety Study NTSB/SS- 98/03 (Washington, DC: NTSB, 1998).

Analysis 38 Highway Accident Report Intercession City, Florida—November 30, 1993 The Safety Board issued several recommendations39 as a result of its investigation. The Board asked AASHTO to encourage the States to review and revise permitting procedures for oversize vehicles crossing highway-rail grade crossings, and the Board urged organizations representing the trucking and railroad industries to educate operators of low-clearance, oversize vehicles about the need to notify the railroad before attempting to traverse a highway-rail grade crossing. In response, AASHTO sent copies of the Safety Board’s accident report to its members, urging them to review these permit procedures and take corrective action. Also in response to these recommendations, industry launched a number of efforts to educate truckdrivers, including the following: The SC&RA distributed an Operation Lifesaver, Inc., (OLI) video on grade crossing safety at its March 1996 Oversize/Overweight Symposium, had Safety Board representatives speak at its October 1996 Safety Forum, and produced a permit manual including State-by-State permit regulations and specific requirements at highway-rail grade crossings. The Association of American Railroads (AAR) disseminated information about the accident and asked its members to review their procedures for coordinating the transit of oversize shipments across their rights of way. The American Short Line and Regional Railroad Association (ASLRRA) informed its members of the accident via a direct mailing and requested that they review their practices regarding coordinating oversize loads. The CSXT railroad revised its permit form to include a 24-hour emergency number. In addition, the Safety Board issued the following safety recommendation to the NCUTLO: H-95-12 Revise Section 14-112, “Permits for Excess and Weight,” of the Uniform Vehicle Code to require that State agencies notify carriers of the provisions contained in Section 11-703, “Moving Heavy Equipment at Railroad Grade Crossings,” before issuing permits. To monitor the implementation of this recommendation, the Safety Board sent letters dated May 5, 1996, and November 6, 2001, to the NCUTLO requesting a reply. Recent discussions with NCUTLO staff indicate that the FHWA has approved funding for development of a model law for railroad crossing safety. The model law will address issues related to the movement of heavy equipment at railroad crossings, and the Board urges the NCUTLO to proceed without delay on this important safety issue. Pending 39 Safety Recommendations H-95-07 through -09, -12, -24, -26, and -30. See appendix B for more information on these and related recommendations.

Analysis 39 Highway Accident Report further response, the Safety Board classifies Safety Recommendation H-95-12 “Open— Acceptable Alternate Response.” Passive Grade Crossing Safety Study—1998 More than 4,000 accidents occurred at the Nation’s active and passive grade crossings each year from 1991 through 1996; 54 percent of the accidents and 60 percent of the fatalities were at passive grade crossings, where drivers are not provided warning by train-activated devices. The Safety Board conducted this study to identify common causes for accidents at passive crossings and to identify remedies to improve safety at passive crossings that are not scheduled for closure or upgrade. As a result of its study, the Safety Board recommended that the States determine within 2 years, in conjunction with U.S. Department of Transportation, governmental oversight responsibility for safety at private highway-rail grade crossings and ensure that traffic control on these crossings meets the standards within the MUTCD.40 Florida responded that although it did not currently have jurisdiction over private crossings, it would consider a legislative initiative to obtain the authority. The State has not done so to date. Portage, Indiana—June 18, 1998 In this accident, a two-car passenger train struck the second semitrailer of a long combination vehicle consisting of a tractor pulling two flatbed semitrailers loaded with steel coils at a highway-rail grade crossing. Three fatalities and five minor injuries resulted. Estimated damages were $886,000. The investigation revealed that action by Federal, State, and private agencies had been ineffective in permanently resolving safety problems at the grade crossing. As a result of its investigation, the Safety Board recommended that the Federal Government eliminate any differentiations between private and public highway-rail grade crossings with regard to providing funding for, or requiring the implementation of, safety improvements.41 The FHWA proposed adding language to the MUTCD to define private highway-rail grade crossings. Sycamore, South Carolina—May 2, 1995 In this accident, a low-clearance vehicle became lodged on railroad tracks and was struck by an Amtrak passenger train, resulting in 33 injuries and over $1 million in damages. Investigators determined that the driver had failed to contact the authorities after becoming stuck. The Safety Board’s recommendations42 focused on educating truckdrivers regarding the hazards of humped crossings. In response to these recommendations, industry launched additional efforts to educate truckdrivers, including the following: 40 Safety Recommendation H-98-35. See appendix B for more information on this and related recommendations. 41 Safety Recommendation I-99-02. See appendix B for more information on this and related recommendations. 42 Safety Recommendations H-96-08 and -09. See appendix B for more information on these and related recommendations.

Analysis 40 Highway Accident Report The American Trucking Associations disseminated information about the accident to its members through its weekly newsletter, Transport Topics, and developed a Physics 101 video to educate drivers on grade crossing safety, specifically on the hazards of driving low-clearance vehicles over grade crossings. The OLI developed an information program, including a brochure and video on grade crossing safety, for truckdrivers not covered by other groups. Glendale, California—January 28, 2000 This accident, in which a tractor-combination vehicle became lodged on railroad tracks and was subsequently struck by a westbound Metrolink commuter train, revealed the importance of educating not only truckdrivers, but also pilot car drivers and police escort personnel, on the safe movement of low-clearance and oversize/overweight vehicles over highway-rail grade crossings. In addition, the investigation revealed that information concerning oversize vehicle movement is fragmented, with guidance spread among the States and AASHTO. Consequently, the Safety Board recommended on December 20, 2001, that the FHWA, in cooperation with the FMCSA and trucking industry associations, develop a model pilot car training program and model oversize/overweight vehicle movement guidelines.43 In addition, the Safety Board recommended that law enforcement and trucking industry associations alert their members of the hazards of moving oversize/overweight vehicles over grade crossings, emphasizing the need for railroad notification.44 Movement of the Oversize/Overweight Load Despite industry’s education and training efforts since 1993, awareness of the hazards of maneuvering oversize/overweight vehicles at grade crossings and the consequent need to notify railroads is still lacking. For instance, the Safety Board discovered during its investigation of the November 17, 2000, Intercession City accident, the second one at this site, that prior to the accident, neither the shippers, nor the motor carrier, nor the receivers notified the CSXT of the oversize/overweight load traversing its tracks. Furthermore, the lack of clarity in the Florida permit process allowed the motor carrier, pilot car drivers, and truckdriver to plausibly argue that they were not aware of the need to notify the railroad. To better understand why those involved with the movement of this oversize/overweight load did not notify the railroad and request safe passage at this 43 Safety Recommendations H-01-30 and -31. See appendix B for more information on these and related recommendations. 44 Safety Recommendations H-01-36 and -37. See appendix B for more information on these and related recommendations.

Analysis 41 Highway Accident Report crossing, the Safety Board examined the roles and responsibilities of those involved in planning and executing the movement of this oversize load. Shipper and Receivers KUA contracted with Black & Veatch to serve as architect-engineer and construction manager for both the 1993 and 2000 construction projects. Although KUA officials claimed to be aware of the hazards of low-clearance, slow-moving vehicles at this crossing since the November 30, 1993, accident, the Safety Board could not identify changes to their procedures to accommodate the special needs of these movements. Since the KUA Power Road crossing is a private crossing and the only oversize/overweight vehicles that traverse this crossing are those making deliveries during a KUA construction phase, KUA and its construction contractors and subcontractors have a responsibility for ensuring safety at this highway-rail grade crossing. Moreover, because of the 1993 accident, all these participants should have been acutely aware of the potential risk at this grade crossing and should have ensured that the railroad was notified. The condenser involved in the November 17, 2000, accident was built by Mark Steel (Salt Lake City) and installed in Kissimmee by TEi, which hired Molnar to haul the condenser from Salt Lake City to the construction site. According to KUA, all carriers were supposed to be advised to notify the railroad before moving oversize loads over the railroad crossing, although this requirement was not specified in writing. Safety Board investigators found that TEi and Molnar disagreed with one another about whether they exchanged information on railroad notification requirements. The railroad was not notified, and safe passage was not provided. Obtaining transit times from the railroad is insufficient. In the 1993 Intercession City accident, the truckdriver stated that a KUA or Black & Veatch employee advised the truck crew to hurry because they could expect a train at a certain time; therefore, the truckdriver believed that KUA was in contact with the railroad. KUA denied that such a conversation occurred. Because these large, low-clearance, slow-moving vehicles require so much time to clear grade crossings and have the potential to bottom out or get stuck, it is imperative that the railroad control train traffic on the track until these vehicles are clear. To do this, the railroad has to be aware that a low-clearance, slow-moving vehicle needs to cross its track. KUA and its contractor should know when they are to take delivery of a load and should ensure that the railroad is notified. They could accomplish the latter by terms of their contracts and by erecting signs in advance of the crossing that advise low-clearance or slow-moving vehicle operators to notify the railroad before traversing the tracks. Therefore, the Safety Board believes that KUA should require that the CSXT railroad is notified in advance of accepting delivery by any low-clearance or slow-moving vehicles. Motor Carrier In this accident, the motor carrier arranged for 8 of the 10 permits directly with the States. The carrier reported receiving the Florida permit with only the statement that the

Analysis 42 Highway Accident Report “movement shall be in compliance with W/FS 316.08, 316.170, and F.A.C. rule 14-26.” According to the Molnar Safety Director, the carrier made several attempts to determine the text of these sections. In addition, before the convoy entered Florida, the carrier indicated that it called the private permit service it used and asked the service to define the text of the citations. The permit service told Molnar that FSSs 316.08 and 316.170 pertained to the carrier “giving truthful information about the load dimensions and description.” As noted previously, the lack of clarity in the Florida permit received by Molnar would have necessitated additional research to determine the conditions of the permit. Florida Department of Transportation After the November 30, 1993, accident at this location, the FLDOT developed a brochure explaining the railroad notification requirements in FSS 316.170 and procedures for contacting the railroads that operate in Florida. However, the brochure is out of print and unavailable for distribution. After the first accident, the FLDOT also added a line on the permit that referenced the statute citation, but did not explain what it meant. As a result, the lack of clarity in the permit allowed Molnar and others to plausibly maintain that they were unaware of the railroad notification requirements. Even though the KUA crossing was a private crossing and may not have been covered by the statute, neither a motor carrier nor a truckdriver is likely to have recognized that it was a private crossing. Therefore, information regarding railroad notification printed on the permit may have alerted Molnar about the need to notify the railroad to arrange safe passage. The Safety Board concludes that had the FLDOT included language on the permit explaining that low-clearance, slow-moving vehicles are required to notify the railroad before crossing, this accident might have been avoided. After the November 17, 2000, accident, the Florida permit office distributed a one- page document with the text of FSSs 316.170 and 316.550 to the private permit companies that do business with the State. The permit office includes this document with all permits issued. As noted above, when Molnar called the FLDOT permit office, it was unsuccessful in determining the text of the statute. When the convoy interacted with the FLDOT Office of Motor Carrier Compliance Weight Enforcement Program officers near the Florida- Georgia border, they were advised that they needed an additional Florida-certified pilot car driver. (One of the two pilot car drivers escorting the load did not have a Florida certification.) But Florida officials did not discuss the meaning of FSS 316.170 with the convoy. During the interaction with the FLDOT permit office and with officers from the Office of Motor Carrier Compliance Weight Enforcement Program at the Florida-Georgia border, Florida officials lost an opportunity for communication regarding the railroad notification requirements. Truckdriver Training The truckdriver told Safety Board investigators that he was not aware that any States had requirements to notify the railroad before crossing its tracks. He was also

Analysis 43 Highway Accident Report unaware of the minimum warning times at railroad grade crossings or how the warning devices operated. In addition, he stated that he did not see the emergency signs with the CSXT 1-800 number posted at the crossing. Since the carrier did not have a formal training program, the truckdriver received no specific training on the hazards of long, slow-moving vehicles at grade crossings. Although the truckdriver may have been exposed to some information regarding grade crossing safety through the CDL program, the CDL tests do not specifically address the operation of grade crossing warning devices and the hazards of long, slow-moving vehicles at grade crossings. As discussed earlier, the Safety Board has addressed the issue of training truckdrivers about the hazards of railroad crossings in previous safety recommendations. The Board has been advised that units of the FRA and the FMCSA are working together to develop a training module on the dangers of grade crossings and the new FMCSA regulations, which take effect in October 2002, setting CDL disqualification penalties for highway-rail grade crossing violations. The development of such a module is commendable. Railroad Notification CSXT railroad charges an operator $350 to provide safe passage at a grade crossing. The penalty in Florida for failing to notify the railroad, when required, is $60. Thus, the CSXT fee for providing safe passage across a crossing far exceeds the Florida penalty for failing to notify the railroad. This situation does not provide an incentive to encourage operators of slow-moving, low-clearance vehicles to notify the railroad. Yet the prevention of railroad grade crossing collisions is in everyone’s best interest. To promote more notifications by operators of slow-moving, low-clearance vehicles of their intent to traverse highway-rail grade crossings, the CSXT should eliminate the $350 fee for safe passage across crossings. The CDL disqualification and the penalties for highway-rail grade crossing violations that take effect in October 2002 should promote railroad grade crossing safety. However, these actions do not address the issue of railroad notification. Therefore, the Safety Board believes that the FMCSA should amend CFR 383.51 (e), “Disqualification for railroad-highway grade crossing violation,” to include a violation for drivers of low- clearance or slow-moving vehicles who fail to make arrangements with the railroad for safe passage, when required. Pilot Car Drivers None of the three certified pilot car drivers accompanying this load indicated that they were aware of the Florida law requiring certain oversize/overweight vehicles to notify the railroad before crossing a highway-rail grade crossing. Two of the three were Florida-certified. In its investigation of the Glendale accident,45 the Safety Board determined that neither the Florida pilot car certification materials nor the other States that 45 NTSB/HAR-01/02.

Analysis 44 Highway Accident Report have certification programs address the need or requirement for certain vehicles (low- clearance or slow-moving or both) to notify the railroad before traversing grade crossings. In Safety Recommendation H-01-30, issued in the Glendale report,46 the Safety Board urged the FHWA to develop a model pilot car driver training program. The training program should address, at a minimum, issues such as (1) how to conduct route surveys; (2) the maneuvering limitations of heavy-haul vehicles; (3) the effects of fatigue on performance; (4) the need to assess the dangers at railroad crossings, particularly for low- clearance vehicles; and (5) the need and requirements to notify the railroads before an oversize/overweight vehicle is escorted across a highway-rail grade crossing. In the interim, those States that already have a pilot car certification program could include information about railroad notification in their programs. Colorado, Florida, Kansas, New York, Oklahoma, Utah, Virginia, and Washington have such programs, and Indiana and North Carolina have pilot car certification programs under development. Although the Safety Board has received no official response from the FHWA to Safety Recommendation H-01-30, the Board understands that the FHWA and others are developing a model pilot car certification program. Adequacy of Uniform Vehicle Code Railroad Notification Requirement Uniform Vehicle Code 11-703 and FSS 316.170 specify that if a vehicle traversing a grade crossing has a normal operating speed of 10 mph or less or a ground clearance of ½-inch-per-foot of the distance between any two axles, or a ground clearance of less than 9 inches, the operator of that vehicle must notify the railroad before crossing. The truckdriver indicated that the normal operating speed of the accident vehicle exceeded 10 mph. Safety Board investigators examined the accident vehicle at the scene; applying the formula provided in FSS 316.170 to this vehicle (1/2 inch per foot times 52 feet), the critical ground clearance was 26 inches. The accident vehicle’s cargo bed could be raised to 32 inches. It is not clear that the accident vehicle would have met the definition for a vehicle required to notify the railroad in advance of crossing its tracks as found in the Uniform Vehicle Code and the Florida statute. However, due to the time this vehicle occupied the crossing, it clearly created a hazard. Uniform Vehicle Code, Section 11-703, and the various State laws that are modeled after it do not cover the situation found in this accident, in which the proximity of an intersection to a grade crossing limits vehicle speed to less than 10 mph. The Safety Board has investigated several accidents47 involving transporters of oversize loads whose normal operating speed was greater than 10 mph, but, due to the proximity of intersections, had to reduce their speed through the turn and over the grade crossing. In addition, unless a low- clearance vehicle stops well in advance of a crossing to raise the cargo deck to clear the 46 NTSB/HAR-01/02. 47 Intercession City, Florida (1993); Glendale, California; and Sumner, Washington.

Analysis 45 Highway Accident Report crossing, it cannot reach highway speed. The relevant speed is the actual speed over the crossing. The Safety Board concludes that the definition of a vehicle required to notify the railroad of its intention to cross a highway-rail grade crossing found in the FSS 316.170 and Uniform Vehicle Code, Section 11-703, is inadequate because it is based on normal operating speed rather than the actual speed over the crossing. The NCUTLO maintains the Uniform Vehicle Code. The FHWA Office of Safety currently has a contract with the NCUTLO to develop a model law on grade crossing safety, and the FHWA Office of Freight Management and Operations provides limited Federal oversight on the transportation of oversize/overweight loads. Therefore, the Safety Board believes that the FHWA and the NCUTLO should revise Uniform Vehicle Code, Section 11-703, to define which vehicles, under what circumstances, need to notify the railroad before crossing a highway-rail grade crossing. The SC&RA represents the heavy-hauling or oversize/overweight industry, and the Truck Trailer Manufacturers Association has knowledge of the operating characteristics of the specialized trailers used in the heavy-hauling industry. The Safety Board encourages the FHWA and the NCUTLO to work with the FRA, FMCSA, AASHTO, SC&RA, Truck Trailer Manufacturers Association, ASLRRA, and representatives from all class 1 and regional railroads to meet the intent of this recommendation. Adequacy and Consistency of Railroad Notification Requirements and Information The need to notify the railroad to obtain safe passage at a given highway-rail grade crossing should be evaluated individually for each at-risk vehicle. The evaluation should take into account the compatibility of the crossing configuration, including approach and departure grades, and the proximity to turns, as well as the vehicle configuration, including ground clearance, axle spacing, overall length, and vehicle speed. The data needed to perform this evaluation are currently found in different places and are not readily available to all participants in the process. The States should have the public crossing configuration information, although the approach and departure grade records may not be current. Many States require a route survey only when the vehicle and load exceed a certain height. Yet route surveys are important to an evaluation of the need to notify the railroad before crossing and should routinely be part of this process. The AAR/FRA Grade Crossing Inventory is available on the Internet. Although the inventory provides information about the proximity of an intersection, it does not include approach and departure grades or whether the crossing is humped. In addition, vehicle operators may not be aware the inventory exists. The vehicle operator should know the configuration of the vehicle. Most States do not collect information about ground clearance or operating speed as part of the permit application process. The only point in the process at which all information becomes readily available is when the vehicle is at the crossing. Even then, the operator can notify the railroad only if an emergency number is posted at the crossing and if telephone access

Analysis 46 Highway Accident Report is available. Arrangements for a given railroad to protect the crossing take time (in the case of CSXT, 2 weeks) and, generally, space to safely park the vehicle is not available. The notification process should be consistent and user-friendly for all participants. The vehicle operator needs to know when it is necessary to notify the railroad, which railroad to notify, and how to do so. Currently, the sources of information about railroad notification requirements provide inconsistent guidance. In 24 of 34 States that have such requirements, the person contacted in the State permitting office did not know the State had railroad notification requirements. In addition, the data in the two published resources are not consistent with State statutes. Thus, the likelihood that a State will make the vehicle operator aware of the requirement is not great. Even if vehicle operators are aware of the State notification requirement, they are not told which railroad to notify. The Safety Board concludes that accurate and complete information pertaining to the requirement for low-clearance or slow-moving vehicles to notify the railroad prior to traversing grade crossings is lacking. The Safety Board, considers that once the Uniform Vehicle Code has been revised, the States should adopt the revised Uniform Vehicle Code, Section 11-703, and require operators of low-clearance and slow-moving vehicles to conduct route surveys. The AASHTO Highway Subcommittee on Highway Transport is concerned with the relationship between commercial vehicle operations and the Nation’s highway systems, and this AASHTO subcommittee deals with permitting issues. Therefore, the Safety Board believes that AASHTO should encourage the States, once the Uniform Vehicle Code has been revised, to adopt the revised Uniform Vehicle Code, Section 11- 703, and require operators of low-clearance and slow-moving vehicles to conduct route surveys. To avoid problems in determining the text of State railroad notification requirements, the States should include the text of the revised Uniform Vehicle Code, Section 11-703, on the face of permits. Therefore, the Safety Board believes that AASHTO should encourage the States to include the text of the revised Uniform Vehicle Code, Section 11-703, on the face of permits. As demonstrated earlier, government officials missed several opportunities to inform the carrier of the railroad notification requirement, and the carrier found it difficult to discover the requirements on its own. Critical information, such as railroad notification requirements, should be easily available, frequently advertised, and regularly provided to motor carriers needing the information. Consequently, State employees who interface with the heavy-hauling industry should be knowledgeable about the State’s railroad notification requirements. Therefore, the Safety Board believes that AASHTO should encourage the States to conduct initial and recurrent training for State employees in the permit offices and State employees involved in commercial vehicle enforcement regarding the railroad notification requirements. The AAR/FRA Grade Crossing Inventory lists the railroad that controls a track if the vehicle operator can identify the crossing by location or knows the crossing number and is familiar with the FRA Web site inventory. In addition, most railroad Web sites publish the track routes. But once a vehicle operator knows which railroad to notify, finding the correct person to contact can be difficult. Various pages of the CSX Corporation Web site include the 1-800 emergency telephone number, and information

Analysis 47 Highway Accident Report about grade crossing safety and a link to OLI is also available. However, investigators found no one source that listed all essential steps that operators of low-clearance or slow- moving vehicles must take to ensure safety and no railroad contact information for the arrangement of crossing safety. Investigators examined the Web sites of the other major railroads with similar results. The Safety Board concludes that safety would be enhanced if the CSXT and other railroads publicized contact information, via the Internet or other means, for those who need to arrange protection at grade crossings. Therefore, the Safety Board believes that all class 1 and regional railroads should provide easily accessed contact and notification information for use by vehicle operators requiring railroad assistance to ensure safety at grade crossings. Safety of Accident Crossing Although the combination vehicle did not get stuck or hang up on the crossing, the physical evidence and witness statements indicated that the vehicle did scrape the roadway on the departure grade. According to the 2001 AASHTO guidelines, the roadway surface should not be more than 3 inches higher or lower than the top of the nearest rail at a point 30 feet from the rail, unless track superelevation makes a different level appropriate. At a point 30 feet from the rail, the north approach was 6.84 inches below the plane of the superelevation extension. Therefore, the Safety Board concludes that under current AASHTO guidelines, the north approach makes the KUA Power Road crossing a humped crossing. Although the presence of slow-moving, oversize/overweight trucks appears to be related to construction cycles at the plant, the possibility that other low-clearance delivery trucks will traverse this crossing still exists. Truckdrivers should be warned that it is a humped crossing. Therefore, the Safety Board believes that the KUA should install low- clearance highway-rail grade crossing signs (W10-5s) at the KUA Power Road crossing. When the CSXT installed the emergency 1-800 number signs at the crossing in 1997, MUTCD standards for such signs did not exist. As a result, the existing signs are 12 by 6 inches and do not conform to the size criteria (29.5 by 29.5 inches and 17.7 by 29.5 inches) of the MUTCD standard signs. To ensure visibility in emergencies, the CSXT should upgrade the existing nonstandard emergency 1-800 number signs with the MUTCD standard I-13 or I-13a signs as the railroad makes improvements to crossings on its track system.

48 Highway Accident Report Conclusions Findings 1. Neither the design nor the operation of the active rail grade crossing warning devices nor the mechanical condition of the truck or the train contributed to the cause of this accident. 2. The CSX Transportation, Inc., emergency notification procedures were adequate and effective in alerting local emergency services; the train crew’s actions after the collision were consistent with the best efforts to summon emergency assistance; and the emergency response was adequate and timely. 3. Neither the Kissimmee Utility Authority, nor its contractors, nor the motor carrier properly considered the risks of crossing the tracks without first notifying the railroad to arrange safe passage. 4. Had the Florida Department of Transportation included language on the permit explaining that low-clearance, slow-moving vehicles are required to notify the railroad before crossing, the November 17, 2000, accident might have been avoided. 5. The definition of a vehicle required to notify the railroad of its intention to cross a highway-rail grade crossing found in the Florida State Statute 316.170 and Uniform Vehicle Code, Section 11-703, is inadequate because it is based on normal operating speed rather than actual speed over the crossing. 6. Accurate and complete information pertaining to the requirement for low-clearance or slow-moving vehicles to notify the railroad prior to traversing grade crossings is lacking. 7. Safety would be enhanced if the CSX Transportation, Inc., and other railroads publicized contact information, via the Internet or other means, for those who need to arrange protection at grade crossings. 8. Under the current American Association of State Highway Transportation Officials guidelines, the north approach makes the KUA Power Road crossing a humped crossing. Probable Cause The National Transportation Safety Board determines that the probable cause of the November 2000 collision of Amtrak train 97 with the tractor-combination vehicle was the failure of the Kissimmee Utility Authority, its construction contractors and subcontractors, and the motor carrier to provide for the safe passage of the load over the grade crossing.

49 Highway Accident Report Recommendations As a result of this accident, the National Transportation Safety Board makes the following safety recommendations:

New Recommendations To the Federal Highway Administration and the National Committee on Uniform Traffic Laws & Ordinances: Revise Uniform Vehicle Code, Section 11-703, to define which vehicles, under what circumstances, need to notify the railroad before crossing a highway-rail grade crossing. (H-02-07) To the Federal Motor Carrier Safety Administration: Amend the Code of Federal Regulations 383.51 (e), “Disqualification for railroad-highway grade crossing violation,” to include a violation for drivers of low-clearance or slow-moving vehicles who fail to notify and make arrangements with the railroad for safe passage, when required. (H-02-08) To the American Association of State Highway and Transportation Officials: Encourage the States, once the Uniform Vehicle Code, Section 11-703, has been revised, (a) to adopt the revised Uniform Vehicle Code, Section 11- 703, (b) to include vehicle ground clearance as part of the permitting process, and (c) to require permitted slow-moving vehicles and those permitted vehicles that do not meet the ground-clearance provisions of the Uniform Vehicle Code to conduct route surveys. (H-02-09) Encourage the States, once the revised Uniform Vehicle Code, Section 11- 703, has been adopted, to include the text of the revised State statute on the face of permits. (H-02-10) Encourage the States to conduct initial and recurrent training for State employees in the permit offices and State employees involved in commercial vehicle enforcement regarding the railroad notification requirements. (H-02-11)

50 Highway Accident Report To all Class 1 and Regional Railroads: Provide easily accessed contact and notification information for use by vehicle operators requiring railroad assistance to ensure safety at grade crossings. (H-02-12) To the Kissimmee Utility Authority: Require that the CSX Transportation, Inc., railroad is notified in advance of accepting delivery by any low-clearance or slow-moving vehicles. (H-02-13) Install low-clearance highway-rail grade crossing signs (W10-5s) at the KUA Power Road crossing. (H-02-14) Previously Issued Recommendation Classified in This Report Safety Recommendation H-95-1248 (previously classified “Open—Await Response”) is classified “Open—Acceptable Alternate Response.” BY THE NATIONAL TRANSPORTATION SAFETY BOARD 48 For the text of this recommendation, see page 38. MARION C. BLAKEY Chairman CAROL J. CARMODY Vice Chairman JOHN A. HAMMERSCHMIDT Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: July 23, 2002 Recommendations

51 Highway Accident Report Appendix A Investigation The National Transportation Safety Board was notified of the Intercession City, Florida, accident on November 17, 2000. An investigative team was dispatched with members from the Gardena, California; the Atlanta, Georgia; and the Washington, D.C., offices. Groups were established to investigate the highway, vehicle, signal, and track factors and the railroad and motor carrier operations. No parties were designated, no public hearing was held, and no depositions were taken.

52 Highway Accident Report Appendix B Previous Recommendations Relating to Slow-Moving, Low-Clearance Vehicles at Highway-Rail Grade Crossings Intercession City, Florida—November 30, 1993 A 184-foot-long vehicle loaded with an 82-ton turbine was stopped on a private crossing near Intercession City, Florida, while the crew was raising the height of the cargo deck, when an Amtrak train carrying 89 passengers struck the side of the cargo deck and the turbine.1 Six people sustained serious injuries and 53 people suffered minor injuries. Damages exceeded $14 million. The National Transportation Safety Board determined that the probable cause of this accident was the failure of Rountree Transport & Rigging, Inc., to notify CSXT2 in advance of its intent to cross the railroad track and to ensure through CSXT that it was safe to do so. Contributing to the accident were deficiencies in the permitting processes of CSXT and the Florida Department of Transportation that resulted in a lack of appropriate guidance for permitting officials; oversize, low-clearance operators; and escort personnel. As a result of the investigation of this accident, the Safety Board made the recommendations discussed below. To the American Association of State Highway and Transportation Officials: H-95-07 Inform your members of the facts and circumstances of the Intercession City, Florida, accident and urge that they require operators of low-clearance, overdimension/overweight vehicles to provide railroads with advance notification of travel over grade crossings. Further, recommend that these members revise their permit document to state that compliance with this notification requirement is a condition of permitting. On April 30, 1996, after learning that the American Association of State Highway and Transportation Officials distributed copies of the accident report to its members, urging them to review their permit procedures and take corrective action, as necessary, the Safety Board classified Safety Recommendation H-95-07 “Closed–Acceptable Action.” 1 National Transportation Safety Board, Collision of Amtrak Train No. 88 with Rountree Transport and Rigging, Inc., Vehicle on CSX Transportation, Inc., Railroad Near Intercession City, Florida, November 30, 1993, Highway Accident Report NTSB/HAR-95/01 (Washington, DC: NTSB, 1995). 2 “CSXT” is a recognized abbreviation for CSX Transportation, Inc., which is a division of CSX Corporation. The railroad is commonly referred to as CSX.

Appendix B 53 Highway Accident Report To the Specialized Carriers & Rigging Association: H-95-08 Advise your members of the facts and circumstances of the Intercession City, Florida accident, and urge that they implement procedures to ensure that personnel coordinate with railroads when traversing grade crossings, comply with all statutes, obtain all necessary permits, have an emergency contingency plan, and outfit the move crew with appropriate emergency equipment, telephone numbers, and contacts. H-95-09 Revise the Permit Manual of State Permits and Canadian Regulations to list those jurisdictions that require low-clearance vehicle operators to provide railroads with advance notification of intended travel over grade crossings and include a caution that coordinating with railroads is necessary to ensure safe travel over grade crossings. The Specialized Carriers & Rigging Association (SC&RA) distributed an Operation Lifesaver video on railroad grade crossing safety at its 1996 Oversize/Overweight Symposium and had a representative from the Safety Board give a presentation on railroad grade crossing safety at its 1996 Safety Forum. On May 14, 1998, the Safety Board classified Safety Recommendation H-96-08 “Closed–Acceptable Action.” On May 14, 1998, after learning that the SC&RA had produced a railroad grade crossing permit guide, the Safety Board classified Safety Recommendation H-95-09 “Closed–Acceptable Action.” To the International Association of Chiefs of Police: H-95-10 Advise your members of the facts and circumstances of the Intercession City, Florida, accident and request that those whose activities include providing or overseeing overdimension vehicle escort review their policies and procedures to ensure the vehicle operator is in compliance with all applicable permit and advance notification requirements and has the communications capability and telephone numbers to contact railroad, utility, and other private entities along the route in the event of a change in plans or an emergency. On November 3, 1995, after learning that the International Association of Chiefs of Police had notified all superintendents of State police and highway patrol organizations of the facts and circumstances of the accident and asked them to review their polices and procedures to ensure the vehicle operator is in compliance with all permit and notification procedures, the Safety Board classified Safety Recommendation H-95-10 “Closed– Acceptable Action.”

Appendix B 54 Highway Accident Report To the National Sheriffs’ Association: H-95-11 Advise your members of the facts and circumstances of the Intercession City, Florida, accident and request that those whose activities include providing or overseeing overdimension vehicle escort review their policies and procedures to ensure the vehicle operator is in compliance with all applicable permit and advance notification requirements and has the communications capability and telephone numbers to contact railroad, utility, and other private entities along the route in the event of a change in plans or an emergency. On October 31, 2001, the National Sheriffs’ Association advised the Safety Board that in February 2002, the subject recommendation will be presented to the Traffic Safety Committee. On December 26, 2001, the Safety Board classified Safety Recommendation H-95-11 “Open—Acceptable Response.” To the National Committee on Uniform Traffic Laws & Ordinances: H-95-12 Revise Section 14-112, “Permits for Excess Size & Weight,” of the Uniform Vehicle Code to require that State agencies notify carriers of the provisions contained in Section 11-703, “Moving Heavy Equipment at Railroad Grade Crossings,” before issuing permits. This safety recommendation is classified “Open–Await Response.” To the Association of American Railroads: R-95-24 Inform your members of the facts and circumstances of the Intercession City, Florida, accident and recommend that they review their procedures for coordinating the transit of overdimension, low-clearance highway vehicles across their right-of-way. On October 2, 1995, the Association of American Railroads advised the Safety Board that it had informed its members of the accident and asked that they review their procedures for coordinating the transit of overdimension, low-clearance vehicles across their right of way. On January 23, 1996, the Safety Board classified Safety Recommendation H-95-24 “Closed–Acceptable Action.” To the American Short Line Railroad Association: R-95-26 Inform your members of the facts and circumstances of the Intercession City, Florida, accident and recommend that they review their procedures for coordinating the transit of overdimension, low-clearance highway vehicles across their right of way.

Appendix B 55 Highway Accident Report On October 17, 1995, after learning that the American Short Line Railroad Association members had been informed of the accident by a direct mailing, including a request that members review their individual practices regarding coordinating over- dimension loads, the Safety Board classified Safety Recommendation R-95-26 “Closed– Acceptable Action.” To the CSX Transportation Corporation: H-95-30 Revise your permitting process and forms to ensure that overdimension vehicle operators provide load and complete route information so that CSX Transportation Corporation can ensure protection; ensure that CSX Transportation Corporation employees issuing permits are familiar with the process and include a staffed 24-hour CSX Transportation telephone number on the permit forms. On April 7, 1997, after learning that the CSXT revised its form to include a 24- hour telephone number, the Safety Board classified Safety Recommendation R-95-30 “Closed–Acceptable Action.” Sycamore, South Carolina—May 2, 1995 A low-clearance vehicle became lodged on the railroad tracks and was struck by an Amtrak passenger train, resulting in 33 injuries and over $1 million in damages.3 As a result of its investigation, the Safety Board made the following recommendations: To the U.S. Department of Transportation: H-96-01 Amend the Department of Transportation/Association of American Railroads Grade Crossing Inventory database to include vertical profile information on all highway-rail grade crossings in the United States. The U.S. Department of Transportation (DOT) advised the Safety Board in a February 10, 1997, letter that the Federal Railroad Administration (FRA) had contracted for modification of the Grade Crossing Inventory database to include the number of high- profile signs located at each crossing. According to the DOT, “zero would indicate that this is not a high-profile crossing (on the assumption that no road or railroad authority would identify a crossing as high-profile without taking appropriate action). Non-zero would indicate a high-profile crossing with appropriate signing.” The DOT further indicated that once modification to the database was complete, which was expected to occur by April 1997, the States and railroads would be instructed on the proper means to provide information to and access the modified database. 3 National Transportation Safety Board, Highway-Rail Grade Crossing Collision Near Sycamore, South Carolina, May 2, 1995, Highway Accident Report NTSB/HAR-96/01 (Washington, DC: NTSB, 1996).

Appendix B 56 Highway Accident Report The Safety Board classified Safety Recommendation H-96-01 “Open—Acceptable Response” on August 29, 1997. On that date, the Safety Board requested that the DOT consider including vertical profile data for each crossing in the Grade Crossing Inventory database. The Safety Board stated that it believed the inventory could be expanded in a cost-effective manner to include vertical profile data and measurements and that survey teams that currently collect State grade crossing data could easily be trained to make these measurements. H-96-02 Encourage and coordinate efforts between the railroad industry and State and local highway transportation officials to identify substandard grade crossing profiles (hump crossings) and close or take appropriate corrective action to eliminate them. H-96-03 Encourage States to post warning notices at hump crossings where high profiles present potential hazards for highway vehicles and where such hazardous profiles cannot be corrected in a timely manner. On February 10, 1997, in response to Safety Recommendations H-96-02 and -03, the DOT indicated that the Technical Working Group of the Grade Crossing Safety Task Force would address how appropriate road authorities (State and local) could establish a systematic procedure for gathering and applying local knowledge of substandard-profile crossings. The DOT stated that once State and local highway agencies, working with railroads, identified crossings with substandard profiles by reviewing accident data and consulting with highway engineers, local railroad officials, truckers, and public officials, the State and local agencies would be encouraged either to post the appropriate signs or correct the problem. On August 29, 1997, having noted the DOT’s positive efforts in response to these recommendations, the Safety Board requested to be informed when action on these recommendations had been completed and classified Safety Recommendations H-96-02 and -03 “Open–Acceptable Action.” H-96-04 Develop procedures and processes that will facilitate improved communication and coordination between the railroad industry and State and local highway transportation officials regarding crossing maintenance activities so as to prevent the creation of hump crossings. On February 10, 1997, the DOT outlined several activities that would be undertaken to address this recommendation, including establishing focal points within the States that could ensure proper coordination between highway authorities and railroads and that would serve as a clearinghouse for the collection and dissemination of pertinent information on how to prevent the creation of high-profile crossings to State and local highway authorities and railroads. On August 29, 1997, the Safety Board asked that it be informed when these activities had been completed and classified Safety Recommendation H-96-04 “Open–Acceptable Action.”

Appendix B 57 Highway Accident Report To the Federal Highway Administration: H-96-05 Adopt the proposed changes that are published in the notice of proposed amendments to the Manual on Uniform Traffic Control Devices regarding warning signs for substandard vertical profiles at railroad grade crossings. On September 5, 1997, the Federal Highway Administration advised the Safety Board that it had adopted the low-ground clearance warning highway-railroad grade crossing sign (W10-5). This sign, which has been incorporated into the Manual on Uniform Traffic Control Devices (MUTCD), is specifically designed to warn drivers of highway profile conditions sufficiently abrupt to create a “hang-up” situation for long wheelbase vehicles or low-ground clearance trailers. Subsequently, on January 2, 1998, the Safety Board classified Safety Recommendation H-96-05 “Closed–Acceptable Action.” To the American Association of Motor Vehicle Administrators: H-96-06 Revise the Commercial Driver’s License Manual to include specific information on hump crossings and ensure that truckdrivers are tested on their knowledge of grade crossing safety, with special emphasis on hump crossings. H-96-07 Revise the Commercial Driver’s License Manual to include information on grade crossing emergency notification procedures and ensure that truckdrivers are tested on their knowledge of these procedures. In March 1996, the American Association of Motor Vehicle Administrators indicated that the recommendations had been referred to its Test Maintenance Subcommittee and would be placed on the agenda for the next meeting. In May 1996, the Safety Board asked for progress reports on the subcommittee’s efforts to meet the intent of the recommendation. In February 1998, the Safety Board inquired about the status of the subcommittee’s actions and, having received no response from the American Association of Motor Vehicle Administrators, in July 1998, classified Safety Recommendations H-96- 06 and -07 “Closed–Unacceptable Action–No Response Received.” To the American Trucking Associations, Inc.: H-96-08 Advise your membership of the circumstances of this accident and during in- service training for all drivers, highlight the potential hazards associated with moving low-bed trailers over hump grade crossings. Include specific instructions for notifying authorities when emergencies or hazardous conditions exist at grade crossings.

Appendix B 58 Highway Accident Report The American Trucking Associations, Inc., responded that information regarding the accident has been published in its weekly newspaper Transport Topics and that it developed the video Physics 101, which highlights general training on grade crossing safety and specific training on the hazards of low-bed vehicles over grade crossings. The Safety Board classified Safety Recommendation H-96-08 “Closed–Acceptable Action” on September 6, 1996. To Operation Lifesaver, Inc.: H-96-09 In conjunction with appropriate trucking industry groups, expand your existing programs to educate truckdrivers who are not exposed to industry programs on the hazards of hump grade crossings. Operation Lifesaver, Inc., has created the brochure Highway-Rail Grade Crossings in which it has included the following text pertaining to grade crossings: “Do not get trapped on a highway-rail crossing. Never drive onto a railroad crossing until you are sure you can clear the tracks on the other side without stopping.” It has also created a training video that has a 10-minute video section and presents another 30 minutes of scheduled grade crossing information. Safety Recommendation H-96-09 has been classified “Closed–Acceptable Action.” To the Class 1 Railroads: R-96-03 Install signage for a 24-hour toll-free emergency telephone notification system for use by the public at all your highway-rail grade crossings. CSXT advised the Safety Board that it had posted the 1-800 phone number at all its public crossings. On August 20, 2000, the Safety Board classified Safety Recommendation R-96-03 “Closed–Acceptable Action.” Portage, Indiana—June 18, 1998 A two-car passenger train struck the second semitrailer of a long-combination vehicle loaded with steel coils at a highway-rail grade crossing near Portage, Indiana.4 When the vehicles collided, a steel coil, weighing about 19 tons, entered the train through the lead car’s front bulkhead and moved into the passenger compartment. Three fatalities and five minor injuries resulted and damages were estimated at $886,000. The Safety Board determined the probable cause of the collision was ineffective action by Federal, State, and private agencies to permanently resolve safety problems at the grade crossing, which they knew to be hazardous. 4 National Transportation Safety Board, Collision of Northern Indiana Commuter Transportation District Train 102 With a Tractor-trailer, Portage, Indiana, June 18, 1998, Railroad Accident Report NTSB/RAR-99/03 (Washington, DC: NTSB, 1999).

Appendix B 59 Highway Accident Report To the U.S. Department of Transportation: I-99-02 Eliminate any differentiations between private and public highway-rail grade crossings with regard to providing funding for, or requiring the implementation of, safety improvements. On May 8, 2000, the DOT advised the Safety Board that it proposed to amend the MUTCD by defining private highway-rail crossings, discussing issues related to private crossings, and adding a sign warning section. The Safety Board anticipates that with this language added to the MUTCD, differences between private and public highway-rail grade crossings will be eliminated. On August 16, 2000, the Safety Board classified Safety Recommendation I-99-02 “Open–Acceptable Response” pending receipt of the final rule amending the MUTCD. 1998 Passive Grade Crossing Safety Study As part of the 1998 passive grade crossing study,5 the Safety Board made the recommendations discussed below. To the Federal Railroad Administration: R-98-91 Modify the grade crossing inventory system to include information on (1) the sight distances available to a motorist, and (2) the presence of curves on the roadway and on the tracks. Direct the States to include these data as a part of the regularly scheduled updates of the database. The FRA updated the grade crossing inventory database, and, therefore, the Safety Board classified Safety Recommendation R-98-41 “Closed–Acceptable Action” on January 4, 2000. However, subsequent Safety Board investigations revealed that some information in the inventory is still outdated and incorrect. The FRA informed the Safety Board that such discrepancies occur because updating the information is voluntary, and the FRA said that it lacks the authority to require States or railroads to upgrade inventory information. The FRA stated that it has encouraged the States to provide up-to-date information for the inventory, but the States have not done so. To the 50 States: H-98-35 Determine within 2 years, in conjunction with the U.S. Department of Transportation, governmental oversight responsibility for safety at private highway-rail grade crossings and ensure that traffic control on these crossings meets the standards within the Manual on Uniform Traffic Control Devices. 5 National Transportation Safety Board, Safety at Passive Grade Crossings, Safety Study Report NTSB/SS-98/03 (Washington, DC: NTSB, 1998).

Appendix B 60 Highway Accident Report Florida stated in a June 7, 2000, letter that it did not have jurisdictional authority over private crossings. The Safety Board, in its October 16, 2000, response, encouraged Florida to introduce legislation to expand its authority to include private crossings. Because Florida responded in a November 9, 2000, letter that it will consider a legislative initiative to expand its highway-rail crossing authority when developing its legislative package next year, the Safety Board, on April 30, 2001, classified Safety Recommendation H-98-35 “Open–Acceptable Response” pending receipt of further information on the subject. Glendale, California—January 28, 2000 On January 28, 2000, about 5:56 a.m. in Glendale, California, a tractor- combination vehicle missed a turn in its planned route, traversed a highway-rail grade crossing, turned around, and was attempting to retraverse the crossing when it became lodged on the railroad tracks. About 90 seconds later, a commuter train collided with the vehicle. The engineer, conductor, and four passengers received minor injuries.6 The tractor-combination vehicle measured 135 feet long, 15 feet wide, and 18 feet 6 inches high, with a ground clearance of approximately 6 inches; the gross vehicle weight was 226,000 pounds. The load, valued at $1.5 million, was being transported from Houston, Texas, to El Segundo, California, and possessed specialized moving permits requiring escort vehicles. At the time of the accident, two private pilot vehicles and three California Highway Patrol officers were escorting the tractor-combination vehicle. The Safety Board determined that the probable cause of the collision of the passenger train with the tractor-combination vehicle was (1) inadequate preparation and route planning for the movement; (2) poor coordination of the movement among the truckdriver, pilot car drivers, police escort, and permitting authorities; and (3) a lack of recognition of the potential hazard caused by the accident vehicle at the grade crossing. Contributing to the accident was the fatigue of the pilot car drivers and the truckdriver. As a result of its investigation, the Safety Board made the following safety recommendations: To the Federal Highway Administration, in cooperation and consultation with the Federal Motor Carrier Safety Administration, the American Association of State Highway and Transportation Officials, the American Association of Motor Vehicle Administrators, the Commercial Vehicle Safety Alliance, the Specialized Carriers & Rigging Association, the California Professional Escort Car Association, the Texas Pilot Car Association, and the United Safety Car Association: 6 National Transportation Safety Board, Collision Between Metrolink Train 901 and Mercury Transportation, Inc., Tractor-Combination Vehicle at Highway-Railroad Grade Crossing in Glendale, California, January 28, 2000, Highway Accident Report HTSB/HAR-01/02 (Washington, DC: NTSB, 2001).

Appendix B 61 Highway Accident Report H-01-30 Develop a model pilot car driver training program. The training program should address, at a minimum, issues such as (1) how to conduct route surveys; (2) the maneuvering limitations of heavy-haul vehicles; (3) the effects of fatigue on performance; (4) the need to assess the dangers at railroad crossings, particularly for low-clearance vehicles; and (5) the need and requirements to notify the railroads before an oversize/overweight vehicle is escorted across a highway-rail grade crossing. (“Open—Await Response”) H-01-31 Develop model oversize/overweight vehicle movement guidelines. The guidelines should address, at a minimum, issues such as (1) when pilot cars and police escorts are required; (2) the training, testing, and certification of pilot car operators, police officers, and truckdrivers in the movement of oversize/overweight loads; (3) the use of height poles and traffic controls; (4) how to conduct route surveys; (5) the maneuvering limitations of heavy-haul vehicles; (6) the effects of fatigue on performance; (7) the need to assess the dangers at railroad crossings, particularly for low-clearance vehicles; and (8) the need and requirements to notify the railroads before an oversize/overweight vehicle is escorted across a highway-rail grade crossing. (“Open—Await Response”) To the Federal Motor Carrier Safety Administration, the American Association of State Highway and Transportation Officials, the American Association of Motor Vehicle Administrators, the Commercial Vehicle Safety Alliance, the Specialized Carriers & Rigging Association, the California Professional Escort Car Association, the Texas Pilot Car Association, and the United Safety Car Association: H-01-32 Work with the Federal Highway Administration to develop a model pilot car driver training program. The training program should address, at a minimum, issues such as (1) how to conduct route surveys; (2) the maneuvering limitations of heavy-haul vehicles; (3) the effects of fatigue on performance; (4) the need to assess the dangers at railroad crossings, particularly for low-clearance vehicles; and (5) the need and requirements to notify the railroads before an oversize/overweight vehicle is escorted across a highway-rail grade crossing. H-01-33 Work with the Federal Highway Administration to develop model oversize/overweight vehicle movement guidelines. The guidelines should address, at a minimum, issues such as (1) when pilot cars and police escorts are required; (2) the training, testing, and certification of pilot car operators, police officers, and truckdrivers in the movement of oversize/overweight loads; (3) the use of height poles and traffic controls; (4) how to conduct route surveys; (5) the maneuvering limitations of heavy-haul vehicles; (6) the effects of fatigue on performance; (7) the need to assess the dangers at railroad crossings, particularly for low-clearance vehicles; and (8) the need and requirements to notify the railroads before an oversize/overweight vehicle is escorted across a highway-rail grade crossing.

Appendix B 62 Highway Accident Report On January 25, 2002, the California Professional Escort Car Association, advised the Safety Board that it had formed a committee to address the issues brought to its attention in the Glendale accident report. In addition, Safety Board staff made two presentations during the last 6 months at the association’s meetings. On April 3, 2002, the Safety Board classified Safety Recommendations H-01-32 and -33 “Open–Acceptable Response” to the California Professional Escort Car Association. The status to the other recipients of these recommendations is “Open—Await Response.” To the Federal Highway Administration and the American Association of State Highway and Transportation Officials: H-01-34 Encourage the States to adopt the model oversize/overweight vehicle movement guidelines, as addressed in Safety Recommendations H-01-31 and –33, and once developed, to require that oversize/overweight vehicle movements conform to the guidelines. (“Open—Await Response”) To the City of Glendale, California: H-01-35 Install low-clearance highway-railroad grade crossing signs (W10-5s) at the Grandview Avenue crossing and evaluate other crossings to determine whether the signs are warranted and, if so, install them. On January 31, 2002, the City of Glendale California advised the Safety Board that on December 28, 2001, low-clearance highway-rail grade crossing signs (W10-5s) were installed at the Grandview Avenue crossing. On April 8, 2002, the Safety Board learned that all other grade crossings were inspected and did not warrant the signs. Accordingly on May 17, 2002, the Safety Board classified Safety Recommendation H-01-35 "Closed– Acceptable Action." To the Commercial Vehicle Safety Alliance, the International Association of Chiefs of Police, and the National Sheriffs’ Association: H-01-36 Notify your members of the circumstances of the Glendale, California, accident and encourage them to train their officers to make sure (1) that documentation regarding permits is reviewed and verified; (2) that safety briefings to discuss routings and special conditions, including the hazards associated with moving oversize/overweight vehicles over grade crossings, are conducted; (3) that provisions for handling off-route loads are in place; and (4) that necessary notification to the railroads is made before an oversize/overweight vehicle is escorted across a highway-rail grade crossing. (“Open—Await Response”)

Appendix B 63 Highway Accident Report To the Specialized Carriers & Rigging Association: H-01-37 Notify your members of the circumstances of the Glendale, California, accident and during in-service training for heavy-haul drivers, (1) highlight the potential hazards associated with moving low-clearance trailers over grade crossings and (2) emphasize the need to notify the railroads before an oversize/overweight vehicle is escorted across a highway-rail grade crossing. (“Open—Await Response”) On March 12, 2002, the Specialized Carriers & Rigging Association advised the Safety Board that it has been actively working with the Board for 20 months to educate the association’s members on oversize/overweight accidents. Safety Board staff made presentations at three transportation and safety conferences over the past 12 months. In addition, the association agrees with the fundamental premise that improved planning, communications, and training can help promote safety performance and help reduce accidents, injuries, fatalities, and property losses. Also, the association indicated that it welcomed the opportunity to work cooperatively with the appropriate organizations to develop guidelines and training to foster improvements in pilot car operations and in the general movements of oversize/overweight loads.

64 Highway Accident Report Appendix C Florida Department of Transportation Brochure and Applicable State Statutes for Railroad Authority Note: The brochure was available at one time only, some time before 1997.

Appendix C 65 Highway Accident Report

Appendix C 66 Highway Accident Report

67 Highway Accident Report Appendix D State Railroad Notification Requirements State Permit office Specialized Carriers & Rigging Association Federal Railroad Administration/ State law book State motor vehicle code Alabama No No No Nof Alaska Noa No Yes Yes Arizona No Noe Yes Yes Arkansas No Noe Yes Yes California No No No No Colorado No Yes Yes Yes Connecticut No Noe No No Delaware No Yes Yes Yes Florida Yesb Yes Yes Yes Georgia No Yes Yes Yes Hawaii No No No No Idaho Yes Yesc Yes Yes Illinois Yes Yes Yes Yes Indiana Yes Yes Yes Yes Iowa No Yes Yes Yes Kansas No Yesd Yes Yes Kentucky No No No No Louisiana Yes Yes Yes Yes Maine No No No No Maryland No Yes Yes Yes Massachusetts No No No No Michigan No No Yes Yes

No 68 Highway Accident Report State Permit office Specialized Carriers & Rigging Association Federal Railroad Administration/ State law book State motor vehicle code Minnesota No Noe No Nof Mississippi No Noe Yes Yes Missouri No No No No Montana No Yes Yes Yes Nebraska No Noe No Nof Nevada No Noe No Nof New Hampshire No Noe Yes Yes New Jersey No Yes Yes Yes New Mexico Yes Noe Yes Yes New York Nog Nof Nof Nof North Carolina Yes Yes Yes Yes North Dakota No Nof Nof Nof Ohio Yes Yesh Yesh Yesh Oklahoma No Nof No No Oregon No Noe Yes Yes Pennsylvania No Yes Yes Yes Rhode Island No No Yes Yes South Carolina Yes Yesc Yes Yes South Dakota No Noe Yes Yes Tennessee No Noe Nof Nof Texas No Noe Yes Yes Utah Noi Nof Yes Yes Vermont No No Nof Nof Virginia No Yesj Yesj Yesj Washington Nok Yes Yes Yes West Virginia Yes No Yes Yes Appendix D

69 Highway Accident Report State Permit office Specialized Carriers & Rigging Association Federal Railroad Administration/ State law book State motor vehicle code Wisconsin No No No No Wyoming No No Yes Yes a Notification required only for vehicles with a height of 17 feet or more and a length of 150 feet or more. b The Florida Permit Office indicated that it does not routinely verify that an oversize vehicle will traverse a grade crossing. c Only lists the statute number. d Applies only to slow-moving vehicles--speed not specified. The text of the Kansas law does include a low-ground clearance provision. e Indicates “No rule on file.” f Specified vehicles are required to stop and then proceed with caution. g State Permit Office Policy that proof of notification is required prior to the issuance of special moving permit. h Notification required for vehicles with a sustained speed of not more than 3 mph and a ground clearance of less than 9 inches. i Utah requires vehicles/loads over 16 feet traversing highway-railroad grade crossings with railroad warning lights cantilevered over the grade crossing to notify the railroad before traversing the crossing. j Rule does not apply in cities or towns. k Washington requires vehicles over 16 feet wide, over 16 feet in height, and weighing over 200,000 pounds to notify the railroad before traversing a highway-railroad grade crossing. Appendix D

this page intentionally left blank

FD07255 ｜ 2002_美国_HAR0203.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2002 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Highway Accident Report Collision Between Truck-Tractor Semitrailer and School Bus Near Mountainburg, Arkansas on May 31, 2001 National Transportation Safety Board Washington, D.C. A A N T I O N L T R A S P O R A T I O N B O A R D S A F E T Y N T E

P L U R IB US UN U M

NTSB/HAR-02/03 PB2002-916203

this page intentionally left blank

Highway Accident Report Collision Between Truck-Tractor Semitrailer and School Bus Near Mountainburg, Arkansas on May 31, 2001 NTSB/HAR-02/03 PB2002-916203 National Transportation Safety Board Notation 7490 490 L’Enfant Plaza, S.W. Adopted September 4, 2002 Washington, D.C. 20594

National Transportation Safety Board. 2002. Collision Between Truck-Tractor Semitrailer and School Bus Near Mountainburg, Arkansas, on May 31, 2001. Highway Accident Report. NTSB/HAR-02/03. Washington, DC. Abstract: On May 31, 2001, near Mountainburg, Arkansas, a Gayle Stuart Trucking, Inc., truck-tractor semitrailer collided with a 65-passenger school bus operated by the Mountainburg, Arkansas, Public Schools. Three school bus passengers were fatally injured; two other passengers received serious injuries. Four passengers, the school bus driver, and the truckdriver sustained minor injuries. The major safety issues discussed in this report are the poor condition of the tractor semitrailer brakes, inadequate motor carrier inspections and oversight, the use of propane tanks on school buses, and occupant protection within school buses. As a result of its investigation, the Safety Board made recommendations to the Federal Motor Carrier Safety Administration, the National Highway Traffic Safety Administration, the Commercial Vehicle Safety Alliance, the National Fire Protection Association, and spring brake manufacturers. The Safety Board reiterated a recommendation to the U.S. Department of Transportation. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2002-916203 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Highway Accident Report Contents Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Truck . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 School Bus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Collision . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Toxicological Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Survivability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Driver Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Truckdriver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 School Bus Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Vehicle and Wreckage Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Truck-Tractor Semitrailer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 School Bus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Highway Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Highway Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Tire Marks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Operational Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Gayle Stuart Trucking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Mountainburg Public Schools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Management Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Gayle Stuart Trucking Company . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Federal Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 State Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Sight Distance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Brake Heat Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Simulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Brake Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Brake Adjustment Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Spring Brakes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Contents iv Highway Accident Report Accident Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Truck Brakes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Recommendation History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Accident Vehicle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Motor Carrier Inspection and Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Recommendation History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Compliance Reviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Qualified Brake Inspector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Fuel Tanks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Recommendation History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Mountainburg Accident School Bus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Occupant Kinematics and Survival Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Recommendation History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Mountainburg Accident School Bus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Appendixes A: Investigation and Public Hearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

v Highway Accident Report Acronyms and Abbreviations ASHTD Arkansas State Highway and Transportation Department AASHTO American Association of State Highway and Transportation Officials ArvinMeritor ArvinMeritor, Inc. Bendix Bendix Commercial Vehicle Brake Systems CDL Commercial Driver’s License CFR Code of Federal Regulations CVSA Commercial Vehicle Safety Alliance DOT U.S. Department of Transportation EMTs emergency medical technicians FHWA Federal Highway Administration FMCSA Federal Motor Carrier Safety Administration FMCSRs Federal Motor Carrier Safety Regulations FMCSR Federal Motor Carrier Safety Regulation FMVSSs Federal Motor Vehicle Safety Standards Haldex Haldex Brake Systems Hammond Hammond Yellow Coach Lines, Inc. I-540 Interstate 540 Kenworth Kenworth Truck Company MCSAP Motor Carrier Safety Assistance Program MUTCD Manual on Uniform Traffic Control Devices NFPA National Fire Protection Association NHTSA National Highway Traffic Safety Administration OMC Office of Motor Carriers psi pounds per square inch SH-282 State Highway 282 Stuart Trucking Gayle Stuart Trucking, Inc.

vi Highway Accident Report Executive Summary On May 31, 2001, about 3:28 p.m. central daylight time, a southbound Gayle Stuart Trucking, Inc., truck-tractor semitrailer exited Interstate 540 at State Highway 282 near Mountainburg, Arkansas. The driver was unable to stop at the stop sign at the bottom of the ramp. The 79,040-pound combination unit was traveling approximately 48 mph when it entered the intersection and collided with the right side of a westbound, 65- passenger, 1990 Blue Bird Corporation school bus operated by the Mountainburg, Arkansas, Public Schools. The school bus rotated approximately 300 degrees clockwise and overturned; the body, which partially separated from the chassis, came to rest on its right side on the eastbound shoulder of State Highway 282. The tractor semitrailer continued across the roadway, rotated about 60 degrees clockwise, overturned, and came to rest on its left side. Three school bus passengers seated across from the impact area were fatally injured; one was partially ejected. Two other passengers, one of whom was seated in the impact area, received serious injuries, and four passengers had minor injuries. The school bus driver and the truckdriver both sustained minor injuries. The Safety Board determines that the probable cause of the accident was the truckdriver’s inability to stop the tractor semitrailer at the stop sign at the bottom of the ramp due to the reduced braking efficiency of the truck’s brakes, which had been poorly maintained and inadequately inspected. Contributing to the school bus passengers’ injuries during the side impact were incomplete compartmentalization and the lack of energy-absorbing material on interior surfaces. The major safety issues discussed in this report are the poor condition of the tractor semitrailer brakes, inadequate motor carrier inspections and oversight, the use of propane tanks on school buses, and occupant protection within school buses. As a result of its investigation, the Safety Board makes recommendations to the Federal Motor Carrier Safety Administration, the National Highway Traffic Safety Administration, the Commercial Vehicle Safety Alliance, the National Fire Protection Association, and spring brake manufacturers. The Safety Board reiterates a recommendation to the U.S. Department of Transportation.

1 Highway Accident Report Factual Information Accident Narrative On May 31, 2001, about 3:28 p.m. central daylight time, a southbound Gayle Stuart Trucking, Inc., (Stuart Trucking) truck-tractor semitrailer exited Interstate 540 (I- 540) at State Highway 282 (SH-282) near Mountainburg, Arkansas. The driver was unable to stop the tractor semitrailer at the stop sign at the bottom of the ramp. The 79,040-pound tractor semitrailer was traveling approximately 48 mph when it entered the intersection and collided with the right side of a westbound, 65-passenger, 1990 Blue Bird Corporation school bus, traveling about 50 mph, and operated by the Mountainburg, Arkansas, Public Schools. The school bus rotated approximately 300 degrees clockwise, overturned, and came to rest on its right side on the eastbound shoulder of SH-282. The tractor semitrailer continued across SH-282, rotated about 60 degrees clockwise, overturned, and came to rest on its left side. Truck The truckdriver departed his home in Vandalia, Missouri, on May 28, 2001, for a 4-day trip through Iowa, Missouri, and Arkansas. On May 31, the day of the accident, the driver stated that he awoke about 8:00 a.m., conducted a 30-minute pretrip inspection, and departed Kingdom City, Missouri, where he had slept in his sleeper berth the previous night. He had picked up a load of bean meal in Mexico, Missouri, earlier that morning (approximately 1:44 a.m., according to the bill of lading) and was en route to Atkins, Arkansas (see figure 1). The driver stopped near Joplin, Missouri, about 1:30 p.m. for a sandwich.

Factual Information 2 Highway Accident Report The driver said that in the vicinity of Fayetteville, Arkansas, he determined that he would need fuel near Mountainburg, where he knew of a truck stop on SH-282. The driver stated that he had stopped at the truck stop on several occasions while traveling northbound on I-540, but had not exited there before while traveling southbound. About 3:28 p.m., as the driver was southbound on I-540, he exited the ramp to SH-282; he estimated his speed to be approximately 20 to 25 mph, and he indicated that his truck was in sixth gear. He said that he attempted to downshift and brake at the top of the ramp, but the brakes did not operate. He stated that he continued to apply the brakes but was unsuccessful in slowing the vehicle, and it continued to accelerate down the ramp. The driver indicated that as he approached the intersection, he did not see any traffic ahead and was unable to see any traffic on westbound SH-282 due to a berm to the left (east) of the ramp. The driver said that he planned to try to stop the vehicle by proceeding directly across SH-282 and onto the upgrade of the I-540 southbound entrance ramp. As he entered the intersection, the driver stated that he saw the westbound school bus and was unable to avoid the collision. Figure 1. Truck route.

Factual Information 3 Highway Accident Report School Bus The school bus picked up students at Mountainburg Elementary School about 2:50 p.m., drove to Mountainburg High School to pick up more students, and departed the high school between 3:00 and 3:05 p.m. for the afternoon route home. The bus had made three stops on the route to unload students before dropping off a student at a truck stop on SH- 282 and proceeding westbound on SH-282 at a driver-estimated speed of 45 mph. The driver stated that as he was nearing the ramp, he heard a passenger shout that a truck was not going to stop at the stop sign on the ramp. The driver said he briefly looked to his right, glimpsed the truck, and heard the loud sound of the collision. Collision The tractor semitrailer hit the bus on the right side in the area of the rear axle. The truck continued south across SH-282, traveled 73 feet from the point of impact, rolled on its left side, and traveled an additional 78 feet, rotating about 60 degrees clockwise (see figures 2 and 3). The school bus traveled 96 feet southwest from the area of impact, rotating about 300 degrees clockwise. The body, which partially separated from the chassis, rolled onto its right side, while the chassis remained partially upright (see figure 4). Injuries Table 1. Injuries.1 INJURIES SCHOOL BUS DRIVER TRUCKDRIVER BUS PASSENGERS TOTAL Fatal 0 0 3 3 Serious 0 0 2 2 Minor 1 1 4 6 None 0 0 0 0 Total 1 1 9 11 1 Title 49 Code of Federal Regulations (CFR) 830.2 defines a fatal injury as any injury that results in death within 30 days of the accident. It defines a serious injury as an injury that requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; results in a fracture of any bone (except simple fractures of the fingers, toes, or nose); causes severe hemorrhages, nerve, muscle, or tendon damage; involves any internal organ; or involves second or third degree burns or any burns affecting more than 5 percent of the body surface.

Factual Information 4 Highway Accident Report Figure 2. Postcrash accident scene.

Factual Information 5 Highway Accident Report Figure 3. Tractor semitrailer, postaccident. Figure 4. School bus, postaccident.

Factual Information 6 Highway Accident Report Medical and Pathological Information The truckdriver’s minor injuries included contusions on the right side of his head, upper right arm, and left shoulder. The busdriver’s minor injuries included contusions on the left side of his face, left shoulder, and left hip. Because of a coronary condition, he was hospitalized after the accident as a precaution. The passengers who sustained minor injuries were seated in seats 1A, 2A, 2C, and 2E (see figure 5). The passenger in seat 1A sustained a contusion on the left side of his scalp. The passenger in seat 2A sustained a contusion on the left side of her scalp and a possible contusion or laceration of the spleen. The passenger in 2C sustained lacerations and contusions on the right elbow, and the passenger in seat 2E had lacerations and contusions on her right elbow and on the back of both knees. Figure 5. Mountainburg school bus seating chart.

Factual Information 7 Highway Accident Report Two seriously injured passengers were seated in the rear of the bus. One was seated in the area of impact (seat 10E) and sustained lacerations to his head and elbow and a closed head injury. The other, seated across from the area of impact (seat 10A), sustained multiple spinal fractures and a fractured right arm and leg. The three fatally injured passengers were seated across from the area of impact. The passenger in seat 9A sustained a fractured skull, fractured left clavicle, three fractured ribs, and a compound fracture of the left leg; the passenger in 9C sustained multiple lacerations and contusions, a right pelvic fracture, a liver laceration, a right renal laceration, ruptured right hemidiaphragm, and vena cava injury; the passenger in 11A, who was partially ejected, had a skull fracture, multiple spinal fractures, and a fractured left tibia. Toxicological Tests Federal Motor Carrier Safety Regulations (FMCSRs)2 required that postaccident alcohol and drug testing3 be performed on both the truckdriver and the busdriver. The postaccident toxicological tests on the truckdriver, conducted by Arkansas State Police and Crawford Memorial Hospital, were negative for alcohol and other drugs. A sample was sent to the Civil Aerospace Medical Institute to test for Cetirizine, the main component of Zyrtec, an allergy medication.4 Test results were negative. Results of postaccident toxicological tests conducted by the Arkansas State Police for the school bus driver were negative for alcohol and other drugs. Survival Aspects Emergency Response The Crawford County Communications Center and the Mountainburg Police Department received notification of the accident at 3:29 p.m. The Mountainburg police chief arrived on scene at 3:31 p.m. and two rescue vehicles arrived at 3:35 p.m. The rescue vehicles were manned by eight firefighters, five of whom were qualified first responders and emergency medical technicians (EMTs). A triage area, where the injured were evaluated and treated, was established on the left side of the school bus. After the triage site was set up, a Lifeflight Air Ambulance (helicopter) was dispatched from Branson, Missouri, about 45 minutes flying time from the accident site. Four additional fire departments and one ambulance service, comprising 25 fire fighters and EMTs, three rescue vehicles, a pumper truck, and seven ambulances, responded to the accident. By 2 Title 49 CFR Part 382.303. 3 Title 49 CFR Part 40.21 requires that drug testing be done for marijuana, cocaine, opiates, amphetamines, and phencyclidine. 4 The driver stated that he occasionally took Zyrtec for allergies on an as-needed basis.

Factual Information 8 Highway Accident Report 3:45 p.m., the ambulances had transported eight of the injured passengers, the busdriver, and the truckdriver from the scene (the helicopter was not needed). One partially ejected passenger (seat 11A) was under the bus. He was extricated by 3:52 p.m. and pronounced dead at the scene. At the postaccident critique attended by all participating agencies, the consensus was that the response was timely and resources were adequate, according to the on-scene police and firefighters. Survivability The truckdriver said he was wearing his lap belt only; the truck was equipped with a separate shoulder belt. He said that during the accident sequence his leg became wedged under the dashboard due to the deformation of the cab. After the truck came to rest, he was able to slide the seat back to free his leg and climb out through the broken windshield. The school bus driver stated that he was wearing his lap belt (the bus was only equipped with a lap belt), which was found tied in a knot during postaccident examination but still usable; no striations were found on the belt webbing. The driver reported that he was unable to get out of the lap belt after the bus came to rest because the weight of his body against the belt jammed the buckle and prevented him from unlatching it. One of the passengers unlatched the driver’s belt. The driver reported that he struck his head, elbows, and chest on the interior of the bus as it rolled over. The busdriver and two passengers (seats 1A and 2B) were able to exit from the bus on their own via the rear emergency door. The busdriver helped the seriously injured passenger in seat 10E exit the bus. EMTs and passersby removed two fatally injured passengers (seats 9A and 9C), one seriously injured passenger (seat 10A), and two passengers with minor injuries (seats 2A and 2D) from the bus. EMTs extricated the third fatally injured passenger (seat 11A) from underneath the bus; this passenger had been partially ejected through the right side window at row 11. The passenger in the front of the bus said that at the end of the impact sequence, he was lying on the “floor,” which, postcollision, was the right side of the bus. The passenger in seat 10E said he was lying on the right side of the bus when it came to rest and that the passenger in seat 9A was laying across his legs. Evidence indicates the passengers in the back of the bus struck the ceiling, right side windows, and sidewall during the impact sequence. Damage Both the school bus and truck tractor were completely destroyed. The semitrailer received minor damage and the load was unusable.

Factual Information 9 Highway Accident Report Driver Information Truckdriver The 25-year-old truckdriver possessed a current Missouri class A Commercial Driver’s License (CDL), with no restrictions or endorsements, issued on March 15, 1999, and scheduled to expire on March 15, 2002. A review of the driver’s record revealed a speeding conviction while driving a personal vehicle on November 19, 2000, and a failure-to-keep-right conviction while driving a commercial vehicle on July 30, 1999. The driver had a valid medical certificate that was issued on May 7, 2001, and scheduled to expire on May 7, 2003. Interviews with the truckdriver and an examination of his employment records showed that he started driving commercial vehicles professionally in March 1999. Stuart Trucking was his first employer. He subsequently worked for McDowell Farms of Perry, Missouri; Target Aluminum of Vandalia, Missouri; and Jennings Implement of Curryville, Missouri, from June 2000 to April 2001. He returned to Stuart Trucking in April 2001. The truckdriver acknowledged that the logs he kept between May 28 and 31, 2001, were not accurate because he had reconstructed his activities and completed the logs at the end of each day. Safety Board investigators reconstructed the driver’s off-duty rest times based on an interview with the driver, fuel receipts, bills of lading, and travel times between locations. Table 2, which follows, shows the driver’s stated rest time, the times on the receipts, and the driver’s likely hours of sleep during the days prior to the accident. The driver stated that he was in good general health, but occasionally suffered from a chronic back problem stemming from a childhood injury. He said he was not experiencing back pain on the day of the accident. He also suffered from a dust allergy and occasionally took Zyrtec for relief of symptoms. He said he last used the medication 2 weeks before the accident, and toxicological tests did not reveal any Zyrtec in the driver’s blood. The driver’s medical records did not indicate any other medical conditions.

Factual Information 10 Highway Accident Report Table 2. Driver’s off-duty/rest times. School Bus Driver The 76-year-old school bus driver possessed a current Arkansas class B CDL, with a passenger endorsement and a school bus restriction, that was issued on April 7, 1999, and scheduled to expire on March 18, 2003. A review of the busdriver’s record revealed no traffic convictions. He had been involved in a traffic accident on February 15, 2001; while exiting school property, the bus struck the right side of a passenger car as he entered the roadway. No one was injured and the busdriver was not cited for the accident. The busdriver had passed his most recent annual physical examination on August 1, 2000, as required by the Mountainburg Public Schools.5 He had been driving school buses for 14 years and had been driving this route for 3 years. Vehicle and Wreckage Information Truck-Tractor Semitrailer The accident vehicle, a 1989 Kenworth Truck Company (Kenworth) model T600A conventional-cab, three-axle tractor, was equipped with a nine-speed transmission and had a sleeper berth; it was towing a two-axle, 43-foot hopper6 semitrailer, model DWH-400, DATE DRIVER’S STATED REST TIMES RECEIPTS LIKELY TIMES OF SLEEP TOTAL SLEEP (HOURS) MAY 26 0100-0900 (Home) 8.0 MAY 27 0100-1000 (Home) 9.0 MAY 28 0001-1030 (Home) 2330-2400 (Truck, Mt. Pleasant, Iowa) 2053 (Bowling Green, Missouri) 2330 (Mt. Pleasant, Iowa) 0001-1030 2330-2400 10.5 0.5 MAY 29 0001-0500 (Truck, Mt. Pleasant, Iowa) 0900-1100 (Truck, Davenport, Iowa) 1250 (Davenport, Iowa) 1756-1821 (Eddyville, Iowa) 0001-0500 5.0 MAY 30 0001-0630 (Truck, Mexico, Missouri) 1300-1400 (Truck, Siloam Springs, Arkansas) 0714 (Kingdom City, Missouri) 1247-1508 (Siloam Springs, Arkansas) 1629-1736 (Noel, Missouri) 2310 (Meta, Missouri) 0001-0630 6.5 MAY 31 0230-0830 (Truck, Kingdom City, Missouri) 0144 (Mexico, Missouri) 0230-0800 5.5 5 All school bus drivers are required to have an annual physical prior to the beginning of each school year.

Factual Information 11 Highway Accident Report built by Wilson Trailer Company in 1996. The tractor, leased to Stuart Trucking, was powered by a six-cylinder Caterpillar diesel engine without an engine brake; it was originally equipped with an electronic control module that had been removed in 1999. Both the odometer, which read 2,967.2 miles at the time of the accident, and speedometer had been replaced.7 The tractor had a wheelbase of 222 inches and a curb weight of 16,805 pounds. According to Stuart Trucking records, the tractor had received its mandatory annual inspection, performed by an employee of Stuart Trucking, on April 17, 2001; the inspection form listed all brake components as “OK.” Prior to that inspection, the tractor had been idle for about 2 years. The hopper, owned by Stuart Trucking and used to haul grain and animal feed, weighed about 10,100 pounds empty. It had received its annual inspection, performed by an employee of Stuart Trucking, on July 3, 2000; the inspection form listed all brake components as “OK.” The hopper had been used as a spare at least once a month for about 18 months prior to the accident. Brakes. A Safety Board postaccident examination revealed that all three tractor axles had air brakes (see figure 6) with standard S-cam/drum foundation (service) brakes (see figure 7) fitted with manual slack adjusters.8 The semitrailer (hopper) had air brakes with standard S-cam/drum foundation brakes; its two axles had automatic slack adjusters. The third axle of the tractor and both trailer axles had emergency-parking spring brakes. Background. About 95 percent of large (26,000 pounds or greater) commercial vehicles are equipped with air brakes with S-cam/drum foundation brakes. The purpose of the service brake components is to convert air pressure into mechanical forces used to decelerate the vehicle. Once air has been directed through lines and valves, it reaches a brake chamber (see figure 6). Brake chambers vary in size and provide a wide range of output forces. Compressed air flows into the brake chamber, where it acts on a pressure plate attached to a pushrod. The air forces the pressure plate to move, extending the pushrod with a force proportional to the air pressure applied to the brake chamber. (This movement is referred to as the pushrod stroke or travel.) Under ideal circumstances, a pressure of 40 pounds per square inch (psi) supplied to a brake chamber with a pressure plate of 30 square inches (a Type 30 brake chamber) results in 1,200 pounds of force on the pushrod. This ideal situation excludes any losses due to friction, loose bearing surfaces, or component stretch and expansion. Such losses reduce actual pushrod forces. 6 A hopper is a box-shaped container with a funnel at the bottom used for delivering grain and other agricultural products. 7 Because the original electronic speedometer did not work when the engine control module was removed, the speedometer was replaced. 8 A slack adjuster multiplies and converts the force from the pushrod into torque on the shaft running perpendicular to the brake drum, rotating the S-cam and spreading the brake shoes inside the brake drum. A manual slack adjuster is adjusted by the operator, who turns the adjusting nut to compensate for lining wear so the pushrod is not required to extend farther out than it is able. An automatic slack adjuster performs this function automatically.

Factual Information 12 Highway Accident Report In an S-cam air brake system, the pushrod is attached to one end of a lever called a slack adjuster (see figure 7). The slack adjuster multiplies and converts the force from the pushrod into torque on the shaft running perpendicular to the brake drum. As the pushrod is extended from the brake chamber, the slack adjuster rotates, in turn rotating the shaft connected to it. The S-cam also rotates, spreading the brake shoes inside the brake drum. When the brake shoes are spread apart, the brake linings (riveted to the shoes) come into contact with the inside of the brake drum. The friction created slows the rotation of the brake drum and, thus, the wheel and the vehicle. To compensate for lining wear, slack adjusters are equipped with an adjusting mechanism. If they were not, the pushrod would be required to extend continually farther out as the lining wore down until the pressure plate in the brake chamber came into contact with the bottom of the brake chamber. Known as “bottoming out” a brake chamber, the resulting pushrod stroke is the maximum stroke listed in the manufacturer’s brake literature. Bottoming out results in no braking because the pushrod cannot travel far enough to rotate the S-cam sufficiently to expand the brake shoes so that they make contact with the drum. Manual slack adjusters must be adjusted by hand with a wrench, while automatic slack adjusters compensate for lining wear without being adjusted manually. Figure 6. Brake diagram.

Factual Information 14 Highway Accident Report During postaccident inspection, investigators measured the brake stroke for each of the brakes with 90 psi of air supplied.10 Of the 10 brakes on the tractor semitrailer, 8 were found to be out of adjustment or nonfunctional. Table 3. Brake types and manufacturers. Table 4 shows the adjustment for each brake. The driver stated that he and the owner of the tractor (his father) had installed manual slack adjusters on the second and third axles of the tractor on May 27, 2001, as preventive maintenance, because the old slack adjusters would not “take grease.” The owner said he adjusted the brakes on the second and third axles at that time by tightening the shoe against the drum and then backing off the adjusting nut about 1/2 turn. The owner also stated that he liked the steering axle brakes (first axle) to be adjusted “loose” and backed off the adjusting nut 3/4 turn. 10 Because of accident damage, the tractor brakes were operated using the brake pedal and shop air; the trailer brakes were operated from the brake pedal of an auxiliary tractor compressing its own air. AXLE CHAMBER SIZE SLACK ADJUSTER EMERGENCY PARKING/SPRING BRAKE CAGING PORT 1 Left (tractor) T-20 Midland Manual None None 1 Right (tractor) T-20 Midland Manual None None 2 Left (tractor) T-30 Midland Manual None None 2 Right (tractor) T-30 Midland Manual None None 3 Left (tractor) T-30/30 Midland Manual Remanufactured Standard 3 Right (tractor) T-30/30 Midland Manual Anchorlok Standard 4 Left (trailer) T-30/30 Rockwell Automatic Midland Standard 4 Right (trailer) T-30/30 Rockwell Automatic Anchorlok Fixed Integrated 5 Left (trailer) T-30/30 Rockwell Automatic Midland Standard 5 Right (trailer) T-30/30 Rockwell Automatic Anchorlok Fixed Integrated

Factual Information 15 Highway Accident Report Table 4. Brake adjustment.

• Manufacturers’ recommended maximum adjustment length.

** Out of adjustment or not functioning properly. The driver reported that he checked his brakes about 8:00 a.m. on the day of the accident by doing a walk-around inspection and looking at the brakes while the parking brake was on. He said that the brakes did not appear to need adjustment, although he noticed that the right-front axle brake chamber was rusted. He stated that he did not climb beneath the vehicle to observe the brakes. To check manual slack adjusters on S-cam brakes, according to the Model Driver's Manual for Commercial Vehicle Driver Licensing: A driver should park on level ground and chock the wheels to prevent the vehicle from moving. He must then turn the parking brake off in order to move the slack adjuster by hand. If the slack adjuster moves more than one inch where the push rod attaches then it probably needs adjustment.11 The driver said that the brakes on the tractor were adjusted weekly, even though doing so might not be necessary, and he described to investigators the correct procedure for adjusting brakes. He also stated a preference for adjusting the trailer axle brakes “loose” to prevent the trailer from slipping in wet and other conditions. He said that he had AXLE MAXIMUM STROKE ALLOWED* MEASURED STROKE NOTES 1 Left (tractor) 1 3/4 inches 2 1/8 inches** 1 Right (tractor) 1 3/4 inches 2 3/8 inches** 2 Left (tractor) 2 inches 2 3/8 inches** 2 Right (tractor) 2 inches 2 1/4 inches** 3 Left (tractor) 2 inches 1 7/8 inches** Parking/emergency brake spring broken, restricting pushrod travel; no dust cover 3 Right (tractor) 2 inches 2 1/2 inches** No dust cover 4 Left (trailer) 2 inches 1 1/2 inches Parking/emergency brake spring broken; no dust cover 4 Right (trailer) 2 inches 1 3/4 inches** Incorrectly installed brake chamber 5 Left (trailer) 2 inches 1 inch** Parking/emergency brake spring broken, restricting pushrod travel; no dust cover 5 Right (trailer) 2 inches 1 1/2 inches 11 American Association of Motor Vehicle Administrators, Commercial Driver License Manual Version 2.0 (Arlington, VA: AAMVA, 1996).

Factual Information 16 Highway Accident Report not personally adjusted the brakes on the trailer but was present when the mechanic at Stuart Trucking did so 2 to 3 weeks before the accident. Safety Board investigators conducted tests on June 2, 2001, to determine whether the trailer brakes were operational. The trailer was connected to a truck tractor and driven at 20 mph and 40 mph. When the service brakes were applied at both speeds, only the 4L (fourth axle, left side) and 5R (fifth axle, right side) trailer brakes locked, and the tires slid on the roadway; wheels 4R (fourth axle, right side) and 5L (fifth axle, left side) were free rolling with the brakes fully applied. Investigators tested the semitrailer’s emergency-parking brakes,12 using an auxiliary tractor to pull the trailer on the cement pavement, on June 6, 2001. When the emergency-parking brake was applied, only the 5R wheel locked. When pulled on gravel on a slight downhill slope, both the 4L and 5R wheels locked. In all tests, the 4R and 5L wheels rolled freely. On September 27, 2001, Safety Board staff and Arkansas Highway Police met with Haldex Brake Systems (Haldex)13 personnel to test the four Midland Brake, Inc., (Midland) manual slack adjusters from the tractor (axles 2 and 3) and to examine and disassemble the spring brakes. The manual slack adjusters for axles 2 and 3 were fitted onto a test spline and rotated manually. All four adjusters functioned properly. When disassembled, the emergency-parking brake spring on brake 3L was found broken into three pieces. The broken spring disabled the emergency-parking brake and restricted the service brake pushrod return by 3/8 inch. During the postaccident inspection, investigators discovered that the angle between the pushrod and the slack arm on brake 4R was greater than the 90 degrees that specifications allowed. When measured against a slack adjuster template, the pushrod was about 1 inch shorter than the pushrod on the left side of the trailer, causing the greater angle. According to the manufacturer, the automatic slack adjuster was bottoming out, thus preventing full release of the pushrod and preventing the brakes from automatically adjusting. The 4R brake drum was rusty and the brake did not appear to be functioning. On July 12, 2001, Safety Board staff met with ArvinMeritor, Inc., (ArvinMeritor)14 personnel to examine and disassemble the automatic slack adjuster on brake 4R and found it to be nonfunctional. Disassembly of the component revealed that the piston retaining ring15 was broken, probably, according to ArvinMeritor personnel, as a result of the angle between the pushrod and slack arm, which, in turn, disabled the 12 All tractors and semitrailers are required to be equipped with emergency-parking brakes. In this and most cases, the brake operates by means of a spring that expands to apply the brakes when the air pressure drops. 13 Midland, now owned by Haldex, manufactured two of the three broken spring brakes and examined the third as a courtesy. Midland manufactured all of the manual slack adjusters. 14 ArvinMeritor is a supplier of commercial vehicle components, including air brakes. 15 The piston retaining ring creates the clearance gap for the actuator piston, which is part of the adjusting mechanism. If the ring is broken, the clearance gap cannot be created, preventing adjustment.

Factual Information 17 Highway Accident Report automatic slack adjuster. When reassembled with a new piston retaining ring, the automatic slack adjuster functioned as designed. An outside mechanic had replaced the spring brake chamber on the right fourth axle (semitrailer) on June 5, 1997. Often, to replace a spring brake chamber, the pushrod must be cut and realigned. When disassembled during the inspection at Haldex, the spring in brake 4L’s emergency-parking brake chamber was found to be in two pieces and a white coloration, consistent with the presence of salt, was present inside the brake chamber. The interior brake drum surface was shiny. The service brake appeared to function normally during dynamic testing on the roadway. The parking/emergency brake spring was found to be in three pieces when brake 5L was disassembled. After a manual caging bolt was installed, the chamber retracted an additional 5/8 inch, indicating that the broken spring was preventing full pushrod release, according to Haldex personnel. The spring was fractured in such a way that it prevented full return of the pushrod; thus, the automatic slack adjuster did not have the minimum 1½ inches of stroke necessary to activate the adjusting mechanism. When disconnected from the air chamber, the automatic slack adjuster operated properly on a test device. Four of the six spring brakes on axles 3, 4, and 5 were equipped with standard caging ports, none of which had dust covers to keep out contaminants. The other two spring brakes were equipped with fixed integrated caging bolts,16 which do not require dust covers. Investigators also measured brake shoe lining thickness. On brake 5R, the lining was 3/16 inch, or 1/16 inch less than the required minimum of 4/16 inch; all other brake shoes were in compliance with minimum requirements. The brake drums were examined and the inside diameters measured. While none of the drums exceeded the manufacturers’ maximum service diameter, they did approach it, making them more susceptible to brake heat than new drums because less drum mass was available to absorb the heat. The drums on brakes 1R, 4R, and 5L exhibited rust. The tread depths on all tires met FMCSRs and Commercial Vehicle Safety Alliance (CVSA) requirements of 4/32 inch on the front tires and 2/32 inch on the remaining tires. TRW, Inc., personnel disassembled and examined the steering gear on August 7, 2001, and found no defects. According to an Arkansas Highway Police mechanic and ArvinMeritor staff, the general condition of the brake system on the trailer was poor. At the Safety Board’s request, inspectors from the Missouri Division of Motor Vehicle and Railroad Safety conducted postaccident vehicle inspections on 12 Stuart Trucking vehicles (see “Management Information” section); they found that grease was absent at the fittings and brake camshaft bushings, suggesting a lack of periodic lubrication. The inspectors stated that Stuart Trucking staff did not seem to be knowledgeable and that some of the defects noted were obvious and did not appear to be recent. 16 An integrated caging bolt is a bolt in the spring brake case that is turned to release the spring brakes.

Factual Information 18 Highway Accident Report Damage. The tractor sustained damage to the front part of the frame, which was bent to the right about 10 degrees; the entire cab was shifted rearward, the windshield and right door window were broken, and both doors were damaged. The engine was dislodged from its mount, and parts within the engine compartment, as well as the front engine support, were broken;17 the left fuel tank was dislodged and the right fuel tank was punctured; and the muffler stack was broken off. Due to accident damage, the tractor lights could not be tested to determine whether they were operational. The hopper trailer’s front left upper clearance lights were damaged, the left side of the trailer was scraped, both outside left trailer wheels were bent, and the tires were flat. School Bus The 65-passenger, 1990 Blue Bird Corporation school bus had a Chevrolet model 60 chassis with a V-8, 366-cubic inch engine reconfigured to operate with propane. The school bus was equipped with a four-speed General Motors Corporation manual transmission with a two-speed differential, power-assisted steering, hydraulic brakes with a dual master cylinder, and a motorized booster pump. The tire tread depths exceeded FMCSRs and CVSA requirements. After the accident, the front brakes were tested and operated properly. The rear brakes could not be tested because of a severed hydraulic line caused by collision damage. The lights that were not damaged in the accident operated during postaccident testing. The bus had 10 rows of three-passenger bench seats on both sides of the bus. The eleventh row had a three-passenger bench seat on the right side and a two-passenger bench seat on the left side to accommodate the vehicle’s one emergency exit door at the rear. Buses manufactured before September 1, 1994, were only required to have one emergency exit door.18 The school bus had been retrofitted with a 66.5-gallon propane tank located 34 inches forward of the rear axle on the right side, about 4 inches behind the caged gasoline tank, which had been drained (see figure 8). The propane tank was mounted outside the frame and was secured by two steel straps. The cylindrical propane tank, manufactured by Brunner Engineering and Manufacturing, was 64 inches long and 18 inches in diameter. The tank shell was 0.187 inch thick and the heads (ends of the tank) were 0.173 inch thick. The tank was equipped with an overfill protection device valve, designed to vent in case of overfill or fire. Part of the valve was inside the propane tank and part outside; if the outer part of the valve was damaged or destroyed, gas flow to the engine was supposed to shut off automatically. 17 The pressurized power steering line was broken at the steering gear box, the input shaft to the steering box was separated at the universal joint, the flywheel housing and bell housing were broken, damage indentations were present on the firewall, the gearshift lever was broken off at the isolated pin, the air filter assembly was damaged, and the batteries were dislodged. 18 Title 49 CFR 571.217.S5.2.3.4.

Factual Information 13 Highway Accident Report Air brakes, when heated due to repeated applications, can also cause bottoming out, resulting in loss of braking capability. When heavy vehicle air brakes heat up, several components can be adversely affected. Heated brake drums expand, thereby increasing the distance that the brake shoes must move so that the lining contacts the drum; as a result, the S-cam must be rotated farther, requiring an extra, or reserve, pushrod stroke. (The reserve stroke refers to the distance remaining before the pressure plate in the brake chamber contacts the bottom of the chamber at the time of brake application.) If little reserve stroke remains on a cool brake (when brakes are out of adjustment), a hot brake can easily use up the small amount of extra stroke. If the brakes become too hot and do not have enough reserve stroke left, the pressure plate can bottom out in the chamber and the shoes will not contact the brake drum. Bottoming out causes an air-braked vehicle to lose its braking capability when descending a grade. It usually takes place when brakes near the limit of adjustment are repeatedly applied during a long descent. Accident Vehicle Brakes. Table 3 lists the accident vehicle brake types, slack adjuster types and manufacturers, spring brake manufacturer, and type of spring brake caging port.9 Figure 7. S-cam diagram. 9 A caging port is a hole in the spring brake assembly into which a tool can be inserted to release the spring brake in the event that the vehicle needs to be towed.

Factual Information 19 Highway Accident Report Mountainburg Public Schools began converting school buses to propane fuel in the mid-1980s because propane was about 75 cents cheaper per gallon than regular gasoline. When the price of propane rose in the mid-1990s, the school district stopped converting the school buses because the savings were minimal; at the time of the accident, the school district had two propane-fueled buses on regular routes and two spares. With the assistance of the Mountainburg Public Schools transportation supervisor, Butane Gas Company of Mountainburg installed the tank on the accident bus some time in the early 1990s. The supervisor said that he was not aware that installation of the tank had to comply with any special regulations. The owner of Butane Gas Company stated that his firm followed all National Fire Protection Association (NFPA) and National Highway Traffic Safety Administration (NHTSA) regulations, as well as instructions from the manufacturer, in installing the tank. The National School Transportation Specifications and Procedures19 recommends that all propane tanks, including those installed on vehicles, comply with NFPA standard 58,20 which specifies requirements for the propane tanks themselves and for their placement and installation. The NFPA requires that propane tanks be located where the possibility of damage is minimized. It states that containers in the rear of vehicles should be protected by substantial bumpers; those near the engine or exhaust system should be shielded from direct heating. Containers should not be mounted on the roof, ahead of the Figure 8. School bus propane tank. 19 The National School Transportation Specifications and Procedures is a compilation of guidelines, not requirements, for school transportation. Representatives from industry and most of the States develop and modify the guidelines every 5 years. 20 National School Transportation Specifications and Procedures, 2000 Revised Edition (Warrensburg, Missouri: Missouri Safety Center, 2000), p. 16.

Factual Information 20 Highway Accident Report front axle, or behind the rear axle and should not protrude beyond the vehicle’s sides or top. Containers mounted between the axles should have ample road clearance and should not be lower than the lowest point of the body, frame, engine, or transmission. The NFPA further requires that the container be securely mounted to prevent jarring loose, slipping, or rotating. Neither the National School Transportation Specifications and Procedures nor the NFPA standards require cages surrounding propane tanks on school buses or crash tests for propane tanks installed on school buses. The Federal Motor Vehicle Safety Standards (FMVSSs) issued by NHTSA require that all fuel tanks installed by the original equipment manufacturer meet crash test standards; manufacturers comply with this requirement by placing cages around fuel tanks. NHTSA generally can only regulate equipment placed on vehicles when originally manufactured; the FMVSSs do not apply to aftermarket equipment, such as the retrofitted propane tank on the accident bus.21 Exterior damage to the school bus was limited to the right side and right roof area, extending 7 feet 2 inches from a point 2 feet forward of the right rear corner (see figure 9). The primary point of impact was in the area of the rear axle on the right side. After impact, the body partially separated from the chassis, which remained attached to the body below the driver’s section. The propane tank, located underneath the floor on the right side of the bus about 4 feet forward of the impact area, was not damaged. The emergency exit door, located at the rear of the bus, was operable after the accident. The boarding door, which was underneath the bus when it came to rest, could not be opened. 21 NHTSA regulates new vehicles and items of equipment. If equipment is installed after the first consumer purchase, 49 United States Code 30122 is relevant to the product. It states that a manufacturer, distributor, dealer, or motor vehicle repair business may not knowingly make inoperative any part of a device or element of design installed on or in a motor vehicle or equipment in compliance with an applicable motor vehicle safety standard. Figure 9. School bus damage.

Factual Information 21 Highway Accident Report Inside the bus, intrusion occurred between rows 5 through 11; the area of greatest intrusion, approximately 25 inches, was between rows 7 and 8. The seats on the right in rows 6, 7, 8, and 9 shifted to the left, blocking the center aisle. The inboard seat legs and horizontal seat supports were fractured in rows 7 through 11 on the right side. The floor joints separated behind the busdriver’s seat and at rows 5, 7, and 9; the linoleum flooring remained intact, so no openings were created. On the left side windows, glazing remained intact, except for the window adjacent to row 9; the glazing was broken on all right side windows, except for the top window adjacent to row 7. Highway Information Highway Design The accident occurred at the intersection of SH-282 and the exit ramp from southbound I-540 (see figure 10). Construction on this part of I-540 began in January 1987, and it opened to traffic in January 1999. The exit ramp from southbound I-540 to SH-282 was completed summer 1999. Arkansas State Highway and Transportation Department (ASHTD) records show that no accidents were reported in the intersection for the 2 years that it had been open. The exit ramp (see figure 11) from I-540 is a 15-foot-wide paved concrete lane, with tined surface texture, bordered by 6-foot paved asphalt shoulders to the west and 4- foot paved asphalt shoulders to the east, each delineated with thermoplastic edge lines. The exit ramp, as measured from the gore area22 to the intersection curb line of SH-282, is approximately 1,342 feet long, with a difference in elevation of about 85 feet. The only ramp curvature is a horizontal curve as the ramp transitions from the interstate. The average grade of the ramp is about 6 percent; the steepest grade is 9.42 percent, encompassing a distance of about 293 feet and ending about 413 feet from the end of the ramp, after which the ramp transitions to a 0.03 percent grade 69 feet before the intersection, as measured on scene. 22 The gore area is the triangular piece of land between the interstate and the ramp as the ramp transitions away from the interstate.

Factual Information 22 Highway Accident Report Figure 10. Intersection of ramp from I-540 south and SH-282.

Factual Information 23 Highway Accident Report A 36-inch stop sign23 was in place on the traffic island north of the intersection. An advance traffic control sign indicating “stop ahead”24 was about 581 feet north of the stop sign in the grassy right-of-way on the right side of the exit ramp. A recreational area guide sign25 was approximately 191 feet north of the “stop ahead” sign. Following the accident, the ASHTD installed additional signing. The ASHTD replaced the 36-inch stop sign with a 48-inch stop sign and erected another 48-inch stop sign on the left side of the ramp. It placed an additional 48-inch “stop ahead” sign on the left side of the ramp across from the original one, which is approximately 581 feet north of the stop sign. The ASHTD added a third 48-inch “stop ahead” sign on the right side of the ramp, approximately 881 feet north of the stop sign, and moved the recreation guide sign to the left side of the ramp. The speed limit on I-540 is 70 mph for cars and 65 mph for trucks. No advisory speed signs are present on the exit ramp. In placing signage at the ramp, the ASHTD followed the Manual on Uniform Traffic Control Devices (MUTCD) guidelines, which state that a warning sign should be used to call attention to unexpected conditions and should be based on an engineering study or judgment.26 The ASHTD did not believe these conditions applied at this ramp. A review of the I-540 construction plans indicates that the truck descended four hills (and ascended three) between the Bunyard tunnel and the accident location (see Figure 11. Exit ramp from I-540 south to SH-282. 23 U.S. Department of Transportation, Federal Highway Administration, MUTCD 2000: Manual on Uniform Traffic Control Devices, Millennium Edition (Washington, DC: FHWA, 2000), section 2B.04 (sign R1-1). 24 MUTCD, section 2C.26 (sign W3-1a). 25 MUTCD, section 2H.01. 26 MUTCD, sections 2C.01 and 2C.02.

Factual Information 24 Highway Accident Report figure 12). While traveling southbound from the tunnel, the truck descended an average grade of 2.7 percent (steepest grade was 4.9 percent) over 3.84 miles; an average grade of 2.3 percent (steepest grade, 4.1 percent) over 3.40 miles; and an average grade of 1.8 percent (steepest grade, 2.5 percent) over 0.47 mile. On its approach to the ramp, the truck was descending an average grade of 3.3 percent (steepest grade, 4.4 percent) over 0.66 mile. The annual average daily traffic for I-540 in 2000, as tabulated by the ASHTD, was 14,600 vehicles, of which about 21 percent were trucks. A 24-hour traffic count on June 13, 2001, showed that 36.7 percent of the 312 vehicles exiting onto the southbound ramp from I-540 were trucks. The June 13 ASHTD traffic count showed that trucks accounted for 32.3 percent of the 460 eastbound and 13.2 percent of the 988 westbound vehicles on SH-282. Figure 12. Grade map.

Factual Information 25 Highway Accident Report In the vicinity of the accident, SH-282 is a two-way, two-lane paved asphalt roadway running east-west. At the time of the accident, a combination of painted markings and raised, mountable concrete islands (2 inches high at the edges and 6 inches high overall) channelized the traffic lanes on both sides of the intersection. A left turn lane, about 12 feet wide, was available for westbound traffic turning onto the entrance ramp to southbound I-540. The east and westbound traffic lanes were about 11 feet wide and bordered by paved shoulders about 8 feet wide and delineated by painted edge lines. Standard pavement markings (a yellow painted double centerline) divided opposing lanes of traffic. The speed limit for SH-282, as posted on a sign approximately 1 mile east of the accident site, was 55 mph. Tire Marks The truck-tractor semitrailer produced multiple tire marks beginning on the east shoulder of the exit ramp, about 30 feet north of the area of impact, and continuing southwest across the intersection. The left front tire created a scuff mark,27 and a series of chips in the asphalt surface were in line with the scuff mark. From the area of impact, the longest tire mark, about 89 feet, traversed the south traffic island and continued toward the area where the truck tractor came to rest. The truck-tractor semitrailer produced multiple north-south scrape marks28 after the unit had rolled onto its left side. Investigators observed no tire marks on SH-282 leading to the area of impact. The school bus produced multiple tire marks beginning at the area of impact and continuing southeast intermittently over a distance of about 110 feet. The longest tire marks terminated in the area where the school bus came to rest. The school bus produced a single deep scrape mark that ran west to east at the area of impact; investigators found no other scrape marks related to the collision. Operational Information Gayle Stuart Trucking Stuart Trucking began operating as a for-hire interstate carrier29 of agricultural commodities, grain, feed, hay, and dry bulk in Vandalia, Missouri, in 1988; the company also conducted farming operations. At the time of the accident, the motor carrier owned 16 tractors and 23 trailers; leased30 3 tractors and 2 trailers; and traveled about 1.777 million miles annually. The motor carrier reported 17 full-time drivers, including 3 who drove leased vehicles, on its payroll. 27 Scuff marks result when a tire slides while the wheel is still rotating. 28 Scrape marks are produced when any part of a vehicle, other than the tires, contacts the ground while the vehicle is still in motion. 29 Operating under USDOT number 376158 and ICC number 213891. 30 The lease agreement is a contract stipulating the contractor’s responsibilities regarding insurance, maintenance, driver control, and payment. The contractor is responsible for maintaining the vehicle.

Factual Information 26 Highway Accident Report The motor carrier used State United Laboratories of Omaha, Nebraska, for pre- employment, random, and postaccident drug testing. State United Laboratories conducted random tests every 3 months, testing 1 to 6 drivers each period. Mountainburg Public Schools Mountainburg Public School District includes three schools—a high school, a middle school, and an elementary school. It covers 197 square miles and the school buses transport 790 students more than 111,250 miles annually; in addition, activity trips account for about 25,000 miles. At the time of the accident, the school district had 12 school bus routes, 11 full-time busdrivers, 2 part-time drivers, and 10 substitute drivers. The school district uses a local medical clinic to conduct alcohol and drug testing of its busdrivers. Safety inspections are conducted on the school buses before the school year begins and at midyear. All district school buses are equipped with cellular telephones for communication with the school district and maintenance shop and for emergencies. The Arkansas State Department of Education trains the district’s school bus drivers. In August, the department conducts annual recertification of school bus drivers, covering topics such as driving techniques, loading and unloading procedures, bus stop location, and changes in operating procedures. In 2000, the school district superintendent conducted an additional meeting with the bus drivers before the school year began; it covered areas such as reporting times, policies and procedures, problems that developed since the previous school year, and route changes. Management Information Gayle Stuart Trucking Company The Stuart Trucking corporate structure comprised a president, vice president, and safety manager. Company officials said they conducted telephone interviews with previous employers listed on a driver’s application and that the company’s insurance carrier provided motor vehicle driving records on all drivers. Before starting work at Stuart Trucking, according to company officials, drivers received 3 hours training in hopper-bottom trailer operation, brake adjustment procedures, and logbook entry. The motor carrier reported that it held safety meetings every 6 months attended by all drivers; the meetings covered issues such as driving procedures, loading and unloading trucks, and load securement. The motor carrier said that it conducted periodic recurrent training in logbook entry, trailer cleaning, and other operational problems. The accident driver had attended the safety meetings but had not attended any recurrent training. Stuart Trucking did not conduct mountain-driving training. Company practice was for all drivers to be home on weekends, according to the carrier, and drivers turned in their logbooks each week for auditing by company safety personnel, who reported no problems with the accident driver’s logbook prior to the

Factual Information 27 Highway Accident Report accident. Nonetheless, Safety Board investigators found errors when they reviewed the logbook, and the driver admitted to falsifying his logbook. In its June 1, 2001, compliance review, the Federal Motor Carrier Safety Administration (FMCSA) found at least one instance of falsified logbooks during its compliance review of Stuart Trucking. In comparing several other drivers’ logbooks with data from a Global Positioning System on the trucks that tracked and recorded truck locations over the previous 10 days, inspectors found that the logbook entries correlated with the truck locations. Stuart Trucking employed one mechanic, who also drove for the company and worked on farm equipment. Title 49 Part 396.25, “Qualification of Brake Inspectors,” states that the brake inspector is any employee of the motor carrier or any other person who is responsible for ensuring that all brake inspections, maintenance, service, or repair meet Federal standards. The CFR goes on to say that the brake inspector is required to be certified 1) by participating in a training program sponsored by a brake or vehicle manufacturer or a Federal or State agency or 2) by having experience performing brake maintenance or inspection for a period of at least 1 year. Additionally, any employee who is responsible for the inspection, maintenance, service, or repair of any brakes on commercial vehicles must meet the minimum qualifications. Stuart Trucking’s mechanic had more than 1 year of experience performing brake maintenance and service. Stuart Trucking reported that neither its drivers nor its mechanic had the required certification, and the owner said he was not aware of the regulation. On December 5, 1989, the Federal Highway Administration’s (FHWA’s) Office of Motor Carriers (OMC), now the FMCSA, conducted a safety review of Stuart Trucking that resulted in a satisfactory rating. Following this accident, the FMCSA conducted a compliance review on June 1, 2001, that resulted in a conditional rating for the driver factor because of the following violations: • Using a driver who was not medically examined and certified during the preceding 12 months; • Failing to retain inquiries into the driver’s driving record in the qualification file; • Requiring or permitting a driver to drive more than 10 hours; • Requiring or permitting a driver to drive after having been on duty 15 hours; Not adhering to the 70-hour rule;31 and • Entering a false report of records-of-duty status. The review did not mention the missing “Qualified Brake Inspector” certification. 31 The 70-hour rule limits drivers to 70 hours of working-driving time within 8 consecutive days.

Factual Information 28 Highway Accident Report The motor carrier received an unsatisfactory rating for the accident factor because its accident rate was 1.688 recordable crashes per million miles traveled.32 The combination of a conditional rating in one factor and an unsatisfactory rating in another resulted in an overall conditional rating, which Stuart Trucking still maintained in August

1. The review noted that the motor carrier’s maintenance records were in compliance

with the FMCSRs requirements. The FMCSA did not inspect any vehicles during the 2001 compliance review; it included only information from roadside inspections in the compliance review report. Title 49 CFR Part 385 requires vehicle inspections during a compliance review if fewer than 3 trucks were inspected during roadside inspections in the previous year or if more than 34 percent of roadside inspections in the previous year resulted in trucks being placed out of service. In the 12 months before the accident, the FMCSA had conducted 29 roadside inspections on Stuart Trucking vehicles, four of which (14 percent) were placed out of service for brake adjustment violations. Therefore, FMCSA inspectors were not required to inspect the carrier’s vehicles during the compliance review. Other out-of- service violations noted in the roadside inspections related to logbooks, equipment, and alcohol. Following the accident, Safety Board investigators asked the Missouri Division of Motor Vehicles and Railroad Safety to inspect all of the motor carrier’s vehicles at the terminal and on the road. Of nine vehicles inspected at the motor carrier’s facility, four had out-of-service defects (a 44 percent out-of-service rate).33 Of three units inspected on the road, one was placed out of service for inoperative stop lamps; one driver was placed out of service for logbook violations. According to company officials, Stuart Trucking conducted general maintenance, including brake adjustment, every 15,000 miles and extensive maintenance every 30,000 to 40,000 miles. The Missouri inspectors stated that Stuart Trucking staff seemed to be lacking in knowledge of maintenance and that some defects found were obvious and did not appear to be recent. Federal Oversight The Motor Carrier Safety Act of 1984 directed the U.S. Secretary of Transportation to establish procedures to determine the safety fitness of commercial motor vehicle owners and operators engaging in interstate and foreign commerce. Subsequently, the FHWA promulgated a set of safety fitness standards and established a methodology for determining whether a carrier has adequate safety management controls to ensure acceptable compliance with the safety requirements. As a result of the Motor Carrier Safety Act of 1990 and a 1997 rulemaking, the FHWA modified the original methodology. 32 Carriers that operate in an area more than 100 miles in radius and that have an accident rate greater than 1.5 recordable crashes per million miles traveled receive an unsatisfactory rating (see 49 CFR Part 385, appendix B). 33 These defects included brakes out of adjustment, defective or inoperative brakes, defective leaf spring assemblies, defective axle positioning parts, suspension cracks, and inoperative rear turn signals.

Factual Information 29 Highway Accident Report Six factors (see table 5) provide the basis for determining a carrier’s safety rating, that is, the degree to which the carrier is in compliance with the FMCSR and therefore meets the safety fitness standard. Each factor is rated satisfactory, conditional, or unsatisfactory. A satisfactory rating means the carrier has not violated any acute regulations (see definition below) or shown a pattern of noncompliance with critical regulations for that factor. A conditional factor means the carrier has violated one acute regulation or has a pattern of noncompliance with critical regulations. An unsatisfactory rating means the carrier has violated two or more acute regulations or has patterns of noncompliance with two or more critical regulations. Factor 6, the accident factor, is based on the number of accidents in relation to the carrier’s size. Table 5. Motor carrier safety rating factors. Acute violations of the FMCSRs or Hazardous Material Regulation are those that demand immediate corrective action regardless of the motor carrier’s overall safety posture. For example, requiring or permitting the operation of a vehicle declared out of service before repairs are made (49 CFR 396.9[c][2]) is an acute violation. Critical violations are regulatory violations that indicate breakdowns in a motor carrier’s management controls. For instance, requiring or permitting a driver to drive after having been on duty for 15 hours (49 CFR 395.3[a][2]) is a critical violation. The rating for the first five factors and the accident rate for the 12 months before the review are entered into a rating table, which is used to establish the motor carrier’s safety rating (see table 6). Each of the six factors is given equal weight. FACTOR APPLICABLE FMCSRs OR OTHER CRITERION Factor 1 – General Parts 387 and 390 Factor 2 – Driver Parts 382, 383, and 391 Factor 3 – Operational Parts 392 and 395 Factor 4 – Vehicle Part 393 and 396 Factor 5 – Hazardous Materials Parts 171, 177, 180, and 397 Factor 6 – Accident Recordable Preventable Rate

Factual Information 30 Highway Accident Report Table 6. Motor carrier safety rating table. State Oversight Missouri. The Missouri State Police administer the Motor Carrier Safety Assistance Program (MCSAP)34 in Missouri, and the State Police handle motor carrier enforcement and roadside inspections. The Division of Motor Carrier and Railroad Safety conducts terminal audits similar to those conducted by the FMCSA, and the division conducted the follow-up inspection of Stuart Trucking requested by Safety Board investigators. Arkansas. In Arkansas, the MCSAP is administered by the Arkansas Highway Police, which is the primary enforcement agency for all laws pertaining to axle and gross weights, the movement of oversize loads or vehicles, vehicle licensing, motor fuel tax, and special distillate motor vehicle fuel tax. The Arkansas Highway Police conduct all motor carrier enforcement. Meteorological Information At the Fort Smith, Arkansas, Regional Airport, approximately 23 miles from the accident site, the weather was partly cloudy with winds from the west at about 13 mph at 3:53 p.m. on May 31, 2000. The temperature was 69° F and the dew point was 60°. FACTOR RATING SAFETY RATING Number of Unsatisfactory Ratings Number of Conditional Ratings Resultant Safety Rating 0 2 or less Satisfactory 0 more than 2 Conditional 1 2 or less Conditional 1 more than 2 Unsatisfactory 2 or more 0 Unsatisfactory 34 The MCSAP is a Federal program administered by the FMCSA that provides funds to the States and U.S. Territories in support of commercial motor vehicle safety.

Factual Information 31 Highway Accident Report Tests and Research Sight Distance Safety Board investigators conducted sight distance tests after the accident. At a driver eye height of 74 inches35 above the pavement, a motorist could see the stop sign from the transition area36 to the end of the ramp, a distance greater than that prescribed by the American Association of State Highway and Transportation Officials (AASHTO). The “State park” sign then in place north of the “stop ahead” sign could impede a motorist’s view of the “stop ahead” sign from a distance of 684 feet until the driver was about 569 feet from the “stop ahead” sign (see figure 13). Since the accident, Arkansas has moved the “State park” sign to the other side of the ramp, where it does not impede a driver’s view of the “stop ahead” sign, and has added “stop ahead” signs. When the ramp was constructed, it was cut into existing terrain, and a grass berm runs parallel to and east of the ramp. A stop sign for traffic exiting I-540 onto SH-282 is in place at the intersection. Safety Board visibility test results showed that, when stopped at the intersection, a driver has a clear line of sight to the east exceeding 582 feet. A driver on westbound SH-282 is not able to see traffic on the exit ramp until the driver is 51 feet east of the intersection. Brake Heat Tests From September 5 to 7, 2001, Safety Board investigators measured the brake temperatures37 of 65 tractor semitrailers traversing the same ramp used by the accident truck. Table 7 lists the daily average brake temperatures for each axle. As brakes heat up, for example, through repeated application, the drum expands, requiring a greater stroke for the same brake force, and the lining friction decreases. Stroke can increase by about 0.1 inch per 100° F.38 At temperatures above 700° F, even a well-adjusted brake can reach out-of-adjustment limits, requiring more than 0.5 inch of additional stroke, and the brake may run out of stroke before the shoe contacts the drum. Brake linings are composed of glue and strengthening material, and when they become hot, the glue softens and begins to melt. As a result, the linings become slick and provide less friction, no longer offering the same level of resistance to the rotation of the drums. When brake lining temperatures exceed 500 to 600° F, the friction between the lining and the drum drops abruptly, further reducing the brake system’s ability to provide a retarding force for the vehicle. 35 AASHTO assumes a driver’s eye height is 70 to 94 inches for large trucks and uses 94 inches for design purposes. The Safety Board investigator who conducted the tests has an eye height of 74 inches. 36 The transition area, which is adjacent to the gore area, is the curved portion of the ramp as it departs from the interstate. 37 Investigators used an infrared thermometer (Omega OS533) and took measurements directly from the exterior of each brake drum. 38 U.S. Department of Transportation, Federal Highway Administration, Evaluation of Brake Adjustment Criteria for Heavy Trucks, FHWA-MC-94-016 (Washington, DC: FHWA, 1995), p. 8.

Factual Information 32 Highway Accident Report Figure 13. Ramp sight distance.

Factual Information 33 Highway Accident Report Table 7. Average brake temperature (° F). If some brakes are out of adjustment, the brakes that are within adjustment provide a disproportionate share of the braking, thus heating more rapidly, further reducing overall braking efficiency more quickly.39 Rockwell International tested the effects of poorly adjusted brakes in the late 1980s.40 Researchers used various initial brake temperatures to compare brakes fully adjusted with brakes backed off beyond the recommended stroke. At 150° F, the average stopping distance from 60 mph for a 55,000-pound truck-tractor semitrailer increased 34 percent when brakes were backed off beyond the recommended stroke, and at 400° F, the stopping distance increased 76 percent. The accident truck, which was not equipped with an engine retarder, descended four grades over the 11.3 miles from Bunyard tunnel to the exit ramp onto SH-282. A grade severity computer analysis41 showed that, had the driver used his brakes to slow on the first three downgrades, he may have noticed some degradation in the accident tractor semitrailer’s braking capability, since the temperature exceeded 900° F at the bottom of the second downgrade. The brakes would have cooled somewhat on the upgrades and on the third descent,42 resulting in the tractor semitrailer’s brake temperature at the top of the final hill reaching approximately 800° F. The grade severity computer analysis also showed that if all the brakes had been properly adjusted, they would have heated to 119° F at the top of the ramp and to 234° F when the vehicle reached the final stop at the end of the ramp. AXLE 1 LEFT AXLE 2 LEFT AXLE 3 LEFT AXLE 4 LEFT AXLE 5 LEFT September 5 127 225 232 247 265 September 6 121 244 258 258 251 September 7 133 201 209 221 234 39 National Transportation Safety Board, Heavy Vehicle Airbrake Performance, Safety Study NTSB/SS-92/01 (Washington, DC: NTSB), p. 31. 40 Leonard C. Buckman, Commercial Vehicle Braking Systems: Air Brakes, ABS and Beyond (Warrendale, PA: Society of Automotive Engineers, 1988), p. 79. 41 The Grade Severity Rating System (GSRS) is a computer program developed under an FHWA- funded project. The purpose of the GSRS is to assist highway engineers in signing grades in order to reduce the number of runaway heavy trucks. The GSRS also predicts the brake temperature as a vehicle travels down the grade. 42 The average grade on the third descent was 1.7 percent, so not much braking was needed; the truck’s aerodynamic drag was 1.4 percent.

Factual Information 34 Highway Accident Report Simulation Using the HVE system43 and the SIMON44 and EDSMAC445 software programs, Safety Board investigators simulated the tractor semitrailer’s final ascent and descent to the accident site and the collision with the school bus. Based on the physical evidence, the EDSMAC4 simulation showed that the tractor semitrailer’s speed immediately prior to impact was about 48 mph and the school bus was traveling about 50 mph. The simulation results indicated that the tractor semitrailer’s postimpact speed was about 48 mph and that the bus’s postimpact speed was about 39 mph. The simulation also showed that the berm to the left of the ramp and the truck’s left mirror may have interfered with the truckdriver’s view of the bus as the two vehicles approached the intersection. To simulate the truck’s braking capability as the brakes heated due to repeated application during the descent, investigators obtained truck brake performance data related to temperature from ArvinMeritor. The data terminated at 603° F. Safety Board staff extrapolated that data to take into account the higher temperatures for this tractor semitrailer during the descent with the brakes out of adjustment. Staff incorporated into the SIMON simulation a braking strategy that entailed pumping the brakes using 30 pounds per square inch of pressure for 3 seconds.46 This strategy, according to the FHWA, is the most efficient method of braking. The simulation showed that the tractor semitrailer was traveling 55 to 60 mph at the bottom of the third descent, reduced its speed as it traveled up the last ascent to between 22 and 27 mph at the crest, and was traveling 29 to 34 mph in sixth gear at the top of the ramp. On the final descent prior to the ramp, the simulation showed that the driver was able to apply the brakes about seven times to prevent the tractor semitrailer from accelerating, but the brakes continued to heat to the point that with each subsequent brake application, the truck’s braking force decreased and the truck gained more speed, even while the brakes were applied, accelerating to 48 mph at impact. 43 The Engineering Dynamics Corporation developed HVE, a Human, Vehicle, Environment system, for engineers and scientists to use as a simulation tool to study vehicle and occupant kinematics. 44 Simulation Model Non-linear, or SIMON, allows users to simulate the response of one or more vehicles to driver inputs and environmentally related factors. It is designed to fully utilize the HVE Brake Designer. 45 EDSMAC4, or the Engineering Dynamics Corporation Simulation Model of Automobile Collisions, fourth revision, permits simulation of single- or multiple-vehicle crashes and is based on SMAC, which Calspan developed for NHTSA. 46 Paul S. Fancher, Christopher B. Winkler, et al., Influence of Braking Strategy on Brake Temperature in Mountain Descent, UMTRI-92-11/FHWA/MC-93/002 (Washington, DC: FHWA). This publication recommends applying 20 psi on a truck with adjusted brakes, but because of this truck’s poor brake condition, 30 psi was used.

Factual Information 35 Highway Accident Report Other Information Brake Data Currently, data are not available that provide information on the extent to which brakes cause or contribute to truck-related accidents. The U.S. Department of Transportation (DOT) is conducting a study on large truck crash causation that is scheduled to be completed in 2004. According to the FMCSA, the report will contain such data. In 1990, the Safety Board inspected 1,520 vehicles and found that 56 percent of the trucks inspected had been placed out of service for brake violations; that figure included 46 percent placed out of service for out-of-adjustment brakes.47,48 Results of a 1996 National Fleet Safety Survey found that 29 percent of trucks randomly inspected at roadside were placed out of service; about 49 percent of the out-of-service violations were brake-related.49 The CVSA sponsors Operation Air Brake annually to promote and reinforce the need for drivers to check and adjust air brake systems and to educate drivers on the serious risks associated with operating a heavy vehicle that has inadequate brakes.50 The results of inspections conducted on six occasions during Operation Air Brake in 2000 and 200151 showed that, on average, 13 percent of commercial vehicles inspected were placed out of service for having brakes out of adjustment. An average of 9.6 percent of brakes equipped with manual slack adjusters were out of adjustment and 4.3 percent of brakes equipped with automatic slack adjusters were out of adjustment. Approximately 65 percent of the brakes checked had automatic slack adjusters. Brake Adjustment Methodology Automatic slack adjusters have been offered as optional equipment since the late 1960s and have been required on all new commercial vehicles since October 20, 1994. Brake adjustment indicators have also been required on all new commercial vehicles since October 20, 1994. Any vehicle manufactured before that date does not have to be retrofitted and can continue to operate using manual slack adjusters. Two common methods are used to measure brake adjustment on S-cam brakes, which are the most frequently used type of service brake. Using the manual method, one person, who pulls on the pushrod by hand or uses a pry bar, can measure the stroke. 47 NTSB/SS-92/01, p. 39. 48 A vehicle is out of service if 20 percent or more of its brakes are out of adjustment. 49 Terry Shelton, “Truck Brake Statistics in the U.S.” Report of Proceedings of the North American Brake Safety Conference, September 15-16, 2000 (Toronto, Canada: CVSA, 2001), p. 12. 50 John Meed, “Operation Air Brake Report,” Report of Proceedings of the North American Brake Safety Conference, September 15-16, 2000 (Toronto, Canada: CVSA, 2001), p. 15. 51 The CVSA conducted the inspections on the same days in a number of States. In May 2000, the inspections took place in 27 States; in September 2000, in 22 States; in October 2000, in 25 States; in May 2001, in 28 States; in September 2001, in 29 States; and in October 2001, in 17 States.

Factual Information 36 Highway Accident Report According to Allan C. Wright, author of a book on air brakes, “one half inch [stroke] is ideal” when using the manual method; “the maximum allowable stroke, before readjusting, is one inch.”52 This method can result in inconsistent measurement due to variables such as the strength of the person pulling the pushrod, the length of the pry bar, or the force exerted on the pry bar. The second, more accurate method requires two people, one to apply the brake to an air pressure of 80 to 90 psi and another to measure the stroke. Ideally, a brake shoe should be adjusted as close as possible to the drum without dragging (the shoe touching the drum). The American Trucking Association’s Technology and Maintenance Council recommends backing off the adjusting nut until the wheel turns freely, making the stroke as short as possible without the brakes dragging.53 This adjustment can also be accomplished without jacking up the vehicle by backing off the adjustment nut while simultaneously hitting the drum with a small hammer or wrench. When the “dull thud” becomes a “ringing sound,” the adjustment nut should no longer be turned, since the ideal shoe-drum clearance has been reached. Bendix Commercial Vehicle Brake Systems (Bendix) recommends adjusting the slack adjuster so that the pushrod travels 3/8 inch when manually extended to contact the brake shoes with the brake drums.54 Determining when to adjust the brakes depends on many variables, including terrain traveled, weight of load, use of engine retarders, size of brakes, miles traveled, age of brakes, and driver’s braking habits. As explained in the Safety Board’s 1992 study of Heavy Vehicle Airbrake Performance, industry recommendations for the adjustment interval varied: Kenworth suggested the pushrod travel be checked and adjusted every 6,000 miles; Bendix suggested every month, 300 operating hours, or 8,000 miles; and Rockwell International and Eaton Corporation suggested adjustment be made whenever the pushrod stroke exceeded adjustment limits. Spring Brakes Federal regulations require that a vehicle be held by mechanical means (without use of electrical power) when parked after all air has been bled out of the system.55 When the vehicle is operating, a continual supply of air to the emergency-parking chamber compresses the power spring so that the spring applies no force to the pushrod. When air is released from the chamber, the spring force moves the chamber pushrod, applying the service brakes. The operational life of the power spring depends on factors such as the quality of the spring material, spring size, application cycle, and exposure to natural elements (water and salt, for example). According to Haldex, springs under adverse conditions, such as salt-treated roadways and frequent use, may last only 1 or 2 years before they need to be replaced; Holland Anchorlok56 springs are guaranteed for 6 years. 52 Allan C. Wright, Airbrakes From the Driver’s Seat (Richmond, British Columbia, Canada: Presto Print Limited, 1984), p. 17. 53 “TMC Recommended Practice,” RP 609A, 2001. 54 . 55 Title 49 CFR Part 571.121.S5.6.3.2. 56 Haldex purchased Anchorlok in January 2002.

Factual Information 37 Highway Accident Report A broken spring, which is difficult to detect, can reduce emergency-parking brake forces or render the emergency-parking brake inoperable, and the broken spring pieces can be displaced, thus shortening the pushrod stroke or preventing the automatic slack adjuster from functioning. The extent of the broken spring problem is undetermined. Radlinski and Associates, a brake consulting firm, reported to investigators that in an inspection of 11 five-axle combination trucks at a large firm with an excellent maintenance program, an inspector found an average of two broken spring brakes on each tractor semitrailer. Broken spring brakes are not an out-of-service item if detected during CVSA inspections, nor is visual examination of spring brakes an inspection item. Regulations do not require use of dust covers over the caging port to prevent contaminants from getting into the spring brake assembly.

38 Highway Accident Report Analysis Truck-tractor semitrailers represented 4 percent of all vehicles on the road in 2000 and accounted for 8 percent of vehicle miles driven; 12 percent of fatalities occurred in accidents involving these vehicles.57 The Safety Board has investigated numerous accidents involving tractor semitrailers in the past 30 years and made many safety recommendations related to truck brakes, which are the most common reason trucks are placed out of service. The Mountainburg accident again clearly demonstrates that when brakes do not function properly, they compromise vehicle safety, sometimes with tragic consequences. Statistically, school buses are one of the Nation’s safest modes of transportation; on average, fewer than 10 passengers die each year as a result of school bus accidents. The fatalities that do occur, as in the case of the Mountainburg accident, generally happen when a train or large truck strikes a bus laterally. In this accident, the brakes on the truck were out of adjustment, thereby degrading its braking capability, and the truck was unable to stop before colliding with the school bus. In the following analysis, the Safety Board will first exclude those factors that did not cause or contribute to the accident and then examine those factors that were causal or otherwise had a role. The discussion will focus on the poor condition of the brakes, inadequate motor carrier inspections and oversight, the use of fuel tanks on school buses, and occupant protection within school buses. The Safety Board has addressed these issues in previous accident investigations and will consider them below in the context of relevant safety recommendations from the earlier investigations. The Accident Exclusions The accident occurred in midday when the weather was clear and dry. Postaccident inspection of the school bus revealed no mechanical problems. Results of postaccident drug and alcohol tests for both the truckdriver and the busdriver were negative. Both drivers held valid commercial driver’s licenses and medical certificates. The roadways were in good condition and complied with AASHTO guidelines; the interstate and ramp signing was in compliance with the MUTCD. Emergency response was timely and adequate. The school bus was traveling about 50 mph at the time of the collision; the speed limit on SH-282 was 55 mph. The truckdriver admitted that he had falsified his logbooks to appear to be in compliance with Federal hours-of-service rules, and he later 57 U.S. Department of Transportation, National Highway Traffic Safety Administration, Traffic Safety Facts 2000: Large Trucks, DOT HS 809 325 (Washington, DC: NHTSA, 2001).

Analysis 39 Highway Accident Report described his actual work and rest times to Safety Board investigators. Until May 28 (3 days before the accident), he was off duty at home for 3 days, where he said he maintained a normal work-rest cycle, that is, awake and active during daylight hours and resting during nighttime hours. During the 3 days before the accident, he said he slept in the truck’s sleeper berth each night, maintaining a normal work-rest cycle. Investigators compared data available from fuel receipts and bills of lading for the accident vehicle against travel times between locations on the driver’s route and found no conflict with the work-rest cycle he described. The driver’s schedule did not include the required 8 hours off-duty time, and the truckdriver obtained 5.5 to 6.5 hours of sleep per night. However, the accident scenario does not indicate that the driver was fatigued. He successfully steered the truck onto the exit ramp and applied the brakes in an attempt to slow the truck before the accident. Had the driver not applied the brakes, the truck would have been traveling much faster due to the downgrades on the interstate and ramp. While investigators could not determine whether the driver was fatigued, his actions just prior to the collision do not suggest that fatigue was a factor in this accident. The Safety Board concludes that there was no evidence of drug or alcohol use by the drivers and that the weather, mechanical condition of the school bus, design and signing of the highways, emergency response, and truckdriver fatigue did not contribute to the accident. Accident Discussion The tractor semitrailer did not stop for the stop sign at the bottom of the ramp because the brakes, all of which were either out of adjustment, poorly maintained, or overheated, could not provide enough retarding force. The driver said he slowed his vehicle prior to the exit and, as he was departing I-540, applied the brakes to slow further, but the vehicle did not respond. He stated that he saw the stop sign at the end of the ramp and realized that he would be unable to stop the vehicle or, given the truck’s speed, make the turn onto SH-282 without overturning the vehicle. Therefore, he decided to continue across the highway and up the opposite ramp in an attempt to slow the truck. The driver hoped that traveling up the entrance ramp to I-540 would reduce vehicle speed sufficiently to allow him to bring it under control. As the simulation indicated, he could not see the school bus on SH-282 because the berm to the left of the ramp and the truck’s left mirror obstructed the driver’s view of the bus as the two vehicles approached the intersection. Before impact, the tractor semitrailer was traveling an estimated 48 mph and the school bus was traveling about 50 mph. The simulation showed that the tractor semitrailer’s speed at separation was about 48 mph and that the bus’s postimpact speed was about 39 mph. As the grade severity computer analysis and the simulation showed, the driver probably used his brakes to maintain speed as he descended the first three downgrades from the Bunyard tunnel. Each time he applied the brakes, the brake temperatures increased. At the bottom of the second descent, the brake temperatures exceeded 900° F, according to results of the grade severity computer analysis, and the brakes quite likely could provide little braking force. At this point, the driver may have perceived that the

Analysis 40 Highway Accident Report brakes were not functioning properly. He probably did not suspect a serious problem with the brakes because his father had installed slack adjusters on the tractor 4 days earlier. The driver was familiar with the location of the Mountainburg exit and the hills near it because he had driven this route often, but he stated that he had never exited onto SH-282 from I-540 southbound. He would not have had to apply the brakes too forcefully to maintain speed going down the third descent because of its moderate grade. At the bottom of the third descent near the sign for the exit, the simulation showed that the tractor semitrailer was traveling 55 to 60 mph. The simulation also indicated that the driver did not accelerate while going up the third ascent, probably in an effort to limit his speed so that he would not have to use his brakes extensively as he neared the exit ramp. At the top of the third ascent, the tractor semitrailer’s speed was 22 to 27 mph, and as the vehicle traversed the final descent, the driver probably pulsed the brakes with about 30 psi of pressure to maintain speed. As the vehicle neared the ramp, the brakes heated beyond the point at which they could slow the vehicle. The driver stated that he noticed this loss of braking near the top of the ramp and tried to downshift, but to no avail. Even applying more pressure, as the driver said he did, would not have provided sufficient braking force to slow the vehicle on the ramp’s steep grade, since the brakes were almost useless due to heating at this point. The tractor semitrailer continued to accelerate until impact. The truckdriver was unable to stop his vehicle because the brakes did not provide enough retarding force when he applied them. The vehicle’s braking efficiency58 at ambient temperature, excluding heat effects, was calculated to be 0.35, that is, the tractor semitrailer brakes produced 35 percent of the stopping force that they could have produced if the brakes had been fully adjusted and functioning. The braking efficiency was reduced to this level because five brakes were out of adjustment and three others were not functioning; four of these eight brakes provided no braking force whatsoever. Traveling down several grades before reaching the exit ramp would have increased brake temperature, further decreasing braking efficiency. The truck was not equipped with an engine retarder, so the driver had to rely solely on the brakes and downshifting to slow the truck on the downgrades. The engine control module had been removed, allowing the engine rpm to increase and further reducing the engine’s ability to slow the vehicle when it was in gear. The driver stated that he began slowing the truck on the interstate prior to the exit ramp because he was unfamiliar with the ramp.59 Using the brakes, drag, and gravity to slow the truck from an estimated 60 mph to a driver-reported speed of 25 mph (simulated speed of 29 to 34 mph) would have caused the brake drums to expand, thereby increasing the stroke required to apply braking force by approximately 0.1 inch per 100° F. The brake drums would have expanded to the point that the brake shoes could no longer apply pressure to the drums, even with the pushrod fully extended. The simulation showed that the brake lining temperature exceeded 500° F, significantly reducing the friction 58 Braking efficiency calculations take into account air pressure, chamber size, stroke length, slack length, drum radius, rolling radius of the wheels, and weight on each wheel. 59 However, simulations show that the driver began to slow before the last descent and maintained the slower speed down the last descent prior to the ramp. The truck would not have been able to slow from 60 mph to 25 mph on the last downgrade due to the condition of the brakes.

Analysis 41 Highway Accident Report between the lining and the drum. At this point, the truck had almost no braking capability. Simulations confirm that brake temperatures under such conditions would have rendered all of the truck’s brakes out of adjustment. Even the brakes that were within adjustment prior to heating (4L and 5R) left no skid marks on the ramp, indicating that these brakes could not apply enough retarding force to lock the wheels. The Safety Board concludes that poorly adjusted and nonfunctional brakes, together with the resulting high temperatures in the functioning brakes, reduced the truck’s braking efficiency to such an extent that the truckdriver was unable to stop the vehicle at the end of the ramp. Truck Brakes Recommendation History The Safety Board has been concerned about proper brake adjustment for more than 25 years. Previous investigations have resulted in several safety recommendations relating to brake adjustment that are relevant to the Mountainburg accident. Brake Adjustment Guidelines. In 1975, the Safety Board investigated an accident involving a tractor semitrailer that lost braking capability while descending a steep grade near Bishop, California.60 The vehicle began accelerating at a point 5 to 5 ½ miles from a truck parking area, where the driver had stopped to adjust the brakes. While attempting to negotiate a curve, the trailer separated from the tractor, overturned in front of a pickup and attached camper-trailer traveling in the opposite direction, and struck the other vehicle, causing it to burst into flames and killing all seven occupants. As a result, the Safety Board recommended that the FHWA: H-75-17 Develop and disseminate throughout the motor carrier industry, an “On Guard” bulletin alerting drivers of commercial vehicles equipped with externally adjustable braking systems of: a) the need to be familiar with company policies and practices with respect to on-road adjustment of brakes; b) methods and techniques for detecting potential or existing problems in adjustment; c) the scope of the problem in insuring proper brake adjustment; d) methods or techniques for the proper on-road adjustment of braking systems currently and generally in use. In response, the FHWA developed a bulletin entitled “Danger-Driver Adjusted Brakes,” which was circulated to all carriers for display on bulletin boards and distribution to drivers and safety supervisors. The Safety Board classified this recommendation “Closed—Acceptable Action” on October 20, 1977. 60 National Transportation Safety Board, Francisco Flores Truck/Pickup Truck with Camper and Trailer Collision, U.S. Route 395, Bishop, California, June 29, 1974, Highway Accident Report NTSB/HAR-75/05 (Washington, DC: NTSB/1975).

Analysis 42 Highway Accident Report A similar recommendation resulted from the Safety Board’s 1992 safety study on heavy vehicle airbrake performance. The Safety Board recommended that the National Private Truck Council, the Owner-Operator Independent Driver Association, and the American Trucking Associations work with one another: H-92-67, -72, and -74 To complete and distribute to member carriers appropriate brake maintenance materials that clearly establish standard inspection techniques (including adjustment indicators), inspection and adjustment interval guidelines, and an adjustment method (covering both manual and automatic slack adjusters) for S- cam brakes on heavy vehicles. Encourage members to provide a copy of the information to each driver of a heavy vehicle and to each mechanic who services heavy vehicles. On July 29, 2002, the Safety Board classified this recommendation to the National Private Truck Council “Closed—Unacceptable Action/No Response Received.” In 1993, the Owner-Operator Independent Driver Association produced and distributed more than 15,000 copies of a brake videotape and accompanying booklet entitled What’s Stopping You? that stressed the importance of regular preventive brake maintenance, provided an overview of roadside inspection procedures, and warned of the potentially serious consequences of mismatching brake components. Also included was information from the FHWA and the University of Michigan Transportation Research Institute on downhill braking techniques. The Safety Board classified the recommendation to the Owner-Operator Independent Driver Association “Closed—Acceptable Action” on January 30, 2001. Through its maintenance council, the American Trucking Associations developed a training video on how to conduct truck brake inspection and maintenance. In 1992, the American Trucking Associations informed the Safety Board that efforts were under way with the FHWA’s OMC to develop a method carriers could use to establish an appropriate brake adjustment interval for their own operations. The FMCSA Web site now contains a comprehensive list of brake maintenance materials and guidelines. The Safety Board classified the recommendation to the American Trucking Associations “Closed— Acceptable Action” on July 16, 2002. The intent of the safety recommendations issued in 1975 and 1992 was to inform carriers and drivers of the need to maintain brake adjustment and to perform the adjustment properly, but the materials may not have reached or been used by all carriers. Safety Board investigators were unable to determine whether Stuart Trucking received any of these materials. Informing drivers about standard inspection techniques and adjustment methods is an important first step in proper brake maintenance. Although the Mountainburg driver described to investigators the correct procedure for adjusting brakes, he apparently did not apply that knowledge in the case of the accident vehicle.

Analysis 43 Highway Accident Report Automatic Slack Adjusters and Out-of-Adjustment Indicators. Beginning in 1978, the Safety Board made several safety recommendations to require that vehicles be equipped with automatic slack adjusters and out-of-adjustment indicators.61 In 1977 and 1978, the Safety Board investigated five accidents in which commercial vehicle drivers were unable to maintain speed control on downgrades. The major causal factor in four of these accidents was improper adjustment of the vehicles’ service brakes, and in the fifth, the trailer brakes were totally inoperative. In two instances, the owners and operators had failed to ensure that the vehicles were safe for operation before they were dispatched. In its 1992 study of Heavy Vehicle Airbrake Performance, the Safety Board issued safety recommendations that superseded those resulting from the investigations conducted in the 1970s and 1980s. The Board cited numerous brake deficiencies, including serious instances of out-of-adjustment brakes, as causal or contributing factors in the accidents investigated to support the 1992 safety study. The Safety Board urged NHTSA to: H-92-50 Require that air-braked vehicles be equipped with visible adjustment indicators that will allow one person to check the level of adjustment. H-92-51 Expedite the proposed rulemaking to require automatic adjusters on vehicles equipped with airbrake systems. NHTSA issued a final rule on October 20, 1992, amending FMVSS 121, “Air Brake Systems,” and FMVSS 105, “Hydraulic Brake Systems,” to require automatic brake adjusters on all air-braked and hydraulic-braked vehicles manufactured after October 20,

1. Consequently, the Safety Board classified both recommendations “Closed—

Acceptable Action” on December 21, 1992. The Safety Board also recommended that the FHWA: H-92-57 Encourage the installation of vehicle brake adjustment indicators on all vehicles equipped with airbrake systems for easy detection of adjustment levels. In 1995, the FHWA published a report entitled Evaluation of Brake Adjustment Criteria for Heavy Trucks, which presented analyses, findings, and recommendations concerning the brake adjustment criteria of the “North American Uniform Driver-Vehicle Inspection Criteria for Heavy Trucks.” The FHWA also issued a final rule requiring motor carriers that have vehicles manufactured on or after October 20, 1994, to retain automatic brake adjustment indicators. Therefore, the Safety Board classified this recommendation “Closed—Acceptable Action” on February 5, 1996. 61 Safety Recommendations H-78-48 and H-88-30 were superseded by Safety Recommendation H-92-

1. Safety Recommendations H-81-1 and H-88-32 were superseded by Safety Recommendation H-92-51.

Analysis 44 Highway Accident Report The safety recommendations issued in 1992 resulted in the Federal requirement that all commercial vehicles manufactured after 1994 have automatic slack adjusters and brake adjustment indicators, which were in place on the trailer involved in the Mountainburg accident. The tractor was built prior to the rulemaking requiring the use of these systems. While the automatic slack adjusters did maintain the adjustment on two of the trailer’s brakes, they could not maintain proper adjustment on two other brakes because of broken springs and an improperly installed spring brake. Automatic slack adjusters can only function as designed if the other brake components are properly installed and maintained. Accident Vehicle Brake Adjustment. The tractor semitrailer in the Mountainburg accident was equipped with manual slack adjusters on the tractor brakes and automatic slack adjusters on the trailer. Eight of the 10 brakes were either out of adjustment or nonfunctional at the time of the accident, and 4 brakes were unable to provide any braking force, even without taking into account heat buildup and drum expansion. The driver said that the tractor brakes were last adjusted on May 27, 2001, when he and the owner had installed manual slack adjusters on the second and third axles of the tractor. The owner admitted that he did not keep the front axle brakes fully adjusted and backed them off ¾ turn. According to accepted maintenance practices, brakes should only be backed off either until the drum turns freely or a maximum of 3/8 to ½ turn. NHTSA has conducted extensive research to evaluate the need for front steering axle brakes. Following a series of tests, the agency concluded: Drivers were clearly able to achieve better performance with full front brakes than without under all circumstances. They stopped in shorter distances under full control with full front brakes. Without front brakes, best stopping distances were 5 to 130 percent longer and drivers were more likely to lose control.62 Because the front brakes on the accident vehicle had not been adjusted properly, they were either out of adjustment or close to being out of adjustment at the start of the trip, decreasing the braking ability of the front axle brakes. The drum on axle 1R was rusty, indicating that the brake shoe was not contacting the drum when the brakes were applied, so this brake provided no braking force at all. The owner of the truck had installed manual slack adjusters on the second and third axles of the tractor 4 days before the accident. He said he adjusted the brakes at that time using prescribed procedures, that is, turning the adjusting nut until the shoes touched the drums and then backing off the adjusting nut ½ turn. The driver said he watched Stuart Trucking’s mechanic adjust the brakes on the trailer 2 or 3 weeks before the accident. 62 U.S. Department of Transportation, National Highway Traffic Safety Administration, A Demonstration of the Safety Benefits of Front Brakes on Heavy Trucks, DOT HS 807 061 (Washington, DC: NHTSA, 1986).

Analysis 45 Highway Accident Report When some brakes are out of adjustment, the remaining brakes must provide greater braking force whenever they are applied in order to stop the vehicle, increasing the rate at which they wear and thus become out of adjustment. The brakes on the first axle (1R and 1L) provided limited braking force because they were improperly adjusted (1R provided no braking force for a period of time before the day of the accident, as evidenced by the rusted brake drum reported by the driver). Brakes on axles 3L, 4R, and 5L could not provide much, if any, braking force since they were nonfunctional owing to poor maintenance and other broken components. Therefore, the remaining 5 brakes (3 on the tractor and 2 on the trailer) had to provide the braking force for 10 brakes. Heat can also speed the rate at which brakes become out of adjustment. When some brakes on a vehicle are out of adjustment, those brakes that are within adjustment heat more rapidly because of the additional workload placed on them. Following the accident, the only brakes found to be within adjustment were those without broken components and equipped with automatic slack adjusters, which compensated for pushrod slack, adjusting accordingly. The truck had only been driven about 1,600 miles, primarily on level roadways, since the new manual slack adjusters had been installed on May 27, or 4 days before the accident. Even so, during postaccident inspection, investigators found that the brakes were out of adjustment. According to industry representatives from Kenworth and Bendix, brakes should require adjustment every 6,000 to 8,000 miles. The Safety Board concludes that the six brakes on the tractor were out of adjustment either because the owner had not properly adjusted them, or because the brakes became out of adjustment due to a disproportional workload, or both. The driver said that he did a visual inspection of the brakes on the day of the accident and did not find them to be out of adjustment. The Commercial Driver’s License Manual recommends that during a pretrip inspection, the driver, at a minimum, pull on the pushrod and measure the stroke. If the stroke exceeds ½ to 1 inch, the brakes should be adjusted. Postaccident inspection showed that the stroke on five of the six tractor brakes exceeded 2 inches and that one other (3L), on which the stroke was restricted to 1 7/8 inch by a broken spring, also needed adjustment. Accident damage would not have affected the brakes’ stroke. The driver did not follow recommended practice for measuring stroke during the pretrip inspection, and a visual inspection did not allow him to determine that the brakes were out of adjustment. While the CDL practice is only recommended, not mandatory, it is an important part of the pretrip inspection because of the safety-related nature of the brake system and the possible consequences, as in the case of this accident, when brakes are not adjusted properly. The Safety Board concludes that the driver did not conduct a sufficiently thorough pretrip inspection on either the tractor or the trailer to discover the brake deficiencies. As 49 CFR 383.111(e)(4) and (g)(5) state, all commercial vehicle operators must have knowledge of procedures for conducting safe and accurate pretrip inspections and knowledge of airbrakes. Title 49 CFR 383.113 requires that all CDL applicants

Analysis 46 Highway Accident Report demonstrate pretrip inspection skills pertaining to airbrakes, including the ability to determine brake conditions and proper adjustment. Interviews with the accident driver indicated that he knew how to adjust brakes. While the accident driver did have a CDL, he did not demonstrate that he was knowledgeable about procedures for conducting a safe and accurate pretrip inspection on the day of the accident or about the consequences of not conducting a thorough pretrip inspection. However, 49 CFR 396.13(a) only stipulates that a driver be satisfied that the motor vehicle is in safe operating condition before driving it; the regulations specify neither what must be done during a pretrip inspection, nor which procedures must be performed daily on a vehicle. The Safety Board has investigated other accidents in which pretrip inspection procedures were lax as well. On March 2, 1999, near Santa Fe, New Mexico, a motorcoach began descending a 14-mile mountainous roadway, and halfway down, the driver found that the brakes were providing no retarding force.63 The driver lost control of the bus, and it departed the right side of the roadway, crashed into a rock embankment, and overturned. Investigators found that four of the bus’s six brakes were out of adjustment at the time of the accident and two brakes were nonoperational. Company mechanics did not routinely examine driver pretrip inspection forms and did not know whether company drivers completed pretrip inspections. The busdriver reported that in the 10 months he had worked for the company, he had never completed a pretrip vehicle inspection. A review of company maintenance records revealed that some drivers were occasionally completing vehicle inspection reports. Had the Mountainburg and Santa Fe drivers been required to measure the stroke on each brake and to determine its adjustment before they began driving on the day of the accident and had they fulfilled such a requirement, they may have discovered that some brakes were out of adjustment and taken appropriate corrective action. The Safety Board believes that the FMCSA should revise CFR 396.13, Driver Inspection, to require minimum pretrip inspection procedures for determining brake adjustment. Spring Brakes. Of six brakes on the tractor semitrailer equipped with spring brakes for emergency-parking brake application (axles 3, 4, and 5), three had broken springs. The 3L brake spring was broken in three pieces, restricting total stroke by 3/8 inch. Thus, even though the 3L brake appeared to be within adjustment at 1 7/8 inches, it was not. The 4L brake spring was broken in two pieces, and dynamic testing of the vehicle showed that the broken spring did not prevent service brake application; the service brakes even locked during one test. When the emergency-parking brake was applied during another test, the 4L brake provided some braking force (the service brake locked on gravel but not on concrete), indicating the emergency-parking brake force was reduced due to the broken spring, but was not completely eliminated. 63 National Transportation Safety Board, Motorcoach Loss of Control and Overturn, New Mexico State Route 475, March 2, 1999, Highway Accident Brief NTSB/HAB-01/01 (Washington, DC: NTSB, 2001).

Analysis 47 Highway Accident Report The 5L brake spring was also broken and blocking the pushrod, thereby limiting pushrod stroke and preventing it from reaching the minimum 1½ inches necessary for the automatic adjuster to begin readjustment. During testing, 5L did not provide any braking force when either the emergency-parking brake or the service brake was applied. In other words, both the emergency-parking brake and the service brake were nonfunctional. Thus, a broken spring, in addition to reducing the braking ability of the emergency-parking brake or rendering it inoperable, can have a detrimental effect on the service brakes, as was the case in this accident. Broken springs on two of the vehicle’s three brakes prevented proper brake adjustment, thereby contributing to a reduction of the tractor semitrailer’s braking efficiency. The caging that houses brake springs makes detection of broken springs difficult because access to the closed chamber is restricted. One method of detection involves inserting an optical device called a borescope into the caging port. Another entails inserting a finger inside the caging port, but doing so can be extremely dangerous during roadside inspections; if the truck moves, the spring breaks, or the driver applies or releases the parking brake, the inspector can be injured. If the spring brake is equipped with an integrated caging bolt, then it has no port for accessing the spring. Brake springs are neither a CVSA out-of-service item nor an inspection item. However, as this accident demonstrates, broken springs can have safety consequences when they prevent proper adjustment of the service brake or decrease the braking capability of the emergency- parking brake. The Safety Board concludes that because of the spring brake design, examining the springs to determine whether they were broken was difficult on three of the truck’s brakes. Therefore, the Safety Board believes that the manufacturers should develop a spring brake that allows inspectors or mechanics to view components safely to determine whether the spring is broken. Safety Board staff participates in CVSA committees, and once the spring brakes are redesigned, staff will work with the CVSA to incorporate inspection of spring brake components into the vehicle inspection criteria. Springs break for various reasons, including exposure to the elements, number of brake applications, age, or material properties. Contaminants can enter spring brake chambers through the caging ports unless dust covers (small caps) are in place to prevent contaminants from entering. These contaminants, such as salt and water, can weaken the material properties of the spring, making it more susceptible to breakage. On the accident vehicle, dust covers were missing on all four spring brakes that had standard nonintegrated caging ports. Evidence of a white substance, probably salt deposits, was present inside the 4L spring chamber, and salt can corrode a spring, leading to its failure. The Safety Board concludes that dust covers on the caging ports of the accident vehicle’s spring brakes would have reduced the chance of corrosion to the spring, possibly prolonging the life of the spring and, in turn, the life of the emergency-service brakes. The Safety Board believes that the CVSA should include spring brake caging port dust covers as an inspection item during Motor Carrier Safety Assistance Program roadside inspections.

Analysis 48 Highway Accident Report Motor Carrier Inspection and Oversight Recommendation History The Mountainburg accident is one of many in which the Safety Board has identified the inadequacy of motor carrier inspections, including compliance reviews, as cause for concern. In 1995, for example, the Safety Board investigated a motorcoach accident in which the bus overturned when it entered an exit ramp in Indianapolis, Indiana;64 2 passengers sustained fatal injuries and 13 sustained serious injuries. Postaccident inspection of the vehicle revealed out-of-adjustment brakes; as a result, the bus had only 50 percent braking efficiency, which probably contributed to the accident. The OMC conducted an after-accident compliance review of the operator, Hammond Yellow Coach Lines, Inc., (Hammond) that resulted in an unsatisfactory rating (10 of 10 vehicles reviewed were placed out of service) and a subsequent out-of-service order because of noncompliance within 45 days of the proposed unsatisfactory rating. However, Hammond already had significant safety problems before the accident and yet was still permitted to operate. The OMC had inspected Hammond nine times between 1987 and 1995. In 1993, the OMC gave Hammond an unsatisfactory rating, citing the carrier’s accident rate and hours-of-service violations; 3 months later, the agency upgraded that rating to satisfactory. In 1994, the OMC used Indiana State Police terminal inspection results to determine the rating for its compliance review. Because of the high number of vehicles (63 percent) meeting out-of-service criteria, Hammond received a conditional rating for the vehicle factor component of the compliance review. But the OMC rated all other factors satisfactory, resulting in an overall rating of satisfactory and Hammond continued to operate with unsafe vehicles. Following the Indianapolis accident, the Safety Board asked the DOT to: H-99-6 Change the safety fitness rating methodology so that adverse vehicle and driver performance-based data alone are sufficient to result in an overall unsatisfactory rating. On December 14, 1999, the OMC (now FMCSA) responded that it expected to issue a notice of proposed rulemaking calling for a more performance-based means of determining carrier fitness to conduct commercial motor vehicle operations. The OMC stated that it would take into account the Safety Board’s recommendation, along with any comments received, in developing a new rating system. The Safety Board classified the recommendation “Open—Acceptable Response” on March 17, 2000, based on the expected notice of proposed rulemaking. Safety Recommendation H-99-6 was also added to the Safety Board’s Most Wanted Transportation Safety Improvements list to increase the public’s awareness of and support for action to adopt safety steps that can help prevent accidents and save lives. Since then, the FMCSA has developed a rating system that 64 National Transportation Safety Board, Selective Motorcoach Issues, Highway Special Investigation Report NTSB/SIR-99/01 (Washington, DC: NTSB, 1999).

Analysis 49 Highway Accident Report allows it to focus compliance reviews on the carriers who have had safety problems in the past. On July 12, 2002, the FMCSA advised the Safety Board that it would address Safety Recommendation H-99-6 in an upcoming notice of proposed rulemaking on “Safety Fitness Procedures.” Like Hammond, the carrier in the Indianapolis accident, Stuart Trucking had significant safety defects on the accident vehicle and other vehicles, numerous driver violations, and unqualified brake inspectors, yet was still permitted to operate. Compliance Reviews Stuart Trucking’s most recent compliance review prior to the Mountainburg accident took place on December 5, 1989, and resulted in a satisfactory rating. Following the accident, the FMCSA conducted a compliance review that resulted in a conditional rating for factor 2 (driver factor), an unsatisfactory rating for factor 5 (accident factor), and a conditional rating overall. FMCSA staff did not inspect any vehicles during this review, even though the accident was vehicle-related. They relied instead on the motor carrier profile report, which listed 29 roadside inspections in the previous 12 months, resulting in four out-of-service vehicles (14 percent), all with out-of-adjustment brakes. The regulations at 49 CFR Part 385, Appendix B, state that if fewer than 34 percent of vehicles (the national average) inspected in the previous 12 months (when more than three vehicles receive roadside inspections) are placed out of service, then the carrier is rated satisfactory for the vehicle factor, as was the case in the postaccident compliance review of Stuart Trucking. Safety Board investigators were concerned that the FMCSA did not inspect any of Stuart Trucking’s vehicles. This accident involved a vehicle in which 8 of 10 brakes were out of adjustment and the carrier’s mechanic was not a qualified brake inspector, suggesting that more vehicles may have had brake problems than were detected in the 12 months of roadside inspections, yet the FMCSA did not inspect any vehicles during the compliance review immediately following this accident. Consequently, the Safety Board asked the Missouri Division of Motor Vehicles and Railroad Safety to conduct an additional review of the carrier and inspect all its vehicles. Of 12 vehicles examined, 5 vehicles (42 percent) had out-of-service violations. Not only did this review reveal an out- of-service rate higher than the FMCSA recorded in its compliance review, but investigators also determined that the brakes had not been maintained properly. Improper maintenance, which cannot be detected without conducting vehicle inspections, can be telling as to the condition of a carrier’s vehicles. The Safety Board concludes that based on the inspection conducted by the Missouri Division of Motor Vehicles and Railroad Safety that followed the accident, had FMCSA staff inspected Stuart Trucking’s vehicles during the 2001 compliance review, the carrier would probably have received a conditional rating in factor 4 (vehicle factor) instead of a satisfactory rating. The FMCSA’s overreliance on roadside inspections when conducting compliance reviews may lead to underestimating the number of out-of-service vehicles. As noted above, the percentage of out-of-service vehicles found during the terminal inspection of Stuart Trucking was triple that found during the previous 12 months of roadside inspections. The Safety Board is concerned that carriers may be operating unsafe vehicles

Analysis 50 Highway Accident Report that are not detected during a roadside inspection or compliance review and that, as a result, the carrier’s rating may be inaccurate because it misrepresents the proportion of out-of-service vehicles. The FMCSA will not conduct a terminal inspection if three or more of a company’s vehicles received roadside inspections in the previous 12 months. But the vehicles that receive roadside inspections may not be representative of the entire fleet. The Safety Board believes that the FMCSA should require that vehicle inspections of a motor carrier’s fleet be conducted during compliance reviews. Furthermore, even if its vehicle factor rating had been changed as a result of the 2001 compliance review, Stuart Trucking’s overall rating would have remained conditional. Under current compliance review procedures, one unsatisfactory factor rating and two or fewer conditional factor ratings result in an overall conditional rating. The 2001 rating for Stuart Trucking underscores the failure of compliance reviews to identify unsafe carriers. This carrier had not been rated in more than 11 years at the time of the accident. Despite having unsafe vehicles on the road, no qualified brake inspectors, and numerous driver violations, Stuart Trucking still received a conditional rating. The tragic consequences of this accident add urgency to the Safety Board’s Safety Recommendation H-99-6 to change the safety fitness rating methodology. The FMCSA continues to respond that it plans to issue a notice of proposed rulemaking that would lead to a more performance-based safety fitness rating system. To date it has not done so. Therefore, the Safety Board reiterates Safety Recommendation H-99-6 to the DOT urging it to change the safety fitness rating methodology so that adverse vehicle and driver performance-based data alone are sufficient to result in an overall unsatisfactory rating. Qualified Brake Inspector Title 49 CFR Part 396.24, “Qualification of Brake Inspectors,” requires that each brake inspector successfully complete an apprenticeship program or a training program or have a certificate or experience totaling 1 year; in addition, the motor carrier must maintain evidence of qualifications. Stuart Trucking’s mechanic, who was responsible for maintaining most of the company’s tractors and trailers, had not received any formal training in brake inspection, although he did have more than 1 year of experience and, under current rules, was eligible for certification. The owner said that he was not aware of the regulations requiring anyone who inspects or maintains brakes to be certified. Although the person responsible for maintaining the brakes on the trailer of the accident vehicle had experience in brake maintenance, the condition of the trailer’s brakes belied this experience, since three of the trailer’s four brakes had broken parts or were nonfunctional at the time of the accident. Two brakes (4L and 5L) had broken springs, and during installation of one spring brake (4R), the pushrod was cut too short, rendering the automatic slack adjuster inoperable. Stuart Trucking’s mechanic did not detect the latter problem in the 4 years between installation of the 4R spring brake in 1997 and the accident. In fact, brakes 4R and 5L had quite likely been inoperative for some time, since the brake drums were rusted, indicating the shoes had not been in contact with the drums. A qualified mechanic should have noticed this problem during routine maintenance and inspections.

Analysis 51 Highway Accident Report In addition, the absence of grease at the fittings and brake camshaft bushings suggested a lack of periodic lubrication, and the Arkansas Highway Police and ArvinMeritor staff both commented on the poor overall condition of the trailer’s brake system. During their follow-up vehicle inspection, Missouri Division of Motor Vehicle and Railroad Safety inspectors stated that Stuart Trucking staff’s knowledge of truck maintenance seemed to be lacking; these inspectors also noted that some defects they found were obvious and did not appear to be recent. A brake inspector with sufficient training and knowledge would probably have identified the problems with the brakes on this semitrailer and fixed the brakes so that they were operative. The Safety Board concludes that the Stuart Trucking mechanic lacked proper training in brake maintenance and inspections, did not detect the poorly adjusted or inoperative brakes on the trailer, and did not perform recommended maintenance. The Safety Board has investigated other accidents in which a motor carrier did not use a certified brake inspector to perform maintenance on its vehicles. In the aforementioned accident near Santa Fe in 1999, investigators found that the steering and drive axle brakes were out of adjustment, that the auxiliary weight-bearing axle brakes were not operational because they were “cammed over,”65 and that both drums were worn beyond the manufacturer’s acceptable limits. During postaccident inspection of the carrier by the New Mexico Motor Transport Division, all but two of the inspected motorcoaches were placed out of service due to mechanical defects, most of which were related to the brake systems. The carrier did not keep brake mechanic qualification records, as required, and none of the three company mechanics interviewed could adequately describe the maximum brake adjustment levels for the brakes on the motorcoaches, how to conduct a vehicle brake inspection, or how to adjust brakes. Under the current compliance review process, the FMCSA does not consider violation of 40 CFR 396.25 “critical.” Thus, if a motor carrier does not have a qualified brake inspector, it does not affect the carrier’s rating. In fact, in its compliance review of Stuart Trucking, the FMCSA did not even note that a qualified brake inspector certificate was not on file. The Safety Board believes that during compliance reviews, the FMCSA should rate companies as unsatisfactory in the vehicle factor category if the mechanics and drivers responsible for maintaining brake systems are not qualified brake inspectors. As the Mountainburg and Santa Fe accidents demonstrate, experience working in a maintenance shop is not always sufficient to ensure that a mechanic has the knowledge necessary to maintain a truck brake system. The FMCSA is remiss in permitting mechanics to work on brakes without knowing whether they have the requisite skills in brake maintenance. The Safety Board believes that the FMCSA should revise 49 CFR 396.25, Qualifications of Brake Inspectors, to require certification after testing as a prerequisite for qualification and specify, at a minimum, formal training in brake maintenance and inspection. 65 A condition in which the S-cam rotates beyond the service brake cam rollers and remains lodged in this position. The cause is generally a combination of out-of-adjustment brakes, worn brake shoes, and an excessively worn drum.

Analysis 52 Highway Accident Report Fuel Tanks Recommendation History While it has not made specific recommendations addressing retrofitted propane tanks on school buses, the Safety Board has recommended protecting fuel tanks on school buses to minimize the risk of fire. On February 29, 1972, a 1961 sedan ran a stop sign near Reston, Virginia,66 and collided with a school bus carrying four children. The impact ruptured the school bus fuel tank, knocked it from the bus, and disabled the school bus service door. A fire ensued in the sedan due to gasoline spilled from the ruptured and detached school bus fuel tank, which was in a vulnerable location and lacked crash protection design features. The Safety Board urged that NHTSA and the Vehicle Equipment Safety Commission: H-72-2 In consideration of the unnecessary hazards posed by locating school bus fuel tanks adjacent to service doors, act promptly to determine the “best” and “safest” location for school bus fuel tanks and to specify such location, as well as any protective shield or structural changes, to minimize the likelihood that a collision which might disable the service door or the emergency exit will also initiate a school bus fuel tank fire, and vice versa. NHTSA replied that the rigorous side- and rear-impact barrier collision test requirements of FMVSS 301 afforded a high level of protection for fuel systems on all vehicles up to 10,000 pounds gross vehicle weight rating. In addition, on September 19, 1974, the agency stated that a program to develop fuel system integrity tests for large school buses was planned. Such tests were later incorporated into FMVSS 301, and the Safety Board classified the recommendation “Closed—Acceptable Action” on September 6, 1985. On May 14, 1988, a pickup truck traveling north in the southbound lanes of Interstate 71 struck a southbound church activity bus head-on near Carrollton, Kentucky.67 The church bus fuel tank was punctured during the collision sequence and a fire ensued, engulfing the bus. The busdriver and 26 bus passengers were fatally injured, 34 passengers received minor to serious injuries, and 6 passengers were not injured. As a result of its investigation of this accident, the Safety Board asked that NHTSA: 66 National Transportation Safety Board, School Bus/Automobile Collision and Fire Near Reston, Virginia, on February 29, 1972, Highway Accident Report NTSB/HAR-72/02 (Washington, DC: NTSB, 1972). 67 National Transportation Safety Board, Pickup Truck/Church Activity Bus Head-on Collision and Fire Near Carrollton, Kentucky, on May 14, 1988, Highway Accident Report NTSB/HAR-89/01 (Washington, DC: NTSB, 1989).

Analysis 53 Highway Accident Report H-89-6 Revise Federal Motor Vehicle Safety Standard 301 to provide additional protection for school buses in severe crash situations based on an evalua- tion of the merits of relocating fuel tanks, providing additional structure to protect fuel system components, and frangible valves in critical locations. NHTSA replied on August 16, 1989, enclosing copies of an advance notice of proposed rulemaking to make the crash standards more stringent. In an April 11, 1991, letter, NHTSA stated that responses to the advance notice of proposed rulemaking did not provide clear direction for proposing changes to FMVSS 301. Thus, for the next step, NHTSA said it was considering several options, including a research program to develop the technical information necessary to evaluate ways to improve the fuel system integrity of buses. On October 20, 1995, NHTSA reported that those commenting on the advance notice of proposed rulemaking agreed that FMVSS 301 was adequate and that manufacturers generally comply with the requirements by adding a cage around the fuel tank. The Safety Board classified the recommendation “Closed—Acceptable Action” on May 15, 1996, citing its understanding that school bus manufacturers generally comply with stringent regulatory crash test requirements for large school bus fuel systems by adding a cage around the fuel tank. These safety recommendations, issued over the past 3 decades, encouraged NHTSA and the school bus manufacturers to make fuel tanks on school buses safer. However, none of NHTSA’s fuel tank safety requirements for school buses apply to propane tanks. Mountainburg Accident School Bus The propane tank, which had been retrofitted on the accident school bus, was installed in accordance with NFPA Standard 58, “Standard for the Storage and Handling of Liquefied Petroleum Gases.” The Safety Board is concerned that this standard does not adequately protect propane fuel systems during a crash. Unlike gasoline and compressed natural gas systems, which are fitted onto school buses by the manufacturer, propane and other retrofitted fuel systems are not required to meet NHTSA crash test standards specified in FMVSSs 301 and 303. These standards require that gasoline and compressed natural gas systems mounted on a vehicle withstand a barrier crash test. Propane systems must pass no such test, and NHTSA cannot even regulate propane system testing because propane systems are aftermarket installations and therefore not subject to NHTSA safety standards. Most States (Idaho is the only exception) require that propane systems meet NFPA standards. While propane systems must have a discharge valve, this valve will not prevent a fire from occurring during a severe crash if the fuel system is compromised. To further protect gasoline and diesel fuel tanks on school buses from being compromised, school bus manufacturers place them within a cage, even though not required to do so. In fact, a rigid safety cage enclosed the manufacturer-installed fuel tank on the accident school bus. The propane tank did not have such protection. As discussed above, the Safety Board has investigated school bus crashes in which cages did not enclose fuel tanks, and severe fires and loss of life ensued. The Safety Board concludes

Analysis 54 Highway Accident Report that catastrophic fires involving vehicles equipped with propane tanks could happen because these tanks are not protected from collision and, thus, could rupture if struck. The Safety Board believes that the NFPA should amend Standard 58, Storage and Handling of Liquefied Petroleum Gas, to require that (1) propane fuel systems installed in school buses be protected and (2) propane fuel systems meet the equivalent to FMVSS 301 crash protection standards. Current legislation generally prohibits NHTSA from regulating aftermarket equipment installed on vehicles. However, in this case, the children riding on the school bus did not receive the same level of protection as those children riding on buses equipped with gasoline, diesel, or compressed natural gas tanks, which NHTSA does regulate. The Safety Board believes that NHTSA should obtain the authority, as necessary, and include propane fuel system integrity standards for aftermarket installations in the FMVSSs. Occupant Kinematics and Survival Factors Recommendation History In its special investigation report on bus crashworthiness issues,68 adopted on September 21, 1999, the Safety Board found that some passengers not seated in the direct intrusion area were seriously or fatally injured in school buses involved in lateral impacts with large vehicles and rollovers. The Safety Board concluded: Current compartmentalization is incomplete in that it does not protect school bus passengers during lateral impacts with vehicles of large mass and in rollovers, because in such accidents, passengers do not always remain completely within the seating compartment. The Safety Board recommended that NHTSA: H-99-45 In 2 years, develop performance standards for school bus occupant protection systems that account for frontal impact collisions, side impact collisions, rear impact collisions, and rollovers. In response to this recommendation, NHTSA is conducting a study to develop ways to enhance the safety of the interior environment for school bus passengers. The agency completed front and side impact full-scale crash testing on large school buses and published the results of the frontal impact restraint testing in May 2002. One of its conclusions was that requiring lap belts on large school buses would have little, if any, benefit in reducing serious or fatal injuries in severe frontal crashes. NHTSA also found that use of lap/shoulder belts could provide some benefit on large school buses, potentially 68 National Transportation Safety Board, Bus Crashworthiness Issues. Highway Special Investigation Report NTSB/SIR-99/04 (Washington, DC: NTSB, 1999).

Analysis 55 Highway Accident Report saving one life per year, if used properly 100 percent of the time. NHTSA recommended that seat heights be increased from 20 inches to 24 inches to prevent passenger override in a collision and that standardized test procedures be developed for voluntarily installed lap/shoulder belts. The side impact testing and research report will not be completed until spring

1. Preliminary test results show that crash test dummies away from the impact area do

not travel across the width of the bus and strike the sidewall,69 contrary to what the Safety Board has observed in accident investigations. The Safety Board is concerned about NHTSA relying on the one side impact test as indicative of all severe side impact crashes. The impact point was soft (not an axle) and the collision energy was absorbed by the deformation. Furthermore, the crash test lacked an angular velocity or acceleration measurement, thereby invalidating any comparisons between the test and real world crashes. Injury values were low for dummies away from the impact area. The Safety Board classified Safety Recommendation H-99-45 “Open—Acceptable Response” on April 18, 2001. During a train-school bus collision at a highway-rail grade crossing in Conasauga, Tennessee, on March 28, 2000,70 six passengers were seriously injured or killed because they struck surfaces within the bus, such as nonenergy-absorbing seat frames and sidewall components, which are exempt from FMVSS passenger protection standards. On December 11, 2001, following its investigation of this accident, the Safety Board asked that NHTSA: H-01-40 Develop and incorporate into the Federal Motor Vehicle Safety Standards performance standards for school buses that address passenger protection for sidewalls, sidewall components, and seat frames. On April 23, 2002, NHTSA responded that it is addressing this issue as part of a research program scheduled to be completed in spring 2003. If protection is deemed feasible, NHTSA said it will upgrade FMVSS 222, “School Bus Passenger Seating and Crash Protection,” to include requirements for passenger protection at sidewalls, sidewall components, and seat frames. The Safety Board classified this recommendation “Open— Acceptable Response” on July 16, 2002. In the Mountainburg accident, Safety Board investigators also found that occupant motion, similar to that seen in previous accidents, resulted in injuries to passengers who 69 The side impact crash test was conducted on a bus equipped with a rear engine; thus the center of gravity was further rearward than in a front-engine bus because the weight was concentrated at the rear rather than the front. This difference could affect the angular velocity and acceleration (which were not measured) experienced by the occupants in the rear of the bus. 70 National Transportation Safety Board, Grade Crossing Accident Involving a CSX Corporation Freight Train and a Murray County, Georgia, School District School Bus, Conasauga, Tennessee, on March 28, 2000. Highway Accident Report NTSB/HAR-01/03 (Washington, DC: NTSB, 2001).

Analysis 56 Highway Accident Report did not remain within their seating compartment and traveled across the width of the bus during impact. Mountainburg Accident School Bus During the Mountainburg collision sequence, the bus rotated about 300 degrees clockwise about the front axle. At the end of the accident sequence, the bus body became partially separated from the chassis and rolled onto its right side. The occupants in the front of the bus at first probably experienced limited lateral acceleration and motion forward and toward the right because of their proximity to the front of the bus and the rotation of the bus about the front axle. Occupants at the rear of the bus quite likely moved forward and toward the right more rapidly than those in the front due to the bus’s rotation about the front axle and the greater lateral acceleration they experienced. Because the passengers in the front were seated close to the bus’s point of rotation (the front axle), they did not experience the high lateral and rotational accelerations experienced by those seated further from the front axle. All passengers in the front of the bus received less serious injuries than those seated in the back. The passengers in the rear of the bus were subjected to the impact force, tractor intrusion, and lateral and rotational accelerations imparted to the bus during the collision sequence. The passenger in seat 10E on the right was directly in the area of impact but survived. Because of his proximity to the side of the bus where the impact occurred and the subsequent intrusion, the difference in relative velocity between his body and the side of the bus was minimal. His serious injuries resulted from being in direct line with the impact forces; his injuries were predominantly on the right side of his body and included lacerations to his head, face, and shoulder from glass fragments and a closed head injury. The passengers seated on the left side of the bus in the rear were probably thrown forward and across the width of the bus toward the striking truck. They did not remain within their seating compartment during impact because compartmentalization, the current occupant protection strategy inside large school buses, only provides protection during frontal impacts. Three of these passengers (in seats 9A, 9C, and 11A) received fatal injuries, primarily to the head and upper torso, most likely as a result of being thrown from their seating compartment and striking nonenergy-absorbing surfaces, including the ceiling, sidewalls, and window frames, after traveling the width of the bus. The passenger in seat 11A may also have sustained injuries as a result of being partially ejected through the right side window of the bus, which rolled on top of him. The passenger in seat 10A sustained serious injuries. In previous accidents, investigators found that passengers possibly struck other passengers during lateral collisions. In this case, the passengers seated across from (seat 10E) or in front of (seat 9C) the passenger in seat 10A may have protected him from more severe or even fatal injuries as they moved out of their compartmentalized seating area. The Safety Board concludes that the impact and subsequent rotation of the bus caused passengers seated in the rear to be thrown from their seating compartment and into the area of intrusion; incomplete compartmentalization and impact with nonenergy-absorbing surfaces within the bus contributed to the serious and fatal injuries sustained by these passengers.

Analysis 57 Highway Accident Report The Safety Board addressed the issue of incomplete compartmentalization and the lack of energy-absorbing material on interior surfaces in its special investigation report on bus crashworthiness issues and in its investigation report on the Conasauga accident. This accident demonstrates again the need for NHTSA to continue its work on occupant protection for lateral impacts and its work to reduce the nonenergy-absorbing surfaces within school buses. Both efforts have the potential to reduce injuries to those occupants seated outside the area of impact.

58 Highway Accident Report Conclusions Findings 1. There was no evidence of drug or alcohol use by the drivers; the weather, mechanical condition of the school bus, design and signing of the highways, emergency response, and truckdriver fatigue did not contribute to the accident. 2. Poorly adjusted and nonfunctional brakes, together with the resulting high temperatures in the functioning brakes, reduced the truck’s braking efficiency to such an extent that the truckdriver was unable to stop the vehicle at the end of the ramp. 3. The six brakes on the tractor were out of adjustment either because the owner had not properly adjusted them, or because the brakes became out of adjustment due to a disproportional workload, or both; the driver did not conduct a sufficiently thorough pretrip inspection on either the tractor or the trailer to discover the brake deficiencies. 4. Because of the spring brake design, examining the springs to determine whether they were broken was difficult on three of the truck’s brakes. 5. Dust covers on the caging ports of the accident vehicle’s spring brakes would have reduced the chance of corrosion to the spring, possibly prolonging the life of the spring and, in turn, the life of the emergency-service brakes. 6. Based on the inspection conducted by the Missouri Division of Motor Vehicles and Railroad Safety that followed the accident, had the Federal Motor Carrier Safety Administration inspected Stuart Trucking’s vehicles during the 2001 compliance review, the carrier would probably have received a conditional rating in factor 4 (vehicle factor) instead of a satisfactory rating. 7. The Stuart Trucking mechanic lacked proper training in brake maintenance and inspections, did not detect the poorly adjusted or inoperative brakes on the trailer, and did not perform recommended maintenance. 8. Catastrophic fires involving vehicles equipped with propane tanks could happen because these tanks are not protected from collision and, thus, could rupture if struck. 9. The impact and subsequent rotation of the bus caused passengers seated in the rear to be thrown from their seating compartment and into the area of intrusion; incomplete compartmentalization and impact with nonenergy-absorbing surfaces within the bus contributed to the serious and fatal injuries sustained by these passengers.

Conclusions 59 Highway Accident Report Probable Cause The National Transportation Safety Board determines that the probable cause of the accident was the truckdriver’s inability to stop the tractor semitrailer at the stop sign at the bottom of the ramp due to the reduced braking efficiency of the truck’s brakes, which had been poorly maintained and inadequately inspected. Contributing to the school bus passengers’ injuries during the side impact were incomplete compartmentalization and the lack of energy-absorbing material on interior surfaces.

60 Highway Accident Report Recommendations As a result of this accident, the National Transportation Safety Board makes the following safety recommendations: To the Federal Motor Carrier Safety Administration: Revise 49 Code of Federal Regulations 396.13, Driver Inspection, to require minimum pretrip inspection procedures for determining brake adjustment. (H-02-15) Require that vehicle inspections of a motor carrier’s fleet be conducted during compliance reviews. (H-02-16) Revise 49 Code of Federal Regulations 396.25, Qualifications of Brake Inspectors, to require certification after testing as a prerequisite for qualification and specify, at a minimum, formal training in brake maintenance and inspection. (H-02-17) During compliance reviews, rate companies as unsatisfactory in the vehicle factor category if the mechanics and drivers responsible for maintaining brake systems are not qualified brake inspectors. (H-02-18) To the National Highway Traffic Safety Administration: Obtain the authority, as necessary, and include fuel system integrity standards for aftermarket installations in the Federal Motor Vehicle Safety Standards. (H-02-19) To the Commercial Vehicle Safety Alliance: Include spring brake caging port dust covers as an inspection item during Motor Carrier Safety Assistance Program roadside inspections. (H-02-20) To the National Fire Protection Association: Amend National Fire Protection Association Standard 58, Storage and Handling of Liquefied Petroleum Gas, to require that (1) propane fuel systems installed in school buses be protected and (2) propane fuel systems meet the equivalent to Federal Motor Vehicle Safety Standard 301 crash protection standards. (H-02-21)

Recommendations 61 Highway Accident Report To Spring Brake Manufacturers: Develop a spring brake that allows inspectors or mechanics to view components safely to determine whether the spring is broken. (H-02-22) The National Transportation Safety Board also reiterates the following recommendation: To the U.S. Department of Transportation: Change the safety fitness rating methodology so that adverse vehicle or driver performance-based data alone are sufficient to result in an overall unsatisfactory rating for the carrier. (H-99-6) BY THE NATIONAL TRANSPORTATION SAFETY BOARD MARION C. BLAKEY Chairman CAROL J. CARMODY Vice Chairman JOHN A. HAMMERSCHMIDT Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: September 4, 2002

63 Highway Accident Report Appendix A Investigation and Public Hearing The National Transportation Safety Board was notified of the Mountainburg, Arkansas, accident on May 31, 2001. An investigative team was dispatched with members from the Washington, D.C.; Fort Worth, Texas; Denver, Colorado; and Atlanta, Georgia, offices. Groups were established to investigate human performance; motor carrier operations; and highway, vehicle, and survival factors. Participating in the investigation were representatives of the Federal Motor Carrier Safety Administration, the Arkansas State Police, and the Arkansas State Highway and Transportation Department. No public hearing was held; no depositions were taken.

this page intentionally left blank

FD07256 ｜ 2002_美国_HAR2002.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2002 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Vehicle Collision With Student Pedestrians Crossing High-Speed Roadway to Board School Bus Rochester, Indiana October 30, 2018

Accident Report NTSB/HAR-20/02 PB2020-100122

National Transportation Safety Board

NTSB/HAR-20/02 PB2020-100122 Notation 59830 Adopted March 31, 2020

Highway Accident Report Vehicle Collision With Student Pedestrians Crossing High-Speed Roadway to Board School Bus Rochester, Indiana October 30, 2018

National Transportation Safety Board

490 L’Enfant Plaza, SW Washington, DC 20594

National Transportation Safety Board. 2020. Vehicle Collision With Student Pedestrians Crossing High-Speed Roadway to Board School Bus, Rochester, Indiana, October 30, 2018. Highway Accident Report NTSB/HAR-20/02. Washington, DC: NTSB.

Abstract: About 7:12 a.m., on October 30, 2018, a school bus, operated by Tippecanoe Valley School Corporation, was traveling north on State Route 25 (SR-25) in Rochester, Indiana, on its morning route. At this location, SR-25 is a two-lane highway with a posted speed limit of 55 mph. The school bus stopped at its designated location to pick up students, and the driver activated the bus’s red warning lights and stop arm. Ten students and a parent were waiting for the school bus at a mobile home park on the other side of the road from the bus stop. After being signaled by the school bus driver to cross, four of the students entered the southbound roadway. A pickup truck traveling south on SR-25 failed to stop for the school bus and struck the four children. A 9-year-old female and two 6-year-old males were fatally injured. An 11-year-old male sustained serious injuries. The National Transportation Safety Board (NTSB) identified the following safety issues: • Deficiencies in establishing safe school bus routes and stop locations. • Failure of other drivers to stop or otherwise respond safely when approaching a school bus that is stopped with its warning lights on and stop arm extended. • Need for greater use of technologies to prevent collisions with, and mitigate injuries of, student pedestrians. The NTSB makes safety recommendations to the National Highway Traffic Safety Administration; the 28 states (and District of Columbia) that do not have laws permitting use of stop arm cameras for enforcement purposes; the Indiana Department of Education; the National Association of State Directors of Pupil Transportation Services, National Association for Pupil Transportation, and National School Transportation Association; the International Association of Chiefs of Police, National Sheriffs’ Association, and National Association of School Resource Officers; and the Tippecanoe Valley School Corporation.

The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974, to investigate transportation accidents, determine their probable causes, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties … and are not conducted for the purpose of determining the rights or liabilities of any person” (Title 49 Code of Federal Regulations section 831.4). Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report (Title 49 United States Code section 1154(b)).

For more detailed background information on this report, visit the NTSB investigations website and search for NTSB accident ID HWY19MH003. Recent publications are available in their entirety on the NTSB website. Other information about available publications also may be obtained from the website or by contacting—National Transportation Safety Board, Records Management Division, CIO-40, 490 L’Enfant Plaza, SW, Washington, DC 20594, (800) 877-6799 or (202) 314-6551.

Copies of NTSB publications may be downloaded at no cost from the National Technical Information Service, at the National Technical Reports Library search page, using product number PB2020-100122. For additional assistance, contact—National Technical Information Service, 5301 Shawnee Rd. Alexandria, VA 22312, (800) 553-6847 or (703) 605-6000, or the NTIS website.

NTSB

Highway Accident Report

i Contents Figures and Tables ....................................................................................................................... iii Acronyms and Abbreviations ..................................................................................................... iv Executive Summary ..................................................................................................................... vi

1 Factual Information ....................................................................................................................1 1.1 Crash Narrative ..........................................................................................................................1 1.2 Other Crash Information ............................................................................................................2 1.2.1 Students............................................................................................................................2 1.2.2 Pickup Truck Driver ........................................................................................................3 1.3 Injuries .......................................................................................................................................3 1.4 Emergency Response .................................................................................................................5 1.5 Highway Information .................................................................................................................5 1.5.1 General .............................................................................................................................5 1.5.2 Highway Sightline ...........................................................................................................7 1.5.3 Scene Evidence ................................................................................................................8 1.6 Driver Information .....................................................................................................................8 1.6.1 Pickup Truck Driver ........................................................................................................8 1.6.2 School Bus Driver ..........................................................................................................11 1.7 Motor Carrier Operations and Regulatory Oversight ..............................................................12 1.7.1 Tippecanoe Valley School Corporation .........................................................................12 1.7.2 School Bus Route ..........................................................................................................13 1.7.3 Indiana State Regulatory Oversight ...............................................................................15 1.7.4 Indiana Department of Education Transportation-Related Training .............................15 1.8 Vehicle Information .................................................................................................................16 1.8.1 Toyota Tacoma Pickup Truck .......................................................................................16 1.8.2 Thomas Built School Bus ..............................................................................................19 1.9 Weather and Astronomical Data ..............................................................................................20 1.10 Witness Statements ................................................................................................................20 1.10.1 Occupants of Vehicle Behind Pickup Truck ...............................................................20 1.10.2 Driver of Vehicle Behind School Bus .........................................................................21 1.10.3 Parent and Student at Bus Stop ....................................................................................21 1.11 Postcrash Actions ...................................................................................................................21 1.11.1 TVSC Postcrash Improvements ...................................................................................21 1.11.2 Indiana Senate Bill 2 ....................................................................................................22 1.12 Other NTSB Investigations ....................................................................................................22 1.12.1 Hartsfield, Georgia ......................................................................................................23 1.12.2 Baldwyn, Mississippi ...................................................................................................23 1.13 Data on School Transportation-Related Crashes and Illegal Passings ..................................23

NTSB

Highway Accident Report

ii 2 Analysis ......................................................................................................................................25 2.1 Introduction ..............................................................................................................................25 2.2 Pickup Truck Driver Response ................................................................................................27 2.3 Enhancing Safety of School Bus Routes and Stops .................................................................28 2.3.1 School Bus Routes and Stops ........................................................................................28 2.3.2 Roadway Crossing Procedures ......................................................................................32 2.4 Modifying Driver Behavior Near School Buses ......................................................................33 2.4.1 Education Efforts ...........................................................................................................34 2.4.2 Enforcement Actions .....................................................................................................35 2.5 Using Technology to Prevent Collisions With Student Pedestrians and Mitigate Injuries .....37 2.5.1 Connected and Automated Vehicles ..............................................................................37 2.5.2 Pedestrian Automatic Emergency Braking ....................................................................40 2.5.3 Other Technologies to Prevent Illegal School Bus Passings and Increase Crossing Safety .............................................................................................................................42 3 Conclusions ................................................................................................................................46 3.1 Findings....................................................................................................................................46 3.2 Probable Cause.........................................................................................................................48 4 Recommendations .....................................................................................................................49 4.1 New Recommendations ...........................................................................................................49 4.2 Previously Issued Recommendations Reiterated in This Report .............................................50 Appendix: Investigation ..............................................................................................................52 References .....................................................................................................................................53

NTSB

Highway Accident Report

iii Figures and Tables Figure 1. View of crash location on SR-25 in Rochester, Indiana................................................. 1 Figure 2. Postcollision site photograph .......................................................................................... 4 Figure 3. Southbound approach to collision site and relative locations of signage ....................... 6 Figure 4. Crash location and SR-25 roadway ................................................................................ 8 Figure 5. Route of school bus #36 at time of crash...................................................................... 14 Figure 6. Frontal damage to pickup truck .................................................................................... 17 Figure 7. On-scene postcrash view of school bus with lights in operation .................................. 20 Figure 8. Extended stop arm with two stop signs on school bus ................................................. 44 Figure 9. Close-up view of extended stop arm with single stop sign and horizontal stop bar..... 45 Table 1. Injuries.............................................................................................................................. 3 Table 2. Pickup truck driver’s first and last cell phone activity, October 27–30, 2018 ............... 10 Table 3. Event data recorder information ..................................................................................... 18

NTSB

Highway Accident Report

iv Acronyms and Abbreviations AAA American Automobile Association ABS antilock braking system CDL commercial driver’s license CFR Code of Federal Regulations DOT US Department of Transportation FCSO Fulton County Sheriff’s Office FMVSS Federal Motor Vehicle Safety Standard GVWR gross vehicle weight rating IDOE Indiana Department of Education IIHS Insurance Institute for Highway Safety IMUTCD Indiana Manual on Uniform Traffic Control Devices for Streets and Highways INDOT Indiana Department of Transportation KSDE Kansas State Department of Education MS-370 Mississippi State Highway 370 MUTCD Manual on Uniform Traffic Control Devices for Streets and Highways NAPT National Association for Pupil Transportation NASDPTS National Association of State Directors of Pupil Transportation Services NCAP New Car Assessment Program [NHTSA] NCSL National Conference of State Legislatures NCST National Congress on School Transportation NHTSA National Highway Traffic Safety Administration NPRM notice of proposed rulemaking

NTSB

Highway Accident Report

v NSC National Safety Council NSTA National School Transportation Association NSTSP National School Transportation Specifications and Procedures NTSB National Transportation Safety Board PAEB pedestrian automatic emergency braking SR-25 State Route 25 TRB Transportation Research Board TVSC Tippecanoe Valley School Corporation V2I vehicle-to-infrastructure V2P vehicle-to-pedestrian V2V vehicle-to-vehicle V2X vehicle-to-everything

NTSB

Highway Accident Report

vi Executive Summary Crash Summary About 7:12 a.m., on Tuesday, October 30, 2018, a 2015 Thomas Built school bus, operated by Tippecanoe Valley School Corporation, was traveling north in the 4600 block of State Route 25 (SR-25) in Rochester, Fulton County, Indiana, on its morning route. At this location, SR-25 is a two-lane highway with a posted speed limit of 55 mph. The school bus stopped at its designated location to pick up students, and the driver activated the bus’s red warning lights and stop arm. At this location, an agricultural field is on the east side of SR-25 and a mobile home park is on the west side; 10 students and a parent were waiting for the school bus at the mobile home park on the other side of the road from the bus’s pickup stop. A Watch For School Bus warning sign is posted for southbound traffic on SR-25 about 868 feet before the mobile home park. There is no roadway lighting at this location. Conditions were dark, the sky was cloudy, and the roadway was dry. After being signaled by a wave from the school bus driver to cross the roadway, four of the students entered the southbound roadway. A 2017 Toyota Tacoma pickup truck traveling south on SR-25 failed to stop for the school bus and struck the four children. According to the vehicle’s recorded data, the pickup truck struck the student pedestrians at 41 mph. As a result of the crash, a 9-year-old female and two 6-year-old males were fatally injured. An 11-year-old male sustained serious injuries. None of the other people waiting for the bus or any occupants of the pickup truck and school bus were injured.1 Probable Cause The National Transportation Safety Board determines that the probable cause of the Rochester, Indiana, crash was the pickup truck driver’s failure to stop for the school bus for unknown reasons, despite its clearly visible warning lights and stop arm, as well as a roadway warning sign indicating an upcoming school bus stop. Contributing to the cause of the crash was the Tippecanoe Valley School Corporation’s (1) inadequate safety assessment of school bus routes, resulting in the prevalence of bus stops that required student pedestrians to cross a 55 mph roadway to board a bus, increasing the risk of injury during a collision, and (2) failure to establish a clear policy regarding surrounding traffic for school bus drivers to follow in determining when it was safe to signal students to cross a roadway to board a school bus. Safety Issues The safety issues identified in this investigation include the following:

1 For more information, see the Factual Information and Analysis sections of this report. Additional information about the investigation of this crash (National Transportation Safety Board [NTSB] case number HWY19MH003) can be found by accessing the Docket Management System at www.ntsb.gov. For more information on our safety recommendations, see the Safety Recommendation Database at www.ntsb.gov.

NTSB

Highway Accident Report

vii • Deficiencies in establishing safe school bus routes and stop locations. The school bus route for the bus involved in this crash required students to cross a 55 mph roadway to board the school bus in the dark, early morning hours. A safe school bus route should avoid requiring students to cross high-speed roadways. Creating safe routes requires that those who develop the routes be adequately trained to assess route safety. Moreover, school bus routes should be evaluated periodically for hazards, and when individuals familiar with the route identify hazards, there should be a mechanism by which the dangers can be reported and tracked. Finally, when students must cross a roadway to board a bus, drivers and students must know and use consistent procedures to reduce the risk of the crossing. • Failure of other drivers to stop or otherwise respond safely when approaching a school bus that is stopped with its warning lights on and stop arm extended. Although motorists are required by law to stop for a school bus that is stopped with its warning lights flashing and stop arm extended, many motorists fail to do so; they drive past the school bus and create a dangerous situation for any student who might be crossing the roadway. Education and enforcement can be used to reduce motorists’ illegal behavior. • Need for greater use of technologies to prevent collisions with, and mitigate injuries of, student pedestrians, including vehicle-to-everything (V2X), pedestrian automatic emergency braking, and school bus safety-enhancing technologies. Although routes that require a student to cross a roadway to board a school bus (or to return home after disembarking) should be minimized, there will continue to be some routes where students will have to cross a roadway. In such cases, technology may help to prevent crashes or mitigate any injuries sustained by students. Findings 1. None of the following were factors in this crash: (1) mechanical condition of the pickup truck or condition of the school bus warning light and stop arm systems; (2) school bus driver licensing; (3) pickup truck driver licensing, drug or alcohol impairment, medical condition, vision, or cell phone use; or (4) actions/behavior of the student pedestrians or the adult pedestrian. 2. There is insufficient information to determine whether the school bus and pickup truck drivers were fatigued in the period leading up to the crash. 3. The emergency response to the crash was timely and effective. 4. For reasons that cannot be determined from the available evidence, the pickup truck driver did not respond to the activated warning lights and stop arm of the school bus, and she did not attempt to stop her vehicle until she saw the students in the roadway. 5. Requiring students to cross a roadway, regardless of the number of lanes, presents a risk of pedestrian death or injury because motorists do not always stop, as required, for school buses, even when a bus is at a bus stop with its lights flashing and stop arm extended.

NTSB

Highway Accident Report

viii 6. Periodically evaluating school bus routes and stops for hazards can reduce the safety risks to student pedestrians. 7. The existing Indiana Department of Education training for school transportation directors does not contain sufficient information on assessing the safety of school bus routes or identifying hazards at school bus stops. 8. The routing hazards evident in the recent Hartsfield, Georgia, and Baldwyn, Mississippi, crashes suggest that inadequate school bus routing may be a widespread problem. 9. The Tippecanoe Valley School Corporation’s inadequate safety assessment of school bus routes resulted in bus stops that required students to cross a high-speed roadway, placing them at risk. 10. Creating a mechanism by which school bus drivers and parents (or caregivers) of student riders could report safety concerns about bus operations would provide an additional source of information that could be used to improve the safety of school bus routes and stops. 11. The Tippecanoe Valley School Corporation’s policy at the time of the crash, which required school bus drivers to determine subjectively when surrounding traffic was “controlled,” left its bus drivers with insufficient information to make a safe determination about when to signal students to cross a roadway to board a school bus, placing students at risk. 12. In circumstances when a student roadway crossing cannot be avoided, the school bus driver must be knowledgeable of, and consistent when making, crossing and warning signals, and students must be aware of, and understand, the crossing and warning signals the driver makes. 13. Although it is illegal in all 50 states, National Association of State Directors of Pupil Transportation Services data show that the passing of stopped school buses by other vehicles remains a pervasive and continuing safety issue in the United States. 14. Education materials informing the driving public of the illegality and dangers of passing a school bus that is stopped to load or unload passengers are widely available from a variety of sources. 15. Evidence suggests that coupling enhanced enforcement of no-passing laws with efforts to educate motorists about the dangers of passing a stopped school bus may reduce the incidence of illegal passings. 16. The use of stop arm cameras could deter drivers from illegally passing stopped school buses. 17. It remains a safety priority that school buses be included in performance standards for connected vehicle technologies.

NTSB

Highway Accident Report

ix 18. The Federal Communications Commission’s proposed rulemaking to reduce Intelligent Transportation System operations to the upper 30 megahertz of the currently assigned bandwidth while opening the remaining 45 megahertz to unlicensed devices would be detrimental to safety and set back advancements in transportation safety. 19. Because school buses and the children they carry are an integral part of the transportation system, it is imperative to transportation safety that the developers and manufacturers of advanced technologies create systems in which automated and connected vehicles respond appropriately to school buses. 20. Although there are limitations to the current pedestrian automatic emergency braking systems, these safety technologies can help the driver and prevent or lessen the severity of crashes involving pedestrians. 21. Because funding for school bus equipment is limited, to make the best use of their resources, school systems need more information on which technologies are most effective in reducing illegal school bus passings and protecting students from the risk of injury. Recommendations New Recommendations To the National Highway Traffic Safety Administration: When evaluating safety self-assessment reports from entities testing automated driving systems on public roads, evaluate how effectively the entities include school bus operations in their plans. (H-20-10) Evaluate the effectiveness of technologies designed to reduce the incidence of illegal school bus passings, and publish and disseminate the evaluation results. (H-20-11) To the states of Alaska, Arizona, California, Colorado, Delaware, Florida, Hawaii, Iowa, Kansas, Louisiana, Michigan, Minnesota, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, North Dakota, Ohio, Oregon, South Dakota, Texas, Vermont, and Wisconsin; the commonwealths of Kentucky and Massachusetts; and the District of Columbia: Enact legislation to permit stop arm cameras on school buses to capture images, and allow citations to be issued for illegal school bus passings based on the camera-obtained information. (H-20-12) To the Indiana Department of Education: Supplement your training program for school transportation directors with a module on how to assess the safety and risks of school bus routes and stops, according to best industry practices. (H-20-13)

NTSB

Highway Accident Report

x Require local school transportation directors and others involved in evaluating school bus routes and stops in Indiana to complete the training module on the safety and risks of routes and stops recommended in Safety Recommendation H-20-13. (H-20-14) To the National Association of State Directors of Pupil Transportation Services, National Association for Pupil Transportation, and National School Transportation Association: Inform your members of the circumstances of the Rochester, Indiana; Baldwyn, Mississippi; and Hartsfield, Georgia, crashes, and urge them to minimize the use of school bus stops that require students to cross a roadway (especially a high-speed roadway) and to, at least annually, and also whenever a route hazard is identified, evaluate the safety of their school bus routes and stops. (H-20-15) Remind your members to ensure that school transportation directors and others involved in evaluating school bus routes and stops complete training on how to assess the safety of school bus routes and stops, according to best industry practices. (H-20-16) Advise your members to train their school bus drivers and students on crossing procedures, including the crossing hand signal and the danger signal, which are to be used when a student roadway crossing cannot be avoided. (H-20-17) Urge your members to continue to coordinate with local law enforcement agencies to conduct educational and enforcement activities aimed at reducing illegal school bus passings. (H-20-18) To the International Association of Chiefs of Police, National Sheriffs’ Association, and National Association of School Resource Officers: Inform your members of the fatal Rochester, Indiana; Baldwyn, Mississippi; and Hartsfield, Georgia, crashes, and encourage them to continue to work with local school districts to conduct educational and enforcement activities to reduce illegal school bus passings. (H-20-19) To the Tippecanoe Valley School Corporation: Implement a process to track school bus driver and parent (or caregiver) complaints regarding the safety of school bus routes and stops, as well as any other safety concerns about bus operations, from initial submission of an issue to its resolution. (H-20-20) Train your school bus drivers and students on crossing procedures, including the crossing hand signal and the danger signal, which are to be used when a student roadway crossing cannot be avoided. (H-20-21)

NTSB

Highway Accident Report

xi Previously Issued Recommendations Reiterated in This Report To the National Highway Traffic Safety Administration: Develop minimum performance standards for connected vehicle technology for all highway vehicles. (H-13-30) Once minimum performance standards for connected vehicle technology are developed, require this technology to be installed on all newly manufactured highway vehicles. (H-13-31) Incorporate pedestrian safety systems, including pedestrian collision avoidance systems and other more-passive safety systems, into the New Car Assessment Program. (H-18-43)

NTSB

Highway Accident Report

1 1 Factual Information 1.1 Crash Narrative On Tuesday, October 30, 2018, the 57-year-old male driver of a 72-passenger 2015 Thomas Built school bus, operated by Tippecanoe Valley School Corporation (TVSC), was driving his normal route. He had picked up three students at designated school bus stops and, about 7:12 a.m., was traveling north in the 4600 block of State Route 25 (SR-25) in Rochester, Fulton County, Indiana. At this location, SR-25 is a two-lane highway with a posted speed limit of 55 mph. A mobile home park is located on the west side of the roadway and an agricultural field is located on the east side. (See figure 1.)1 There is no roadway lighting at this location. Conditions were dark, the sky was cloudy, and the roadway was dry.

Figure 1. View of crash location on SR-25 in Rochester, Indiana. (Source: Google Earth 2020, modified by the National Transportation Safety Board [NTSB]) Before stopping the school bus in the northbound lane, the bus driver activated the bus’s amber warning lights. As the bus came to a complete stop at the designated stop location, the driver activated the bus’s red warning lights, which deployed the stop arm.2 Ten students and a parent were waiting for the school bus at the mobile home park on the

1 SR-25 generally runs northeast to southwest; however, it is usually referred to as a north and south highway. In the Rochester area, just north of the crash site, SR-25 curves so as to change the road’s orientation to one that is essentially east–west. Just south of the crash site, SR-25 again resumes its more typical northeast–southwest orientation. To avoid confusion in this report, we generally refer to vehicles traveling northbound and southbound on SR-25 rather than providing strict compass directions at any location. 2 See Title 49 Code of Federal Regulations (CFR) 571.131. The term “stop signal arm” is used in Federal Motor Vehicle Safety Standard (FMVSS) 131; however, the safety device is commonly referred to as a “stop arm.” In this report, wherever possible, the term “stop arm” is used.

NTSB

Highway Accident Report

2 west side of the roadway, opposite the bus stop. The school bus driver said he saw the headlights of a vehicle approaching in the southbound lane in the distance, and he expected the driver of that vehicle to stop. The bus driver signaled with a wave of his hand for the students to cross SR-25 to board the school bus. Four of the students entered the southbound lane of SR-25 and began crossing the roadway. A few steps behind this group were three more students who had not yet begun to cross the roadway. The remaining three students had not reached the roadway. The approaching vehicle was a 2017 Toyota Tacoma pickup truck operated by a 24-year-old female driver. The driver’s brother and two children were seated, and restrained, in the rear seat. While traveling south on SR-25, the pickup truck driver passed a Watch For School Bus warning sign posted about 868 feet before the mobile home park. The driver of the pickup truck did not stop for the school bus, as required by Indiana state law.3 When the bus driver realized that the pickup truck was not going to stop, he honked the school bus’s horn. The pickup truck struck four student pedestrians. A 9-year-old female and two 6-year-old males were fatally injured. An 11-year-old male sustained serious injuries and was transported by medical helicopter to a medical facility in Fort Wayne, Indiana. The other people waiting for the school bus, as well as the occupants of the pickup truck and school bus, were not injured. The vehicle-recorded speed of the pickup truck several seconds before impact was 58–59 mph. The recorded data indicate that the pickup truck brakes were applied between 1.3 and 0.8 seconds before impact. At 0.8 seconds before impact, the vehicle speed was 55.9 mph. At the time of impact, the recorded vehicle speed was 41 mph. The pickup truck was not equipped with a pedestrian automatic emergency braking (PAEB) system. 1.2 Other Crash Information 1.2.1 Students On the day of the collision, a parent waited at the mobile home park with 10 students, ranging in age from elementary to high school, for the school bus to arrive.4 The parent said she instructed all the students to remain behind the fence that was between the mobile home park and the roadway. The parent reported that she saw the white flashing light on top of the school bus from a distance as it approached from the south. As the school bus reached the designated stop location, she started to gather the students into one group to cross SR-25. She said that when the school bus stopped, the warning lights and interior light were on, and the stop arm was deployed. In preparation to cross the roadway, the 9-year-old female held hands with one of the 6-year-old males on her left side and the other 6-year-old male on her right side (as the children faced the roadway). The 11-year-old male student stood to the right of the 6-year-old male on the right. The parent said that the school bus driver signaled the children to cross the road. The parent said that, as the children began

3 See Indiana Code 9-21-8-52. 4 This information is summarized from NTSB investigators’ interview with the parent and a student waiting for the school bus on the day of the collision. The interview occurred on February 12, 2019.

NTSB

Highway Accident Report

3 to cross the roadway, the pickup truck “appeared out of nowhere.” She said the school bus driver honked the bus’s horn. 1.2.2 Pickup Truck Driver The pickup truck driver said that on the morning of the crash, she left her home in Rochester, Indiana, with her husband, their two children (ages 2 and 3 years old), and her 12-year-old brother. Her husband drove them to his job in Talma, Indiana, about 9 miles away, and they arrived at 7:05 a.m. After dropping off her husband, the driver began driving the pickup truck on a return trip back to Rochester, this time heading for her brother’s house (near her home) to get him ready for school.5 Her brother and the other children were seated in the rear seat of the pickup truck. She said she talked to her brother as she drove, and the younger children were asleep. She said that as she approached the stopped school bus, she saw a vehicle ahead but did not recognize what type of vehicle it was. She said she suddenly saw two children and tried to stop. She said that she did not realize that the vehicle was a school bus until seeing the children. 1.3 Injuries As a result of this crash, three student pedestrians died, and another sustained serious injuries. The other student pedestrians and adult pedestrian were not injured. None of the pickup truck occupants sustained injuries. The school bus was not involved in the collision, and the school bus driver and the bus’s three passengers were not injured. (See table 1.) Table 1. Injuries.

Fatal Serious Minor None Total Pedestrians 3 1 0 7 11 Pickup truck occupants 0 0 0 4 4 School bus occupants 0 0 0 4 4 Total 3 1 0 15 19 NOTE: Title 49 CFR 830.2 defines fatal injury as any injury that results in death within 30 days of the accident, and serious injury as any injury that: (1) requires hospitalization for more than 48 hours, commencing within 7 days from the date of injury; (2) results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages, nerve, or tendon damage; (4) involves any internal organ; or (5) involves second- or third-degree burns, or any burn affecting more than 5 percent of the body surface. Figure 2 shows the positions of the student pedestrians after impact. The 9-year-old female was struck by the pickup truck and came to rest in the grassy area on the west side

5 Although the pickup truck driver was familiar with this route on SR-25, it was not usual for her to make an early morning trip to and from Talma. The circumstances of the trip will be discussed in section 1.6.1.

NTSB

Highway Accident Report

4 of the roadway about 79 feet south of the front bumper of the stopped school bus. She sustained multiple fatal blunt-force trauma injuries. The two 6-year-old males were also struck by the pickup truck and came to rest in the southbound lane next to the double yellow line, about 46 feet south of the bus’s front bumper. Both of the 6-year-old males sustained fatal blunt-force trauma injuries. The 11-year-old male was also struck by the pickup truck and came to rest in the grassy area adjacent to the roadway, about 130 feet south of the bus’s front bumper. He sustained serious blunt-force trauma injuries and was flown by medical helicopter to a medical facility in Fort Wayne, Indiana.

Figure 2. Postcollision site photograph showing the postcollision positions of the school bus, pickup truck, and four struck student pedestrians. (The students are indicated by age and gender (that is, “age-gender.”) (Source: Indiana State Police, modified by the NTSB) The driver of the pickup truck was restrained with a lap/shoulder belt. The driver airbags deployed during impact.6 The driver’s 2-year-old and 3-year-old children were restrained in child restraint systems in the rear passenger seat of the pickup truck, and the driver’s 12-year-old brother was wearing a lap/shoulder belt in the center seating position of the rear seat.

6 The data downloaded from the airbag control module indicated that the driver-side frontal and knee, side, and side-curtain airbags all deployed. On the passenger side, the side and side-curtain airbags deployed; the frontal airbag for this seat did not deploy because the seat was unoccupied. The module had event data recorder functionality. The data were downloaded by the Indiana State Police.

NTSB

Highway Accident Report

5 1.4 Emergency Response The Fulton County Sheriff’s Office (FCSO) Emergency 911 Communications Center received its first call at 7:15:25 a.m.7 At 7:15:50, eight FCSO deputies were dispatched to the crash site. The FCSO emergency dispatcher also notified the Rochester Fire Department. The Rochester Fire Department informed Lutheran EMS that at least one medical helicopter, and potentially three, would be needed for the incident.8 A Lutheran EMS ambulance and a Rochester Fire Department truck were the first to arrive at the crash site at 7:21:47 a.m. The first FCSO deputy arrived shortly afterward, at 7:25:46 a.m. Two additional Lutheran EMS ambulances arrived at the scene at 7:29:30 a.m. and 7:36:17 a.m., respectively. A fire truck from the nearby town of Mentone also responded. The medical helicopter provided by Parkview Samaritan Medical Transport was requested at 7:22:13 a.m. and arrived at the scene at 7:49:06 a.m. The Indiana State Police was notified by the FCSO of the crash at 7:52:51 a.m. 1.5 Highway Information 1.5.1 General The collision of the pickup truck with the student pedestrians occurred on SR-25, about 4.6 miles north-northeast of the city of Rochester. This segment of SR-25 has two opposing lanes of traffic delineated by solid white striping at the right-side lane edges and yellow centerline striping denoting where passing is permitted or restricted. In the southbound direction, passing is restricted beginning about 3,593 feet north of the collision area. The southbound lane at the crash site measures about 12.9 feet wide; the northbound lane at this location is about 11.9 feet wide. This segment of SR-25 is defined as a rural major collector.9 The highway approach to and through the collision area has no street lighting or other sources of supplemental roadway lighting. The speed limit is 55 mph, and the nearest speed limit sign in the southbound direction is about 2.46 miles before the collision site.10 The collision occurred along a 960-foot-long tangent (straight) segment of highway. The area of impact between the pickup truck and the students was near the center of the southbound travel lane, adjacent to the centermost (of three) paved access roadways for the mobile home park.

7 Interviews with witnesses indicated that several individuals unsuccessfully attempted to call 911 on their cell phones; however, cell phone reception in the area is unreliable. 8 Lutheran EMS is a private contractor that provides emergency medical services in Indiana. 9 “Collectors” are roads that connect local roads and streets with highways and similar higher-speed roadways. The posted speed limits on collectors are usually in the 35–55 mph range. 10 This location is just south of the unincorporated community of Talma, through which the highway speed limit is reduced.

NTSB

Highway Accident Report

6 The highway has curves on the northern and southern approaches to the tangent segment. One curve is about 890 feet north of the collision site.11 A second curve begins about 2,164 feet north of the collision site.12 Another curve begins about 70 feet south of the collision site.13 (Sightline information is discussed in the next section of this report.) With respect to highway signage, a Watch For School Bus sign is positioned about 868 feet north of the collision site. A School Bus Stop Ahead sign is positioned 9,706 feet north of the collision site. Curve warning signs are located 667 feet north of the collision site (left curve warning sign), 1,747 feet north of the collision site (right curve warning sign), and 3,355 feet north of the collision site (right curve warning sign). (See figure 3 for roadway and signage information.)

Figure 3. Southbound approach to collision site and relative locations of signage along SR-25. (Source: Google Earth 2020, modified by the NTSB) The Indiana Manual on Uniform Traffic Control Devices for Streets and Highways (IMUTCD) does not specify an application for the Watch For School Bus warning sign, but it states that the sign may be installed if the school bus stops at individual residences to pick up or discharge passengers, rather than at a single location where numerous passengers

11 This is a rightward curve for vehicles traveling southbound on SR-25. 12 This is a rightward curve for vehicles traveling southbound on SR-25. 13 This is a leftward curve for vehicles traveling southbound on SR-25.

NTSB

Highway Accident Report

7 are picked up or discharged.14 Further, the IMUTCD says that the Watch For School Bus signs are not intended for use everywhere a school bus stops to pick up or discharge passengers but are to be used where terrain and roadway features limit the approach sight distance and there is no opportunity to relocate the school bus stop location to another spot with adequate visibility. According to the Indiana Department of Transportation (INDOT), in 2018, the estimated annual average daily traffic for SR-25 through the area of the collision was 2,953 vehicles.15 In all, 53 crashes were reported within 2 miles of the crash site from 2013 through 2018. In the area of the mobile home park (between the northern and southern access roadways), there was one single-vehicle crash, in addition to this collision. 1.5.2 Highway Sightline INDOT personnel conducted a static line-of-sight measurement from the area of the collision northward. As a 6-foot-tall subject stood in the center of the northbound lane adjacent to the collision site, an approaching southbound observer was able to see the subject at a distance of 1,233 feet.16 This was consistent with an estimate made based on highway plans and collision site measurements, which projected a sight distance of 1,185 feet. On the day of the crash, the students waited for the approaching school bus on an access road to the mobile home park at a short distance behind a chain link fence that ran parallel to the roadway, between the mobile home park and the SR-25 roadway. The fence was set back about 26 feet from the SR-25 pavement edge. Had those waiting for the bus stood any farther behind the fence, the mobile homes in their northward line of sight would have blocked their view of the road in that direction. An area of dense foliage was located along the fence line about 80 feet from the mobile home park access road and extended toward the highway from the fence. The clear zone from the foliage to the roadway was 13 feet. Considering these limitations, the northward (toward the pickup truck) sightline distance for those waiting for the bus at the mobile home park could have been as short as 265 feet.17 As the students moved toward the roadway, their northward line of sight would steadily improve. With respect to their south- and eastward sightlines, from their position behind the fence, the students had a clear line of sight of the school bus as it approached the mobile home park, as well as of the stop position of the bus. (See figure 4.)

14 By statute, Indiana Code section 9-21-2-1 through 9-21-2-4, Indiana Department of Transportation, adopts the IMUTCD with concurrence from the Federal Highway Administration. The IMUTCD conforms substantially with the federal MUTCD (FHWA 2009). 15 INDOT reported that the annual average daily traffic for SR-25 through the area of the collision was estimated from ground counts taken in June 2014 and April 2017. 16 The observation was conducted during daylight hours, with the observer likely aware of the purpose of the observation. 17 An unobstructed line of sight does not consider that light sources, such as approaching vehicle headlamps, could be visible through the foliage.

NTSB

Highway Accident Report

8

Figure 4. Crash location and SR-25 roadway. (Source: Google Earth 2020, modified by the NTSB) 1.5.3 Scene Evidence When the crash occurred, the school bus was approximately centered within the northbound lane, with its front bumper about 11.5 feet south of the centerline of the access road into the mobile home park (where the children stood). The final rest position of the pickup truck after the crash was 170.6 feet south of the school bus, as measured from the two vehicles’ bumpers. At final rest, the pickup truck was positioned off the right side of the southbound travel lane with its right-side wheels off the pavement. In the southbound lane, beginning near the center of the intersecting access road, investigators found a tire friction mark on the pavement. The mark was just to the right of the lane center, and it exhibited a slight angular heading toward the southbound pavement edge. Investigators measured the tire mark as about 12 feet long. 1.6 Driver Information 1.6.1 Pickup Truck Driver The pickup truck was driven by a 24-year-old female. Through her legal counsel, the driver declined to be interviewed by NTSB investigators. Information in this section is based on the Indiana State Police interview with the pickup truck driver, a forensic cell

NTSB

Highway Accident Report

9 phone examination, driver license records, and pharmacy and medical records.18 Additionally, NTSB investigators reviewed the driver’s court testimony from an October 18, 2019, proceeding in the Fulton County Superior Court on this case. 1.6.1.1 License and driving history. The pickup truck driver obtained an Indiana operator’s license on August 26, 2011. Her current driver’s license was issued in 2016 and was valid until 2021. Her license history showed no record of traffic violations or license suspensions. The National Driver Register did not indicate that her driving privileges had been suspended, canceled, revoked, or denied.19 According to an insurance industry database, the driver was involved in a property-damage-only accident on July 9, 2014, in Rochester, Indiana. The pickup truck driver had a corrective lens restriction on her Indiana operator’s license, which required that she wear glasses or contact lenses when driving. According to her October 18, 2019, court testimony, she was wearing glasses at the time of the crash. 1.6.1.2 Medical and toxicology information. Medical and pharmacy records for the pickup truck driver showed no medical conditions that would have affected her performance in the crash. No chronic illnesses or routine medication use was documented. Following the crash, the pickup truck driver consented to a toxicology test at the request of the Indiana State Police. The testing was performed by the Indiana State Department of Toxicology. The test results were negative for ethanol, drugs commonly used for abuse, and several sedating substances.20 1.6.1.3 Activities in the days before the crash. No information was available on the pickup truck driver’s daily activities or sleep schedule in the days preceding the crash. Table 2 shows her first and last cell phone activity each day.

18 The Indiana State Police interview was conducted on October 30, 2018. 19 The National Driver Register is a division in the National Center for Statistics and Analysis within the National Highway Traffic Safety Administration (NHTSA), which maintains the Problem Driver Pointer System database. The database contains records of drivers whose privilege to drive has been suspended, canceled, revoked, or denied or who have been convicted of serious traffic-related offenses. 20 The substances tested for included the following: acetone, ethanol, isopropanol, methanol, 7-aminoclonazepam, alprazolam, clonazepam, desalkylflurazepam, diazepam, lorazepam, midazolam, nordiazepam, oxazepam, temazepam, zolpidem, a-hydroxyalprazolam, THC, THC-COOH, amphetamine, benzoylecgonine, cocaine, ephedrine, MDA, MDEA, MDMA, methamphetamine, phencyclidine, phentermine, phenylpropanolamine, and pseudoephedrine.

NTSB

Highway Accident Report

10 Table 2. Pickup truck driver’s first and last cell phone activity, October 27–30, 2018. Time Driver Activity Source Saturday, October 27, 2018 6:49 a.m. Outgoing text message Cell phone device 9:59 p.m. Cell phone notes saved Sunday, October 28, 2018 7:45 a.m. Outgoing text message Cell phone device 9:51 p.m. Outgoing text message Monday, October 29, 2018 6:46 a.m. Incoming phone call Cell phone device 10:28 p.m. Outgoing phone call Tuesday, October 30, 2018 7:02 a.m. Outgoing text message (according to the driver interview, her husband was driving at this time) Cell phone device 7:05 a.m. Driver arrives in Talma, Indiana, and departs minutes later for Rochester, Indiana Driver interview 7:12 a.m.

Crash occurred

Cell phone records indicate no incoming or outgoing text messages or phone calls at the time of the crash. The FCSO conducted a forensic data extraction of the pickup truck driver’s cell phone, which showed that an application was active but no conclusive indication that the phone was being manipulated at the time of the crash. In her interview, the driver said that the phone was in the center of the console and that a music application may have been playing. 1.6.1.4 Driver interview. Although the driver declined to be interviewed by NTSB investigators, she was interviewed by the Indiana State Police on October 30, 2018. She said that she left her house on the morning of the crash with her husband, two children, and brother. Her husband drove the pickup truck to his job in Talma, Indiana, and they arrived about 7:05 a.m. She said she had her 12-year-old brother with her for the night because her stepfather was in the hospital, and her mother was with him. She had planned to take her brother back to his house to get him ready for school, and then she was going to drive him to school. She said that while driving south on SR-25, she saw a vehicle but did not know what it was. She said she was trying to figure out “what heavy load it was.” She said, “I didn’t see a stop sign—like usually when I see a bus, I like see a stop sign.”21 She said she suddenly saw children and tried to stop her vehicle. In her court testimony, she noted that the vehicle was in the “other lane,” and also confirmed that she saw the red flashing lights on the vehicle. She recalled being by the mobile home park and described it as dark. She said she was using her “brights” until she saw another vehicle. When asked how fast she was

21 Based on the context of this statement, it appears that the pickup truck driver was referring to a stop arm on the bus, not a roadside stop sign.

NTSB

Highway Accident Report

11 driving, she stated that she was a slow driver and usually drives about 50 mph or slower, but she did not know how fast she was traveling when the crash occurred. She indicated that she was familiar with that roadway but was not usually on that road at that time of day. She said it was not usual for her to drive her husband to work; she was doing so this morning so that her husband could retrieve his car, which he had left at work the previous day. She said she was not talking or texting on her phone. She said that, when the crash took place, her children were asleep, and she was talking with her brother about schoolwork. She replied “no” when asked if she had been drinking alcohol or using drugs that morning or the previous weekend. 1.6.2 School Bus Driver 1.6.2.1 License and driving history. The 57-year-old male school bus driver held a valid Indiana class B commercial driver’s license (CDL), with passenger transport and school bus endorsements, issued on March 4, 2016.22 According to the driver’s license record provided by the Indiana State Police, he had no prior license suspensions, convictions, or crashes. His medical certificate was valid, and there were no medical issues listed on his Commercial Driver Fitness Determination Report (Indiana Code 20-27-8-4). The driver’s record indicated that he had been subject to two preemployment and one random driver alcohol and controlled substance tests; all were negative for tested substances. According to US Department of Transportation (DOT) regulations (49 CFR Part 382), the school bus driver was not subject to postaccident controlled substance or alcohol testing following the October 2018 crash.23 1.6.2.2 Employment history. The school bus driver was employed by the TVSC as of March 2016. Previously, he was a school bus driver for Greenfield Central School Corporation from March 2015 to January 2016. He had retired in February 2015 after working for a forklift company for 20 years. 1.6.2.3 Training. The school bus driver completed a 2.5-day-long basic bus driver training session as required by the Indiana Department of Education (IDOE) and received his certificate, which was valid until December 31, 2019. (Additional information on IDOE training requirements is provided in section 1.7.4.) The bus driver also completed an in-service safety class required to maintain his certification on August 1, 2018. When, in

22 (a) An Indiana class B CDL permits the operation of any single vehicle with a gross vehicle weight rating (GVWR) of 26,001 or more pounds, or any such vehicle towing a vehicle not in excess of 10,000 pounds GVWR. (GVWR is the total maximum weight that a vehicle is designed to carry when loaded, including the weight of the vehicle itself plus fuel, passengers, and cargo.) The license showed restrictions prohibiting the driving of manual-transmission-equipped vehicles. (b) The driver was operating under Indiana state laws because this trip was an intrastate commerce trip. The state of Indiana has adopted the Federal Motor Carrier Safety Regulations. The carrier/driver is subject to alcohol and drug testing requirements (49 CFR Part 382) and CDL requirements (49 CFR Part 383) but is exempt from hours-of-service regulations (49 CFR 390.3(f)(1)). See section 1.7.3 for more information. 23 The NTSB was unable to determine whether the school bus driver underwent any type of postcrash controlled substance testing. The driver was not disciplined following this crash and remains a TVSC school bus driver.

NTSB

Highway Accident Report

12 April 2018, he took over the school bus route on which the crash occurred, he rode with the previous driver 3–4 days to learn the route. 1.6.2.4 School bus driver interview. During his postcrash interview with the state police, the school bus driver said that he was traveling north on SR-25 as usual for the route and when he reached the bus stop, it was like a normal day where “I pull up to my stop, put my stop sign on.”24 He said that he saw a vehicle approaching at a far distance. The bus driver said that he thought the vehicle’s driver would stop; so, after a couple of seconds, he waved to the students waiting in the mobile home area to cross the roadway and board the bus. As the pickup truck got closer, the school bus driver realized that it was not going to stop, and he sounded the bus’s horn. 1.7 Motor Carrier Operations and Regulatory Oversight 1.7.1 Tippecanoe Valley School Corporation The TVSC operated the school bus. The corporation serves more than 1,780 students at two elementary schools, one middle school, one high school, and one educational center. It operates its own transportation services with 44 active school buses and 26 full-time drivers providing transportation to students in 2 counties and 12 cities, including Rochester. The TVSC superintendent/transportation director is ultimately responsible for school bus route planning. The TVSC transportation director at the time of the crash had been employed in that position since 2014. Records indicated that he attended a 3-day conference in December 2014 that addressed making safe stops, safe loading and unloading procedures, and school bus crash statistical data but provided little information on risk assessment of school bus stops. The transportation director also attended a school bus driver training course. The TVSC held its 2018–2019 bus driver orientation meeting on August 1, 2018. The orientation material included information on the universal crossing signal, which the TVSC bus drivers are to use for any student who must cross the highway when getting on or off the bus.25 If the driver perceives danger while students are in the road, the driver is to honk his horn and the students are to return to their original side of the road. Additionally, the orientation meeting detailed the dates for evacuation training and discussed the procedures for crossing a railroad crossing, using bus radio communications, reducing bus idling, and dealing with emergencies while driving, such as tornados or illness. The meeting also provided general school calendar information.

24 NTSB investigators were unable to interview the school bus driver. 25 The universal crossing signal refers to a signal the bus driver should use to signal student pedestrians that it is safe for them to cross the road. The signal used by the TVSC is a two-part gesture. First, the driver should use a thumbs-up to indicate that the situation is safe, and, second, the driver should use the index finger to point in the direction of travel. This signal (or versions with slight variants) is used in school districts across the nation.

NTSB

Highway Accident Report

13 The TVSC told NTSB investigators that it had no written policy about school bus drivers’ reporting (or forms by which bus drivers could report) motorists who committed a stop arm violation. The TVSC expected drivers to report such violations verbally to the bus garage; however, the TVSC also noted that, if the incident description did not include the violating vehicle’s license plate number, no official report could be filed with the sheriff’s department. The TVSC also said that, although it had no written policy about reporting safety hazards identified along the school bus route or at a stop, it encouraged its school bus drivers to report such risks to the transportation department. In her interview with NTSB investigators, the previous driver of the school bus route indicated that no formal system existed for TVSC bus drivers to report when vehicles illegally passed the school bus, or other hazards, such as a dark bus stop.26 She said that some drivers might make a radio report to the garage of an incident, but no records were maintained on such reports. She recalled that, during her last year driving the route, there was one case in which a commercial vehicle had failed to stop for the bus, and the parent of the three children who were killed in the October 30, 2018, crash had complained about it to the school transportation director. The transportation director followed up with the company of the offending commercial driver and was told that the company would reprimand the driver. No route changes were made. 1.7.2 School Bus Route At the time of the crash, the TVSC maintained 24 bus routes. The crash occurred on the route of school bus #36. Figure 5 shows the route that was to be taken on the day of the crash. The route began at the school bus garage (behind the high school) and then traveled along rural roads until it reached SR-25, where it continued in a northerly direction, making several stops. The bus stop where the crash occurred was number 5 of

1. Of the 18 stops on this route, 10 were at locations that required student pedestrians to

cross the road to board the bus.27 In all, 34 student pedestrians on this route were required to cross a road to board the school bus.

26 NTSB investigators interviewed the previous driver of the school bus route on March 28, 2019. She retired in April 2018 after 20 years of driving the crash route. 27 All these crossings, except those in the vicinity of Talma, were on high-speed roadways.

NTSB

Highway Accident Report

14

Figure 5. Route of school bus #36 at time of crash. The numbers enclosed in boxes indicate the order of the bus stops, and the dots off each box indicate the side of the road the students were on while waiting for the bus. The crash occurred at stop #5, which is marked in red. (Source: TVSC) The previous driver of this bus route said that she had inherited the route without changes from the driver before her and that, when she retired, the route for bus #36 was passed to the crash bus driver. Other than changes to the stops required by the periodic changes in the student rider population, the route remained as it had been when the previous driver drove it. Neither the previous driver nor the current driver made any changes to the route. The TVSC told investigators that the school bus route drivers selected the bus stop locations. The previous driver said that, at the beginning of each school year, each driver presented the school corporation with a map of his or her route. According to her, the route map was devised by the drivers, and the school corporation was not involved in route planning or pickup scheduling, other than limiting the lengths of routes to about 25 miles. Alterations to routes were based on the locations of the students’ homes and the students’ need for school transportation. During her interview, the former bus driver did not clearly indicate whether the TVSC transportation director reviewed the route maps to assess risk. When asked whether she had considered alternatives to the route to eliminate requiring students to cross the roadway to reach their bus stops, the previous driver explained that such changes would have required some students to board the bus earlier because she would have had to run the route twice—essentially driving the full route in both directions. She also said that she would not have been comfortable pulling into the mobile home park itself to pick up students, because the students would have been coming from their homes from multiple directions to board the bus.

NTSB

Highway Accident Report

15 The previous school bus driver and the crash driver similarly described how to stop at school bus stops. They said that the school bus driver should activate the bus’s amber lights ahead of the stop and slowly come to a stop. After stopping and ensuring that all traffic was stopped or at such a distance that the vehicles had sufficient time to stop, the driver should activate the bus’s red lights, which would automatically extend the stop arm. Once the driver had determined that the students could cross safely, the driver should turn on the bus’s interior light and motion to the students to cross the roadway. According to the TVSC, at the beginning of and throughout the school year, school bus drivers instructed student riders on how to conduct themselves on the bus and how to safely cross the roadway, which included making them aware of the universal crossing signal. The previous school bus driver said that each student was taught to respond to the driver’s hand signal and was told not to cross the roadway without the driver’s permission. 1.7.3 Indiana State Regulatory Oversight The school bus trip was an intrastate trip involving the transportation of students from home to school. On this basis, the carrier fell under the jurisdiction of the state of Indiana, which has adopted the Federal Motor Carrier Safety Regulations. Indiana requires all school bus drivers to obtain a physical examination certificate similar to the DOT-required medical exam and certificate required for commercial drivers. Additionally, Indiana school bus drivers must meet physical performance standards including the ability to (1) exit the bus through the service and emergency exit doors, (2) climb and descend the bus service doorsteps, (3) open and close the bus service door from a seated position, and (4) operate the hand controls and steering wheel. The driver of the crash-involved school bus met these standards. Indiana conducts annual safety inspections of all school buses in the state. Before the crash, school bus #36 had passed a vehicle inspection conducted by the Indiana State Police on April 17, 2018. A postcrash vehicle inspection revealed minor defects, but none related to the operation of the warning lights or stop arm.28 1.7.4 Indiana Department of Education Transportation-Related Training According to the IDOE, all school bus drivers must complete a transportation basics training course consisting of 2.5 days of classroom training, 8 hours of behind-the-wheel driver training, and 4 hours of observed behind-the-wheel driver training. Upon completion of the course, the drivers receive their certificate, also known as a yellow card. To maintain their certification, drivers are required to complete a safety class annually.29 The school

28 According to the Indiana State Police inspection report, the following violations were found: (1) the trash container is greater than a 14-quart capacity, (2) the trash container is not secured to prevent movement and does not allow for easy removal and replacement, (3) antilock braking system warning light is illuminated, (4) first aid kit is not complete, (5) any front tire has less than 4/32-inch tread depth when measured in any two adjacent major grooves (right outside tread and adjacent tread was 3/32 inch), (6) there are loose items that would create a hazard, and (7) there is no brake certificate, or the certificate has expired or is not signed. 29 The TVSC bus driver orientation meeting meets this requirement.

NTSB

Highway Accident Report

16 bus driver training course covers ways to safely serve the route, as well as positioning of vehicles and student management. It does not address school bus route planning or risk assessment of routes. The IDOE offers training titled “Transportation 101,” which is designed for new school transportation directors. It covers a wide range of school transportation topics, such as school bus driver qualifications, school bus standards, statutes related to school bus transportation, and mechanic qualifications. With the exception of discussing the statutes related to the stop arm and divided highways, making a recommendation to load/unload students as close as possible to the right-hand curb or edge of the roadway, and advising that school bus stops should be reviewed annually, Transportation 101 does not address school bus route or stop risk assessment. According to the IDOE, few (about 1.5 percent) of Indiana’s school districts, charter and nonpublic schools, and Head Start programs requested the Transportation 101 course. There is no record of the TVSC transportation director having attended the course. 1.8 Vehicle Information 1.8.1 Toyota Tacoma Pickup Truck 1.8.1.1 General. The 2017 Toyota Tacoma pickup truck was manufactured in December 2016. Its GVWR was 5,600 pounds, and it had a six-speed automatic transmission and a 3.5-liter, V-6, 278-horsepower gasoline engine. It was equipped with hydraulically power-assisted steering gear. It had an independent suspension system on the steering axle and a non-independent suspension system on the drive axle. It was equipped with a hydraulic, antilock braking system (ABS).30 The steering axle had disc brakes, and the drive axle had drum brakes. Postcrash visual inspection revealed that the brake linings, discs, drums, and ABS wiring were intact and without damage. In accordance with manufacturer’s specification, the pickup truck was equipped with four 265/70R16 tires, mounted on 16x7J rims. All tread depths were within the minimums recommended for passenger vehicles. Halogen projector headlamps were mounted on the pickup truck, and it was equipped with Toyota’s Star Safety System.31 According to the NHTSA recall database, no recalls had been issued for this vehicle.

30 The pickup truck was not equipped with any automatic emergency braking systems, including PAEB. 31 The Toyota Star Safety System includes vehicle stability control, traction control, and an ABS with electronic brake-force distribution, brake assist, and smart stop technology (designed to assist with braking in the event of unintended circumstances, such as when, while driving, the brake and accelerator pedals are pressed at the same time).

NTSB

Highway Accident Report

17 1.8.1.2 Damage. The NTSB conducted a postcrash visual inspection and photographed the pickup truck on October 31, 2018. A detailed inspection was conducted on February 12, 2019, after the vehicle had been released by local authorities. Figure 6 shows the damage the pickup truck sustained during the collision. The leading edge of the hood was displaced rearward, and the center was arched upward. The grille and much of the front bumper covering were missing. The hood was indented to the right of the left headlamp assembly. The left headlamp assembly was crushed. The left front fender was displaced rearward, and the trailing edge of the left fender was contacting the driver’s door. The right headlamp assembly was displaced from its mounting location but remained attached to the vehicle. According to photographs taken at the crash site, the headlamps were working after the crash.

Figure 6. Frontal damage to pickup truck. 1.8.1.3 Event data recorder information. The pickup truck was equipped with an airbag control module with the capability to record “event” data and function as an event data recorder.32 According to the vehicle recorder, the pickup truck was traveling at a relatively constant speed of 58–59 mph beginning about 4.8 seconds before module wake-up.33 (See table 3.) At 2.8 seconds before module wake-up, the accelerator pedal and engine throttle substantially decreased, and vehicle speed began to slightly decrease. Two

32 The term “event” refers to crash data related to activation of supplemental restraints (airbags and seat belt pretensioners). 33 In this case, module “wake-up” refers to the activation of the restraint control algorithm and approximates the time of impact.

NTSB

Highway Accident Report

18 seconds later, at 0.8 seconds before module wake-up, the service brakes were reported as “ON,” and brake fluid pressure began to increase. The accelerator pedal and engine throttle percentages decreased to zero and a rightward steering input was recorded. The reported speed at this time was 55.9 mph. At 0.3 seconds before module wake-up, the brake fluid pressure was recorded at near maximum, the rightward steering input increased, and the vehicle speed decreased to 48.5 mph. At module wake-up, the vehicle speed decreased to 41 mph, the service brake was “ON,” and the rightward steering input decreased. Deployment of the airbags and seat belt pretensioners began 0.053 seconds after module wake-up. Table 3. Event data recorder information. Time (seconds before impact) 4.8 4.3 3.8 3.3 2.8 2.3 1.8 1.3 0.8 0.3 Wake -up Speed (mph)a 58.4 59 58.4 58.4 58.4 57.8 57.2 57.2 55.9 48.5 41 Accelerator (percent)b 22.0 19.0 19.0 17.0 4.0 5.5 6.5 5.0 0.0 0.0 0.0 Engine throttle (percent)c 12.0 10.0 10.0 10.0 1.0 0.5 1.5 1.5 0.0 0.0 0.0 Service braked off off off off off off off off on on on Brake oil pressure (megapascals)e 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 5.47 11.71 9.79 Steering input (degrees)f 3.0 4.5 6.0 7.5 7.5 3.0 9.0 9.0 -3.0 -18.0 -3.0 a Resolution of 1 kilometer per hour (0.6 mph) with the value rounded down for reporting. b Percent of full application of the accelerator pedal with a resolution to the nearest one-half of a whole percent and rounded down for reporting. c Percent of full application of the engine throttle with a resolution to the nearest one-half of a whole percent and rounded down for reporting. d Indicates the status of the brake pedal as reported by the brake lamp switch with the possible values as “on” and “off.” e Reports the brake oil pressure at the master cylinder in megapascal units. f Measured rotational angle of the steering wheel between +375 degrees and -375 degrees at a resolution of 1.5 degrees with the value rounded down for reporting. Negative numbers indicate a right steering wheel input.

NTSB

Highway Accident Report

19 1.8.2 Thomas Built School Bus 1.8.2.1 General. At the time of the crash, the 2015 Thomas Built school bus was stopped at a designated school bus stop to pick up students with its red warning lights on and stop arm deployed.34 The school bus was not involved in the collision. 1.8.2.2 Federal requirements. FMVSS 108 contains the requirements for vehicle lamps, reflective devices, and associated equipment.35 School buses are required to be equipped with two red signal warning lamps on the front of the bus above the windshield, and two red signal warning lamps on the rear of the bus positioned at least above the top of any side window opening. These lights are to flash, and they are to be actuated by a manual switch. Additionally, optional amber lights may be placed at the same height and inboard of the red lamps. The amber lamps must also flash and may be activated by manual or foot operation. The amber lamps must be automatically deactivated and the red lamps automatically activated when the bus entrance door is opened. FMVSS 131 sets the standards for the stop arm (49 CFR 571.131). It defines a “stop signal arm” (stop arm) as a device that can be extended outward from the side of a school bus to provide a signal to other motorists not to pass the bus because it has stopped to load or discharge passengers. The stop arm is to be installed on the left side of the bus and, when extended, is perpendicular to the side of the bus. Each side of the stop arm must have at least two red lamps, one at the top of the stop arm and the other at the bottom. The National School Transportation Specifications and Procedures (NSTSP), developed by the National Congress on School Transportation (NCST), provide specifications for school buses and operational procedures for states to consider when establishing their standards, specifications, recommendations, and guidelines (NCST 2015). The FMVSSs are incorporated into the document and reiterate the regulations. 1.8.2.3 Exterior lights. NTSB investigators examined the exterior lights (signal warning lights, stop arm, headlamps, brake, and turn signals) of the school bus and found them operational. (See figure 7.) When the red signal warning lights are activated, the stop arm automatically extends from the left side of the bus, just behind and below the driver’s window. The red warning lights automatically turn on when the bus door is opened, or they can be operated manually when the bus door is closed. When the red warning lights are active and flashing, the headlamps alternately flash between high and low beam.

34 The school bus was not equipped with a stop arm camera. A stop arm camera is a device attached to the side of a school bus that is used to photograph vehicles that pass the bus when it is stopped to load or unload passengers. The recorded information is often used to assess traffic citations. Since the October 2018 crash, the TVSC has installed stop arm cameras on its entire school bus fleet. 35 Title 49 CFR 571.108 refers to the amber and red lights as “warning lamps.” Common terminology refers to these as “lights.” The terms “warning lamps” and “warning lights” are used interchangeably in this report.

NTSB

Highway Accident Report

20

Figure 7. On-scene postcrash view of school bus with lights in operation. (Source: Indiana State Police) 1.9 Weather and Astronomical Data Weather data for October 30, 2018, were obtained from weather station KSBN in South Bend, Indiana, about 45 miles from the crash site. At 6:54 a.m., a few minutes before the pickup truck struck the students, the station reported a temperature of 49° F, cloudy conditions, winds from the south-southeast at 12 mph, and no precipitation. Astronomical data from the US Naval Observatory reported that, for that day, sunrise was at 8:13 a.m. and civil twilight began at 7:45 a.m.36 1.10 Witness Statements 1.10.1 Occupants of Vehicle Behind Pickup Truck The driver of a vehicle that was traveling south behind the pickup truck stated that, as she approached the crash location, she first observed the lights of the stopped school bus through a cluster of trees as she traveled through a curve. She said that she was driving about a car length behind the pickup truck, and no cars were behind her. She saw that the school bus was stopped with its red lights flashing, and several small children were crossing

36 Civil twilight is the period preceding sunrise when the sun is about 6 degrees below the horizon but there is sufficient natural light to engage in typical outdoor activities without artificial lighting.

NTSB

Highway Accident Report

21 the road to board the bus. A passenger in her vehicle said that he had seen the bus’s stop sign (stop arm) come out. The witness said that, upon seeing the stopped school bus, she slowed her vehicle to a stop, but the pickup truck did not appear as if it were going to stop. She described the lighting conditions as dark. She said that she could see the children because they were illuminated by the headlamps of the pickup truck in front of her. The bus’s red lights were flashing, and a white light was flashing on the top of the school bus. The driver indicated that, upon seeing the bus, she immediately recognized it as a school bus. 1.10.2 Driver of Vehicle Behind School Bus The driver of a vehicle traveling north behind the school bus said that he had been following the school bus and that it had made a few stops before reaching the crash location. When the bus stopped, he stopped his vehicle behind it. He said that the stopped school bus had its red lights on and its stop arm extended. He said that he could see the pickup truck in the southbound lane traveling fast as it approached, and he saw it hit the children. He called 911. 1.10.3 Parent and Student at Bus Stop The parent and one of the students who were waiting for the school bus said that the group was standing behind the fence that ran between the roadway and the mobile home park. They said that they identified the school bus from the bright white light on its roof, and that they could see the bus approaching from the right (south). They saw the bus stop with its red lights flashing and stop arm extended. They said that the bus’s interior light was also on, and that they could see the driver wave from the driver’s seat to signal the students to cross the roadway. They said that it was difficult for them to see traffic coming from the left (north) from where they were standing because a mobile home blocked the view. They said the southbound pickup truck “came out of nowhere.” They recalled the school bus driver honking his horn but also noted that lots of horns are honked in the morning by motorists waiting for the stopped school bus to move. 1.11 Postcrash Actions 1.11.1 TVSC Postcrash Improvements Following the collision, the TVSC altered the portion of the school bus route for school bus #36 on SR-25 to facilitate the loading and unloading of students on the right side of the bus, so that students would not have to cross the roadway to board the bus. A transportation safety review committee, consisting of members of three local school corporations (Rochester County, Kosciusko County, and Caston County), local law enforcement officials from the FCSO and the Kosciusko County Sheriff’s Office, and personnel from the Kosciusko County Highway Department, was formed to discuss the safety issues regarding student transportation. The committee reviews local school bus routes and implements the new safety standards that were established as a result of the Rochester crash. Following the committee’s recommendations, the TVSC modified its

NTSB

Highway Accident Report

22 school bus routes so that no student crosses a state highway to board a school bus. According to the TVSC transportation director, the TVSC has also reduced from 300 to 136 the number of school bus stops that require students to make any roadway crossing. In addition, the TVSC has purchased and installed stop arm cameras for its entire fleet of regular route school buses. The TVSC told the NTSB that its students’ parents will receive a handout on the universal crossing signal. 1.11.2 Indiana Senate Bill 2 In May 2019, the governor of Indiana signed into law Senate Bill 2 (P.L. 144-2019), also known as the MAX Strong law), which contains many provisions to improve the safety of students when boarding or disembarking from a school bus. The new law makes the following enhancements to school transportation practices: • Increases penalties for drivers passing a stopped school bus with the stop arm deployed.37 • Prohibits school bus drivers, when operating on a US or state route (unless within the boundary of a city or town), from loading or unloading students at a stop which requires the student to cross a roadway unless no other safe alternatives are available. • Authorizes schools to petition their counties for reimbursement of stop arm camera equipment. • Requires school corporations to review school bus routes and school bus safety policies annually. • Requires the state school bus committee to develop and post on the IDOE website school bus safety guidelines or best practices to include procedures to ensure that students do not enter a roadway until approaching traffic has come to a complete stop and information on how an individual or school may petition to reduce maximum speed limits to ensure student safety.38 1.12 Other NTSB Investigations The NTSB investigated two other fatal pedestrian crashes in 2018 involving illegal passings of school buses stopped to load or unload passengers. In both cases, the school

37 Illegally passing a stopped school bus is now considered a class A misdemeanor (increased from a class B misdemeanor) punishable by up to 1 year in prison and a fine of up to $5,000. Illegally passing a stopped school bus and injuring someone is a level 6 felony (increased from a class A misdemeanor), punishable by 6 months to 2.5 years in prison and a fine of up to $10,000. Illegally passing a stopped school bus and killing someone is a level 5 felony carrying a 1- to 6-year prison sentence and up to $10,000 in fines. Citations can be issued based on police witness or stop arm camera evidence. 38 The information concerning the new law is from the following webpage: Indiana Senate Bill 2 (MAX Strong law), accessed January 27, 2020.

NTSB

Highway Accident Report

23 bus route required students to cross high-speed roadways to board the bus. These crashes occurred in Hartsfield, Georgia, and Baldwyn, Mississippi. 1.12.1 Hartsfield, Georgia On Thursday, October 25, 2018, at 6:45 a.m., a school bus operated by the Colquitt County School District was traveling north in the 1000 block of Thigpen Trail, also known as State Route 202, in Hartsfield, Colquitt County, Georgia. At this location, Thigpen Trail is a two-lane, two-way asphalt roadway bordered by farms and agricultural fields; it has a posted speed limit of 55 mph. The school bus driver stopped the bus at a designated student pickup location and activated the bus’s warning lights, which deployed the stop arm. Two pedestrians, a 7-year-old male and a 10-year-old male, began to cross the roadway to board the stopped bus, which was on the opposite side of the road. At the same time, a 2008 Kia passenger car, operated by a 25-year-old female, was traveling south on Thigpen Trail. The Kia driver failed to stop for the school bus and struck both pedestrians while they were crossing the southbound lane. The 10-year-old pedestrian died. The 7-year-old pedestrian sustained serious injuries. The Kia driver was not injured.39 1.12.2 Baldwyn, Mississippi On Wednesday, October 31, 2018, at 6:36 a.m., a school bus operated by Baldwyn School District was traveling east on Mississippi State Highway 370 (MS-370) in Baldwyn, Lee County, Mississippi. At this location, MS-370 is a two-lane, two-way roadway with a posted speed limit of 55 mph. The school bus driver stopped the bus, with its warning lights activated and stop arm extended, at a designated student pickup location. A 9-year-old male pedestrian entered MS-370 from the north side and began crossing the westbound traffic lane with the intention of boarding the stopped school bus, which was on the opposite side of the road from him. At the same time, a 2002 Toyota Tacoma pickup truck, operated by a 22-year-old male driver, was traveling west on MS-370. The pickup truck driver did not stop for the school bus and struck the pedestrian as he was crossing the westbound traffic lane. The student pedestrian died from injuries received during the collision. The pickup truck driver was not injured.40 1.13 Data on School Transportation-Related Crashes and Illegal Passings NHTSA reports that, from 2008 to 2017, a total of 264 school-age (18 and younger) children were killed in school transportation-related crashes (NHTSA 2019b). Ninety- seven (37 percent) of the school-age children were pedestrians, 61 (23 percent) were occupants of school transportation vehicles, 100 (38 percent) were occupants of other vehicles, 5 were pedalcyclists (2 percent), and 1 ( percent) was another nonoccupant.41

39 Additional information about the investigation of the Hartsfield crash can be found by accessing the Docket Management System and searching for NTSB case number HWY19IH004. 40 Additional information about the investigation of the Baldwyn crash can be found by accessing the Docket Management System and searching for NTSB case number HWY19IH005. 41 The term “pedalcyclist” is synonymous with bicyclist or cyclist.

NTSB

Highway Accident Report

24 Of the 97 school-age pedestrians killed in a school-transportation-related crash, 53 (55 percent) were struck by school buses, 1 (1 percent) by vehicles functioning as school buses, and 43 (44 percent) by other vehicles involved in the crashes. In all 50 states, it is illegal to pass a school bus that is stopped to load or unload passengers with its red lights flashing and stop arm extended. This law applies to traffic approaching from either direction on undivided highways. State laws vary about what action is required by motorists on a divided highway and what constitutes a divided highway. Since 2011, the Kansas State Department of Education (KSDE), with assistance from the National Association of State Directors of Pupil Transportation Services (NASDPTS), has been collecting data through 1-day observational surveys to determine the prevalence of illegal passing of school buses (KSDE 2019). In the 2019 effort, 39 states participated, and they reported that 95,319 vehicles illegally passed school buses on a single day. Based on these numbers, the NASDPTS estimated that more than 17 million vehicles illegally passed school buses in a 180-day school year (NASDPTS 2019a). For several years, the KSDE has been tracking school bus fatalities across the United States resulting from passenger loading and unloading (KSDE 2019). During the past 49 years, 1,252 students were killed while loading or unloading a school bus. Of these, 492 involved a motor vehicle passing a school bus and striking a student, 706 involved a school bus striking a student, and 54 were undetermined or due to “other” circumstances. Seven loading/unloading school bus fatalities involving approaching vehicles occurred during the 2018–2019 school year. In addition to the three fatalities in Rochester, the fatality in Baldwyn, Mississippi, and the fatality in Hartsfield, Georgia, the KSDE reported two additional fatalities involving oncoming vehicles, one in Maryland and one in Missouri. In the Maryland crash, a 16-year-old male student was running to catch a bus and was struck by an oncoming vehicle as he crossed the road. He died as a result of the crash. The school bus had its eight-way amber lights activated, but the stop arm was not extended. In the Missouri crash, an 8-year-old female was struck by an oncoming vehicle as she crossed the road to board a stopped school bus with its red lights activated and stop arm deployed. She died as a result of the crash.

NTSB

Highway Accident Report

25 2 Analysis 2.1 Introduction A 2017 Toyota Tacoma pickup truck operated by a 24-year-old female driver was southbound on SR-25, a two-lane roadway, in Rochester, Indiana, at 58–59 mph. The pickup truck driver failed to stop for a school bus as required by Indiana state law and struck four children who were crossing the southbound lane to get to their waiting school bus on the opposite side of the road.42 The school bus was stopped in the northbound lane of SR-25 with its red lights flashing and stop arm deployed. As a result of the crash, three children died, and one child sustained serious injuries. The analysis portion of this report first discusses factors that could be excluded as not causing the crash or contributing to the severity of its outcome. Then, it addresses the pickup truck driver’s failure to respond to the warning cues of the stopped bus or to take action until it was too late to avoid striking the student pedestrians (section 2.2). The following safety issues are also discussed in the analysis: • Deficiencies in establishing safe school bus routes and stop locations (section 2.3). • Failure of other drivers to stop or otherwise respond safely when approaching a school bus that is stopped with its warning lights on and stop arm extended (section 2.4). • Need for greater use of technologies to prevent collisions with, and mitigate injuries of, student pedestrians, including vehicle-to-everything (V2X), PAEB, and school bus safety-enhancing technologies (section 2.5). As a result of its analysis, the NTSB established that the following factors did not cause or contribute to the crash: • Mechanical condition of the pickup truck. Postcrash examination of the pickup truck did not reveal any preexisting mechanical defects or deficiencies in its mechanical and operational systems. The steering system, suspension system, braking system, and tires and wheels were operational at the time of the crash. The headlights of the pickup truck were operational and, according to the pickup truck driver and others in the vicinity, the lights of the pickup truck were on at the time of the crash.

42 The driver made a brake application between 1.3 and 0.8 seconds before impact. At 0.8 seconds before impact, the vehicle speed was 55.9 mph. At the time of impact, the recorded vehicle speed was 41 mph.

NTSB

Highway Accident Report

26 • Operation of the school bus warning lights and stop arm. Postcrash examination of the school bus and its maintenance records did not reveal any mechanical defects or deficiencies related to the operation of the bus’s warning lights or stop arm. The warning lights and stop arm were in operating condition and in compliance with federal regulations. Witness statements from drivers of vehicles following the school bus, as well as those approaching the bus, indicated that its warning lights were on and its stop arm was extended. • School bus driver licensing and training. The school bus driver held a valid CDL with the correct endorsements for passengers and school bus operations. The bus driver had received formal training for his school bus certification from the state of Indiana. Additionally, he had completed annual in-service training to maintain his certification. Before taking over this school bus route in April 2018, he drove the route with the previous driver. He had been driving for the TVSC since March 2016, and he had no crashes on his school bus driving record. • Pickup truck driver licensing. The pickup truck driver had held a valid Indiana driver’s license since 2011. Her current license was valid until 2021. Records indicate that the driver had been involved in a property-damage-only accident in 2014. She had no other records of traffic violations. • Pickup truck driver alcohol and controlled substance impairment. Following the crash, the pickup truck driver underwent alcohol and controlled substance testing. Test results were negative for alcohol and all other drugs tested for. • Pickup truck driver medical condition and vision. A review of medical records did not show any evidence of medical or vision conditions that would have negatively affected the driver’s performance. The pickup truck driver had a corrective lens restriction on her license, and she testified that she was wearing glasses when the crash occurred. • Cell phone use. The results of the FCSO’s forensic examination of the pickup truck driver’s cell phone and her cell phone records provided no evidence that she had been texting or talking on the phone at the time of the crash. The forensic examination found that an application on the phone was active, but there was no conclusive indication that the phone was being manipulated. The driver said the phone was on the center console at the time of the crash. • Actions/behavior of the student pedestrians and the adult pedestrian. The student pedestrians remained behind the fence between the mobile home park and SR-25 until the bus arrived and stopped. The adult pedestrian gathered the student pedestrians together as the bus approached. The students did not begin to cross the roadway until waved onward by the school bus driver. Given the information that they had, they acted appropriately in crossing when they did.

NTSB

Highway Accident Report

27 On the basis of this information, the NTSB concludes that none of the following were factors in this crash: (1) mechanical condition of the pickup truck or condition of the school bus warning light and stop arm systems; (2) school bus driver licensing; (3) pickup truck driver licensing, drug or alcohol impairment, medical condition, vision, or cell phone use; or (4) actions/behavior of the student pedestrians or the adult pedestrian. The NTSB considered whether fatigue on the part of the pickup truck driver or the school bus driver might have affected this crash. No information was available on the sleep histories of the two drivers. Only limited information was available concerning their daily activities. With respect to the pickup truck driver, her cell phone records showed that, in the 3 days preceding the crash, she did not send or receive any texts or calls during the nighttime hours. Just moments before the crash, the driver successfully navigated a curve in the roadway, and she applied the brakes before the collision. The driver of the vehicle traveling south behind the pickup truck did not report any unusual driving behavior on the part of the pickup truck driver before the crash. The available information concerning the school bus driver indicates that he was actively engaged with his driving and related tasks on the morning of the crash. Preceding the crash, he activated the bus lights and stop arm, and he waved the student pedestrians across the roadway. The NTSB concludes that there is insufficient information to determine whether the school bus and pickup truck drivers were fatigued in the period leading up to the crash. The first 911 call reporting the crash was received at 7:15:25 a.m.; about 6 minutes later, the first medical help arrived on scene. The Rochester Fire Department, Lutheran EMS, Mentone Fire Department, and medical helicopters provided by Parkview Samaritan Medical Transport all assisted in the response. A medical helicopter transported the seriously injured student pedestrian to a medical facility in Fort Wayne, Indiana. The NTSB concludes that the emergency response to the crash was timely and effective. 2.2 Pickup Truck Driver Response The pickup truck driver did not stop for the stopped school bus on SR-25, as required by state law. The school bus driver had stopped his bus in the northbound lane of SR-25, activated its warning lights, and extended its stop arm. As the pickup truck driver was traveling south on SR-25, she passed a Watch For School Bus sign, as well as signs warning of curves. When speaking to the Indiana State Police after the crash, the pickup truck driver said she saw a vehicle ahead but did not recognize it as a school bus, despite the activated warning lights and extended stop arm. Specifically, in her interview with the police, she said, “I didn’t see a stop sign—like usually when I see a bus, I like see a stop sign.” She said she tried to stop her vehicle when she saw the children crossing the road to board the school bus. Other drivers approaching the crossing area said that they saw the activated lights and stop arm on the school bus. The driver of the vehicle traveling south behind the pickup truck said that she saw the school bus with its flashing lights and stop arm. Her passenger indicated that he had seen the bus’s stop sign (stop arm) come out. A driver in a vehicle

NTSB

Highway Accident Report

28 traveling north behind the school bus recounted that he saw the bus’s red lights and stop arm. All available evidence shows that the school bus’s headlamps and flashing red warning lights were on and would have been noticeable in the dark. Before exiting a curve north of the collision site, the pickup truck driver had an unobstructed sight distance of at least 1,185 feet in which to see the stopped school bus with its flashing red lights. If the pickup truck driver had maintained an average speed of 58–59 mph, as indicated by the recorded data, the school bus would have been within the driver’s unobstructed line of sight for 14.0–14.6 seconds. According to the parent who was waiting with the student pedestrians at the mobile home park before the crash, while waiting for the bus, the student pedestrians were standing in an unlit area away from the roadway. Dark conditions and their position off the roadway would have initially reduced the pickup truck driver’s ability to see the pedestrians, until they approached the roadway. The pickup truck driver most likely did not become aware of the pedestrians until they were beginning to cross the roadway. This scenario is consistent with the recorded event data, which show that the driver began braking less than 1.3 seconds before impact, while the vehicle was less than 100 feet from the crash location.43 The brake application made at this time and at this distance from the pedestrians could not stop the vehicle in time to avoid colliding with them. The pickup truck driver failed to respond appropriately to the warning lights, or to the school bus itself; however, it is not clear why she failed to respond. With respect to the school bus, the driver reported observing the warning lights but said that she did not identify the vehicle as a school bus and that she did not see a stop sign (stop arm) on the bus, so she did not attempt to stop until she was about 100 feet from the crash location. There is no evidence that she was distracted at the time of the crash by cell phone use, her children asleep in her vehicle, or her conversation with her brother. It was early in the morning and dark when the crash occurred, which limited her ability to see the student pedestrians approaching the roadway. Her activities that morning were not routine, and, although she frequently drove on SR-25, she was not typically on the road in the morning hours, when school buses are on the road. The NTSB concludes that for reasons that cannot be determined from the available evidence, the pickup truck driver did not respond to the activated warning lights and stop arm of the school bus, and she did not attempt to stop her vehicle until she saw the students in the roadway. 2.3 Enhancing Safety of School Bus Routes and Stops 2.3.1 School Bus Routes and Stops 2.3.1.1 Crossing risks posed by high-speed roadways. In the Rochester collision, the school bus route included a bus stop that required the students to cross a roadway with a 55 mph posted speed limit to board the bus. Seconds before the pickup truck struck the student pedestrians, it was traveling at a speed of 58–59 mph. The students were waiting

43 The event data recorder recorded data at intervals of 0.5 seconds.

NTSB

Highway Accident Report

29 for the bus in the dark, which is common in the United States, given that much of the school year takes place in months with fewer daylight hours. The 2018 collisions that the NTSB investigated in Baldwyn, Mississippi, and Hartsfield, Georgia, were similar in that they also occurred in the dark early morning hours and involved students crossing high-speed roadways to board a school bus.44 In 1989, the Transportation Research Board (TRB) published a report on improving school bus safety (TRB 1989). In the chapter dedicated to “measures to prevent school bus and pedestrian accidents,” the TRB pointed out that the potential for pedestrian crashes can be reduced by improving the locations of school bus routes and stops. It also presented three basic principles that school districts should follow: (1) do not require school buses to back up on their routes, (2) locate stops to minimize traffic disruptions and give the driver a good field of vision, and (3) locate stops to minimize the need for students to cross in front of the bus, especially on busy highways. The state of New York established route and bus stop guidelines in 1992 (Madison-Oneida Board of Cooperative Education Service 1992). The guidance included a discussion of the dangers of crossing a roadway to board a bus, recognizing that “Crossing the road is the most hazardous aspect of riding a school bus and it should be eliminated whenever and wherever possible.” With funding from NHTSA, the National Center for Safe Routes to School and the Pedestrian and Bicycle Information Center (2010) developed a guide for determining school bus stop locations. The guide recommended that school bus stops be placed to “minimize the need for students to cross a road from the stop to the bus, regardless of the type of roadway.” The guide further suggested picking a bus stop location that offers adequate lighting whenever possible. The National Safety Council (NSC) also has noted that school bus routes should be planned to minimize walking across public highways and should enable the bus driver to pick up and drop off students on their own side of the street, if possible (NSC 2008). In 1995, the NTSB investigated the collision of a train with a school bus that was stopped on a railroad/highway grade crossing in Fox River Grove, Illinois (NTSB 1996). The NTSB issued Safety Recommendation H-96-52 to the NASDPTS asking the organization to encourage its members to develop and implement a program for the identification of school bus route hazards and to routinely monitor and evaluate all regular and substitute bus drivers. The recommendation was “Closed—Acceptable Action.” With a grant from NHTSA, the NASDPTS generated a checklist of school bus route hazards,

44 Information about the investigation of the Baldwyn crash can be found by accessing the Docket Management System and searching for NTSB case number HWY19IH005; the Hartsfield crash investigation is under NTSB case number HWY19IH004.

NTSB

Highway Accident Report

30 focusing on driving hazards (NASDPTS 1998).45 The checklist has been adopted by the NCST and is included in the NSTSP (NCST 2015). The NSTSP also contains a section on routing and scheduling that includes a list of factors (such as visibility) to consider when planning a school bus route and locating a stop. Specific information pertaining to highways divided into separate roadways and highways with three or more marked traffic lanes states that— Fleet operators, schools and Head Start Centers should design bus routes that service each side of the highway so students do not have to cross the highway unless there is a traffic control signal or an adult crossing guard within 300 feet of the bus stop to assist students while crossing such multiple lane highways. Based on longstanding safety guidance, as well as the crash investigations discussed in this report, the NTSB concludes that requiring students to cross a roadway, regardless of the number of lanes, presents a risk of pedestrian death or injury because motorists do not always stop, as required, for school buses, even when a bus is at a bus stop with its lights flashing and stop arm extended. 2.3.1.2 Assessing school bus routes and stops for risks. Following the passage of Senate Bill 2 in Indiana, the IDOE updated its School Bus Safety Guidelines and Best Practices (IDOE 2019). The document now states that, for bus stops on US or state routes (highways), outside the city limits, students will no longer be required to cross the street to board the bus, unless no safe alternatives are available. If no safe alternative exists and an elementary student must cross the highway to board the bus, the school board must approve having a crossing at that location. In compliance with Senate Bill 2, the TVSC changed the crash bus route and other school bus routes so that no student in the TVSC’s jurisdiction must cross a state highway to board (or disembark from) a school bus. In addition, the number of roadway crossings (of any kind of road) within the TVSC jurisdiction decreased from 300 to 136. Indiana’s Senate Bill 2 also required school districts to review school bus routes and safety policies annually. It is common for school bus routes to be used year after year and passed on from driver to driver without being reassessed for safety. In the TVSC, the school bus route where the collision occurred had been in service for several years, although the individual stops may have changed due to student turnover. It should be noted that, although the route itself may not change, the specific stops and environments of the stops may change and become less safe. According to the NSTSP, routes should be reviewed periodically to identify factors that might necessitate a route change. The NTSB concludes that periodically evaluating school bus routes and stops for hazards can reduce the safety risks to student pedestrians. Therefore, the NTSB recommends that the

45 The NASDPTS defined “driving hazards” as those hazards that are encountered while operating a school bus route, such as railroad grade crossings and industrial intersections. School bus loading zone hazards include hazards that are encountered at a school bus stop, such as a narrow, busy street without sidewalks or dangerous curves that do not provide the school bus driver, the students, or other motorists with an adequate view of the school bus loading zone.

NTSB

Highway Accident Report

31 NASDPTS, National Association for Pupil Transportation (NAPT), and National School Transportation Association (NSTA) inform their members of the circumstances of the Rochester, Indiana; Baldwyn, Mississippi; and Hartsfield, Georgia, crashes, and urge them to minimize the use of school bus stops that require students to cross a roadway (especially a high-speed roadway) and to, at least annually, and also whenever a route hazard is identified, evaluate the safety of their school bus routes and stops. 2.3.1.3 Training to reduce school bus route and stop hazards. The IDOE is the agency responsible for developing training for school bus drivers and transportation directors in Indiana. The IDOE course “Transportation 101” is designed to be taken by school transportation directors. This course covers a multitude of topics, including school bus driver requirements, school bus mechanic requirements, and various safe bus operating definitions, but it does not contain specific information about assessing the safety of school bus routes or identifying hazards at school bus stops. The NTSB concludes that the existing IDOE training for school transportation directors does not contain sufficient information on assessing the safety of school bus routes or identifying hazards at school bus stops. Therefore, the NTSB recommends that the IDOE supplement its training program for school transportation directors with a module on how to assess the safety and risks of school bus routes and stops, according to best industry practices. At present, only 1.5 percent of all Indiana school districts/charter schools and nonpublic schools/Head Start programs have requested the course Transportation 101 for their transportation directors. Consequently, the NTSB also recommends that the IDOE require local school transportation directors and others involved in evaluating school bus routes and stops in Indiana to complete the training module on the safety and risks of routes and stops recommended in Safety Recommendation H-20-13 (above). The NTSB also concludes that the routing hazards evident in the recent Hartsfield, Georgia, and Baldwyn, Mississippi, crashes suggest that inadequate school bus routing may be a widespread problem. Further, the NTSB concludes that the TVSC’s inadequate safety assessment of school bus routes resulted in bus stops that required students to cross a high-speed roadway, placing them at risk. Therefore, the NTSB recommends that the NASDPTS, NAPT, and NSTA remind their members to ensure that school transportation directors and others involved in evaluating school bus routes and stops complete training on how to assess the safety of school bus routes and stops, according to best industry practices. 2.3.1.4 Evaluating and tracking safety risks associated with school bus routes and stops. Training school transportation personnel to assess routes and stops effectively is only the first step in improving their safety. To be of optimum value, assessments should take place recurrently, and all available information should be collected to make the assessments as comprehensive as possible. The TVSC had no written policy on when or how to report safety incidents, such as illegal passings, or identified route hazards, such as a dark bus stop. Although drivers could report incidents to the garage, no records of such reports were maintained. The NSC suggests that school bus drivers should examine their stops regularly and report unsafe conditions to the transportation supervisor (NSC 2008). Although school bus drivers are in the best position to identify any hazards associated with the routes they drive every school day, parents and caregivers who accompany their

NTSB

Highway Accident Report

32 children to a bus stop also have opportunities to observe risky behaviors or conditions. Therefore, the NTSB concludes that creating a mechanism by which school bus drivers and parents (or caregivers) of student riders could report safety concerns about bus operations would provide an additional source of information that could be used to improve the safety of school bus routes and stops. The NTSB recommends that the TVSC implement a process to track school bus driver and parent (or caregiver) complaints regarding the safety of school bus routes and stops, as well as any other safety concerns about bus operations, from initial submission of an issue to its resolution. 2.3.2 Roadway Crossing Procedures The school bus driver said that, on the day of the collision, he pulled up to the stop with his bus’s amber warning lights on, and he activated the bus’s red warning lights, which extended the stop arm. He saw headlights in the distance but still waved the students on to cross the street, believing that the oncoming vehicle was sufficiently far away and expecting that it would stop before reaching the crossing area. The students waited for the school bus behind the fence between the road and the mobile home park. From that location, they would have had a clear line of sight to the school bus’s northbound approach on SR-25, as well as to the bus when it was stopped across the road. Their line of sight toward the southbound traffic and the approaching pickup truck, however, would have been restricted by the mobile homes and foliage north of their location until they had progressed through the clear zone and were nearer the roadway. Although their line of sight to the approaching pickup truck would have improved as they moved toward the highway, it is likely that, once near the highway, the students’ focus would have been on the stopped school bus and its driver. Although routes that require students to cross a road to board or disembark from a school bus create safety risks, there may be circumstances where alternative routes are not feasible. NHTSA maintains a School Bus Driver In-Service Safety Series training program designed for experienced school bus drivers (NHTSA 2011). The training module from this series on “Loading and Unloading for School Bus Drivers” says that students should wait for the driver to signal them to cross. When the driver signals that it is safe to cross, the student should first check for traffic, and then cross at a position in front of the bus and make eye contact with the school bus driver. NHTSA also suggests that drivers establish a special horn signal to be used to warn of danger and indicate that student pedestrians should “return to the side of the road [they] started from–AT ONCE.” The NHTSA training further states that school bus drivers should ensure that student pedestrians know both the hand signal indicating that it is safe to cross and the horn signal indicating danger. NHTSA’s guidance is similar to the universal crossing signal guidance that the TVSC provided to its school bus drivers at the August 2018 driver orientation. The 2018 orientation training did not specify that all the traffic must be stopped before signaling students to cross; instead, it stated that, before signaling students to cross, the school bus driver should be sure that “traffic is controlled.” Since this crash, in Indiana Senate Bill 2, Indiana has clarified its crossing safety policy to ensure that students crossing a roadway to board a stopped bus do not enter a roadway until approaching traffic has come to a

NTSB

Highway Accident Report

33 complete stop. The NTSB concludes that, the TVSC’s policy at the time of the crash, which required school bus drivers to determine subjectively when surrounding traffic was “controlled,” left its bus drivers with insufficient information to make a safe determination about when to signal students to cross a roadway to board a school bus, placing students at risk. The school bus driver said that, on the day of the crash, when he perceived the pickup truck’s approach as a hazard to the student pedestrians, he honked the school bus horn to warn them. This action is in accord with the universal crossing signal and NHTSA’s guidance to indicate danger—intended to prompt student pedestrians to return to their point of origin on the side of the road. However, witnesses said that they frequently hear horns in the morning near the bus stop and did not necessarily associate the honking horn with danger, nor with the need for crossing students to return to the side of the road. Although it appears from the circumstances of the crash that the student pedestrians were aware that they should wait until signaled by the school bus driver to cross the road, it is not clear whether they understood what to do when the driver sounded his horn. Also, although at the time of the crash, the driver was not trained to withhold the signal to cross until all approaching vehicles had stopped, since the adoption of Senate Bill 2, no Indiana school bus driver should now make the “safe to cross signal” until all vehicles have stopped. The NTSB concludes that, in circumstances when a student roadway crossing cannot be avoided, the school bus driver must be knowledgeable of, and consistent when making, crossing and warning signals, and students must be aware of, and understand, the crossing and warning signals the driver makes. Therefore, the NTSB recommends that the TVSC train its school bus drivers and students on crossing procedures, including the crossing hand signal and the danger signal, which are to be used when a student roadway crossing cannot be avoided. The NTSB further recommends that the NASDPTS, NAPT, and NSTA advise their members to train their school bus drivers and students on crossing procedures, including the crossing hand signal and the danger signal, which are to be used when a student roadway crossing cannot be avoided. 2.4 Modifying Driver Behavior Near School Buses According to NASDPTS estimates, more than 17 million illegal school bus passings take place every school year. Even though it is illegal in all 50 states to pass a school bus that is stopped to load or unload passengers with its red lights flashing and stop arm extended, such illegal passings are taking place with dangerous frequency and putting children at daily risk.46 Therefore, the NTSB concludes that, although it is illegal in all 50 states, NASDPTS data show that the passing of stopped school buses by other vehicles remains a pervasive and continuing safety issue in the United States. A driver may fail to stop for a stopped school bus for many reasons, including not knowing the law, not knowing that it applies to traffic in both directions, being distracted

46 Following the Rochester crash, the Stop for School Buses Act of 2019 was introduced into Congress in April 2019 (H.R. 2218 and S. 1254). It proposes that the Secretary of Transportation research the significant safety measures and programs to prevent the illegal passing of school buses.

NTSB

Highway Accident Report

34 while driving, being unaware of the potential risk of striking a child, or simple impatience. NHTSA is in the early stages of a demonstration project to prevent illegal passing of school buses. One of the objectives of the project is to assess drivers’ levels of comprehension of state laws regarding passing of stopped school buses.47 NHTSA suggests a two-pronged approach to reducing illegal passings of school buses: education and enforcement. 2.4.1 Education Efforts There is no shortage of published service announcements or educational information on the dangers of illegally passing a stopped school bus, the state laws pertaining to illegal passings, and the penalties associated with such violations. For example, in October 2019, NHTSA issued a news release, “Back to School Safety Tips for All Drivers, Students and Parents,” which included a video showing drivers how to slow with the amber lights, stop on the red lights, and, in general, be careful when driving near a school bus (NHTSA 2019a). NHTSA also maintains an electronic repository of school bus safety materials in its traffic safety “marketing” materials.48 The NSC publishes a back-to-school safety tip sheet for drivers (NSC 2020). The American Academy of Pediatrics (2019) has a video on teaching children about safety on a school bus and reminds drivers to be cautious when driving near a school bus. Moreover, many school districts, law enforcement agencies, and state departments of education and transportation have developed public service announcements, posters, or other printed materials to inform motorists of the dangers of illegally passing a stopped school bus.49 State driving manuals provide additional information. In Indiana, the driver’s manual tells learning drivers that they must stop when approaching (from either direction) a stopped school bus with its red lights activated and stop arm extended. It warns drivers to be cautious when approaching a school bus and to stop to watch for children congregating near the stop or who may dart into the street to get on the bus. The driving manuals for Georgia and Mississippi contain similar information. At a minimum, state driving manuals provide basic information on state laws regarding the restrictions against passing a stopped school bus with its lights flashing and stop arm extended (NASDPTS 2019b). New York is revising its driver’s curriculum to enhance its coverage of school bus safety.50 Each year, National School Bus week is held in the third week of October, hosted by the NAPT, NSTA, and NASDPTS. Typically, there is a surge of activity during this

47 The project is also intended to evaluate current stop arm violation initiatives at the state and local level, enhance the Reducing the Illegal Passing of School Buses Best Practices Guide, and test the comprehensive implementation of those best practices through a field study to examine the effectiveness of automated school bus camera enforcement. 48 For more information, see NHTSA safety marketing material webpage, accessed January 27, 2020. 49 For example, the Montgomery County, Maryland, Police Department and the KSDE have developed such items. 50 In 2019, New York State Senate Bill 2960B amended §502, Vehicle and Traffic Law (both weblinks accessed March 26, 2020).

NTSB

Highway Accident Report

35 week on school bus safety. The theme for 2020 is “Red Lights Mean STOP!” Given this theme, the NTSB anticipates that, during this week in 2020, there will be increased opportunities to educate the public about the dangers of driving past a bus with its red lights on and stop arm extended. The NTSB concludes that education materials informing the driving public of the illegality and dangers of passing a school bus that is stopped to load or unload passengers are widely available from a variety of sources. Unfortunately, despite the profusion of such information, crashes in which student pedestrians are struck by vehicles whose drivers do not stop for stopped school buses continue to occur; the Rochester, Baldwyn, and Hartsfield crashes discussed in this report are only three examples of such tragic crashes. One approach to making these education materials more memorable and significant to drivers might be to combine education with enhanced enforcement of no-passing laws. 2.4.2 Enforcement Actions Several states and local communities have been involved in programs that combine education and enforcement efforts to reduce illegal passings of school buses. Typically, these programs include participants from departments of education, student transportation agencies, law enforcement officers, and other parties involved in student transportation who work together to raise awareness of the potential consequences of illegal school bus passing. During School Bus Safety Week in 2019, officers from the Sedgwick County Sheriff’s Office in Kansas and police departments in Wichita, Haysville, and Maize, Kansas, boarded school buses to watch for violators of school bus passing laws. These efforts were coupled with high-visibility enforcement using patrol cars (KAKE News 2019). New York State conducted its “Operation Safe Stop” day on May 2, 2019, during which 702 police officers from 75 law enforcement agencies wrote 646 tickets for drivers who passed stopped school buses and 1,991 tickets for other moving violations (New York State Governor’s Traffic Safety Committee 2019). At the 2019 NAPT conference, during a session on illegal school bus passing, several attendees cited success stories of schools teaming up with local law enforcement to prevent violations of no-passing laws (Thompson 2019). A North Carolina study completed in 2000 noted that when school transportation staff and law enforcement worked together to reduce illegal school bus passings, convictions of reported violators increased, and the resulting publicity helped to decrease overall violations (North Carolina Department of Public Instruction 2000). The NTSB concludes that evidence suggests that coupling enhanced enforcement of no-passing laws with efforts to educate motorists about the dangers of passing a stopped school bus may reduce the incidence of illegal passings. Therefore, the NTSB recommends that the NASDPTS, NAPT, and NSTA urge their members to continue to coordinate with local law enforcement agencies to conduct educational and enforcement activities aimed at reducing illegal school bus passings. Similarly, the NTSB recommends that the International Association of Chiefs of Police, National Sheriffs’ Association, and National

NTSB

Highway Accident Report

36 Association of School Resource Officers inform their members of the fatal Rochester, Indiana; Baldwyn, Mississippi; and Hartsfield, Georgia, crashes, and encourage them to continue to work with local school districts to conduct educational and enforcement activities to reduce illegal school bus passings. Although such high-visibility enforcement campaigns can be effective in raising awareness of the dangers of illegally passing a stopped school bus, they are expensive to conduct and limited in scope to a specific area and time period. As an alternative, some school districts are trying a more automated approach; they are installing cameras on school bus stop arms to record images of vehicles (and/or drivers) illegally passing the school bus when it is stopped to load or unload students. According to the National Conference of State Legislatures (NCSL), 22 states explicitly permit local governments or school districts to use cameras to capture images and issue traffic tickets for illegally passing stopped school buses based on the images (NCSL 2020).51 The state laws differ in some details. Some states permit images to be taken only of the license plate of the offending vehicle and prohibit taking images of the driver and passengers. Several state laws define how the fines collected from stop arm camera violations may be used. For example, legislation (Senate Bill 2) passed in Indiana in April 2019 allows schools to petition counties for money to pay for stop arm cameras using funds collected from penalties. Connecticut, Illinois, Maine, and Rhode Island require school buses to be marked to alert drivers to the presence of a stop arm camera. Some evidence suggests that use of stop arm cameras can improve compliance with no-passing laws. The firm Verra Mobility (formerly American Traffic Solutions) studied the citations resulting from 290 school bus safety cameras in 15 programs in Georgia, Maryland, Virginia, and Texas during the 2013–2014 school year.52 The results indicated that the use of the cameras resulted in a reduction in violations of almost 40 percent (Verra Mobility 2016). A 2013 study found that North Carolina’s pilot program of issuing citations based on images of violations captured by stop arm cameras resulted in overall success in reducing the incidence of illegal passings (Cook and Tsai 2013). (NHTSA has conducted a study on the effectiveness of stop arm cameras, which is currently under internal review by the agency.) The NTSB concludes that the use of stop arm cameras could deter drivers from illegally passing stopped school buses. Therefore, the NTSB recommends that the 28 states and the District of Columbia that do not currently have laws permitting the use of stop arm cameras on school buses for enforcement purposes enact legislation to permit stop arm

51 The 28 US states that do not have such laws are as follows: Alaska, Arizona, California, Colorado, Delaware, Florida, Hawaii, Iowa, Kansas, Kentucky, Louisiana, Massachusetts, Michigan, Minnesota, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, North Dakota, Ohio, Oregon, South Dakota, Texas, Vermont, and Wisconsin. The District of Columbia also does not have such a law. 52 The company develops, delivers, and operates road safety products and services intended to increase compliance with traffic laws addressing red lights, school zones, speed limits, and school bus safety.

NTSB

Highway Accident Report

37 cameras on school buses to capture images, and allow citations to be issued for illegal school bus passings based on the camera-obtained information. At the time of the Rochester crash, the TVSC did not have stop arm cameras installed on its buses. The TVSC also told investigators that few school bus drivers had reported “near miss” incidents involving a vehicle illegally passing a school bus and that such reports were rarely communicated to local law enforcement. However, the TVSC has stated that, for the 2019 school year, it has purchased and installed stop arm cameras for its entire fleet of regular route buses, and that all future newly purchased buses will have cameras installed.53 The images from the cameras can be used to enforce stop arm violations, and they can also provide additional information for assessing the safety of school bus routes and stops. 2.5 Using Technology to Prevent Collisions With Student Pedestrians and Mitigate Injuries Requiring a student to cross an active roadway to board a school bus or to return home after disembarking from a bus is not a recommended safety option. Ultimately, the goal should be to eliminate school bus stops that require students to cross a roadway. However, where student crossings are not avoidable through route planning, technology may help to prevent a vehicle from striking a student or to mitigate the injuries sustained in a crash. Advanced vehicle technologies are available that can assist drivers in avoiding or mitigating crashes with pedestrians and in recognizing stopped school buses that are loading or unloading students. These systems can respond to certain hazards when the driver does not take action, regardless of why the driver is not responding. 2.5.1 Connected and Automated Vehicles The NTSB has long supported the development and use of vehicle-to-vehicle (V2V), vehicle-to-infrastructure (V2I), and vehicle-to-pedestrian (V2P) technologies, which have the potential to reduce crashes, injuries, and fatalities on roadways. The comprehensive term V2X refers to V2V, V2I, and V2P technologies collectively. For implementing these technologies, the primary method is radio communication; however, there has been progress in using cellular communication (83 Federal Register 66338; also, NHTSA 2018). Various V2X technologies may be applicable to school buses. For instance, a technology by which a school bus can trigger the activation (flashing) of a school bus stop warning sign on the road when the bus is approaching, or stopped at, a bus stop would help alert drivers of other vehicles and could lead to reductions in illegal school bus passings. There is some evidence that dynamic warning signs have the potential to reduce the

53 Stop arm cameras have not been installed on older substitute buses.

NTSB

Highway Accident Report

38 incidence of vehicles illegally passing stopped school buses or to reduce their speeds (Carson and others 2005). At one time, the Canadian province of Alberta allowed for the warning flashers on School Bus Stop Ahead signs to be activated by the school bus driver (Government of Alberta Transportation 2004). However, because drivers were inconsistent in when and how they activated the flashers, Alberta stopped installing the signs and recommended that those in use should be removed. Using V2I technology to activate the flashing lights would remove the element of driver inconsistency from the situation, because V2I technology would automatically activate the flashers, without human involvement. Advanced technologies hold promise not just in alerting drivers to standard situations, such as a stopped bus, but in responding to dynamic ones, such as before an imminent crash. V2V technology could warn a driver of the presence of a stopped school bus with its warning lights on and stop arm extended; it could also (possibly) reduce vehicle speed to avoid a crash. The NTSB investigated a 2012 crash in Chesterfield, New Jersey, where a school bus drove into the path of a dump truck, resulting in the death of one child and the injury of several others (NTSB 2013). Had the truck and the school bus been equipped with connected technology, the school bus driver would have received a continuous warning as he began to cross the intersection. In the Chesterfield report, the NTSB concluded that connected vehicle technology could have provided active warnings to the school bus driver of the approaching truck and possibly prevented the crash. The NTSB issued Safety Recommendations H-13-30 and -31 to NHTSA, which read as follows: H-13-30 Develop minimum performance standards for connected vehicle technology for all highway vehicles. H-13-31 Once minimum performance standards for connected vehicle technology are developed, require this technology to be installed on all newly manufactured highway vehicles. Because of NHTSA’s lack of progress on these recommendations, they are currently classified “Open—Unacceptable Response.” The NTSB continues to believe that, given their special operating features, which can involve safety vulnerabilities such as student pedestrians, school buses must be included in all plans to develop connected vehicle technology. Consequently, the NTSB concludes that it remains a safety priority that school buses be included in performance standards for connected vehicle technologies. Therefore, the NTSB reiterates Safety Recommendations H-13-30 and -31 to NHTSA. The NTSB is concerned that the implementation of V2X technology could be negatively affected by a recent notice of proposed rulemaking (NPRM) issued by the Federal Communications Commission. The proposed rulemaking would reduce the radio bandwidth available for V2X applications. As the NTSB stated in its response to the NPRM, if the rulemaking is enacted, V2X applications would be functionally infeasible,

NTSB

Highway Accident Report

39 which would impede transportation safety advancements, including automated vehicle technologies (85 Federal Register 6841).54 The school bus industry shares the NTSB’s concern that the proposed rulemaking could negatively affect V2X capabilities. In its response to the NPRM, the NSTA noted that many of its members have incorporated the latest technologies onto their school buses and that these technologies depend on the success of high-speed safety communications. The NSTA stated that “Delays in a school bus receiving a crash-avoidance message due to signal interference can mean the difference between a catastrophic crash, and a narrow miss.”55 The NTSB concludes that the Federal Communications Commission’s proposed rulemaking to reduce Intelligent Transportation System operations to the upper 30 megahertz of the currently assigned bandwidth while opening the remaining 45 megahertz to unlicensed devices would be detrimental to safety and set back advancements in transportation safety. The NTSB recognizes that new automated vehicle technologies are rapidly being integrated into vehicles. SAE International defines six levels of driving automation that range from Level 0 (No Automation) to Level 5 (Full Automation) (SAE 2018). In recent years, the NTSB has issued major investigation reports on crashes involving partial driving automation as well as one involving the testing of higher-level automation systems (NTSB 2020, 2019a, and 2017). NHTSA has not established automated driving system safety standards or assessment protocols. It has published automated vehicle guidance and encouraged manufacturers and developers of automated driving systems to submit voluntary safety self-assessment reports describing the safety approach they are taking in the development of their systems. Underwriters Laboratories (with Edge Case Research) is developing UL 4600, Standard for Safety for the Evaluation of Autonomous Products, which proposes an extensive list of factors that should be considered when designing automated vehicles (Edge Case Research 2019). School buses and their passengers are identified as factors with which automated vehicles will interact and to which they will need to respond safely. In its recent report on the collision between a vehicle operating with a developmental automated driving system and a pedestrian in Tempe, Arizona (NTSB 2019a), the NTSB recommended that NHTSA require entities that are testing or intend to test a developmental automated driving system on public roads to submit a safety self-assessment report (Safety Recommendation H-19-47). Additionally, the NTSB recommended that NHTSA establish a process for evaluating the safety self-assessment reports and determine whether the plans include appropriate safeguards for testing such

54 See NTSB's V2X radio bandwidth NPRM response to view NTSB’s response, accessed March 25,

1. To view all of the comments on this NPRM, see responses to bandwidth NPRM, accessed March 25,

55 See NSTA's V2X radio bandwidth NPRM response to view the NSTA’s response, accessed March 25,

1. To view all of the comments on this NPRM, see responses to bandwidth NPRM, accessed March 25,

NTSB

Highway Accident Report

40 systems on public roadways, including adequate monitoring of vehicle operator engagement, if applicable (Safety Recommendation H-19-48).56 The unusual operating features of school buses should also be considered when developing such new technologies. School buses operate under conditions that do not apply to most other vehicles; they make frequent stops on highly active roadways in the morning and afternoon hours, they transport student passengers who will be boarding and leaving the bus; and they require other vehicles to stop when bus warning lights are active and the stop arm is extended. The NTSB concludes that, because school buses and the children they carry are an integral part of the transportation system, it is imperative to transportation safety that the developers and manufacturers of advanced technologies create systems in which automated and connected vehicles respond appropriately to school buses. Therefore, in light of the special operating nature of school buses on public roadways, the NTSB recommends that NHTSA, when evaluating safety self-assessment reports from entities testing automated driving systems on public roads, evaluate how effectively the entities include school bus operations in their plans. 2.5.2 Pedestrian Automatic Emergency Braking Although the 2017 Toyota Tacoma pickup truck involved in the Rochester crash was not equipped with a PAEB system, the 2020 model is equipped with one. PAEB systems are designed to automatically apply or supplement the vehicle’s brakes to prevent a collision or reduce the severity of a collision between a vehicle and a pedestrian.57 Usually, PAEB systems use camera or radar sensors to identify when a pedestrian is a potential hazard. Developing a system to detect pedestrians is challenging because pedestrians are smaller than vehicles; they may be present around vehicles, on sidewalks, in crosswalks, and on the roadside; and they often change trajectory quickly (Jermakian and Zuby 2011). In the Rochester collision, as well as in other school bus crashes, the pedestrians involved were children, who are smaller than the average adult, so when they cross the road in the dark, they are harder to see and may blend more fully into the environment. NHTSA has not set performance standards for PAEB systems or required their installation on any vehicle. In its report on pedestrian safety (NTSB 2018b), the NTSB made the following recommendation to NHTSA:

56 Both recommendations are currently in “Open—Await Response” status. 57 An automatic emergency braking system engages dynamic brake support or crash-imminent braking to prevent or mitigate the severity of vehicle-to-vehicle rear-end crashes. A PAEB system assists the driver by automatically applying the brakes to avoid or mitigate a potential contact between the equipped vehicle and a pedestrian.

NTSB

Highway Accident Report

41 H-18-43 Incorporate pedestrian safety systems, including pedestrian collision avoidance systems and other more-passive systems, into the New Car Assessment Program [NCAP].58 NHTSA responded that it had published an NPRM on the NCAP on August 3, 2018, and that one of the issues it raised was whether to incorporate pedestrian crash avoidance features into NCAP. NHTSA also held a public meeting on NCAP on October 1, 2018 (83 Federal Register 38201).59 On November 21, 2019, NHTSA issued a request for comments on “Advanced Driver Assistance Systems Draft Research Test Procedures” (84 Federal Register 64405). PAEB systems are among those for which draft testing procedures were provided; one test condition for a PAEB system is its ability to detect and respond to a child pedestrian running from behind a parked vehicle into the path of a PAEB-equipped vehicle traveling at 10 or 25 mph.60 In its response to NHTSA’s request for comments, the NTSB expressed its disappointment that the proposed testing procedures were for “research purposes only” and were not intended to be used to update the NCAP program. The NTSB urged NHTSA to incorporate advanced driver assistance systems and associated safety performance measures into its NCAP rating system.61 The Insurance Institute for Highway Safety (IIHS) has added PAEB testing to its passenger vehicle safety tests (IIHS 2019). Vehicles are rated as basic, advanced, or superior, based on their ability to avoid or mitigate a crash with pedestrian dummies in three different test track scenarios (parallel adult, perpendicular adult, and perpendicular child) conducted at different speeds. The parallel adult test simulates an adult pedestrian in the right lane near the edge of the road, facing away from traffic. Tests are run at 25 and 37 mph. The perpendicular adult scenario involves an adult pedestrian walking across the road; tests are run at 12 and 25 mph. The third scenario, and the one most relevant to the Rochester crash, is the perpendicular child test, which involves a child running into the road between parked vehicles; tests are run at 12 and 25 mph. To date, IIHS has rated 11 vehicles equipped with PAEB.62 The American Automobile Association (AAA) tested midsize sedans that were equipped with pedestrian detection/mitigation systems under various scenarios, including

58 NCAP is a 5-star safety rating program designed to provide consumers with information about the crash protection and rollover safety provided by new vehicles beyond what is required by federal law. In the NCAP rating system, one star is the lowest safety rating; five stars is the highest. More stars equal a safer car. See NCAP ratings, accessed January 27, 2020. 59 Safety Recommendation H-18-43 is currently classified “Open—Acceptable Response.” 60 NHTSA proposed several test conditions under two general scenarios: (1) pedestrian crosses the road in front of the vehicle and (2) pedestrian walks along the side of the road in the path of the vehicle. 61 The NTSB’s response may be found at NHTSA-2019-0102-0020, accessed January 27, 2020. 62 The IIHS ratings on PAEB systems were as follows: superior: 2018–2019 Honda CR-V, 2019 Subaru Forester, 2019 Toyota RAV4, and 2019 Volvo XC40; advanced: 2019 Chevrolet Equinox, 2018–2019 Hyundai Kona, 2019 Kia Sportage, 2018–2019 Mazda CX-5, and 2019 Nissan Rogue; basic: 2019 Mitsubishi Outlander; and no credit: 2018–2019 BMW X1.

NTSB

Highway Accident Report

42 one involving a child darting out between two parked cars (AAA 2019). In the AAA child pedestrian tests conducted at 20 mph, the system-equipped sedans avoided collisions 11 percent of the time; collisions were mitigated (at an average speed of 5.9 mph) 25 percent of the time. The pedestrian systems were found to be ineffective under nighttime testing conditions. The pickup truck was traveling 58–59 mph moments before the Rochester crash, but at the time of the impact, the truck’s speed was 41 mph. Based on event recorder data, the driver began braking the vehicle less than 1.3 seconds before impact. The NTSB is encouraged that PAEB systems are being researched, developed, and tested; however, they are not yet proven to be capable of preventing collisions such as the Rochester crash. To date, most testing of PAEB systems has been conducted at much lower speeds than were involved in this crash. PAEB systems may be more effective in preventing crashes and mitigating injuries in lower-speed situations. In particular, they could have a more beneficial safety effect in preventing and mitigating crashes in cases where pedestrians are crossing low-speed roadways, such as in residential areas, where school buses commonly operate. Overall, the NTSB concludes that, although there are limitations to the current PAEB systems, these safety technologies can help the driver and prevent or lessen the severity of crashes involving pedestrians. Therefore, the NTSB reiterates Safety Recommendation H-18-43 to NHTSA. 2.5.3 Other Technologies to Prevent Illegal School Bus Passings and Increase Crossing Safety Other technologies are available that could prevent crashes involving students crossing roadways, when changes to school bus routes are not possible. Some of these technologies are intended to make students more visible, while others are designed to help motorists recognize a stopped school bus. Supplemental lighting systems can be attached to the school bus that would (1) enable the bus drivers to better see the pedestrian students; (2) provide a clear, distinct path for the students to walk, which would permit the bus driver to ensure that students are crossing the road in a safe area; and (3) enable motorists to see the students crossing the roadway from a distance. The NTSB is aware of 23 states that permit supplemental lighting on school buses.63 Recently, Marion Community Schools in Marion, Indiana, field-tested a supplemental lighting system for its school buses.64 The tested system was a light-emitting diode mounted on the bus’s left bumper at a 45-degree downward angle. The light projected a beam that extended 18–20 feet past the bus, illuminating the students’ path for both the

63 The 23 states are Alaska, Arkansas, Arizona, Colorado, Delaware, Iowa, Idaho, Illinois, Maine, Michigan, Missouri, Mississippi, North Carolina, Nebraska, New Jersey, Nevada, New York, Ohio, Texas, Vermont, Wisconsin, West Virginia, and Wyoming. 64 In 2013, Marion County was approved to test the Gardian (sic) Angel School Bus Lighting System.

NTSB

Highway Accident Report

43 bus driver and any other motorists. Despite positive feedback on the system, the Indiana School Bus Committee did not approve its use in the state.65 The NTSB addressed student pedestrian conspicuity in its investigation of a 2016 collision in Thief River Falls, Minnesota, where a minivan struck and killed a 7-year-old male who was crossing a high-speed roadway to board a school bus. The NTSB recommended that NHTSA assess, and if necessary, update, the guidelines on pupil transportation to specifically address pedestrian issues related to conspicuity and route selection (Safety Recommendation H-18-50) (NTSB 2018a). In its March 2019 response to the recommendation, NHTSA stated that it will expand its Highway Safety Program Guideline no. 17, “Pupil Transportation Safety,” to address the issue of pedestrian conspicuity, such as through the use of retroreflective garments and route risk assessment strategies. Further, NHTSA indicated that it will seek discussions with national associations such as the NASDPTS, NAPT, and NSTA on identifying, promoting, and improving student pedestrian safety. Safety Recommendation H-18-50 is currently classified “Open—Acceptable Response.” In its report on pedestrian safety, the NTSB recognized that one of the most straightforward approaches to make it easier for drivers to see and avoid pedestrians is to improve vehicle headlights (NTSB 2018b). In that report, the NTSB recommended that NHTSA revise FMVSS 108 to include performance-based standards for vehicle headlight systems correctly aimed on the road and tested on-vehicle to account for headlight height and lighting performance (Safety Recommendation H-18-39) as well as to allow use of adaptive headlight systems (Safety Recommendation H-18-40). These recommendations were reiterated in the NTSB’s Safety Research Report: Bicyclist Safety on US Roadways: Crash Risks and Countermeasures (NTSB 2019b). According to NHTSA, it is still working on the vehicle level headlight performance requirements, but it has published an NPRM for adaptive driving beam headlight systems. Safety Recommendation H-18-39 is currently classified “Open—Unacceptable Response,” and Safety Recommendation H-18-40 is currently classified “Open—Acceptable Response.” In 2016, the IIHS released its first vehicle headlight ratings. The evaluations conducted by IIHS measure how far light is projected from a vehicle’s low- and high-beam headlights as the vehicle travels on straight roads and on curves. Although the headlights of the 2017 Toyota Tacoma pickup truck received a poor rating, in the IIHS tests, the 2020 Tacoma headlights, depending on type, received a rating of good or marginal. It should be noted that witnesses at the Rochester crash said that the pickup truck’s lights were on at the time of the crash, and that the student pedestrians could be seen in the beam.

65 The committee could not agree on whether the supplemental lighting system should be “wired” into the current bus lighting system or a separate switch controlling the supplemental system should be installed.

NTSB

Highway Accident Report

44 To address motorists’ failures to stop for school buses, extended stop arms have been designed to better communicate to oncoming drivers their responsibility to stop. Figures 8 and 9 show examples of extended stop arm systems. Pilot programs using extended stop arms have shown decreases in vehicles illegally passing stopped school buses.66

Figure 8. Extended stop arm with two stop signs on school bus. (Source: Bus Safety Solutions)

66 For example, a pilot program in Albemarle County, Virginia, used an extended stop arm system that lengthens the school bus’s existing stop arm an additional 5–6 feet from the left side of the bus. During the test period, when the extended stop arm was installed on 10 buses in the county, an average of 0.81 daily violations took place for each of the equipped buses (118 total illegal school bus passings recorded over 15 days), compared with 1.79 daily violations for the buses without the extenders (268 total illegal school bus passings recorded over 15 days).

NTSB

Highway Accident Report

45

Figure 9. Close-up view of extended stop arm with single stop sign and horizontal stop bar. (Source: S.A.F.E. Gates) Another new technology is the predictive stop arm. This safety feature uses radar technology and predictive analysis to monitor traffic approaching the school bus from either direction to assess the likelihood of illegal passings.67 Each oncoming vehicle’s speed, location, and acceleration/deceleration are used to determine whether the vehicle is likely to stop. When a risk is detected, the predictive stop arm provides an audible warning to the students and the bus driver. As was noted at the outset of this section, the ultimate safety goal to prevent events such as the Rochester pedestrian crash is to eliminate the practice of having students cross roadways when boarding or leaving school buses, especially on high-speed roads. But because some students may still have to cross roadways when route planning cannot change the bus stop location, countermeasures to improve the safety of such crossings, including advanced technologies, must be evaluated. Because of their relative newness, the effectiveness of some such technologies is not yet established. The NTSB concludes that, because funding for school bus equipment is limited, to make the best use of their resources, school systems need more information on which technologies are most effective in reducing illegal school bus passings and protecting students from the risk of injury. Therefore, the NTSB recommends that NHTSA evaluate the effectiveness of technologies designed to reduce the incidence of illegal school bus passings, and publish and disseminate the evaluation results.

67 Safe Fleet is manufacturing the predictive stop arm.

NTSB

Highway Accident Report

46 3 Conclusions 3.1 Findings 1. None of the following were factors in this crash: (1) mechanical condition of the pickup truck or condition of the school bus warning light and stop arm systems; (2) school bus driver licensing; (3) pickup truck driver licensing, drug or alcohol impairment, medical condition, vision, or cell phone use; or (4) actions/behavior of the student pedestrians or the adult pedestrian. 2. There is insufficient information to determine whether the school bus and pickup truck drivers were fatigued in the period leading up to the crash. 3. The emergency response to the crash was timely and effective. 4. For reasons that cannot be determined from the available evidence, the pickup truck driver did not respond to the activated warning lights and stop arm of the school bus, and she did not attempt to stop her vehicle until she saw the students in the roadway. 5. Requiring students to cross a roadway, regardless of the number of lanes, presents a risk of pedestrian death or injury because motorists do not always stop, as required, for school buses, even when a bus is at a bus stop with its lights flashing and stop arm extended. 6. Periodically evaluating school bus routes and stops for hazards can reduce the safety risks to student pedestrians. 7. The existing Indiana Department of Education training for school transportation directors does not contain sufficient information on assessing the safety of school bus routes or identifying hazards at school bus stops. 8. The routing hazards evident in the recent Hartsfield, Georgia, and Baldwyn, Mississippi, crashes suggest that inadequate school bus routing may be a widespread problem. 9. The Tippecanoe Valley School Corporation’s inadequate safety assessment of school bus routes resulted in bus stops that required students to cross a high-speed roadway, placing them at risk.

NTSB

Highway Accident Report

47 10. Creating a mechanism by which school bus drivers and parents (or caregivers) of student riders could report safety concerns about bus operations would provide an additional source of information that could be used to improve the safety of school bus routes and stops. 11. The Tippecanoe Valley School Corporation’s policy at the time of the crash, which required school bus drivers to determine subjectively when surrounding traffic was “controlled,” left its bus drivers with insufficient information to make a safe determination about when to signal students to cross a roadway to board a school bus, placing students at risk. 12. In circumstances when a student roadway crossing cannot be avoided, the school bus driver must be knowledgeable of, and consistent when making, crossing and warning signals, and students must be aware of, and understand, the crossing and warning signals the driver makes. 13. Although it is illegal in all 50 states, National Association of State Directors of Pupil Transportation Services data show that the passing of stopped school buses by other vehicles remains a pervasive and continuing safety issue in the United States. 14. Education materials informing the driving public of the illegality and dangers of passing a school bus that is stopped to load or unload passengers are widely available from a variety of sources. 15. Evidence suggests that coupling enhanced enforcement of no-passing laws with efforts to educate motorists about the dangers of passing a stopped school bus may reduce the incidence of illegal passings. 16. The use of stop arm cameras could deter drivers from illegally passing stopped school buses. 17. It remains a safety priority that school buses be included in performance standards for connected vehicle technologies. 18. The Federal Communications Commission’s proposed rulemaking to reduce Intelligent Transportation System operations to the upper 30 megahertz of the currently assigned bandwidth while opening the remaining 45 megahertz to unlicensed devices would be detrimental to safety and set back advancements in transportation safety.

NTSB

Highway Accident Report

48 19. Because school buses and the children they carry are an integral part of the transportation system, it is imperative to transportation safety that the developers and manufacturers of advanced technologies create systems in which automated and connected vehicles respond appropriately to school buses. 20. Although there are limitations to the current pedestrian automatic emergency braking systems, these safety technologies can help the driver and prevent or lessen the severity of crashes involving pedestrians. 21. Because funding for school bus equipment is limited, to make the best use of their resources, school systems need more information on which technologies are most effective in reducing illegal school bus passings and protecting students from the risk of injury. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of the Rochester, Indiana, crash was the pickup truck driver’s failure to stop for the school bus for unknown reasons, despite its clearly visible warning lights and stop arm, as well as a roadway warning sign indicating an upcoming school bus stop. Contributing to the cause of the crash was the Tippecanoe Valley School Corporation’s (1) inadequate safety assessment of school bus routes, resulting in the prevalence of bus stops that required student pedestrians to cross a 55 mph roadway to board a bus, increasing the risk of injury during a collision, and (2) failure to establish a clear policy regarding surrounding traffic for school bus drivers to follow in determining when it was safe to signal students to cross a roadway to board a school bus.

NTSB

Highway Accident Report

49 4 Recommendations 4.1 New Recommendations As a result of its investigation, the National Transportation Safety Board makes the following new safety recommendations. To the National Highway Traffic Safety Administration: When evaluating safety self-assessment reports from entities testing automated driving systems on public roads, evaluate how effectively the entities include school bus operations in their plans. (H-20-10) Evaluate the effectiveness of technologies designed to reduce the incidence of illegal school bus passings, and publish and disseminate the evaluation results. (H-20-11) To the states of Alaska, Arizona, California, Colorado, Delaware, Florida, Hawaii, Iowa, Kansas, Louisiana, Michigan, Minnesota, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, North Dakota, Ohio, Oregon, South Dakota, Texas, Vermont, and Wisconsin; the commonwealths of Kentucky and Massachusetts; and the District of Columbia: Enact legislation to permit stop arm cameras on school buses to capture images, and allow citations to be issued for illegal school bus passings based on the camera-obtained information. (H-20-12) To the Indiana Department of Education: Supplement your training program for school transportation directors with a module on how to assess the safety and risks of school bus routes and stops, according to best industry practices. (H-20-13) Require local school transportation directors and others involved in evaluating school bus routes and stops in Indiana to complete the training module on the safety and risks of routes and stops recommended in Safety Recommendation H-20-13. (H-20-14) To the National Association of State Directors of Pupil Transportation Services, National Association for Pupil Transportation, and National School Transportation Association: Inform your members of the circumstances of the Rochester, Indiana; Baldwyn, Mississippi; and Hartsfield, Georgia, crashes, and urge them to minimize the use of school bus stops that require students to cross a roadway (especially a high-speed roadway) and to, at least annually, and also whenever a route hazard is identified, evaluate the safety of their school bus routes and stops. (H-20-15)

NTSB

Highway Accident Report

50 Remind your members to ensure that school transportation directors and others involved in evaluating school bus routes and stops complete training on how to assess the safety of school bus routes and stops, according to best industry practices. (H-20-16) Advise your members to train their school bus drivers and students on crossing procedures, including the crossing hand signal and the danger signal, which are to be used when a student roadway crossing cannot be avoided. (H-20-17) Urge your members to continue to coordinate with local law enforcement agencies to conduct educational and enforcement activities aimed at reducing illegal school bus passings. (H-20-18) To the International Association of Chiefs of Police, National Sheriffs’ Association, and National Association of School Resource Officers: Inform your members of the fatal Rochester, Indiana; Baldwyn, Mississippi; and Hartsfield, Georgia, crashes, and encourage them to continue to work with local school districts to conduct educational and enforcement activities to reduce illegal school bus passings. (H-20-19) To the Tippecanoe Valley School Corporation: Implement a process to track school bus driver and parent (or caregiver) complaints regarding the safety of school bus routes and stops, as well as any other safety concerns about bus operations, from initial submission of an issue to its resolution. (H-20-20) Train your school bus drivers and students on crossing procedures, including the crossing hand signal and the danger signal, which are to be used when a student roadway crossing cannot be avoided. (H-20-21) 4.2 Previously Issued Recommendations Reiterated in This Report As a result of its investigation, the National Transportation Safety Board reiterates the following safety recommendations. To the National Highway Traffic Safety Administration: Develop minimum performance standards for connected vehicle technology for all highway vehicles. (H-13-30) Once minimum performance standards for connected vehicle technology are developed, require this technology to be installed on all newly manufactured highway vehicles. (H-13-31)

NTSB

Highway Accident Report

51 Incorporate pedestrian safety systems, including pedestrian collision avoidance systems and other more-passive safety systems, into the New Car Assessment Program. (H-18-43) BY THE NATIONAL TRANSPORTATION SAFETY BOARD ROBERT L. SUMWALT, III

JENNIFER HOMENDY Chairman

Member BRUCE LANDSBERG

MICHAEL GRAHAM Vice Chairman

Member

THOMAS B. CHAPMAN

Member Report Date: March 31, 2020

NTSB

Highway Accident Report

52 Appendix: Investigation The National Transportation Safety Board was notified of the Rochester, Indiana, crash on October 30, 2018, and dispatched an investigative team to the site. The NTSB established groups to investigate human performance; motor carrier operations; and highway, survival and vehicle factors. Parties to the investigation were the Indiana State Police, Fulton County Sheriff’s Office, Tippecanoe Valley School Corporation, and Daimler Trucks North America.

NTSB

Highway Accident Report

53 References AAA (American Automobile Association). 2019. Automatic Emergency Braking with Pedestrian Detection. https://newsroom.aaa.com/2019/10/aaa-warns-pedestrian- detection-systems-dont-work-when-needed-most/, accessed January 27, 2020. American Academy of Pediatrics. 2019. Webpage on school bus safety. “A Minute for Kids: School Bus Safety.” https://www.healthychildren.org/English/safety- prevention/on-the-go/Pages/School-Bus-Safety.aspx, accessed January 27, 2020. Carson, Jodie, L., Andrew Holick, Eun Sun Park, Mark Wooldridge, and Richard A. Zimmer. 2005. Development and Evaluation of an Active Warning Device for School Bus Loading and Unloading Points in Areas of Limited Visibility. FHWA/TX-05/0-4749-1. Cook, Thomas, and Jeffrey Tsai. 2013. Pilot Testing of a School Bus Stop-Arm Camera System. Raleigh, North Carolina: Institute for Transportation Research and Education. Edge Case Research. 2019. Proposed first edition of the Standard for Safety for the Evaluation of Autonomous Products, UL 4600. https://edge-case- research.com/ul4600/, accessed January 27, 2020. FHWA (Federal Highway Administration). 2009. Manual on Uniform Traffic Control Devices for Streets and Highways. Washington, DC: FHWA. Government of Alberta (Canada) Transportation. 2004 (rev. 2009). School Bus Stop Ahead Sign: Recommended Practices. https://www.alberta.ca/recommended-practices- guidelines.aspx, accessed January 27, 2020. IDOE (Indiana Department of Education). 2019. School Bus Safety Guidelines and Best Practices. https://www.doe.in.gov/transportation, accessed January 27, 2020. IIHS (Insurance Institute for Highway Safety). 2019. New Ratings Address Pedestrian Crashes. https://www.iihs.org/news/detail/new-ratings-address-pedestrian- crashes, accessed January 27, 2020. Jermakian, Jessica, S., and David S. Zuby. April 2011. Primary Pedestrian Crash Scenarios: Factors Relevant to the Design of Pedestrian Detection Systems. Arlington, Virginia: Insurance Institute for Highway Safety. KAKE News (Wichita, Kansas). 2019. Article on “Local law enforcement cracking down on drivers illegally passing school buses.” http://www.kake.com/story/41202436/local-law-enforcement-cracking-down-on- drivers-illegally-passing-school-buses, accessed January 27, 2020.

NTSB

Highway Accident Report

54 KSDE (Kansas State Department of Education). 2019. 2018-2019 National School Bus Loading and Unloading Survey. https://www.ksde.org/Agency/Fiscal-and- Administrative-Services/School-Finance/School-Bus-Safety/Loading-and- Unloading-Surveys, accessed January 27, 2020. (The KSDE collects this information with assistance from NASDPTS.) Madison-Oneida Board of Cooperative Education Services. 1992. Safe Routes-Safe Stops. http://www.p12.nysed.gov/schoolbus/documents/pdf/SafeRoutes_SafeStops.pdf, accessed January 27, 2020. NASDPTS (National Association of State Directors of Pupil Transportation Services).

1. Identification and Evaluation of School Bus Route and Hazard Marking

Systems. Dover, Delaware: NASDPTS. _____. 2019a. Annual NASDPTS Survey Highlights Danger of Passing School Buses. https://www.isbe.net/Documents/2019-NASDPTS-Release.pdf, accessed January 27, 2020. _____. 2019b. Law Summaries from Drivers’ Handbooks. http://www.nasdpts.org/Operations/documents/State_Laws_Regarding_Passing_ School_Buses.pdf, accessed January 27, 2020. National Center for Safe Routes to School and Pedestrian and Bicycle Information Center.

1. Selecting School Bus Stop Locations: A Guide for School Transportation

Professionals. Chapel Hill, North Carolina: University of North Carolina Highway Safety Research Center. NCSL (National Conference of State Legislatures). 2020. Webpage on “School Bus Safety.” https://www.ncsl.org/research/transportation/school-bus-safety.aspx, accessed January 27, 2020. NCST (National Congress on School Transportation). 2015. National School Transportation Specifications and Procedures (2015 revised edition). http://www.nasdpts.org/ncstonline/index.html, accessed January 27, 2020. New York State Governor’s Traffic Safety Committee. 2019. Webpage on “Ongoing Efforts to Improve School Bus Safety.” https://trafficsafety.ny.gov/ongoing- efforts-improve-school-bus-safety, accessed January 27, 2020. NHTSA (National Highway Traffic Safety Administration). 2011. School Bus Driver In-Service Safety Series, Administrator Guide. DOT HS 811 539A. Washington, DC: NHTSA. _____. 2018. “Request for Comments V2X Communications.” DOT-OST-2018-0210-

1. https://www.federalregister.gov/documents/2018/12/26/2018-27785/notice-

of-request-for-comments-v2x-communications, accessed January 27, 2020.

NTSB

Highway Accident Report

55 _____. 2019a. Webpage on “Back to School Safety Tips.” https://www.nhtsa.gov/back- school-safety#back-school-safety-tips-drivers, accessed January 27, 2020. _____. 2019b. Traffic Safety Facts 2008–2017 Data. School-Transportation-Related Crashes. DOT HS 812 712. Washington, DC: NHTSA. North Carolina Department of Public Instruction. 2000. A Cooperative Program to Reduce Incidents of Vehicles Passing Stopped School Buses in a Coastal Region of North Carolina. Raleigh, North Carolina: North Carolina Department of Public Instruction. NSC (National Safety Council). 2020. Webpage on “School Safety Tips for Drivers.” https://www.nsc.org/home-safety/seasonal-safety/back-to-school/drivers, accessed January 27, 2020. _____. 2008. School Bus Loading and Unloading. https://www2.safetyserve.com/articles/school-bus-loading-and-unloading/, accessed January 27, 2020. NTSB (National Transportation Safety Board). 1996. Collision of Northeast Illinois Regional Commuter Railroad Corporation (METRA) Train and Transportation Joint Agreement School District 47/155 School Bus at Railroad Grade Crossing in Fox River Grove, Illinois, October 25, 1995. Highway/Railroad Accident Report NTSB/HAR-96/02. Washington, DC. NTSB. _____. 2013. School Bus and Truck Collision at Intersection Near Chesterfield, New Jersey, February 16, 2012. Highway Accident Report NTSB/HAR-13/01. Washington, DC. NTSB. _____. 2017. Collision Between a Car Operating With Automated Vehicle Control Systems and a Tractor-Semitrailer Truck Near Williston, Florida, May 7, 2016. Highway Accident Report NTSB/HAR-17/02. Washington, DC: NTSB. _____. 2018a. Fatal Pedestrian Collision with Minivan, Thief River Falls, Minnesota, October 6, 2016. Highway Accident Brief NTSB/HAB-18/17. Washington, DC: NTSB. _____. 2018b. Pedestrian Safety. Special Investigation Report NTSB/SIR-18/03. Washington, DC: NTSB. _____. 2019a. Collision Between Vehicle Controlled by Developmental Automated Driving System and Pedestrian, Tempe, Arizona, March 18, 2018. Highway Accident Report NTSB/HAR-19/03. Washington, DC: NTSB. _____. 2019b. Bicyclist Safety on US Roadways: Crash Risks and Countermeasures. Safety Study. Safety Research Report NTSB/SS-19/01. Washington, DC: NTSB.

NTSB

Highway Accident Report

56 _____. 2020. Collision Between a Sport Utility Vehicle Operating With Partial Driving Automation and a Crash Attenuator, Mountain View, California, March 23, 2018. Highway Accident Report NTSB/HAR-20/01. Washington, DC: NTSB. SAE (SAE International). 2018. Taxonomy and Definitions for Terms Related to Driving Automated Systems for On-Road Motor Vehicles. J3016_201806. https://www.sae.org/standards/content/j3016_201806/, accessed January 27, 2020. Thompson, Sadiah. 2019. School Bus Fleet online article, “Illegal Passing Prevention Efforts Shared at NAPT Conference.” https://www.schoolbusfleet.com/news/736256/illegal-passing-prevention-efforts- shared-at-napt-conference, accessed January 27, 2020. TRB (Transportation Research Board). 1989. Improving School Bus Safety: Special Report 222. Washington, DC: TRB. Verra Mobility. 2016. Web article published July 21, 2016, “New Study Reaffirms the Dangers of School Bus Stop Arm Running.”

FD07257 ｜ 2002_美国_NTSB_HAB0501_MultipleVehicle_Collision_and_Fire_on_Interstate_Highway_40.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2002 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

1 E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N

National Transportation Safety Board Washington, DC 20594

Highway Accident Brief

Accident No.: HWY-02-FH-012 Accident Type: Multiple-vehicle collision and fire Location: Interstate Highway 40, eastbound at milepost 290.7 Cuervo, New Mexico Date and Time March 8, 2002, 1:18 p.m. Vehicles: 3 truck tractor-semitrailers 2 straight trucks 1 pickup truck 4 passenger vehicles 1 school bus 1 motor home Owners/Operators: U.S. Express LSG, Inc. Kurtz Trucking Ltd. Zimmerman Truck Lines, Inc. Atlanta Peach Movers, Inc. Fatalities/Injuries: 7 fatalities 3 serious and 13 minor injuries

Accident Description On March 8, 2002, about 1:18 p.m., a Union Pacific Railroad (UP) work crew was replacing rail near the town of Cuervo, New Mexico. Open-flame track-mounted torches were being used to heat the new rail before attaching it to crossties. As the work crew proceeded eastbound on the track, a smoldering railroad crosstie ignited a large, fast-moving brush fire. High winds drove the fire and smoke in a southeasterly direction toward Interstate 40 (I-40). The smoke eventually blew across the highway, reducing visibility in all four lanes. Twelve vehicles on the roadway collided, resulting in 7 fatalities, 3 serious injuries, and 13 minor injuries. (See figure 1.)

I-40 is a four-lane rural principal arterial highway, which runs parallel to the rail track and is located 7/10 mile to the south. An 80-foot-wide grassy median separates the two eastbound and two westbound lanes of I-40; the posted speed limit is 75 mph. According to witnesses and drivers on I-40, the density of the smoke varied along the highway. An eastbound 1999 Jeep sport utility vehicle and a 1989 U-haul straight truck towing a passenger car drove into the smoke near milepost (MP) 290.7, where—according to one driver—both vehicles slowed because of reduced visibility. A 1999 Kenworth truck tractor-semitrailer, owned by Kurtz Trucking Ltd. (Kurtz), and traveling behind the slower moving U-haul truck and Jeep, entered the area of thickened smoke and collided with both vehicles. The Kurtz truck then stopped in the right lane, partially blocking the left lane. The ensuing fire engulfed all three vehicles. NTSB/HAB-05/01

2 (not to scale) 1 2 3 4 6 8 5 9 7 10 12 Key: 1. 1999 Jeep

1. 1989 U-Haul straight truck towing car
2. 1999 Kenworth truck tractor-semitrailer (Kurtz)
3. 1992 GMC pickup truck
4. 2001 GMC van
5. 1999 Buick sedan
6. 1999 International straight truck (Atlanta Peach)
7. 2001 Freightliner truck tractor-semitrailer (U.S. Express)
8. 1988 Plymouth van
9. 1994 motor home towing 1990 Suzuki
10. 1999 International truck tractor-semitrailer (Zimmerman)
11. 1989 Blue Bird school bus

11 Median

Figure 1. Accident scene eastbound.

Subsequent collisions occurred as other eastbound vehicles entered the smoke and struck the wreckage. The additional vehicles included a 1992 General Motors Corporation (GMC) pickup truck; a 2001 GMC van; a 1999 Buick sedan; a 1999 International straight truck, owned by Atlanta Peach Movers; a 2001 Freightliner truck tractor-semitrailer, owned by U.S. Express; a 1988 Plymouth van; a 1994 motor home and a 1990 Suzuki (towed); a 1999 International truck tractor-semitrailer, owned by Zimmerman Truck Lines; and a 1989 Blue Bird Corporation school bus, operated by the Logan Municipal School District, New Mexico. Rail Replacement Operations The UP work crew, consisting of 108 workers, was replacing the rails over several miles of track, an operation that was scheduled to take more than a week. The process involved using 63 rail relay-type machines to remove old rail and replace it with new continuous-welded rail. Additionally, several support trucks, water trucks, and fire extinguishers equipped with both foam retardant and water were present. The rail replacement operation involved removing the track and rail; buffing the old tie for a smoother tie plate placement; placing the new rail; heating the rail, cutting excess rail, and welding; grinding the welded area; anchoring and spiking the rail; tamping the track; and establishing the correct rail geometry. NTSB/HAB-05/01

3 The UP foreman said that the crew took the routine precaution of having fire extinguishers at the ready when performing the grinding and welding operations, which normally produce sparks. The work crew members reported that during the morning hours, they extingushed several small fires that consumed brush and rail ties. Meteorology On March 8, the National Weather Service issued a weather advisory indicating that high winds were expected throughout the day and into the evening hours. Wind speeds of 25 to 35 mph were predicted, and wind gusts of up to 50 mph were also forecast. Witnesses described wind conditions as ranging from “mild” to “very strong,” and all witnesses agreed that the wind was very strong by noon. Although they could not estimate wind speed, some witnesses stated that they had to take precautions to avoid being blown off their feet. Management Oversight On the morning of the accident, the UP work foreman held a routine crew meeting before starting work. According to the foreman, the meeting focused on safety-related issues, rules of the day, and special circumstances. The foreman described the morning as “breezy,” but indicated that he did not mention the windy conditions during the meeting.

UP management stated that all members of rail work crews receive UP pamphlets annually. The pamphlets provide general fire suppression information, including the classes of various fires and techniques for spraying water or chemicals at the base of a fire. UP officials stated that this particular work crew was equipped with shovels for firefighting and with various sources of water, but that they were not trained to fight large brush fires.

At the time of the accident, UP had no formal risk assessment policy that addressed all fire-related issues affecting the rail replacement operation. UP representatives indicated that they rely on the crew foreman to make decisions regarding fire hazards on the job site. According to UP management, at the time of the accident, the company restricted rail-grinding procedures in windy conditions but had no written policy to this effect. On August 1, 2003—about 15 months after the Cuervo accident—the UP Engineering Department issued a “Fire Prevention Plan” to prevent loss of life, property, and natural resources and “to prevent disruption of train operations as the result of fires caused by the work activities of Union Pacific’s engineering employees.” The plan contains guidelines for job briefings and fire control measures, including specific instructions for welding, grinding, and cutting operations. NTSB/HAB-05/01

4 Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the work crew foreman’s failure to consider the effects of high winds on the open- flame rail replacement activity. Contributing to the accident was the lack of specific guidance for the work crew on the fire hazards of welding, grinding, or cutting operations. The failure of the motorists to slow their vehicles sufficiently as they entered the area of reduced visibility contributed to the severity of the accident. Adopted: March 7, 2005

NTSB/HAB-05/01

FD07258 ｜ 2002_美国_NTSB_HZM0402_Rupture_of_a_Railroad_Tank_Car_Containing_Hazardous_Waste.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2002 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Rupture of a Railroad Tank Car Containing Hazardous Waste Freeport, Texas September 13, 2002 Hazardous Materials Accident Report NTSB/HZM-04/02 PB2004-917003 Notation 7661 National Transportation Safety Board Washington, D.C.

this page intentionally left blank

Hazardous Materials Accident Report Rupture of a Railroad Tank Car Containing Hazardous Waste Freeport, Texas September 13, 2002 NTSB/HZM-04/02 PB2004-917003 National Transportation Safety Board Notation 7661 490 L’Enfant Plaza, S.W. Adopted December 1, 2004 Washington, D.C. 20594

National Transportation Safety Board. 2004. Rupture of a Railroad Tank Car Containing Hazardous Waste, Freeport, Texas, September 13, 2002. Hazardous Materials Accident Report NTSB/HZM-04/

1. Washington, DC.

Abstract: About 9:30 a.m. central daylight time on September 13, 2002, a 24,000-gallon-capacity railroad tank car, DBCX 9804, containing about 6,500 gallons of hazardous waste, catastrophically ruptured at a transfer station at the BASF Corporation chemical facility in Freeport, Texas. The tank car had been steam- heated to permit the transfer of the waste to a highway cargo tank for subsequent disposal. The waste was a combination of cyclohexanone oxime, water, and cyclohexanone. As a result of the accident, 28 people received minor injuries, and residents living within 1 mile of the accident site had to shelter in place for 5 1/2 hours. The tank car, highway cargo tank, and transfer station were destroyed. Two storage tanks near the transfer station were damaged; they released about 660 gallons of the hazardous material oleum. The National Transportation Safety Board identified one major safety issue, the adequacy of procedures for heating hazardous materials cargoes in railroad tank cars before transfer. As a result of its investigation of this accident, the Safety Board makes safety recommendations to the Research and Special Programs Administration, the Occupational Safety and Health Administration, and the Environmental Protection Agency. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2004-917003 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Hazardous Materials Accident Report Contents Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iv Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Events Preceding the Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Tank Car Rupture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Railroad Tank Car Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Hazardous Materials Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 BASF Oxime Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Postaccident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Preaccident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 BASF Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Company and Facility Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Procedures for Heating and Unloading Hazardous Materials at Freeport . . . . . . . . . . 15 BASF Postaccident Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Rupture of DBCX 9804 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Overpressure Condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Procedures Used in Steam-Heating DBCX 9804 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 MFR Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 BASF Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Heating Hazardous Materials in Railroad Tank Cars . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Appendix A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 B: Summary of Significant Events Preceding the Freeport Accident . . . . . . . . . . . . . . . 30

iv Hazardous Materials Accident Report Executive Summary About 9:30 a.m. central daylight time on September 13, 2002, a 24,000-gallon-capacity railroad tank car, DBCX 9804, containing about 6,500 gallons of hazardous waste, catastrophically ruptured at a transfer station at the BASF Corporation chemical facility in Freeport, Texas. The tank car had been steam-heated to permit the transfer of the waste to a highway cargo tank for subsequent disposal. The waste was a combination of cyclohexanone oxime, water, and cyclohexanone. As a result of the accident, 28 people received minor injuries, and residents living within 1 mile of the accident site had to shelter in place for 5 1/2 hours. The tank car, highway cargo tank, and transfer station were destroyed. The force of the explosion propelled a 300-pound tank car dome housing about 1/3 mile away from the tank car. Two storage tanks near the transfer station were damaged; they released about 660 gallons of the hazardous material oleum (fuming sulfuric acid and sulfur trioxide). The National Transportation Safety Board determines that the probable cause of the rupture of railroad tank car DBCX 9804 was overpressurization resulting from a runaway exothermic decomposition reaction initiated by excessive heating of a hazardous waste material. Contributing to the accident was the BASF Corporation’s failure to monitor the temperature and pressure inside the tank car during the heating of the hazardous waste. The Safety Board identified the following safety issue during this investigation: • Adequacy of procedures for heating hazardous materials cargoes in railroad tank cars before transfer. As a result of its investigation, the Safety Board makes safety recommendations to the Research and Special Programs Administration, the Occupational Safety and Health Administration, and the Environmental Protection Agency.

1 Hazardous Materials Accident Report Factual Information The Accident Synopsis About 9:30 a.m. central daylight time1 on September 13, 2002, a 24,000-gallon-capacity railroad tank car, DBCX 9804, containing about 52,450 pounds (6,500 gallons)2 of hazardous waste, catastrophically ruptured at the BASF Corporation (BASF) chemical facility in Freeport, Texas. The tank car had been undergoing steam-heating to permit the transfer of the waste to a highway cargo tank for subsequent disposal. The waste was a combination of cyclohexanone oxime, water, and cyclohexanone. The railroad tank car, the highway cargo tank, and the transfer station were destroyed. (See figure 1 for a postaccident photo of the transfer area.) Two nearby storage tanks containing oleum (fuming sulfuric acid and sulfur trioxide) were damaged and released about 10,650 pounds (660 gallons)3 of material. Twenty-eight people received minor injuries, and residents living within 1 mile of the accident site had to shelter in place for 5 1/2 hours. Events Preceding the Accident4 Generation and Initial Storage of the Waste in Freeport. On June 1, 2001, a process upset5 occurred at the caprolactam II6 process of the BASF facility in Freeport. On June 5, 2001, as a result of the upset, about 90,875 pounds (11,261 gallons) of material, consisting of about 94 percent cyclohexanone oxime, 4 percent water,7 and 2 percent cyclohexanone, was temporarily transferred to four highway cargo tanks. On June 11, 2001, the material was to be transferred to railroad tank car DBCX 9804, but it had solidified within the highway cargo tanks. (The material would solidify at temperatures below 194° F.) BASF applied steam heat from a facility boiler to the four highway cargo tanks to liquefy the material for transfer. On June 12, 2001, BASF transferred the contents of the four highway cargo tanks to tank car DBCX 9804. 1 Unless otherwise specified, the times used in this report are central daylight time. 2 According to the BASF Corporation, the density of the waste material was about 8.07 pounds per gallon. 3 The density of oleum is about 16.14 pounds per gallon. 4 See appendix B for a summary chronology of significant events preceding the accident. 5 A process is a facility area where hazardous materials are used, stored, manufactured, or handled. A process upset is a condition outside of routine operating parameters in chemical manufacturing. 6 Caprolactam is used in the production of nylon. There are two caprolactam processes at the Freeport facility, known as caprolactam I and caprolactam II. 7 Because cyclohexanone oxime is produced in water within the process, some water accompanies it.

Factual Information 2 Hazardous Materials Accident Report Sometime between June 12, 2001, and April 26, 2002, BASF applied steam heat to the tank car to liquefy the waste mixture so water could be removed and disposed of on-site.8 BASF was unable to provide information on how many times the tank car was heated, the specific dates of the heating, the pressures at which the steam heat was applied, or the amount of water removed. According to BASF, no additional materials were added to the tank car during this period. On February 12, 2002, a BASF contractor took samples of the material in DBCX 9804. The samples were sent to several waste disposal companies, which provided BASF with disposal cost estimates. BASF subsequently contracted with Missouri Fuel Recycling Environmental Services (MFR) in Hannibal, Missouri, to dispose of the hazardous waste. (MFR conducted tests on its sample, which determined the material’s heating value [13,600 British thermal units per pound] and the fact that it contained no metals.) On or about April 2, 2002 (exact date unknown), BASF removed about 90,875 pounds (11,261 gallons) of waste material, consisting of about 94 percent cyclohexanone oxime, 4 percent water, and 2 percent cyclohexanone, from a second Figure 1. Damage to transfer area caused by catastrophic rupture of tank car DBCX 9804. 8 Environmental regulations allow facilities to dispose of some types of waste materials, such as the water from DBCX 9804, on-site. Location of DBCX-9804

Factual Information 3 Hazardous Materials Accident Report process upset of the caprolactam II process and loaded it into four highway cargo tanks. According to BASF, the second batch of material had essentially the same chemical composition as the material from the June 1, 2001, process upset. On April 26, April 29, and May 10, 2002, BASF transferred the second batch of material from the highway cargo tanks to DBCX 9804, which still contained the material from the June 1, 2001, caprolactam II process upset. According to BASF, after the second batch of material was added to DBCX 9804, nothing more was added to or removed from the tank car while it remained at the Freeport facility. On June 21, 2002, BASF released railroad tank car DBCX 9804, containing the material from both process upsets, to the Union Pacific Railroad for transportation to MFR in Hannibal, where the waste was to be unloaded and incinerated. According to BASF, when the tank car departed Freeport, it contained about 181,750 pounds (22,522 gallons) of the waste material. Heating and Unloading the Waste in Hannibal. On the morning of July 7, 2002, tank car DBCX 9804 arrived at the Continental Cement facility in Hannibal. MFR, a division of the Continental Cement Company, procures hazardous wastes as supplemental fuels for the cement production process at the facility. Each year, MFR unloads about 350 railroad tank car loads of such waste at Continental’s Hannibal plant. MFR had never before heated or unloaded the waste material contained in DBCX 9804. On July 8, MFR began preparing DBCX 9804 for unloading by moving the tank car to a boiler station, where the waste material within the tank car was to be heated to liquefy it. An MFR liquid fuel supervisor who oversaw most of the unloading stated that when the tank car arrived at the boiler station, he looked through a 6-inch-diameter access opening in one of the two dome housings on the top of the tank car. The liquid fuel supervisor said he saw a white, solid material in the tank car. He attempted to take a sample using a 7-foot-long sampling tube but was unable to do so because the material was too hard. He said the material’s hardness was comparable to steel. The liquid fuel supervisor decided to try to take a sample from a different location. After inserting the sampling tube through a 3-inch-diameter eduction (liquid or product) line valve, the liquid fuel supervisor extracted a sample through the eduction line, which extended almost to the bottom of the tank car. The liquid fuel supervisor described the sample material extracted as “flaky, gooey, very thick, black, and the consistency of oatmeal.” On the morning of July 9, MFR began to steam-heat DBCX 9804 using a natural gas boiler to generate steam. The steam was applied to the tank car at a pressure of 115 pounds per square inch, gauge (psig). MFR inserted a pressure/temperature gauge (attached to a 4-foot probe) into the 3-inch valve opening on top of the tank car. The gauge was connected to an automatic shutdown mechanism on the boiler that would stop the heating if the pressure within the tank car exceeded 15 psig. MFR employees documented heating, unloading, and other daily activities in an operations logbook. According to the logbook, at 9:00 a.m. on July 9, the temperature of

Factual Information 4 Hazardous Materials Accident Report the material in the tank car was 107° F. At 2:00 p.m., the temperature was 119° F and the pressure within the tank car was 3.5 psig. The heating continued until the boiler was shut off at 9:30 p.m. on July 9.9 According to the logbook, when the boiler was shut off, the temperature of the material was 131° F and the pressure within the tank car was 0.3 psig. At 5:00 a.m. on July 10, MFR restarted the boiler and resumed the heating process. According to logbook notes, at 9:00 a.m., the temperature of the material was 146° F, and the material was “still chunky.” At 12:00 p.m., the temperature of the material was 150° F. At 1:00 p.m., the liquid fuel supervisor, finding that the 4-foot probe attached to the gauging device did not extend to the bottom of the tank car and so was not providing an accurate reading of the material’s overall temperature, temporarily removed the probe and replaced it with a 10-foot metal rod. The liquid fuel supervisor stated that, after leaving the rod in place for about 5 minutes, the rod’s temperature was 129° F (21° F lower than the most recent reading obtained using the 4-foot probe attached to the gauging device). When the liquid fuel supervisor removed the rod, he could see the material was less viscous, but he also noted that the material hardened very quickly when exposed to the ambient temperature. The pressure/temperature gauge was reinserted into the tank car, and the heating continued until 11:00 p.m. on July 10, when the heating was discontinued for the night. At this time, the temperature of the material was 195° F. At 5:00 a.m. on July 11, the temperature of the material in the tank car was 215° F.10 The liquid fuel supervisor visually checked the material’s viscosity and determined that the material could be unloaded. MFR moved the tank car to a transfer station about 200 yards from the boiler station. When the tank car arrived at the transfer station, MFR employees used a vacuum truck to prime the pump to start the flow of product from the tank car to a highway cargo tank. The transfer continued until the highway cargo tank was full, at which time it was weighed. The highway cargo tank contained about 57,840 pounds (7,167 gallons) of waste material. The highway cargo tank was moved to another area where its contents were unloaded into a storage tank; then it was returned to the transfer station, and the transfer of material from the tank car resumed. The liquid fuel supervisor stated that while material was being unloaded from the tank car to the highway cargo tank for the second time, the pump began to “suck air,” which indicated to him that all the material that could be pumped from the tank car had been removed. The vacuum truck was used to suck out any additional material in the transfer hoses. Then, the pump was turned off, the hoses were disconnected, and the transfer process was terminated. The highway cargo tank and the vacuum truck were driven to the storage tank area, where they were weighed, and the waste was transferred to the storage tank. The second 9 MFR did not operate a third shift at the Hannibal facility, so the boiler was shut down overnight, when no employees were on duty. 10 In an insulated tank car, the temperature of heated material can continue to rise even after heating has been discontinued.

Factual Information 5 Hazardous Materials Accident Report load in the highway cargo tank contained about 36,540 pounds (4,528 gallons) of waste, and the vacuum truck contained about 6,220 pounds (771 gallons) of waste. According to the load receipt, MFR unloaded 100,600 pounds (12,466 gallons) of material from DBCX 9804. The unloading procedure was completed about 4:00 p.m. on July 11. According to the secondary liquid fuel supervisor, shortly after 4:00 p.m., he closed all the valves and access ways on DBCX 9804 and applied new security seals to the tank car’s two dome housings.11 DBCX 9804 left Hannibal on July 12. While traveling from Hannibal to Freeport, DBCX 9804 encountered no unusual delays or routing. When BASF sent tank car DBCX 9804 to MFR for unloading, it had provided MFR a State of Missouri hazardous waste manifest for the shipment. The manifest from BASF did not record the total quantity of material sent in the tank car. When MFR returned the manifest to BASF, it was signed by an MFR secondary liquid fuel supervisor and dated July 11, 2002. The manifest returned from MFR stated that 91,013 pounds (11,278 gallons) of material had been in the tank car when MFR received it. Neither the primary nor secondary liquid fuel supervisor, nor any other MFR employee, could tell investigators how MFR had derived the figure for total quantity received from BASF that appeared on the manifest. The manifest also stated that MFR had unloaded 90,973 pounds (11,273 gallons) of material at Hannibal. Heating and Unloading the Waste in Freeport. Tank car DBCX 9804 arrived at the BASF Freeport facility on July 22. Facility personnel conducted a routine inspection of the tank car and found no security seals on the dome housings or anywhere else on the tank car. Aside from the missing seals, they found no indications of tampering with the tank car or its contents. Also as part of the inspection, they removed the 6-inch access plate and examined the interior of the tank car. A BASF contract employee who looked into the tank car observed that it was still about one-third full of material. BASF accepted the tank car. BASF did not contact MFR concerning the material remaining in the tank car or the absence of security seals. Facility personnel determined that the tank car could not be cleaned (in the typical manner) because it contained too much material. They decided to transfer the material remaining in DBCX 9804 to highway cargo tanks for disposal. Between July 22 and September 11, no action was taken to unload the tank car. At some time during this interval, a BASF employee and a Mundy Industrial Services (Mundy)12 employee looked into the tank car through the 6-inch access opening and found that the tank car was about one-third full of material. Both employees stated that they saw liquid in the tank. On September 11, DBCX 9804 was moved to the caprolactam II process area so it could be prepared for heating and unloading. A 7,000-gallon-capacity highway cargo tank was brought to serve as a receiving vehicle for the waste. The highway cargo tank was already about half full of a similar waste material. 11 There is no Federal requirement that security seals be attached; generally, companies establish their own practices with respect to security seals. MFR practice was to attach security seals to all outgoing tank cars, even those MFR believed were empty. 12 The contractor Mundy Industrial Services of Houston, Texas, provides chemical loaders, a track repair crew, clerical support for truck shipments, and security inspections for BASF.

Factual Information 6 Hazardous Materials Accident Report In the afternoon of September 11, two Mundy employees⎯a primary unloader and a secondary unloader⎯connected the heating and unloading hoses to the railroad tank car. They threaded one end of a 3-inch-diameter hose into the 3-inch eduction line valve on top of the tank car; they inserted the other (open) end of the hose into the manway opening on the top of the highway cargo tank. They connected a second hose from a facility nitrogen supply to a 2-inch-diameter vapor line valve13 on top of the tank car. The nitrogen was available to provide additional pressure to the tank car, if needed, to assist in unloading the waste. The nitrogen was not turned on; the eduction and vapor line valves on the tank car were not opened. Unloaders ran a steam hose between a facility boiler and the inlet for the tank car’s heating coil. They placed no pressure or temperature gauges in the tank car to monitor the interior conditions, nor did they employ any automatic shutdown mechanism. Later in the afternoon of September 11, steam was applied to the tank car at 60 psig. After about 1 hour of heating, facility personnel decided to adjust the car’s position. They disconnected the unloading and heating lines, repositioned the tank car, and reconnected the unloading and heating lines. They did not resume heating the tank that day. (See figure 2 for a diagram showing the layout of the Freeport transfer area.) 13 A vapor line valve opens to the vapor space within the tank car. Figure 2. Schematic drawing of Freeport facility transfer area showing the highway cargo tank, railroad tank car DBCX 9804, unloading hose, and oleum tanks. OLEUM OLEUM UNLOADING STRUCTURE DBCX-9804 Hose Road Road N Highway Cargo Tank

Factual Information 7 Hazardous Materials Accident Report On September 12, about 7:00 a.m., unloaders again applied 60-psig steam to the tank car. The steam-heating continued until 12:00 p.m., when a transfer was attempted. The material did not transfer. All transfer hose connections were left in place. The primary unloader told a BASF operations coordinator that the product was too thick to unload and suggested continuing the application of steam heat until the next morning. The operations coordinator agreed. According to the primary unloader, about 2:00 p.m., a steam trap14 was added to the tank car’s outlet coil, and the steam pressure was reduced to about 20 psig. The heating of the tank car continued uninterrupted for 17 hours, until 7:00 a.m. the following morning. No one monitored the temperature of the material or the pressure within the tank car during the overnight heating, although workers were in the area through the night. On September 13, about 7:00 a.m., the primary unloader stopped heating the tank car. He was able to transfer product from the tank car to the highway cargo tank at this time. About 7 minutes after the transfer began, the primary unloader saw a splash from the highway cargo tank’s manway opening, indicating that the level of the material in the highway cargo tank had reached the transfer hose. The transfer was stopped, and the 3-inch valve on top of the tank car was closed. The BASF operations coordinator climbed on top of the highway cargo tank, looked in its manway opening, and decided that the highway cargo tank was full. Tank Car Rupture About 7:45 a.m., the primary unloader and a secondary unloader (who had been present during the unloading) left the area to do other tasks. About 8:40 a.m., the secondary unloader returned to the unloading area. He noticed that the tank car’s pressure relief valve had opened and then reset itself. He called the primary unloader and asked what should be done. The primary unloader said the tank car just needed to vent and that it should be left alone. According to the secondary unloader, the pressure relief valve opened and reset one or two more times. The first time, the valve opened for 3 or 4 minutes and then closed for about 5 minutes. The following time(s), the valve closed for several minutes between openings. Numerous workers noticed an ammonia smell coming from the car. About 9:00 a.m., the tank car’s pressure relief valve began to continuously vent white vapor. (The continuous venting persisted until the tank rupture occurred.) Facility personnel called the Dow Chemicals fire department for assistance.15 Witnesses reported hearing a high-pitched whistle sound coming from the relief valve around this time. BASF activated a “seek shelter” horn in an adjacent process. 14 A steam trap recirculates the steam within the heating coils while allowing the condensate to flow out of the coils. A steam trap increases the efficiency of the steam-heating process. 15 A Dow Chemicals facility is adjacent to the BASF facility in Freeport. BASF had contracted with the Dow facility for Dow to provide BASF some limited emergency services.

Factual Information 8 Hazardous Materials Accident Report At 9:05 a.m., BASF personnel began to apply water to the tank car to knock down the venting vapors and to cool the tank car. At 9:10 a.m., evacuation horns within the caprolactam II process sounded, and all nonessential employees were ordered to evacuate the area. At 9:15 a.m., Dow Chemicals fire department personnel arrived and began applying water to the tank car using their fire truck. At 9:25 a.m., unmanned fire hoses were positioned to apply water to the tank car while on-scene personnel moved away from the area to discuss further actions. About 9:30 a.m., while water was being applied, the tank car catastrophically ruptured. Emergency Response Eleven emergency response agencies responded to the accident, including local fire departments, law enforcement agencies, emergency medical services organizations, a public safety agency, and an emergency management department. After the accident, residents living within 1 mile of the accident site were ordered to shelter in place. About 5 1/2 hours later, the shelter-in-place order was lifted. The area immediately surrounding the accident site (including several facility processes) at the BASF facility remained evacuated, except for essential emergency responders, for about 10 days after the accident due to a continuing leak of the hazardous material oleum from damaged storage tanks and the danger from structural damage to the transfer station. Injuries No fatalities were caused by the accident. According to a BASF nurse from the Freeport facility, 28 people reported minor injuries and all these individuals were treated and released from medical supervision. Damage Tank car DBCX 9804 split longitudinally near its top. The split ran the length of the tank car. Two circumferential tears on opposite sides of the car ran from the area where the dome housings had been to about halfway down the sides of the tank car. The tank’s fracture surfaces were consistent with overstress fracturing. The sides of the tank car had unfolded into a flattened position. (See figure 3.) The pressure relief valve was not found. One dome housing (without the cover) that contained the valves and fittings was found on the adjacent Dow Chemicals facility property about 1/3 mile south of the accident site. The second dome housing (containing the 6-inch access opening) was not found. Both tank car heads were separated from the tank car shell. The B-end head was found about 25 feet west of the flattened tank car, and the A-end head was found about 125 feet to the east.

Factual Information 9 Hazardous Materials Accident Report The transfer station where DBCX 9804 had been, the highway cargo tank that had been receiving the waste, and a second tank car in the vicinity were destroyed. The station structure east and west of the blast site was severely damaged. Two storage tanks containing oleum immediately to the north/northwest of the accident scene were damaged by flying debris, leading to the oleum release. Railroad Tank Car Information DBCX 9804 was a U.S. Department of Transportation (DOT) specification 111A100W6 railroad tank car manufactured by Trinity Industries in June 1998. The tank car was manufactured for BASF and was intended to transport acrylic acid. (DBCX 9804 had transported 26 shipments of acrylic acid before it began to be used to store waste. The last shipment of acrylic acid made in DBCX 9804 took place on May 10, 2001.) The tank car’s capacity was 23,589 gallons. DBCX 9804 was a jacketed, stainless steel, general-purpose tank car equipped with exterior heating coils. The tank was manufactured of 7/16-inch ASTM A240-type 316L stainless steel. The tank car had glass wool and ceramic fiber blanket insulation covered by a steel jacket. (See figure 4 to view a comparable tank car.) Figure 3. Postaccident photo showing a Safety Board investigator standing on flattened portion of railroad tank car DBCX 9804.

Factual Information 10 Hazardous Materials Accident Report According to postaccident estimates calculated by Trinity Industries, the burst pressure of DBCX 9804 was about 595 psig. When the tank car was manufactured, its tank and pressure relief valve were pressure-tested to 100 psig and 75 psig, respectively. The valves, gauging devices, and tank access points were inside the two dome cover housings on the top of the tank car. (See figure 5.) One housing contained a 20-inch-diameter cover assembly. A 6-inch-diameter access plate was secured to the top of the 20-inch cover assembly. The opening through the 6-inch flange extended through the 20-inch cover assembly, which allowed for visual inspection of the tank interior through the 6-inch access plate opening. Figure 4. Undamaged tank car comparable to DBCX 9804.

Factual Information 11 Hazardous Materials Accident Report Product transfer took place by way of the valves and fittings located within the second dome cover housing. (See figure 6.) The second dome housing contained the eduction line valve, which was used for loading and unloading the tank car. A 3-inch-diameter eduction line extended from the eduction valve to near the bottom of the tank car. The dome housing also contained the 2-inch-diameter vapor line valve, which could be used to pressurize the tank car with nitrogen. Figure 5. Photo showing interiors of two dome housings of tank car comparable to DBCX 9804. Housing to the right contains 6-inch access opening and 20-inch access opening.

Factual Information 12 Hazardous Materials Accident Report The pressure relief valve was mounted on top of the tank car, outside of the dome cover housings. The pressure relief valve, a Midland Manufacturing model A-1779-P-MO-CZ, had a set pressure of 75 psig and a flow rating of 1,340 standard feet per minute, air, at 75 psig. During postaccident examination of the tank car, investigators found no indications of corrosion or unusual wear. Since the tank car’s manufacture, only its brakes had undergone repairs. No repairs to the tank or its attachments were recorded. DBCX 9804 had last been cleaned on June 9, 2001. The cleaning consisted of water-rinsing the tank for 4 1/2 hours and then removing the water by vacuum. Hazardous Materials Information The waste material in DBCX 9804 was a combination of cyclohexanone oxime (oxime),16 water, and cyclohexanone. The majority of the waste material (94 percent) was Figure 6. Housing of second dome on tank car comparable to DBCX 9804. 16 BASF typically referred to this material as “oxime,” so from this point onward, this report will generally use this term to refer to cyclohexanone oxime.

Factual Information 13 Hazardous Materials Accident Report oxime, which is a white, solid material under normal atmospheric conditions at temperatures below 194° F. When solid, oxime is not classified as a hazardous material by the DOT but, when liquid, oxime is flammable. The material safety data sheet for oxime produced by BASF in 1994 describes the material as stable under normal temperatures and pressures but states that temperatures above 212° F should be avoided. About 4 percent of the waste material was water. About 2 percent of the waste material was cyclohexanone, which is a flammable liquid with a flashpoint of 111° F. Its flammable limits are 1.1 percent to 8.1 percent in air. The BASF material safety data sheet for cyclohexanone describes the material as stable. Oxime and cyclohexanone are maintained between 180° F and 204° F within the caprolactam production process. The process operates at atmospheric pressure. BASF Oxime Testing Postaccident BASF’s postaccident analysis of the material from the tank car showed that its chemical constituents were consistent with the oxime waste material from the Freeport process upsets. BASF found no additional constituents in the material. Because the events preceding the accident (the heating of the tank car and the continuous venting of the tank car’s pressure relief valve) suggested that overpressurization from a chemical reaction might have brought about the accident, BASF conducted postaccident Automatic Pressure Tracking Adiabatic Calorimeter tests on residual oxime material from the accident scene to determine why the tank car ruptured.17 For comparison purposes, BASF ran the same tests on pure oxime from several different sources. The tests measured changes in the oxime’s temperature and pressure as it was heated. The BASF test results showed that untempered oxime had a significantly higher onset temperature18 and a longer induction time19 than tempered20 oxime. In effect, BASF found that tempering oxime reduced its stability. 17 A Safety Board chemist reviewed the testing methodology and parameters used by BASF during its postaccident testing and found them reasonable and appropriate. 18 The onset temperature is the lowest temperature at which exothermic (heat-releasing) behavior is exhibited. 19 The induction time is the time required, at a given temperature above the onset temperature, for the decomposition reaction to accelerate to an uncontrolled runaway condition. 20 Oxime is tempered by putting it through cycles of heating and cooling.

Factual Information 14 Hazardous Materials Accident Report BASF tested one sample of untempered oxime obtained from a common chemical supplier. Water was added to bring the percentage of water in the sample to 4.5 percent. When the sample was heated,21 exothermic reactions were first observed at 338° F, about 590 minutes into the experiment. A second spike in exothermic reactions was recorded after 895 minutes. BASF also tested a sample of tempered oxime material (containing about 2.8 percent water) recovered from the highway cargo tank at the accident scene. When heated, the sample first showed exothermic reaction at 282° F, about 503 minutes into the experiment. More exothermic activity was recorded after about 665 minutes. To confirm the lower onset temperature for tempered oxime, BASF conducted a further test. BASF took a sample of oxime22 from the caprolactam process at the Freeport facility, tempered the material at 230° F for 840 minutes, and then allowed it to cool. When this sample was heated as the previous two samples had been, BASF recorded two episodes of exothermic activity–the first at 258° F and the second starting at 381° F. On the basis of its testing, BASF determined that the following reactions occurred when oxime was heated: 1) Cyclohexanone Oxime + Heat + H2O -----→ Cyclohexanone + NH2OH (hydroxylamine). Then, 2) 4NH2OH + Heat -----→ N2O (nitrous oxide gas) + 2NH3 (ammonia gas) + 3H2O. BASF further determined that the second reaction is essentially irreversible because two of the products of the reaction are gases and a state of equilibrium is never attained. BASF found that once the first reaction started, both reactions would continue until the reactants were consumed. BASF also conducted five analyses of the gases that evolved during the heating of the oxime. The results of all five tests showed the presence of ammonia and nitrous oxide. Preaccident From 1989 to 1991, the BASF parent plant in Ludwigshafen, Germany, conducted analytical tests of oxime. The data generated by the tests included information concerning onset temperature and induction time. The data showed that the onset temperatures for oxime ranged from 248° F to 338° F. The induction times for oxime ranged from 480 minutes at 311° F to 1,320 minutes at 275° F. Data from the tests were discussed at a 21 In the postaccident testing BASF conducted to determine when exothermic reactions would occur for the various oxime samples, the samples were initially heated to 212º F, the maximum safe temperature for oxime, before the test heating process was begun. 22 The sample was about 4.5 percent water.

Factual Information 15 Hazardous Materials Accident Report 1991 BASF caprolactam technology exchange meeting in Belgium, which personnel from the Freeport facility attended. Some of the data appeared in an appendix of the BASF Technical Exchange Packet for 1991, which was distributed at the meeting. The stated goal of the appendix was to “prevent an out of control reaction resulting in emissions of anone, hydroxylamine and/or oxime.” The appendix stated, “To avoid uncontrolled rearrangement, temperature in oxime tank should not exceed 194° F. Proper attention is given to the explosion limits of oxime in air.” BASF Information Company and Facility Information The BASF Group comprises a parent plant in Ludwigshafen and 164 wholly owned subsidiaries. The BASF Group has production facilities in 38 countries and manufactures a wide range of products, including chemicals, polymers, automotive and industrial coatings, colorants, vitamins, nylon fibers, and agricultural products. The BASF Corporation is the North American affiliate of the BASF Group. More than 700 employees and 350 contractors work at the 406-acre Freeport BASF facility. The facility produces 23 different products in 16 processes. Raw materials arrive at the facility by rail, highway, barge, and pipeline. Intermediate chemicals produced at the facility are shipped out by rail, highway, and barge. Procedures for Heating and Unloading Hazardous Materials at Freeport According to BASF officials, the Freeport facility had no written procedures for heating and unloading the specific waste material contained in tank car DBCX 9804. The oxime mixture is an intermediate material in the production process for caprolactam, and it is not typically removed from the process or shipped for disposal from the Freeport facility. Consequently, the Freeport unloaders did not routinely handle this material. According to BASF, the last shipment of oxime from Freeport had taken place more than 10 years before the accident, and the material had never before been shipped from the facility in a railroad tank car. The BASF Freeport facility had general operating procedures for transferring material from a highway cargo tank to a railroad tank car and for using pressure to transfer material from a tank car to a plant receiving tank. The facility also provided product-specific unloading and heating procedures for the two materials that are routinely steam-heated in tank cars at the Freeport facility⎯caprolactam and formaldehyde. Of the written procedures provided by the BASF Freeport facility, only the general operating procedure for transferring material from a tank car to a receiving tank required that the material be sampled and tested by lab personnel before the transfer could begin. Only the product-specific procedures for steam-heating formaldehyde required that the pressure within the tank car be monitored during the steam-heating process. Those

Factual Information 16 Hazardous Materials Accident Report procedures specified that the pressure within the tank car be checked every 30 minutes. Neither the procedures for steam-heating formaldehyde nor those for steam-heating caprolactam specified the pressure or temperature of the steam to be applied. The Freeport facility did not provide the unloaders with additional or specific procedures for unloading DBCX 9804. BASF Postaccident Actions Since the accident, the BASF Freeport facility has made several changes to its facility procedures. It has developed and implemented written procedures specifically addressing the safe handling of oxime waste material. The procedures prohibit the transfer of oxime waste to railroad tank cars and the heating of closed containers of oxime. The Freeport facility now requires that hot water, rather than steam, be used to heat oxime waste. Additionally, BASF changed its material safety data sheet for oxime to specify that the material must not be heated above 212° F.

17 Hazardous Materials Accident Report Analysis This analysis has three main sections. First, it identifies factors that can be readily excluded as causal or contributory to the accident. Next, the analysis addresses the accident and its possible causes. The remainder of the analysis discusses the following safety issue arising from this investigation: • Adequacy of procedures for heating hazardous materials cargoes in railroad tank cars before transfer. Exclusions Before the Freeport accident, railroad tank car DBCX 9804 had not been in any accidents, and the past repairs to this tank car involved only its brakes. Postaccident examination of the tank car showed no evidence of corrosion or other signs of deterioration. Postaccident evaluation of the tank car’s fracture surfaces indicated that they were consistent with overstress failure. Therefore, the Safety Board concludes that railroad tank car DBCX 9804 had no structural or material defects that caused or contributed to the rupture of the tank. The Accident Rupture of DBCX 9804 Although the pressure relief valve for DBCX 9804 was not recovered after the accident, the events described by the witnesses at the scene on September 13, 2002, indicate that the pressure relief valve was functioning and venting vapors up to the time the tank car ruptured. Witnesses recalled that the pressure relief valve opened and reset itself two or three times between about 8:40 a.m. and 9:00 a.m., began to constantly vent about 9:00 a.m., and continued to constantly vent until the rupture occurred about 9:30 a.m. Witnesses also reported hearing a high-pitched whistle around 9:00 a.m. and seeing a stream of white vapor come from the pressure relief valve as it constantly vented. During postaccident inspection of the tank car, investigators found a longitudinal tear along the top of the tank car and circumferential tears near the dome housings. The initial cycling of the pressure relief valve’s opening and closing, followed by its continuous venting up to the time the tank car ruptured, indicates that the gas within the tank car was being produced more rapidly than it could be vented. Further, this activity of the pressure relief valve and the postaccident condition of the tank car—including the flattened and torn tank shell, the damage to the tank heads, and the projection of one dome housing a substantial distance from the tank car—strongly indicate that an overpressure

Analysis 18 Hazardous Materials Accident Report condition developed due to the rapid generation of gas or vapor within the tank from a chemical reaction involving the hazardous waste in the tank car. The DOT hazardous materials regulations (49 CFR, Subchapter C) require that tank car tanks have a pressure relief device with a sufficient flow capacity to prevent pressure in the tank from exceeding a maximum pressure under specified fire conditions. The regulations do not specifically require that pressure relief devices have the flow capacity to relieve pressure generated from a chemical reaction within the tank. Rather, the regulations include requirements that are intended to prevent chemical reactions from occurring. For example, all components of a tank car must be chemically compatible with the chemical cargoes authorized for carriage. Hazardous materials that self-react or are highly reactive must have chemical stabilizers added to prevent these adverse reactions from occurring during transportation. The Safety Board considers that this approach is reasonable, and it has proven to be effective. Therefore, the Safety Board concludes that the pressure relief valve on tank car DBCX 9804 functioned as designed and vented vapors continuously once it activated, but the rapid generation of gas within the tank exceeded the valve’s capacity to relieve the tank’s internal pressure sufficiently to prevent the catastrophic rupture of the tank car. Overpressure Condition The Safety Board considered several possible causes for the overpressurization that led to the tank car’s rupture, including 1) instability of the waste material, 2) introduction of chemically incompatible material to the waste material within the tank, and 3) an adverse reaction resulting from the heating of the waste in the tank car. Instability of the Waste Material. BASF material safety data sheets for oxime and cyclohexanone state that both materials are stable. In addition, the waste had been in the tank car for more than a year—experiencing significant changes in ambient temperatures and humidity—and had arrived at the MFR plant in Hannibal, Missouri, without any reported abnormalities, such as elevated tank pressure or material temperature. Further, the tank car was shipped back from Hannibal to Freeport without incident, and it remained in Freeport without unusual developments for 2 months before the accident. Thus, instability of the material did not appear to be the cause of the overpressurization. Introduction of Incompatible Material. Another possible cause of the overpressurization in the tank was the introduction of a chemically incompatible material, either intentionally or unintentionally, which caused the reaction in the tank that led to the overpressurization. Given that the tank car arrived in Freeport without the security seals that MFR said it had applied in Hannibal, the introduction of an incompatible material during the transport period may have been possible. However, the routing of the tank car from Hannibal to Freeport was traced, and no unusual delays were found. Further, no indications of product tampering were found. The waste mixture was not reactive with steels or metals, and postaccident analysis of the material from the tank car showed that the chemical constituents were

Analysis 19 Hazardous Materials Accident Report consistent with the waste material from the process upsets in Freeport. Therefore, it appears that the overpressurization was not caused by the introduction of incompatible chemical contaminants. Heating the Tank Car. BASF’s postaccident tests of oxime materials showed that heat-tempered oxime like the material in DBCX 9804 has a lower onset temperature than untempered oxime. Consequently, less heat would have been needed to initiate an exothermic (heat-releasing) reaction of the tempered material in DBCX 9804 than would have been necessary for untempered material. Specifically, the tests showed that untempered oxime required heating to about 338° F to show the first signs of exothermic reaction. In contrast, the tempered oxime from the accident scene, as well as another sample of tempered oxime, required heating only to about 282° F to show the first signs of exothermic reaction. Thermodynamic tables show that, for the heating conducted at the BASF facility, 60-psig steam would have had a minimum temperature of 308° F and 20-psig steam a minimum temperature of 260° F. (BASF applied 60-psig steam to the tank for about 1 hour on September 11 and about 7 hours on September 12. BASF applied 20-psig steam to the tank for about 17 hours from September 12 through the early morning of September 13.) According to the results of BASF postaccident testing, given the amount of waste material in DBCX 9804 at the time of the accident and the steam pressures used by BASF to heat the material in Freeport, 23 hours of heating would have been required to raise the temperature of the material in the tank car to 284° F, surpassing the estimated onset temperature of 282° F. In fact, BASF heated the material for about 24 hours on September 12 and 13. The use of the steam trap during the heating would have increased the efficiency of the steam-heating process. Further testing showed that when heated, tempered oxime broke down into cyclohexanone and hydroxylamine. The heat released from this breakdown reaction was sufficient to initiate a second exothermic reaction, the decomposition of hydroxylamine into nitrous oxide and ammonia gases. The generation of ammonia from such a reaction is consistent with the witness reports of ammonia odors as DBCX 9804 vented before the accident. Therefore, the steam heat that BASF applied to DBCX 9804 in the hours preceding the accident at Freeport was sufficient to initiate two exothermic reactions of the waste material. Both reactions released heat in an insulated tank, the insulation of which likely prevented the heat’s dissipation. This resulted in the generation and retention of heat at a rate that led to a runaway reaction and build-up of pressure within the tank. Given the runaway nature of the reaction, the capacity of the pressure relief valve to vent the gases and relieve the pressure in the tank was exceeded, so the pressure increased until the tank ruptured. The Safety Board concludes that the overpressurization and rupture of the tank car was caused by a runaway exothermic decomposition reaction that resulted when the oxime waste material the tank car contained was steam-heated to an excessive temperature for an extended period of time.

Analysis 20 Hazardous Materials Accident Report Procedures Used in Steam-Heating DBCX 9804 In the months preceding the accident, both MFR and BASF had steam-heated tank car DBCX 9804 to liquefy the hardened waste material within it so that the waste could be transferred from the tank car. However, MFR and BASF followed different procedures while performing these operations. MFR Procedures Different waste materials may have widely dissimilar chemical make-ups and properties. As might be expected of a company that unloads many different waste materials of diverse compositions, MFR was not familiar with the specific chemical properties of the oxime waste material in DBCX 9804. (MFR had never previously unloaded this particular waste material from a tank car.) MFR knew only the waste’s heating value and that it did not contain metals. Because MFR did not have detailed information about the chemical properties of the waste, it was concerned about the potential for an increase in vapor pressure that could result from heating the tank car. Consequently, MFR took precautions to monitor the interior conditions of the tank car during heating. MFR used a gauging device to keep track of the temperature and pressure within the tank car, employed a safety mechanism to automatically stop the heating of the tank car if the pressure reached a preset limit (15 psig), periodically conducted visual inspections of the material, and halted the application of heat when no employees were present (at night) to monitor the process. MFR records show that the pressure within the tank car never exceeded 3.5 psig while the tank car was being heated at the Hannibal facility. However, had a significant increase in the internal tank pressure developed, the MFR procedures for monitoring the heating process probably would have alerted MFR employees before the pressure reached critical levels. In such a situation, MFR would most likely have had sufficient time to take appropriate measures to relieve the pressure within the tank car (such as by opening the 6-inch access plate) before the pressure could reach a level that would rupture the tank. It should be noted that although MFR used appropriate safety procedures when heating DBCX 9804, MFR’s lack of procedures for ensuring that the tank car had been emptied of all waste material after the unloading process at Hannibal was terminated allowed the tank car to be sent back to BASF containing about 8,000 to 10,000 gallons of waste. Had MFR taken steps to ensure that the tank car was truly empty before sending it back to BASF (such as by visually inspecting the interior of the tank through the 6-inch access opening), MFR would have learned that the tank car still contained a significant amount of material. Then, MFR could have unloaded the remaining waste and sent DBCX 9804 back to Freeport empty, in which case the Freeport facility would not have had to deal with the disposal of the material. BASF Procedures Like the unloading personnel at MFR, the unloaders in Freeport did not routinely heat oxime waste material for transfer. According to BASF, the Freeport facility had last

Analysis 21 Hazardous Materials Accident Report shipped this material more than 10 years before the accident. And, although the oxime material was an intermediate product from the Freeport facility, it had never before been heated and transferred from a railroad tank car. Consequently, the BASF Freeport facility had no specific written procedures for heating the waste mixture before unloading it from the tank car. Perhaps the Freeport facility could not have been expected to have predetermined procedures for heating this particular hazardous waste mixture, but the facility’s lack of experience with the material should have indicated that special care should be taken during the heating process. Instead of adopting reasonable safety measures, the BASF Freeport facility treated the material as if it posed little or no risk. Specifically, the unloaders in Freeport did not use a gauge or other device to monitor the temperature and pressure within the tank; they did not apply any safety mechanism that would stop the heating if the pressure inside the tank reached a preset limit; and they did not periodically evaluate the tank’s interior conditions. The unloaders at the Freeport facility did not use any monitoring tools to help them assess the internal conditions of the tank during the heating process. Because the facility did not require its unloading personnel to use a pressure gauge to monitor the pressure in the tank car during the heating process, the first indication the unloaders had of the rising pressure in the tank car was the activation of the pressure relief valve when the pressure exceeded 75 psig. This happened about 45 minutes before the tank car ruptured. By this time, it was likely too late to stop the runaway chemical reaction. Nor did the Freeport unloaders use a safety mechanism to automatically stop the heating if the pressure reached a preset limit. Had they used an automatic shutdown mechanism, the tank car heating would likely have been terminated much sooner, when the tank pressure rose to the established safe limit. Further, if the Freeport facility workers had monitored and evaluated the conditions within the tank car (specifically, the temperature of the waste material and the internal pressure of the tank car) by checking them periodically, they would have found that the material was sufficiently liquid for successful transfer around 9:00 p.m. on September 12—about 12 1/2 hours before the accident occurred. They also would have had time to relieve the pressure within the tank car before it reached critical levels, by taking such action as opening the 6-inch access plate. Therefore, the Safety Board concludes that lack of experience in transferring the oxime material should at least have led the BASF Freeport facility, like MFR, to take precautions during the heating process. Although the workers immediately involved in the transfer operation may not have been aware of the specific properties of the oxime waste they were unloading, BASF had such information. The 1994 BASF material safety data sheet for oxime specifically stated that temperatures above 212° F should be avoided for this material. Additionally, during a 1991 BASF meeting in Belgium, the variations in onset temperatures for oxime were discussed. Guidance distributed to those attending the meeting (including representatives

Analysis 22 Hazardous Materials Accident Report from the Freeport facility) advised that to avoid uncontrolled runaway reactions of tempered oxime, the temperature within the tank should not exceed 194° F. The Safety Board concludes that, before the accident, BASF had information concerning the dangers associated with excessive heating of oxime that should have alerted the Freeport facility to the need for developing and implementing safe procedures for heating and unloading this material from railroad tank cars. The BASF Freeport facility has changed its facility procedures to address problems identified during the investigation of this accident. It has developed and implemented written procedures designed to ensure the safe handling of oxime waste material. The procedures prohibit the transfer of oxime waste to railroad tank cars, as well as the heating of closed containers of oxime. Additionally, the Freeport facility now requires that hot water be used, rather than steam, to heat oxime waste. BASF revised its material safety data sheet for oxime to stipulate that oxime must not be heated above 212° F. The Safety Board considers that these actions will significantly reduce the likelihood of incidence of an accident similar to the one discussed in this report. Consequently, the Safety Board makes no recommendations to the BASF Freeport facility concerning its oxime handling procedures. Heating Hazardous Materials in Railroad Tank Cars The Safety Board addressed issues involving the heating of hazardous materials cargoes prior to unloading in its investigation of the rupture of a railroad tank car that took place in Clymers, Indiana, on February 18, 1999.23 The Safety Board determined that the tank car had overpressurized and catastrophically ruptured after a waste material had been heated in it for more than 28 hours over several days. As in the Freeport accident, the internal tank conditions were not monitored during the heating process. In the Clymers investigation, the Safety Board determined that the failures in the procedures were attributable to the companies involved with the shipment and heating. Consequently, the Safety Board issued the following safety recommendations to the specific companies involved with the generation and disposal of the waste material in the Clymers accident: I-01-2 through -5 Collaborate with applicable producers, shippers, consignees, and end-users in the development and implementation of specific and written procedures for the loading or offloading of any chemical or waste material from a railroad tank car, highway cargo tank, or other bulk transportation vessel when the chemical or waste material exhibits properties that require special handling or processing during the loading or offloading operation. 23 National Transportation Safety Board, Rupture of a Railroad Tank Car Containing Hazardous Waste Near Clymers, Indiana, February 18, 1999, Hazardous Materials Accident Report NTSB/HZM-01/01 (Washington, DC: NTSB, 2001).

Analysis 23 Hazardous Materials Accident Report Two of the four companies receiving the safety recommendations did not respond. Safety Recommendations I-01-2 and -3 were therefore classified as “Closed— Unacceptable Action—No Response Received” on July 31, 2003. The third company responded that it considered the recommendation unwarranted. Consequently, Safety Recommendation I-01-4 was classified as “Closed—Unacceptable Action” on September 12, 2001. The fourth company ultimately determined not to implement Safety Recommendation I-01-5, which was classified as “Closed—Unacceptable Action” on September 16, 2004. Because of the lack of action by the companies involved in the Clymers accident, as well as the circumstances of the Freeport accident, the Safety Board is concerned that the heating of hazardous materials cargoes in railroad tank cars remains a significant safety problem. The DOT hazardous materials regulations24 do not specifically address the heating of cargo in tank cars. On October 30, 2003, the Research and Special Programs Administration (RSPA) published a final rule under docket HM-223 that was intended to clarify the applicability of the hazardous materials regulations to the loading, unloading, and storage of hazardous materials during transportation. Under this final rule, with respect to tank cars and other bulk containers, RSPA has interpreted “unloading incidental to movement,” which is subject to the DOT hazardous materials regulations, to take place only when a hazardous material is emptied from its bulk packaging after the material has been delivered to the consignee and prior to the delivering carrier’s departure from the consignee’s facility or premises. Because virtually all tank cars are unloaded by the consignee after the delivering rail carrier has departed, this rule in effect means that RSPA no longer considers the unloading of a tank car to be a RSPA-regulated transportation function. The final rule under HM-223 was to have become effective on October 1, 2004. In a Federal Register notice published on May 28, 2004, RSPA stated it was delaying the effective date to January 1, 2005. In the notice, RSPA stated that it had received 14 appeals to the final rule. According to RSPA, the appellants raised a number of issues concerning the consistency of the final rule with Federal hazardous materials transportation law, State and local regulation of hazardous materials facilities, the relationship of the DOT hazardous materials regulations to Occupational Safety and Health Administration (OSHA) and Environmental Protection Agency (EPA) regulations, the definition of “unloading incidental to movement,” and other aspects of the final rule. Also, 11 industry associations filed a petition on December 29, 2003, in the U.S. Court of Appeals for the District of Columbia to reverse the HM-223 final rule. The Safety Board initially summarized its concerns in an October 29, 2001, response to the Notice of Proposed Rulemaking for HM-223 by stating that the proposed rule may result in the elimination of effective Federal oversight of hazardous materials loading/unloading operations for bulk transportation containers. The Safety Board also emphasized in its response that the Board has historically and consistently considered loading and unloading operations, particularly of bulk containers such as tank cars, to be 24 The DOT’s Research and Special Programs Administration promulgates these regulations.

Analysis 24 Hazardous Materials Accident Report transportation-related functions. The Board also expressed its belief that the DOT has both the statutory mandate and the authority to regulate loading and unloading operations, and that the DOT should strengthen its oversight of these operations rather than ignore these issues. The Safety Board’s concerns were reinforced as a result of its investigation of the July 14, 2001, accident at a chemical plant in Riverview, Michigan.25 In this accident, methyl mercaptan, a poisonous and flammable gas, was released and ignited during the offloading of a railroad tank car. Three plant employees were killed and about 2,000 residents were evacuated from their homes for 10 hours. Although the unloading operations involving the accident tank car were subject to OSHA’s process safety management and the EPA’s risk management programs, the Safety Board concluded that effective oversight of hazardous materials loading and unloading operations from tank cars and other bulk containers was not provided by the Federal Railroad Administration, the EPA, or OSHA. As a result, the Safety Board issued the following safety recommendations to the DOT: I-02-1 Develop, with the assistance of the EPA and OSHA, safety requirements that apply to the loading and unloading of railroad tank cars, highway cargo tanks, and other bulk containers that address the inspection and maintenance of cargo transfer equipment, emergency shutdown procedures, and personal protection requirements. I-02-2 Implement, after the adoption of safety requirements developed in response to Safety Recommendation I-02-1, an oversight program to ensure compliance with these requirements. The Safety Board also issued Safety Recommendations I-02-3 and -4 to OSHA and the EPA, respectively, to recommend that they assist the DOT in the development of the safety requirements referred to in Safety Recommendations I-02-1 and -2. In a November 25, 2002, response to Safety Recommendations I-02-1 and -2, RSPA noted that it had worked closely with OSHA and the EPA on various hazardous materials issues and that it was proceeding with the HM-223 rulemaking. In a February 25, 2003, reply to RSPA’s response, the Safety Board again expressed its concern that the rulemaking could have an adverse effect on the safety of loading and unloading operations, and the Board classified both recommendations “Open— Unacceptable Response.” OSHA and the EPA responded to Safety Recommendations I-02-3 and -4 in August and October 2002, respectively. The two agencies pledged to work with the DOT to develop the needed safety requirements. As a result, the Safety Board classified Safety Recommendations I-02-3 and -4 “Open—Acceptable Response.” 25 National Transportation Safety Board, Hazardous Materials Release from Railroad Tank Car With Subsequent Fire at Riverview, Michigan, July 14, 2001, Hazardous Materials Accident Report NTSB/HZM-02/01 (Washington, DC: NTSB, 2002).

Analysis 25 Hazardous Materials Accident Report The Safety Board’s investigation of the Riverview accident identified a lack of effective oversight of hazardous materials loading and unloading operations with respect to inspection and maintenance of equipment, emergency shutdown procedures, and personal protection. Further, the accidents in Clymers and Freeport identify a lack of Federal oversight when hazardous materials in railroad tank cars are heated prior to unloading the materials. In the absence of any apparent Federal regulations addressing this issue, and given the uncertainty over the eventual outcome of the appeals to HM-223, the Safety Board concludes that Federal oversight of operations for heating hazardous materials in railroad tank cars prior to unloading is inadequate. The Safety Board believes that RSPA should, in cooperation with OSHA and the EPA, develop regulations that require safe operating procedures to be established before hazardous materials are heated in a railroad tank car for unloading; at a minimum, the procedures should include the monitoring of internal tank pressure and cargo temperature.

26 Hazardous Materials Accident Report Conclusions Findings 1. Railroad tank car DBCX 9804 had no structural or material defects that caused or contributed to the rupture of the tank. 2. The pressure relief valve on tank car DBCX 9804 functioned as designed and vented vapors continuously once it activated, but the rapid generation of gas within the tank exceeded the valve’s capacity to relieve the tank’s internal pressure sufficiently to prevent the catastrophic rupture of the tank car. 3. The overpressurization and rupture of the tank car was caused by a runaway exothermic decomposition reaction that resulted when the cyclohexanone oxime waste material the tank car contained was steam-heated to an excessive temperature for an extended period of time. 4. Lack of experience in transferring the cyclohexanone oxime material should at least have led the BASF Freeport facility, like Missouri Fuel Recycling Environmental Services, to take precautions during the heating process. 5. Before the accident, the BASF Corporation had information concerning the dangers associated with excessive heating of cyclohexanone oxime that should have alerted the Freeport facility to the need for developing and implementing safe procedures for heating and unloading this material from railroad tank cars. 6. Federal oversight of operations for heating hazardous materials in railroad tank cars prior to unloading is inadequate. Probable Cause The National Transportation Safety Board determines that the probable cause of the rupture of railroad tank car DBCX 9804 was overpressurization resulting from a runaway exothermic decomposition reaction initiated by excessive heating of a hazardous waste material. Contributing to the accident was the BASF Corporation’s failure to monitor the temperature and pressure inside the tank car during the heating of the hazardous waste.

27 Hazardous Materials Accident Report Recommendations As a result of its investigation of the September 13, 2002, hazardous materials accident at Freeport, Texas, the National Transportation Safety Board makes the following safety recommendations: To the Research and Special Programs Administration: In cooperation with the Occupational Safety and Health Administration and the Environmental Protection Agency, develop regulations that require safe operating procedures to be established before hazardous materials are heated in a railroad tank car for unloading; at a minimum, the procedures should include the monitoring of internal tank pressure and cargo temperature. (R-04-10) To the Occupational Safety and Health Administration: In cooperation with the Research and Special Programs Administration and the Environmental Protection Agency, develop regulations that require safe operating procedures to be established before hazardous materials are heated in a railroad tank car for unloading; at a minimum, the procedures should include the monitoring of internal tank pressure and cargo temperature. (R-04-11) To the Environmental Protection Agency: In cooperation with the Research and Special Programs Administration and the Occupational Safety and Health Administration, develop regulations that require safe operating procedures to be established before hazardous materials are heated in a railroad tank car for unloading; at a minimum, the procedures should include the monitoring of internal tank pressure and cargo temperature. (R-04-12) BY THE NATIONAL TRANSPORTATION SAFETY BOARD MARK V. ROSENKER CAROL J. CARMODY Vice Chairman Member RICHARD F. HEALING Member DEBORAH A. P. HERSMAN Member Adopted: December 1, 2004 Chairman Ellen Engleman Conners did not participate in the adoption of this report.

this page intentionally left blank

29 Hazardous Materials Accident Report Appendix A Investigation The National Transportation Safety Board was notified of the accident about 10:30 a.m. eastern daylight time on September 13, 2002. Two hazardous materials investigators were dispatched from Washington, D.C., to Freeport, Texas. No Board Member went with the team. A single investigative group was established, comprising the following parties: the BASF Corporation; Missouri Fuel Recycling Environmental Services; Trinity Industries, Inc.; the Midland Manufacturing Corporation; the Federal Railroad Administration; and the Railroad Commission of Texas. The Safety Board did not conduct a public hearing concerning this investigation.

30 Hazardous Materials Accident Report Appendix B Summary of Significant Events Preceding the Freeport Accident Date Event June 1, 2001 Caprolactam II process upset in Freeport, Texas, BASF facility produces about 91,000 pounds of cyclohexanone oxime mixture waste material June 5, 2001 BASF transfers the June 1, 2001, process upset waste to four highway cargo tanks at Freeport June 12, 2001 After heating the waste to liquefy it, BASF transfers the contents of the four highway cargo tanks to railroad tank car DBCX 9804 at Freeport Between June 12, 2001, and April 26, 2002 BASF applies steam heat to the tank car to liquefy the waste mixture so water can be removed and disposed of on-site April 2, 2002 BASF loads about 91,000 pounds of cyclohexanone oxime waste from a second caprolactam II process upset at Freeport into four highway cargo tanks (Waste material is chemically indistinguishable from material from June 1, 2001, process upset) April 26, April 29, and May 10, 2002 BASF transfers the second batch of material from the four highway cargo tanks to DBCX 9804, which still contains the material from the June 1, 2001, caprolactam II process upset June 21, 2002 BASF sends tank car DBCX 9804, containing the material from both process upsets, to the Missouri Fuel Recycling Environmental Services (MFR) facility in Hannibal, Missouri, so the hazardous waste material can be incinerated July 7, 2002 DBCX 9804 arrives at the MFR facility in Hannibal July 9, 2002 MFR steam-heats DBCX 9804 from 9:00 a.m. until 9:30 p.m. July 10, 2002 MFR steam-heats DBCX 9804 from 5:00 a.m. until 11:00 p.m. July 11, 2002 MFR unloads waste material from DBCX 9804; MFR mistakenly believes DBCX 9804 is empty July 12, 2002 MFR sends the partially emptied DBCX 9804 back to the BASF Freeport facility July 22, 2002 Tank car DBCX 9804 arrives back in Freeport; tank car is judged to be about 1/3 full of waste material September 11, 2002 BASF begins heating DBCX 9804 (for about 1 hour) so that the material left in the tank can be transferred to highway cargo tanks

Appendix B 31 Hazardous Materials Accident Report Date Event September 12, 2002 7:00 a.m. BASF heats DBCX 9804 for about 5 hours 12:00 p.m. BASF attempts to transfer the material from the tank car but is unsuccessful because the material is not sufficiently liquid 2:00 p.m. BASF continues to heat the tank car; heating continues till next morning September 13, 2002 7:00 a.m. Heating of DBCX 9804 is stopped; transfer of material to highway cargo tanks is begun 7:45 a.m. Transfer of material to one highway cargo tank is completed 8:40 a.m. DBCX 9804 is seen to be venting 9:00 a.m. DBCX 9804 is seen to be continuously venting; fire emergency personnel are summoned from Dow Chemical; the “seek shelter” horn is activated 9:05 a.m. Water is applied to DBCX 9804 to knock down vapors and cool the tank car 9:10 a.m. Area around DBCX 9804 is evacuated 9:15-9:30 a.m. Water is applied to DBCX 9804 9:30 a.m. DBCX 9804 catastrophically ruptures

this page intentionally left blank

FD07259 ｜ 2002_美国_NTSB_MAR0205_Collision_Between_the_US_Coast_Guard_Patrol_Boat_CG242513_an.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2002 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Marine Accident Report Collision Between the U.S. Coast Guard Patrol Boat CG242513 and the U.S. Small Passenger Vessel Bayside Blaster, Biscayne Bay, Florida January 12, 2002 National Transportation Safety Board Washington, D.C. A A N T I O N L T R A S P O R A T I O N B O A R D S A F E T Y N T E

P L U R IB US UN U M

NTSB/MAR-02/05 PB2002-916405

this page intentionally left blank

Marine Accident Report Collision Between the U.S. Coast Guard Patrol Boat CG242513 and the U.S. Small Passenger Vessel Bayside Blaster, Biscayne Bay, Florida January 12, 2002 NTSB/MAR-02/05 PB2002-916405 National Transportation Safety Board Notation 7454A 490 L’Enfant Plaza, S.W. Adopted December 17, 2002 Washington, D.C. 20594

National Transportation Safety Board. 2003. Collision Between the U.S. Coast Guard Patrol Boat CG242513 and the U.S. Small Passenger Vessel Bayside Blaster, Biscayne Bay, Florida, January 12, 2002. Marine Accident Report NTSB/MAR-02/05. Washington, DC. Abstract: This report discusses the collision that occurred on the evening of January 12, 2002, between the U.S. Coast Guard patrol boat CG242513, which was on a routine patrol of Biscayne Bay, Florida, and the small passenger vessel Bayside Blaster, which was on a sightseeing tour of the area. The accident resulted in no deaths or serious injuries. However, both Coast Guard crewmembers and 2 of the Bayside Blaster's passengers were taken to a hospital for examination. Damages to the patrol boat (which was a total loss), the Bayside Blaster, and a moored recreational boat totaled $184,722. From its investigation of the accident, the National Transportation Safety Board identified safety issues regarding the adequacy of the following: operation of the Coast Guard patrol boat; operation of the Bayside Blaster; Coast Guard oversight of routine patrols; Boatrides International, Inc. (owner of the Bayside Blaster) management oversight; kill switch operation on Coast Guard nonstandard boats; lifejacket stowage on the Bayside Blaster; and Coast Guard safety oversight of small passenger vessels in Miami. On the basis of its findings, the Safety Board made recommendations to the U.S. Coast Guard, to Boatrides International, Inc., and to the Passenger Vessel Association. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2002-916405 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Marine Accident Report Contents Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Bayside Blaster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Coast Guard Patrol Boat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Damages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Crew Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Coast Guard Patrol Boat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Bayside Blaster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Vessel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Coast Guard Patrol Boat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Bayside Blaster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Waterway Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Meteorology Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Coast Guard Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Coast Guard Nonstandard Boat Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Recreational Boating Safety and Manatee-Zone Enforcement Patrols . . . . . . . . . . . . 20 Island Queen Sightseeing Tours Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Wreckage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Coast Guard Patrol Boat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Bayside Blaster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Other Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Emergency Systems/Survival Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Kill Switch Attachments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Coast Guard Patrol Boat’s Navigation Lights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Postaccident Developments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Passenger Vessel Association . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Collision . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Operation of the Coast Guard Patrol Boat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Operation of the Bayside Blaster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Navigation Lights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Contents iv Marine Accident Report Coast Guard Oversight of Routine Patrols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Boatrides International, Inc., Management Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Kill Switch Operation on Coast Guard Nonstandard Patrol Boats . . . . . . . . . . . . . . . . . . . 41 Lifejacket Stowage on the Bayside Blaster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Coast Guard Safety Oversight of Small Passenger Vessels in Miami . . . . . . . . . . . . . . . . . 44 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Appendix A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .51

v Marine Accident Report Acronyms and Abbreviations AOR area of responsibility CFR Code of Federal Regulations COI certificate of inspection DOT U.S. Department of Transportation FWC Florida Fish & Wildlife Conservation Commission ICAO International Civil Aviation Organization MLB motor lifeboat OOD Officer of the Day PQS personnel qualification standard SAR search and rescue UTB utility boat

vi Marine Accident Report Executive Summary About 2013 on January 12, 2002, the 24-foot Coast Guard patrol boat CG242513, with two crewmembers on board, was on a routine recreational boating safety and manatee-zone patrol in Biscayne Bay, Florida, when it collided with the small passenger vessel Bayside Blaster, carrying 2 crewmembers and 53 passengers. Both Coast Guard crewmembers were ejected from their boat. The patrol boat continued running, circled to port, and struck the Bayside Blaster again. The unmanned Coast Guard patrol boat continued to circle for 10 to 15 minutes, striking a moored recreational boat two times and pilings near the shore. Police officers responding to the scene pinned the Coast Guard patrol boat to the pilings and shut off the engines. Five passengers who reported being injured were taken to the Coast Guard Station, where they were triaged. After triage, two passengers were transported to a hospital, and the others did not request further medical treatment. The two Coast Guard crewmembers were triaged by paramedics on Palm Island, taken to a nearby hospital for further examination, and released the morning of January 13. As a result of the accident, the Coast Guard patrol boat, valued at $80,000, was declared a total loss. The damage to the Bayside Blaster was estimated at $80,000, and the damage to the moored recreational boat was $24,722. Damages from the accident were estimated at $184,722. The Safety Board's investigation of the accident identified the adequacy of the following as major safety issues: • Operation of the Coast Guard patrol boat; • Operation of the Bayside Blaster; • Coast Guard oversight of routine patrols; • Boatrides International, Inc., management oversight; • Kill switch operation on Coast Guard nonstandard patrol boats; • Lifejacket stowage on the Bayside Blaster; and • Coast Guard safety oversight of small passenger vessels in Miami. The National Transportation Safety Board determines that the probable cause of the collision between the Coast Guard patrol boat CG242513 and the small passenger vessel Bayside Blaster was the failure of the coxswain of the Coast Guard patrol boat to operate his vessel at a safe speed in a restricted-speed area frequented by small passenger vessels and in conditions of limited visibility due to darkness and background lighting. Contributing to the cause of the accident was the lack of adequate Coast Guard oversight of nonstandard boat operations. As a result of the investigation, the Safety Board makes recommendations to the U.S. Coast Guard, to Boatrides International, Inc. (owner of the Bayside Blaster), and to the Passenger Vessel Association.

1 Marine Accident Report Factual Information Accident Narrative Bayside Blaster The U.S. small passenger vessel Bayside Blaster (see figure 1) left Bayside Marina, Miami, Florida, on an excursion to Biscayne Bay about 19301 on January 12, 2002, with a master, a deckhand, and 53 passengers on board. The Bayside Blaster followed its normal route from the marina, under the bridge on the west side of Dodge Island, eastward through the main channel along Dodge Island, and under the MacArthur Causeway Bridge. North of the causeway, the vessel maneuvered around the north end of Star Island and then south along its west side, traveling at idle speed (3 to 4 knots), while the master and deckhand alternated providing bilingual (English and Spanish) narration of the sights in the area (see figure 2). 1 All times in this report are Eastern Standard Time, based on the 24-hour clock. Figure 1. The Bayside Blaster.

Factual Information 2 Marine Accident Report From the south end of Star Island, the Bayside Blaster traveled west to Palm Island at a slow speed of 6 to 8 knots. Arriving at a point about 100 feet from the island, the master again slowed the vessel to idle and resumed the narrated tour. About 2010, the master began to round the east end of Palm Island, with the intention of touring between Palm and Hibiscus islands. The master and the deckhand were at the center steering station. The deckhand had just completed a narration describing a house on Palm Island when he noticed a commotion from the passengers seated in the bow area. Looking off the starboard bow, the deckhand saw the running lights and bow wave of an oncoming boat approaching at high speed. The deckhand alerted the master and told him, “Go.” The master applied right rudder and increased the throttle in an attempt to avoid the approaching boat. Coast Guard Patrol Boat About 1940, a Coast Guard petty officer at Coast Guard Station Miami Beach sought out the station Officer of the Day (OOD) and requested permission to undertake a recreational boating safety patrol of the north part of Biscayne Bay. According to the OOD, the coxswain requested, “to get under way for recreational boating safety . . . and while in the area go see [another Coast Guardsman] at a private residence on Palm Island.” The OOD granted permission for the patrol and the visit to the private residence, but cautioned the petty officer “to complete some boardings around their visit” [that is, to board recreational boats and conduct safety checks on them while in the area of their visit]. Figure 2. Bayside Blaster route. BISCAYNE BAY CLAUGHTON ISLAND MIAMI MIAMI BAY- SIDE BISCAYNE BAY (DODGE ISLAND) PORT OF MIAMI (LUMMUS ISLAND) Scale Approximate YARDS 0 100 500 MAC ARTHUR CAUSEWAY PALM ISLAND HIBISCUS ISLAND ACCIDENT SITE MAC ARTHUR CAUSEWAY BRIDGE COAST GUARD BASE BELLE ISLAND MIAMI BEACH RIVO ALTO ISLAND DILIDO ISLAND SAN MARINO ISLAND SAN MARCO ISLAND BISCAYNE ISLAND WATSON PARK N MONUMENT ISLAND STAR ISLAND

Factual Information 3 Marine Accident Report About 2005, the petty officer got under way on the 24-foot Coast Guard patrol boat CG242513 from Coast Guard Station Miami Beach for the recreational boating safety patrol, to enforce safe recreational boating rules and proper speeds in manatee-protection zones in Biscayne Bay (see “Waterway Information” section for more information). On board the patrol boat were two Coast Guardsmen: a coxswain (the petty officer who had requested the patrol) and a crewmember (also a petty officer). While the 24-foot patrol boat was departing the station at slow speed (about 6 knots), a crewmember on a nearby Coast Guard 41-foot utility boat (UTB) informed the coxswain of the patrol boat that his port navigation light (red sidelight) was out. The patrol boat’s coxswain said that he tapped the light and it came back on. The patrol boat then traveled north under the MacArthur Causeway Bridge. After clearing the bridge, the coxswain accelerated to full speed2 (about 4,000 rpm, or 32 knots) and steered around the north end of Star Island and along the north shore of Hibiscus Island. After traversing about halfway along the north side of Hibiscus Island, the coxswain reversed course and headed toward the east end of the island (see figure 3). 2 The manufacturer’s operating limit for the outboard engine is 4,400 rpm. Coast Guard Station Miami Beach had established 4,000 rpm as the maximum throttle setting for operations to reduce stress on the engines. Figure 3. Manatee-protection speed zones in the accident area, with Coast Guard patrol boat route. BISCAYNE BAY CLAUGHTON ISLAND Land Slow Speed Areas (includes Some Idle Speed Areas) 30-35 Mph Areas (DODGE ISLAND) PORT OF MIAMI (LUMMUS ISLAND) Scale Approximate YARDS 0 100 500 MAC ARTHUR CAUSEWAY PALM ISLAND HIBISCUS ISLAND ACCIDENT SITE MAC ARTHUR CAUSEWAY BRIDGE COAST GUARD BASE BELLE ISLAND RIVO ALTO ISLAND DILIDO ISLAND SAN MARINO ISLAND SAN MARCO ISLAND BISCAYNE ISLAND WATSON PARK N MIAMI MIAMI BAY- SIDE STAR ISLAND TO ATLANTIC OCEAN MONUMENT ISLAND MELOY CHANNEL MIAMI BEACH IDLE SPEED BISCAYNE BAY BISCAYNE BAY Bridge Approximate Track of Coast Guard Patrol Boat

Factual Information 4 Marine Accident Report Still traveling about 32 knots, the patrol boat rounded the east end of Hibiscus Island and proceeded south in the waterway between Hibiscus and Star islands, heading toward the east end of Palm Island. The coxswain testified that “knowing [he] was going too fast in the manatee area” as the patrol boat approached Palm Island, he “started bringing the throttle back.” The crewmember confirmed that the coxswain had his hands on the throttle as they entered the manatee zone. At the same time, both crewmembers saw a silhouette directly ahead and heard people screaming. The coxswain turned sharply to port and applied full starboard throttle in an attempt to avoid the obstacle. About 2013, the patrol boat struck the Bayside Blaster’s starboard quarter, sideswiping it with the patrol boat’s starboard bow. According to the crewmember, at or immediately after the impact, both she and the coxswain were ejected over the starboard side of the boat and into the water. With the patrol boat’s engines still running about full throttle, the boat continued in a left-hand (counterclockwise) turn. In the water, both Coast Guard crewmembers removed their automatically inflated lifejackets to more easily swim to nearby Palm Island; they did not remove their law enforcement equipment. Both were forced to dive under the water at least once to avoid the circling patrol boat. During one pass, the coxswain, while underwater, was struck in the back by the patrol boat’s hull but not its propellers. As the crewmembers swam toward Palm Island, they called for help to people they saw on the island. Two people entered the water from a residence on Palm Island, swam to the crewmembers, and helped them to shore. The master of the Bayside Blaster slowed his boat after the impact to determine whether the passengers were all right. The deckhand also looked over the side of the vessel to see whether any passengers were in the water, to check for damage, and to determine whether the vessel was taking on water. As the Bayside Blaster slowed, the unmanned patrol boat circled back and struck the Bayside Blaster again on the starboard side (see figure 4). After the patrol boat struck the Bayside Blaster the second time, the deckhand went to the helm console, where the master was calling the Coast Guard to report the accident. Coast Guard records show that the call was made at 2015. After the second impact, the master of the Bayside Blaster increased his speed and headed the vessel north to avoid being struck again by the circling boat. He maneuvered the Bayside Blaster toward the northwest side of Monument Island, about 800 yards north of the accident site, and beached the vessel’s bow on the sandy beach. En route to the island, lifejackets were distributed to the passengers, first by the deckhand and then by the passengers. Once the master beached the boat, the deckhand directed everyone to the forward end of the vessel. He then jumped off the bow and began to help the passengers disembark onto the beach. All passengers received a lifejacket either while on the Bayside Blaster or while on the island. The Bayside Blaster’s uninjured passengers were ferried from the island by another company boat to Bayside Marina, their departure point. Five people who reported they were injured were taken with others in their group in Coast Guard vessels to the Coast Guard station, where medical technicians were waiting to triage them and where

Factual Information 5 Marine Accident Report ambulances were on hand to transport them to local hospitals. According to Coast Guard Station Miami Beach, two passengers with injuries were transported to South Shore Hospital. The other three injured passengers declined transport to a hospital and were taken to Bayside Marina by government vehicle. Figure 4. Approximate collision angles between the Coast Guard patrol boat and the Bayside Blaster. CG242513 CG242513 FIRST COLLISION BAYSIDE BLASTER N SECOND COLLISION N Black circles indicate crew

Factual Information 6 Marine Accident Report Meanwhile, the Coast Guard patrol boat continued turning in counterclockwise circles toward the east side of Palm Island. Twice, the Coast Guard patrol boat struck a 46- foot recreational boat moored bow-out at a dock on Palm Island. The Coast Guard patrol boat’s T-top struck the bow pulpit of the recreational vessel during the first collision. The T-top was knocked over and dragged on the port side of the Coast Guard patrol boat. According to witnesses on shore, the patrol boat began making very small left-hand circles with the T-top dragging (attached to the boat by engine control cables and electrical wiring) in the water. At 2035, about 20 minutes after it first collided with the Bayside Blaster, the Coast Guard patrol boat hit pilings on the northeast side of Palm Island. It was wedged into the pilings by a Florida Fish & Wildlife Conservation Commission (FWC) boat and a Miami Beach Police Department boat that had responded to the emergency (see figure 5). The officers managed to shut down the patrol boat’s engines (figure 6 shows the patrol boat after the accident). See “Emergency Response” section for further details. Injuries The two Coast Guard crewmembers suffered bruises, and five of the Bayside Blaster’s passengers reported injuries as a result of the accident. After triage at the Coast Guard station, two passengers were transported to a hospital and three declined further treatment. The two Coast Guard crewmembers were taken to a nearby hospital for further examination and released early on the morning of January 13. The injuries sustained in the accident are shown in table 1.3 Table 1. Injuries sustained Bayside Blaster CG242513 Injuries Crew Passengers Crew Total Fatal 0 0 0 0 Serious 0 0 0 0 Minor 0 5 2 7 None 2 48 0 50 Totals 2 53 2 57 Title 49 Code of Federal Regulations (CFR) 830.2 defines a fatal injury as any injury that results in death within 30 days of an accident. It defines serious injury as that which requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; results in a fracture of any bone (except simple fractures of fingers, toes, or nose); causes severe hemorrhages, nerve, muscle, or tendon damage; involves any internal organ; or involves second- or third-degree burns, or any burn affecting more than 5 percent of the body surface. 3 Injuries are categorized according to the injury criteria of the International Civil Aviation Organization (ICAO). The Safety Board uses the ICAO injury criteria in all its accident reports, regardless of transportation mode.

Factual Information 7 Marine Accident Report Figure 5. Possible track of the Coast Guard patrol boat from the time it collided with the Bayside Blaster to the time it was secured to pilings on Palm Island (for illustrative pur- poses only). PALM ISLAND STAR ISLAND LEGEND (LOCATIONS ARE APPROXIMATE) HIBISCUS ISLAND BRIDGE MAC ARTHUR CAUSEWAY Scale Approximate YARDS 200 100 0 #1- First collision between Bayside Blaster and CG242513 Number and diameter of left-hand turns (counter clockwise) are unknown Bayside Blaster en route to Monument Island after collisions #1 and #2 #2- Second collision between Bayside Blaster and CG242513 #3- Location of two collisions between moored recreational boat

and

CG242513 #4- Location of CG242513 pinned in pilings #1 #3 #4 #2 N

Factual Information 8 Marine Accident Report Damages The Coast Guard patrol boat, valued at $80,000, was declared a total loss. The damage to the Bayside Blaster was also estimated at $80,000. The damage to the moored recreational boat was $24,722 (see “Wreckage” section for more information). The Bayside Blaster returned to service on April 21, 2002. Crew Information Coast Guard Patrol Boat Coxswain. The coxswain, a petty officer second class (E-5), age 24, had served in the Coast Guard for 4 1/2 years at the time of the accident. Before being stationed at Coast Guard Station Miami Beach, he served on the Coast Guard cutter Long Island. He reported to Station Miami Beach in July 2000 and was qualified as a coxswain of 41-foot UTBs in February 2001, which automatically qualified him to coxswain nonstandard Coast Guard boats (those 30 feet or less in length), which included the 24-foot patrol boat. According to the Coast Guard, while it had not yet established servicewide training standards for nonstandard boats, Station Miami Beach had generated a personnel qualification standard (PQS) checklist for its nonstandard boats, a common practice throughout the Coast Guard. The qualification review board for the station’s UTB served as the review board for all Figure 6. Damaged Coast Guard patrol boat.

Factual Information 9 Marine Accident Report station boats. Some questions asked during the qualification review pertained to nonstandard boats, though a check ride on a nonstandard boat was not required for qualification. The Coast Guard has since issued nonstandard boat PQS certification and check ride requirements, which are distinct for each type of nonstandard boat in addition to being separate from the requirements for standard boats. At the time of the accident, the coxswain had been operating the 24-foot patrol boat for 11 1/2 months as a qualified coxswain. He stated that he had been through the accident area many times during his tour at Coast Guard Station Miami Beach. Coxswains were required to conduct at least one day trip and one night trip on any type of boat every 6 months through all designated areas of interest in the Station Miami Beach area of responsibility (AOR), which included the location of the accident. According to the coxswain’s individual training record, which covered June 1, 2001, to January 11, 2002, he had accumulated 6 hours of night operation time in the station’s AOR over two separate trips. The coxswain’s training record also revealed that he had practiced boat-handling skills, specifically, maneuvering in tight quarters on Coast Guard Station Miami Beach’s 41-foot UTB, and that he had spent 8.2 hours practicing piloting and navigation onboard the same boat. Station records showed that he had a total of 49 hours of operating experience on the accident boat and nearly 34 hours of operating experience on the other 24-foot patrol boat at the station. The coxswain’s personnel file contained no record of any reprimands or anything else negative. The coxswain had 8 hours of sleep two nights before the accident and 11 hours of sleep the night before it. Station policy allows the boat crewmen the day off on the day before their scheduled duty period begins. Therefore, the coxswain did not work the day before the accident. He began his duty at 0700 on the day of the accident and operated the 41-foot UTB from approximately 0840 to 1200. About 1330, he ate lunch and then reviewed PQSs with the OOD. The rest of the afternoon, he watched a televised football game, which started at 1630, in the station crew lounge with other Coast Guardsmen. Alcoholic beverages are not permitted in the lounge. According to the station log, the 24- foot patrol boat got under way on the accident voyage about 2005. During the Safety Board interview, the coxswain rated his overall health as good and indicated that he was not taking any prescription or nonprescription medication. Crewmember. The crewmember, a petty officer third class (E-4), age 23, joined the Coast Guard on February 1, 2000. After completing basic training, she was assigned to Coast Guard Station Miami Beach on July 7, 2000. She also attended a specialty training school for a machinery technician rating at the Coast Guard Training Center in Yorktown, Virginia. She had been qualified as a boat engineer for about a year at the time of the accident. According to the crewmember’s individual training report, which covered the period June 1, 2001, through January 11, 2002, she had accumulated 2 hours of night operation time in the station’s AOR during one trip. She had also participated in 16 hours of team coordination training in October 2001. The training report revealed that the crewmember had had no specific training in the operation of nonstandard boats, although she had completed the station’s PQS to qualify as a boat crewman and engineer on

Factual Information 10 Marine Accident Report nonstandard boats. The crewmember’s personnel file contained no record of any reprimands or other negative items. The crewmember indicated that she stood day work duty, 0700 to 1500, on January 10, 2002. She had gotten 7 1/2 hours of sleep on January 10. On January 11, she was off duty and ate dinner about 1900. That night she slept for 8 hours. On January 12, the day of the accident, she began her duty at 0700 and ate lunch about 1300. She got under way to escort cruise ships out of Miami Harbor about 1600 and returned to the station about 1730. The crewmember reported that her overall heath was good. Although she had a history of hypertension, no medication was currently prescribed for the condition. Bayside Blaster Master. The Master, age 49, worked part-time on the Bayside Blaster one day a week, on Saturdays, and only during the second shift (1600 to 2400). He had worked for Island Queen Sightseeing Tours, Inc., the parent company of Boatrides International, Inc., the owner and operator of the Bayside Blaster, for about 3 years as a deckhand before receiving a Coast Guard master’s license in October 1998. Previously, he had worked as a deckhand on a 75-foot vessel and as a mate on several fishing vessels in Key West, Florida, for a year. The owner of the Bayside Blaster indicated that there had never been any reprimands or other negative items in the master’s personnel file. On October 9, 1998, the master completed a Coast Guard-approved Master of Passenger Vessels training course at Sea School in Fort Lauderdale, Florida. On October 21, 1998, he received a Coast Guard master’s license as a master of near-coastal steam or motor vessels of not more than 100 gross tons. The master of the Bayside Blaster said that on January 9 through 11, he slept about 6 hours each night. From 0700 to 1800 on January 11, he was at his other job, and that night he slept for about 9 hours. On the day of the accident, January 12, he went to his other job from 0700 to about 1100. He reported eating lunch about 1200 and taking a nap from 1300 to 1500. At 1650, he started his shift on the Bayside Blaster. About 1715, he began loading passengers for the 1730 trip, which returned to the dock about 1845. He took a few minutes to relax, drank some coffee, and about 1915, began loading passengers for the second trip. About 1930, he got under way on the accident trip. The master reported that his overall health was good and that he was not taking any prescription or nonprescription medication. Deckhand. The deckhand, age 25, had worked for Island Queen Sightseeing Tours for about 3 years. He had left their employment to work for other companies and had been back working for Island Queen Sightseeing Tours for 4 or 5 months before the accident. In the previous 3-year period, he had worked on all four boats owned by the company, including the Bayside Blaster. Since returning to the company, he had worked solely on the Bayside Blaster as a deckhand. He had not completed any formal maritime training,

Factual Information 11 Marine Accident Report nor was any required. The owner of the Bayside Blaster indicated that there were no reprimands or anything else negative in the deckhand’s personnel file. The deckhand reported sleeping about 7 1/2 hours on the night of January 9. He slept for approximately 11 hours on the night of January 10. He spent January 11 shopping with his family and slept about 10 1/2 hours the night before the accident. He started work at 1030 on January 12, washing down the boat for the afternoon cruise. Before the accident run, he worked on three trips—at 1330, 1530, and 1730. Between trips, he stood by at the dock and waited for the next trip. Vessel Information Coast Guard Patrol Boat The Coast Guard patrol boat was a fiberglass-reinforced plastic Boston Whaler Guardian, 24 feet long by 8 feet 3 inches wide, built in 1997 and powered by two 200- horsepower Mercury outboard engines. The coxswain’s control/console station was in the center of the boat, with a leaning post behind it. The console was covered by an overhead T-top made of canvas stretched over a metal framework. Radio and radar antennas were mounted on the T-top. The boat was equipped with separate red and green sidelights and a white all-around light. The vertical separation between the sidelights and the white all- around light was about 1 foot.4 The red and green sidelights were moved from the bow area to the forward outside corners of the T-top when it was installed in 2001. The white all-around light was also moved to the T-top and installed on top of a 1-foot extension aft of the radar antenna. Safety Board investigators examined the boat involved in the accident and found that the radar antenna partially blocked the white all-around light for about 10° on either side of dead ahead (see “Other Information” section for further discussion of navigation lights on Coast Guard patrol boats). The manufacturer’s operating limit for each outboard engine is 4,400 rpm. Coast Guard Station Miami Beach had established a 4,000-rpm limit for normal (nonemergency) high-speed operations. Depending on sea state and vessel load, 4,000 rpm on both engines produced speeds of about 32 knots. The steering wheel was offset left of center on the console. Immediately right of center were the engine controls, which consisted of a single lever control (shift and throttle on the same lever) for each engine, mounted together (see figure 7). Two separately keyed ignition switches (one for each engine) were mounted under the wheel. The steering wheel had a knob attached to ease turning (see figure 8). 4 The Inland Navigation Rules stipulate that the minimum vertical separation between sidelights and the white all-around light will be 1 meter (3.3 feet).

Factual Information 12 Marine Accident Report The Coast Guard patrol boat was equipped with a toggle-style engine kill switch (see figure 9), provided by MerCruiser, the engine’s manufacturer. The kill switch was mounted on the aft vertical face of the center console, to the right of the engine ignition Figure 7. Postaccident photograph of Coast Guard patrol boat console. Figure 8. Patrol boat steering wheel, with steering-assist knob.

1. Kill switch location
2. Engine ignition keys
3. Throttles
4. Damaged steering wheel

1 2 4 3

Factual Information 13 Marine Accident Report switches and about 1 1/2 feet lower than the engine control levers (see figure 7). A plastic loop on one end of a coiled lanyard (about 1 foot long, it could be stretched to about 4 feet) fit over the kill switch, where it was held in place by a plastic cover. The other end of the lanyard was connected to a plastic handcuff key clip on the coxswain’s belt (see figure 10). About three months before the accident, Coast Guard Station Miami Beach had changed to a coiled lanyard because the straight one used previously had interfered with work, according to the commanding officer of the station. The system is designed so that if the plastic loop and lanyard are pulled in any direction from the kill switch (when, for example, the operator inadvertently moves away from the console), the engines should stop. In such a system, the kill switch maintains an open circuit while the engines are operating. When the lanyard-and-loop assembly is pulled from the switch, the toggle closes the switch, which grounds the ignition circuits and shuts down the engines. When the kill switch is in the on position, the engines can be started regardless of whether the lanyard-and-loop assembly is in place. The handcuff key clip was connected to a loop on the coxswain’s web belt. The crewmember confirmed during her interview that the kill switch was connected by the lanyard to the coxswain’s belt. After the accident, the handcuff key clip was found broken (figure 10). A Safety Board investigator took possession of the handcuff key clip and kill switch lanyard from the commanding officer of Coast Guard Station Miami Beach and delivered them to the Safety Board’s Materials Laboratory for examination (see “Test and Research” section for more information). Engineering staff at Coast Guard Station Miami Beach completed a daily examination of each boat at the station, following a checklist. At the time of the accident, the list did not include checking the kill switch operation. However, the station’s standing orders required the kill switch to be checked daily. The station duty engineer stated that he Figure 9. Kill switch with lanyard attached.

Factual Information 14 Marine Accident Report had checked the kill switch on the morning of the accident and that it had operated properly. The checklist also included a visual examination of the engines, with a check of fuel and oil levels, and operational tests of engines, navigation lights, searchlight, worklights, and bilge pumps. The only deficiency noted on the January 12, 2002, checklist for the CG242513 was that the starboard worklight was inoperative. After Safety Board investigators viewed the salvaged Coast Guard patrol boat, located part of the kill switch, and viewed the damaged steering wheel and the broken plastic clip hook from the coxswain’s belt used to attach the kill switch lanyard, they interviewed a Miami Beach police officer about the kill switch. The officer reported that the kill switch lanyard was hanging from the switch when he leaned into the patrol boat. After wedging the boat into pilings at Palm Island, he and the FWC officers shut off the engines by pulling on the console’s wiring harness and hitting the console with a baton. After the patrol boat was salvaged and T-top placed upright, the kill switch and lanyard were found in the deck drain. (The lanyard was not connected to the switch.) At the request of Safety Board investigators, the Station Miami Beach commanding officer polled his coxswains about the kill switch lanyard becoming fouled with the steering wheel during turns. The coxswains universally reported having experienced the problem more than once. Figure 10. Belt loop with broken clip (left) and lanyard with metal clip and plastic loop (right).

Factual Information 15 Marine Accident Report Safety Board investigators advised the Coast Guard team conducting an internal investigation of the accident and Coast Guard Headquarters Office of Boat Forces5 that the kill switch did not activate in the accident. As a result, a safety advisory regarding engine kill switches was sent out by the Coast Guard Assistant Commandant for Operations, in ALCOAST6 message 038/02 on January 30, 2002: Crews operating non-standard boats and cutterboats are at significantly higher risk for ejection from their boat than their counterparts operating larger standard boats. In FY 2001 alone, over 70 Coast Guard members had unplanned departures from their boats. . . . As a result of these mishaps, two Coast Guard members lost their lives and one was seriously injured. The Coast Guard message also stated that kill switches must be used at all times while such boats are under way, and that kill switch lanyards must be attached to a metal D-ring on the coxswain’s lifejacket or survival vest. The Coast Guard message equated the wearing of the kill switch lanyard to putting on a seat belt when operating an automobile. Further, the message required that the kill switch and lanyard be inspected daily, incorporated into a daily checklist, and tested weekly. It also stated that Coast Guard headquarters intended to have kill switches installed on all nonstandard boats, and that boats less than 40 feet long are to have kill switches installed within 24 months. Finally, the message mandated inspecting kill switch and lanyard configurations for condition and switch location, and making changes if necessary. The Coast Guard reported that its inspection of the kill switch wiring inside the console after the accident revealed a disconnected wire. The report indicated that the disconnected wire would have kept a ground from being completed in the ignition circuits when the toggle switch was closed, thereby preventing the engines from stopping. Possible explanations offered by the Coast Guard report for the disconnected wiring are, first, that the boat was used earlier in the day to respond to a boat taking on water offshore about 10 miles from Coast Guard Station Miami Beach. The coxswain in the case stated that he had run the boat at high speed in moderate seas, causing moderate to severe pounding of the boat. Such pounding, according to the Coast Guard report, could have disconnected the wiring. Second, the report stated that the wiring could have been disconnected by one of the police officers who boarded the boat and tried to stop the engines by pulling wires in the console. Third, the Coast Guard report stated that the wiring could have been disconnected when the console was torn loose from the deck. Bayside Blaster The Bayside Blaster, O.N. 1033547, was a fiberglass-reinforced plastic, 65-foot- long by 18-foot-wide, 54-gross-ton small passenger vessel, built by the Defender Yacht 5 The office functions in the Coast Guard Headquarters Operations Directorate and is responsible for planning coordination and facility management for Coast Guard groups, stations, aids to navigation teams, port security units, and all small boats less than 65 feet long (standard and nonstandard). The office also develops boat crew survival equipment standards and requirements, provides for their acquisition and maintenance, and coordinates small boat training. 6 Message sent by U.S. Coast Guard headquarters to all Coast Guard units.

Factual Information 16 Marine Accident Report Company in 1995. The Bayside Blaster was powered by two 1,600-horsepower diesel engines. It was owned and operated by Boatrides International, Inc., Miami, Florida, a subsidiary of Island Queen Sightseeing Tours, Inc., a company that operated three other vessels. According to the company’s website, Island Queen Sightseeing Tours is a family- owned business that has operated for over 50 years. Passenger seating in the Bayside Blaster was on fixed benches, divided by a center walkway. Eight rows of benches were aft of the raised operator’s station (see figure 11) and three rows of benches were forward of the station. A canvas awning covered the rear passenger area, and a separate canvas awning covered the operator’s steering station. The Bayside Blaster was equipped with separate red and green sidelights, a white masthead light, and a stern light. The red and green sidelights were installed on the side bulkheads, at the forward corners of the operator’s raised station in the center of the vessel. Postaccident examination of the Bayside Blaster’s navigation lights by the Coast Guard in Miami showed that the sidelights were not properly screened, that the arc of visibility of the sidelights was approximately 30° greater than it should have been, and that the vertical separation between the masthead light and the gunwale was less than the required minimum of 2 1/2 meters (8.2 feet). The masthead light was mounted on the forward bulkhead of the operator’s station, near the top edge, and the light’s arc of visibility terminated at the port and starboard beams. Safety Board investigators found the stern light mounted on the top of the canopy, at its rearmost edge. The light fixture was designed to be an all-around white light, but the forward half of the lens was covered with duct tape to make it a stern light. Figure 11. Bayside Blaster seating, looking aft from steering station.

Factual Information 17 Marine Accident Report The Bayside Blaster was inspected by Coast Guard Marine Safety Office Miami and was issued a certificate of inspection (COI)7 on August 20, 2001, permitting the vessel to carry 83 passengers, with a minimum crew of a master and two deckhands, on a limited coastwise route on the Atlantic Ocean and the Gulf of Mexico between Melbourne, Key West, and Cape Romano, Florida, not more than 3 miles from shore. The Coast Guard’s inspection for certification of the Bayside Blaster included approval of the navigation lights and lifejacket locations. The Bayside Blaster provided 90-minute sightseeing cruises along Millionaire’s Row, the Port of Miami, and Miami Beach, usually only on weekends. Waterway Information Miami Harbor is a deepwater port on the east coast of Florida. It is principally a consumer port (most imported cargo is consumed in the area rather than transshipped elsewhere) and is of great importance as a cruise port. Two unmarked jetties protect the harbor entrance, known as Government Cut. Miami Beach is the barrier island that separates Biscayne Bay from the ocean. Causeways and bridges connect a series of islands throughout Biscayne Bay to Miami Beach and the city of Miami on the mainland. A Coast Guard complex, including Coast Guard Station Miami Beach, is on the north side of the main ship channel at the east end of the MacArthur Causeway, and a large cruise ship complex and container port are on the south side of the main channel. The MacArthur Causeway forms the north shore of the main ship channel. North of the causeway, in Biscayne Bay, are Palm, Hibiscus, and Star islands. The area of the bay where the accident occurred has background lighting from various sources in the Miami harbor area, including downtown office buildings to the west and private residences around Biscayne Bay. The MacArthur Causeway and the brightly lit container port are located south of the accident site, and an area of white and red lights on the islands and bridges is located to the north. The lights are generally at the same level as the navigational lights of vessels on the water. The coxswain reported that in Miami, the background lights are always a “big” visibility factor, and that on nights when the causeway has more traffic, it is more difficult to operate. The coxswain also stated that he knew there was a blind spot coming around the end of Hibiscus Island, and that he made a wide turn at 4,000 rpm. Most of Biscayne Bay has low-speed restrictions on vessels, imposed by the State of Florida to protect manatees, a marine mammal that is covered by the Federal Marine 7 Small passenger vessels carrying more than six passengers for hire may not operate without a valid Coast Guard COI, which is issued by the Coast Guard Officer in Charge, Marine Inspection, for the zone. The COI, among other conditions, stipulates minimum firefighting, lifesaving, and staffing requirements. When determining the number and competencies of the crewmembers, the Officer in Charge, Marine Inspection, considers many factors, including the size of the vessel, its route, the type and horsepower of the vessel’s propulsion machinery, the number of passengers, the type and location of lifesaving equipment, and the hazards peculiar to the route and service.

Factual Information 18 Marine Accident Report Mammal Protection Act of 1972 and the Endangered Species Act of 1973. The Florida Manatee Sanctuary Act was passed in 1978 to regulate motorboat speeds and operations in critical areas of manatee concentration. In those zones, boats must operate at idle or slow speeds (the designation can vary by time of year). Idle speed is defined as the minimum speed that will maintain the steerageway of a vessel while producing no wake. Slow speed is defined as the speed at which a vessel is off plane, has settled into the water, and is proceeding without a wake or with a minimal wake. In the area of the accident, slow speed is the maximum allowed year-round. The area immediately north of Star Island and northeast of Hibiscus Island has a vessel speed limit of 35 mph. Two signs mark the boundary of the manatee-protection zone where the accident occurred. One sign is on the northwest corner of Star Island and the other is on the northeast corner of Hibiscus Island. A boat rounding Hibiscus Island and heading south immediately enters the State-designated slow-speed zone. The distance from where the Coast Guard patrol boat made the turn at Hibiscus Island to the area of the accident is about 400 yards (see figure 5). Meteorology Information Hourly observation tables from the National Weather Service for Miami International Airport, approximately 8 miles west of the accident site, show that at the time of the accident, there were broken clouds, with a visibility of 10 miles and a temperature of about 67º F. The winds were 6 knots from the south-southeast. According to the Coast Guard, the seas were calm and there was no precipitation in the vicinity at the time of the accident. Sun and moon data provided by the U.S. Naval Observatory Astronomical Applications Department for Miami, Dade County, Florida, for January 12, 2002, list the sunset at 1750 and the end of twilight at 1815. Moonrise occurred at 1827. The moon was in a waning crescent phase, with 1 percent of its visible disk illuminated. Operations Coast Guard Operations Coast Guard Station Miami Beach is a multimission boat station. Its primary duties are search and rescue (SAR), law enforcement, and port security. It has a response requirement of providing two boats and crews on 30-minute standby, 24 hours a day, 365 days a year. To maintain daily control of the response duties, senior second-class or first- class petty officers rotate as OOD. At the time of the accident, the OODs stood a 24-hour duty period on a 5- to 7-day rotation and were not part of the boat crews. The boat crews for the standby operations were organized into four duty sections. Each section had at least two complete boat crews (two each of the following: coxswain, engineer, and crewmember) and a boarding team (boarding officer and boarding team member). The

Factual Information 19 Marine Accident Report senior coxswain in each duty section was responsible for the overall mission-readiness of his section. Guidelines from the command structure to the OODs and duty sections were provided by verbal direction and the station’s standing orders. The duty coxswain was responsible for the overall mission-readiness of all SAR resources under his or her control, and while under way had overall responsibility for the operation of the vessel. The main duties of the duty boat crewmember while under way were to follow the directions of the coxswain and to act as primary lookout. The standing order that covered the operation of small boats required the OOD to give permission for all boat launches. The order also provided operating limitations for each type of boat based on seas, wind, and visibility. The standing order did not mention specific speed or nighttime limitations for any patrol. Coast Guard Group Miami is the supervising unit for Station Miami Beach. Group Miami is responsible for coordinating the operations of 16 separate units, which include four small boat stations, among them Station Miami Beach. The Seventh Coast Guard District, headquartered in Miami, is the supervising unit for Group Miami and is the program manager for nonstandard boats at Station Miami Beach. Coast Guard Nonstandard Boat Oversight According to the Coast Guard, small boat operations are divided into two categories—standard and nonstandard boats. Standard boats are those more than 30 feet long and include the 41-foot UTBs and the 47-foot motor lifeboats (MLBs). Standard boats are designed and procured by Coast Guard headquarters. For standard boats, crew training, crew qualifications, vessel outfitting, and vessel operating limitations are set by Coast Guard headquarters. In addition, a 41-foot UTB standardization team from the Coast Guard Training Center and a 47-foot MLB team from the National Motor Lifeboat School at Cape Disappointment, Washington, biannually visit every boat station that has standard boats to inspect the standard boats and check the standardization of crew qualification. During the years when the national visit is not made, the group office that supervises the station conducts a ready-for-operations inspection for the same purpose. Both inspections concentrate solely on standard boats. The Boat Crew Training Manual (Commandant Instruction M16114.9C), issued by Coast Guard headquarters in May 1998, contains guidance for training and certifying personnel to operate Coast Guard boats. Nonstandard boats, those measuring 30 feet or less in length, compose the remainder of the small boats at stations. The local Coast Guard district office has procurement authority. Thus, the manufacturer, size, and equipment of nonstandard boats vary widely, depending on the operating region and the conditions at individual stations. Nonstandard boats are typically highly maneuverable, lightweight vessels that have a greater speed, a shallower draft, and require fewer crewmembers than standard boats. Nonstandard boats make up 53 percent of the boats operated by Coast Guard station boat crews and carry out 3 percent of SAR missions.8 8 U.S. Department of Transportation (DOT), Audit of the Small Boat Station Search and Rescue Program, Office of Inspector General, report MH-2001-094, September 14, 2001 (Washington, DC: DOT, 2001).

Factual Information 20 Marine Accident Report According to Coast Guard officials, at the time of the accident, no formal training or certification requirements existed for operating nonstandard Coast Guard boats. When someone was qualified on standard boats at a Coast Guard station, he or she was automatically considered qualified to operate nonstandard boats, although qualification on a particular type of vessel did not automatically qualify an individual on all types of vessels. As noted earlier, the Coast Guard has since issued nonstandard boat PQS certification and check ride requirements, which are distinct for each type of nonstandard boat in addition to being separate from the requirements for standard boats. During his interview, the coxswain stated that all the qualification requirements to become a coxswain at Station Miami Beach were carried out on the 41-foot UTB. He also reported that during the coxswain qualification process, he was asked only “a couple of questions” about nonstandard boats and did not have to complete any qualification standards specific to the operation of nonstandard boats. The crewmember also stated that Coast Guard personnel are qualified on the 41-foot UTB, but noted that they do some drills and familiarization exercises on nonstandard boats. An addendum to the Coast Guard Station Miami Beach nonstandard boat qualification guide for coxswains, engineers, and boat crewmen contains qualification requirements regarding the nonstandard boats used at the station. One section on boat handling contains an eight-item checklist. Three items assess operator proficiency in mooring and anchoring the boat, in the proper use of tilt/trim controls, and in maneuvering the boat in tight quarters. The remaining items require the operator to explain different aspects of boat handling, but they do not require an individual to demonstrate skill in boat handling. A review board consisting of the unit’s department heads recommends qualified personnel to the commanding officer, who approves and designates them as qualified. Recreational Boating Safety and Manatee-Zone Enforcement Patrols Undertaking a routine patrol is left to the discretion of the OOD or coxswain.9 No specific patrol routes or minimum number of patrols per day were required at the time of the accident. The OOD had final authority in the duty section and approved the areas to be patrolled, the boat to be used, and the crew. According to the coxswain, he decided to go on the patrol, with permission from the OOD. He further stated that he intended to conduct a patrol of the manatee-protection zone near Palm Island because of the high incidence of high-speed operation of personal watercraft in the area. According to Coast Guard officials, station management learns of improper operation of its patrol boats (personnel not obeying speed limits or operating recklessly) from other crewmembers, from citizen complaints, or from postaccident or incident investigations. The commanding officer of Station Miami Beach stated that he had not received any complaints about the manner in which his coxswains had operated their boats before the accident. The marine patrol unit of the Miami Beach Police Department reported that no previous complaints had been filed against Coast Guard Station Miami 9 The Coast Guard defines a routine patrol as a random-timed patrol in the AOR in support of Coast Guard missions.

Factual Information 21 Marine Accident Report Beach personnel for operating at high speeds in restricted zones. The FWC also reported that it had not received any complaints from the public or reports from its personnel about Coast Guard boats speeding in the restricted zones. A Florida statute (68C-22.003(2) and (3)) exempts law enforcement officers from speed restrictions when entering a “motorboats prohibited” or “no entry” area in the performance of their duties if the entry is reasonably warranted, is conducted to directly protect manatees, or is necessary to prevent the loss of life or property or to render emergency assistance. Because the Coast Guard personnel involved in the accident were conducting a routine patrol, they were not exempt from the State’s manatee-zone speed restrictions. Island Queen Sightseeing Tours Operations According to the procedures and policy manual of Island Queen Sightseeing Tours, which lists duties of the company’s employees, the vessel master is responsible for the operation and maintenance of company vessels and for supervising deckhands while under way. He is also responsible for reporting deficiencies in policies, equipment, procedures, or personnel to the operations manager. Island Queen employees were responsible for completing the deck assignment checklist for their assigned deck while under way, unless they were attending to passengers (for example, narrating). The checklist included cleaning the vessel and restocking the refreshments sold to passengers. When they were not attending to the checklist or other shipboard duties, the crewmembers were required to monitor passengers for safety and for enforcement of the alcoholic beverage policy. The procedures and policy manual states, “Employees shall not operate any company vehicle or crew any vessel when taking any type of drug (prescribed or over the counter) that affects faculties in any way contrary to safety.” The company is a member of the American Professional Captains Association’s Maritime Drug Consortium.10 The consortium conducts drug testing for preemployment, for periodic testing, for random testing, for postaccident testing, and for reasonable cause. It also provides medical review officer services and an employee assistance program for employees with substance-abuse problems. Boat crews for all four Island Queen Sightseeing Tours vessels were drawn from the same staffing pool and scheduled in advance by the Island Queen operations manager. Typically, the day crews and evening crews changed about 1730. The Bayside Blaster was required to have a crew consisting of a licensed master and two deckhands. The operations manager said that two deckhands were scheduled for the 1930 trip on the Bayside Blaster on the evening of the accident. However, the second deckhand for the 1930 trip did not report for work the day of the accident. The master stated that he decided it was safe to sail with only one deckhand and that he had done it before, although infrequently. The 10 Title 46 CFR 16.201-260 (subpart B) requires marine owners to have an approved drug-testing program for their employees involved in vessel operations.

Factual Information 22 Marine Accident Report operating manager said that he was not informed that the Bayside Blaster was short one deckhand before the trip started. He indicated that it was not the first time the Bayside Blaster had sailed shorthanded, but that it did not typically do so. Medical and Pathological Information Two marine casualty investigators from the Coast Guard Marine Safety Office, Miami, conducted Breathalyzer tests for alcohol on the crewmembers of the Bayside Blaster immediately after the accident, while they were on Monument Island. The results were negative. Between 0405 and 0420 on January 13, urine samples were taken by a contractor to test for the presence of drugs. The master of the Bayside Blaster tested negative. The deckhand tested positive for cannabinoids/THC (marijuana). Witnesses stated that the deckhand performed his duties in a seamanlike manner and did not appear to be impaired. After the accident, the owner reported that he had suspended the deckhand from his safety-sensitive position as deckhand but had continued to employ him. The deckhand was placed in the Maritime Drug Consortium’s drug rehabilitation and monitoring program for at least 1 year. He was drug-tested on February 27, 2002, with negative results. His latest drug test, on October 15, 2002, was also negative. He was reinstated to a safety-sensitive position on May 1, 2002. Postaccident blood samples were taken from the Coast Guard coxswain and the crewmember at Mount Sinai Medical Center, Miami Beach, to test for the presence of drugs and alcohol. The coxswain’s sample was taken about 4 hours after the accident, and the other crewmember’s was taken approximately 5 hours after the accident. The results for both coxswain and crewmember were negative for drugs and alcohol. Wreckage Coast Guard Patrol Boat The bow section of the Coast Guard patrol boat was crushed back about 4 feet, with evidence of buckling on the inside and outside of the hull (see figure 6). The stainless steel trailer eyebolt was broken and bent downward. The T-top and center console assembly was torn loose from the deck plate mounting attachments. The aft mounting plates were torn upward, and the forward mounting plates were bent forward and torn out. The port forward frame of the T-top was crushed rearward. The starboard engine propeller shaft was broken, as evidenced by the freely rotating propeller. The starboard side of the outboard engine’s lower gear housing and one of the propeller blades had fresh contact marks. The red plastic assembly of the port running light was missing, but the starboard running light was present and undamaged. A Safety Board investigator took possession of both lights from the commanding officer of Coast Guard Station Miami Beach and delivered them to the Safety Board’s Materials Laboratory for examination (see “Test and Research” section for more information).

Factual Information 23 Marine Accident Report The ignition switches on the center console were found in the off position, with the keys inserted in the switches. The kill switch assembly was destroyed. The actual switch was found in the deck drain on the port side, along with, but not connected to, the kill switch lanyard. Inspection of the wiring harnesses inside the console showed that a connection was pulled apart. The connection was traced to the remains of the wiring to the kill switch. The steering wheel was broken and about a third of its circumference was missing, along with the knob on the wheel used for steering. Bayside Blaster Damage to the starboard side of the hull began about 20 feet forward of the transom. A series of scrapes and gouges originated in that area and extended aft, toward the stern and up to the deck. The gunwale aft was buckled inward above its joint with the main deck. The gunwale cap was torn loose and shifted rearward. The aft starboard canopy stanchion was torn away from the gunwale. Three bench seats on the starboard side aft were torn from the deck. They had been mounted to the deck with wood screws. The screws had left gouges in the deck, indicating that the seats had been displaced to the port side across the center aisle and against the seats on the port side. A canopy stanchion attached to one of the seats was torn loose and bent. Other Damage The Coast Guard patrol boat struck a moored 46-foot fiberglass recreational boat, damaging the boat’s bow pulpit area and the forward section of its port side. Survival Aspects Emergency Response At 2015, the master of the Bayside Blaster notified Coast Guard Station Miami Beach of the accident via VHF-FM radio channel 16. According to the recorded radio communication, he reported that a runaway vessel with no one on board had “broadsided” his vessel. Simultaneously, a witness on Palm Island telephoned Coast Guard Station Miami Beach to report the collision. An operator of a private vessel also notified Coast Guard Station Miami Beach of the accident on VHF-FM radio after the Bayside Blaster had left the scene. He confirmed the location of the Coast Guard patrol boat and stayed in the area, remaining clear of the patrol boat until it hit the pilings and stopped. At 2017, Coast Guard Station Miami Beach dispatched two boats to the scene. The Coast Guard station notified the city of Miami emergency dispatcher, who passed the information to the Miami Beach Police Department marine unit and the FWC. Both units dispatched patrol vessels to the scene. A boat from Miami Fire-Rescue also responded. A

Factual Information 24 Marine Accident Report Coast Guard Auxiliary vessel and a commercial towing company, Seatow Miami, overheard the VHF radio traffic and responded to the scene. Island Queen Sightseeing Tours also responded with another of the company’s small passenger vessels, the Island Queen. At approximately 2025, the first response vessels on scene were two Coast Guard boats, followed shortly by the other vessels noted above. At that point, the Coast Guard patrol boat was still running in circles. About 2035, when the patrol boat collided with the shore pilings on Palm Island, the FWC and Miami Beach Police Department marine unit vessels came alongside the patrol boat. A Miami Beach officer reached for the ignition switches and observed that the kill switch lanyard was hanging from the kill switch. He pulled the lanyard off, then tried to reach the ignition switches, ultimately striking them with his baton. At the same time, two FWC officers boarded from the starboard side of the Coast Guard patrol boat. One officer tried to pull the throttles to neutral but could not stop the engines or slow their speed. The other FWC officer reached into the console interior and began pulling at the wiring harness in an attempt to shut off the engines. The engines subsequently shut down. A search of the vessel by the responding officers confirmed that no one was on board. After the Bayside Blaster beached on Monument Island, most of the passengers disembarked off the bow onto the island. The master accounted for all passengers by asking each group to check for all its people. FWC officers directed Coast Guard and Miami Beach Police Department personnel to make a passenger list. After the list was complete, passengers not going to the Coast Guard station for triage were transported on the Island Queen to the Bayside Marina. Coast Guard boats transported people reporting injuries and others in their group to Coast Guard Station Miami Beach, where ambulances were standing by for triage. Five passengers complained of minor injuries and two passengers were transported to the hospital by local emergency medical services. Three of the passengers did not request any further medical care and were transported to the Bayside Marina by government vehicle. The Coast Guard crewmembers reached shore with the help of two people from Palm Island who swam out to render aid. An ambulance called by the Palm Island security force transported the two Coast Guard crewmembers to Mount Sinai Hospital, Miami Beach, for examination. The crewmembers were released from the hospital early on the morning after the accident and returned to Coast Guard Station Miami Beach. The master and deckhand brought the Bayside Blaster, under its own power, back to Bayside Marina, escorted by a Coast Guard Auxiliary vessel. The Coast Guard patrol boat was towed by Seatow Miami to a nearby boat ramp, put on a highway boat trailer, and transported to Coast Guard Station Miami Beach.

Factual Information 25 Marine Accident Report Emergency Systems/Survival Equipment Coast Guard Patrol Boat. The crewmembers on board the Coast Guard patrol boat were wearing automatically inflating lifejackets that had been provided to station personnel about 6 months earlier. They were also wearing web belts with law enforcement equipment attached (9-millimeter pistol, magazines, baton, and handcuffs). The lifejackets are worn uninflated during routine underway operations. When needed, a carbon dioxide cartridge inflates a bladder in the lifejacket. The cartridge is activated by a manual pull toggle, or it activates automatically after being immersed in water for about 4 seconds. In all previous training with the inflatable lifejackets, station personnel had used a mouth- inflation tube to inflate them. Crewmembers had received no training in which the lifejackets were inflated using the carbon dioxide cartridge. When the crewmembers were ejected into the water, the lifejackets inflated automatically. The crewmembers found that the lifejackets constricted their necks and made it hard to breathe. They also had difficulty turning their heads and found it hard to swim because the buoyancy of the lifejackets rolled them onto their backs. The crewmembers said that they removed their lifejackets to make it easier for them to swim, to allow them to look out for the circling patrol boat, and to enable them to dive under the boat to keep from being hit. Since the accident, Coast Guard Station Miami Beach has instituted annual training in the use and operation of the inflatable lifejackets, including in-water training, inflation by mouth tube, and manual and automatic carbon dioxide inflation. The training includes swimming with lifejackets inflated. Bayside Blaster. The Bayside Blaster was equipped with 90 Coast Guard- approved adult-size lifejackets stowed in lockers at the bow (see figure 12). The lifejackets could be reached through two vertical hatches at the forward edge of the forward passenger seating area. The hatches were not labeled. The owner reported that the signs had been removed during ongoing refinishing of the decks and bulkheads. Fourteen Coast Guard-approved child-size lifejackets were stored in a compartment at the operator’s station. The compartment was labeled “Childs Lifejackets,” but the locker’s opening mechanism was broken. Safety Board investigators observed that opening the compartment required prying the latch with a knife or similar object. Small passenger vessels such as the Bayside Blaster that carry 150 or fewer passengers or have overnight accommodations for 49 or fewer passengers are required by 46 CFR part 180.78 to have lifejackets “stored in convenient places distributed throughout accommodation spaces.”11 The CFR further requires that “each life jacket kept in a storage container must be readily available.” Federal regulations (46 CFR part 185.604(f)) also require that each container for lifejackets be marked with the number and identification of the items stowed inside. The Coast Guard last inspected the Bayside Blaster on August 20, 2001, and found no deficiencies in lifejacket stowage, although the inspection required 11 The same regulation is found at 46 CFR 117.78 for small passenger vessels that carry more than 150 regular passengers or more than 49 overnight passengers.

Factual Information 26 Marine Accident Report replacing the reflective tape on some lifejackets. The Bayside Blaster was certified for service as a result of the inspection. In a recent accident on the small passenger vessel Port Imperial Manhattan investigated by the Safety Board,12 lifejacket stowage was identified as a problem. The Safety Board concluded, “If the lifejacket stowage had been more evenly distributed throughout the passenger cabin of the Port Imperial Manhattan, the lifejackets would have been more accessible to the passengers.” After the accident, the owners voluntarily made changes to improve the stowage and distribution of lifejackets on this vessel and on another company vessel with similar lifejacket stowage problems. As a result of the Port Imperial Manhattan investigation, the Safety Board issued the following Safety Recommendation to the Coast Guard on July 3, 2002: M-02-13 Issue a directive to small passenger vessel operators to review the distribution of lifejackets on board their vessels and to ensure that the lifejackets are accessible and segregated. Figure 12. Bayside Blaster’s forward lifejacket stowage lockers. 12 National Transportation Safety Board, Fire On Board the Small Passenger Vessel Port Imperial Manhattan, Hudson River, New York City, New York, November 17, 2000, Marine Accident Report NTSB/MAR-02/02 (Washington, DC: NTSB, 2002).

Factual Information 27 Marine Accident Report On November 19, 2002, the Coast Guard responded, stating that it “will issue a Safety Alert reminding small passenger vessel operators of the requirements and suggest that they review the stowage arrangements on their vessels to ensure compliance with the regulations.” Tests and Research Kill Switch Attachments The Safety Board’s Materials Laboratory examined the following kill switch attachments from the Coast Guard patrol boat: a curled nylon lanyard (about 3/16 inch in diameter by about 1 foot long curled, or about 4 feet long stretched), with a plastic loop (about 1 3/4 inches long by about 5/8 inch wide by 5/32 inch thick) on one end and a metal clip (1 7/8 inches long by 1/2 inch wide by 5/32 inch thick) on the other. The end of the plastic loop fit into the kill switch on the boat console. The metal clip end was attached to a plastic clip of about the same size, on a nylon loop (about 2 1/2 inches long [1 1/2 inches in diameter] by about 1 inch wide by about 1/8 inch thick) that had been attached to the coxswain’s belt. The end of the plastic clip on the belt loop was broken off (see figure 10). The end of the plastic clip was not found. The inside surface of the recovered part of the plastic clip from the belt loop showed several areas of damage and two smeared surface areas, each displaying a similar arced shape that matched the end of the lanyard’s metal clip. A V-shaped impression was observed where material had been displaced upward and outward. The V-shaped impression was deepest at the edge, and its direction was across the width of the clip, stopping just past the center. The edges of the fracture face were sharp and well-defined. The fracture intersected a void containing a series of surface lines emanating from the void. The void was located at the maximum material thickness of the section of the clip. According to the Materials Laboratory, the void was typical of a shrinkage void in an injection-molded product. The inner surface of the kill switch loop attachment, which would normally contact the kill switch toggle, appeared to be disturbed by a rubbing action. There were no indications of severe deformation. Coast Guard Patrol Boat’s Navigation Lights The Safety Board’s Materials Laboratory examined the Coast Guard patrol boat’s port and starboard running lights. The port running light assembly was damaged. It consisted of the base with the bulb, but the red lens was missing. The bulb’s glass envelope was removed from the port running light assembly for examination under a scanning electron microscope. One end of the filament end was fractured in a brittle manner, typical of the fracture of a cold filament (no electrical flow through the filament). The other filament end was fractured in a globular fashion, typical of the fracture of a hot element (with electrical flow).

Factual Information 28 Marine Accident Report According to the Materials Laboratory, to produce these fracture features, the sequence of events must have been as follows: (1) the globular fracture and bending of the filament were produced first, while electricity was flowing, and (2) the brittle fracture was produced later, when the filament had cooled. The starboard running light assembly was undamaged and consisted of the base, the green lens, and the bulb. The Materials Laboratory determined that the filaments of the port and starboard running lights displayed stretching and deformation features consistent with being illuminated at the time of impact. Other Information Postaccident Developments Nonstandard Boat Program. The DOT Inspector General’s report, Audit of the Small Boat Station Search and Rescue Program, made recommendations to the Coast Guard concerning nonstandard boats. As noted in the report, a Coast Guard risk analysis was conducted in July 2000 as a result of the increase in accidents involving nonstandard boats. Improper operation of nonstandard boats was identified as the highest concern. Since then, the Coast Guard has made a number of changes in the nonstandard boat pro- gram. Some were already under development when the accident occurred; some were instituted as a result of the accident. The audit recommendations concerned developing and implementing a strategic plan for improving SAR readiness. The report found that oversight at the Coast Guard headquarters level is needed to ensure standardization of nonstandard boats and rigid-hull inflatable boats in all aspects of their use, including operational doctrine, training, and boat design and configuration (there are about 293 different nonstandard boats of varying types and designs among the 554 Coast Guard rescue boats). The report found that commanding officers should give safety and training precedence over less urgent or less important command or program operational goals to ensure that units will be “always ready” for more urgent or more important operations. The report also indicated that Coast Guard headquarters involvement is needed to assure the implementation of Coast Guard risk analysis recommendations. On March 11, 2002, the Office of Boat Forces and the Office of Safety jointly sent a mishap trend message from Coast Guard headquarters to 384 Coast Guard units operating nonstandard boats or having support responsibility for nonstandard boats. The message challenged leaders involved with small boat operations to reverse the trend of mishaps involving small boats. Specifically, it suggested training in operational risk management and team coordination as a way of reducing small boat mishaps. The message emphasized that human errors were causing a high number of the recent mishaps involving nonstandard boats. In the message, the Chief of Boat Forces encouraged boat

Factual Information 29 Marine Accident Report force leaders13 to “impress upon all hands that throttles have more than two [stop and full] operational positions.” He emphasized that “normal operating speeds must be something less than maximum speeds, and coxswains must have time to see, react, and avoid obstacles.” He continued, “The image of the young Coastie zipping along at max throttle is becoming a stereotype, reflects poorly upon out [sic] professionalism, and encourages reckless behavior in our developing boat crews.” A draft nonstandard boat operations manual that had been available to units on the Coast Guard web site for over a year was in the final phases of revision when the accident occurred. On April 3, 2002, the Non-standard Boat Operators Handbook (Commandant Instruction M16114.28) was published. The manual covers basic boat operation and provides sample preventive maintenance and boat outfitting checklists. Chapter 5, section A, “Operating Parameters,” addresses speed: “A high number of small boat mishaps can be attributed to excessive speed.14. . . As a crewmember, never hesitate to ask the coxswain to SLOW DOWN or take up a more forgiving heading. There is no justification for navigating recklessly or fatiguing crews unnecessarily. . . . Safe operating speed is an element of prudent seamanship.” On April 25, 2002, the Commandant of the Coast Guard issued a final action letter15 to all Coast Guard stations regarding a March 2001 accident involving a Coast Guard small boat. The Coast Guard boat had deviated from its intended patrol route and had capsized in Lake Ontario, resulting in the deaths of two Coast Guardsmen. The Commandant found that “the deaths resulted from a series of equipment and experience shortfalls, as well as a number of mistakes” by Coast Guard personnel on the water and on shore. The Commandant specifically found that administration, supervision, and training related to nonstandard boats was inadequate and “that the normal boat tracking and mission monitoring process failed.” As a consequence of the Coast Guard’s internal investigation of the March 2001 accident in Lake Ontario, the Commandant directed several actions related to nonstandard boat support, training, and operation. Among other things, he instructed the Assistant Commandant for Operations to ensure that small boat coxswains provide the unit maintaining their radio guard with a “float plan” and that they notify the guarding unit of any significant changes in their projected movements. Furthermore, he required each Coast Guard area and district commander to publish operating limits for each nonstandard boat under their responsibility and to reexamine each boat’s suitability for its purpose. 13 A boat force leader is anyone who oversees boat operations or is in the coxswain’s chain of command, such as a station commanding officer or officer-in-charge. 14 The DOT Inspector General’s audit reported that there had been a 225-percent increase in accidents in FY 2000 over FY 1998 and that “56 percent of the [FY 2000] accidents were caused by poor judgment, or navigation and operational errors and hence, were preventable.” 15 U.S. Coast Guard, Final Action on the Administrative Investigation into the Boat Mishap and the Resulting Deaths and Injuries to Station Niagara Crewmen That Occurred on 23 March 2001, file 5100, April 25, 2002, signed by Admiral James M. Loy, Commandant.

Factual Information 30 Marine Accident Report On April 29, 2002, the Coast Guard issued a revision to the Boat Crew Training Manual (Commandant Instruction M16114.9D, replacing M16114.9C). The revised manual gives more emphasis to nighttime training operations, specifically mandating that every 6 months, at least 10 percent of coxswains’ minimum required underway time should be at night. New requirements to perform drills once at night and once during the day every 6 months will take effect in January 2003. The Coast Guard Headquarters Chief of the Office of Boat Forces advised the Safety Board on May 14, 2002, that training teams for nonstandard boats were established in the spring of 2002. The teams became operational in the summer of 2002, and began making training visits to Coast Guard stations throughout the nation to assess the adequacy of nonstandard boat operations. On June 13, 2002, the Chief of the Office of Cutter Forces at Coast Guard headquarters issued a new Coast Guard Navigation Standards Manual (Commandant Instruction M3530.2A) that sets forth navigation policies and procedures for all cutters and shore-based boats. The section of the manual that discusses unit command responsibilities16 states that commanding officers shall: Identify specific areas within the unit’s Area of Responsibility (AOR) that pose significant navigational or environmental risks to boats. The CO shall mitigate these risks by imposing specific operating restrictions such as speed limits, establishing safe operating distances from known hazards, increasing frequency of fixes, and restricting operating areas for specific boat types. Each unit shall maintain a chart on display in the operations/planning space that highlights known hazardous and special operating areas within the unit’s AOR. Navigation Lights on Coast Guard Patrol Boats. During the inspection of the damaged Coast Guard patrol boat, Safety Board investigators observed that the boat’s white all-around light was blocked for about 10° each side of dead ahead by a radar antenna dome that had had been installed about 1 month before the accident. As a result of Safety Board investigators’ conversations with the commanding officer, the all-around light on the station’s other 24-foot patrol boat was inspected and found to be similarly obstructed. The light was correctly repositioned on January 15, 2002. On January 29, 2002, the station sent a message to Coast Guard headquarters that outlined the obstructed-light problem so that other stations might learn about the issue. On two separate occasions in August 2002, one of the Safety Board investigators investigating this accident advised Coast Guard Headquarters Office of Boat Forces that he had observed two nonstandard boats (not in the Miami AOR) whose all-around white navigation lights were obscured by radar domes in front of the light. Those observations prompted Coast Guard Headquarters Office of Safety to send an ALCOAST message on September 5, 2002, to all stations having nonstandard boats. The message acknowledged that the obscuration of masthead lights on Coast Guard nonstandard boats by installed equipment was a problem of national scope that had been identified during the Bayside 16 Page 2-3, item c.

Factual Information 31 Marine Accident Report Blaster accident investigation. Consequently, Coast Guard headquarters required that all boats display proper unobscured all-around white lights, in accordance with the Inland Navigation Rules. Passenger Vessel Association The Passenger Vessel Association is an association of small passenger vessel owners and operators in the United States. The organization serves the interests of more than 350 vessel owners and operators in the domestic passenger vessel industry, which represents about 65 percent of the industry nationwide. Association members operate more than 1,100 passenger vessels in the United States, carrying up to 200 million passengers annually. Members offer services including dinner cruises, tour and excursion services, car and passenger ferries, private charters, whale-watching trips, overnight cruises, and riverboat gaming. The association has a committee responsible for reviewing, developing, and implementing programs to encourage enhanced training and safety among its members. The association’s Risk Management Manual contains a section on signage for lifesaving equipment that covers marking lifejacket lockers, but not the Federal requirement for storing lifejackets in convenient places and distributing them throughout accommodation spaces.

32 Marine Accident Report Analysis General The analysis first identifies factors that can be readily eliminated as causal or contributory to the accident. The major safety issues identified during the investigation are then discussed, regarding the adequacy of the following: • Operation of the Coast Guard patrol boat; • Operation of the Bayside Blaster; • Coast Guard oversight of routine patrols; • Boatrides International, Inc., management oversight; • Kill switch operation on Coast Guard nonstandard patrol boats; • Lifejacket stowage on the Bayside Blaster; and • Coast Guard safety oversight of small passenger vessels in Miami. Exclusions The weather on the night of the accident was mild, with calm seas and a clear visibility of 10 miles. Such conditions should not and did not interfere with either vessel operator’s ability to detect the other vessel. Both vessel operators were in generally good health and were not taking any prescription or nonprescription medications. The master of the Bayside Blaster reported his rest history for the 72 hours before the collision. He indicated that he had slept 6 hours each night on January 10 and 11 and 9 hours the evening before the accident, and that he had taken a 2-hour nap before reporting for work at 1650 the day of the accident. His deckhand had slept about 10 hours the two nights before the accident. He had reported to work at 1030 and completed three trips—at 1330, 1530, and 1730—before the accident trip. The Coast Guard coxswain’s 72-hour sleep history included 11 hours of sleep the previous two nights and 8 hours of sleep the night before the accident. The Coast Guard crewmember had obtained 7 1/2 and 8 hours of sleep the two nights preceding the accident. The coxswain and crewmember both reported to work at 0700 on the day of the accident. All four individuals reported obtaining adequate sleep on the days preceding the accident and were not affected by fatigue. The Coast Guard crewmembers provided blood samples for alcohol and drug testing between 4 and 5 hours after the accident. The results for both crewmembers were negative for alcohol and drugs. Because testing for alcohol did not take place within the optimal 2-hour period after the accident, the test does not conclusively eliminate the possibility that alcohol was a causal factor in the accident. However, the crewmembers

Analysis 33 Marine Accident Report spent more than 2 hours before the accident with other Coast Guardsmen in the crew lounge, where alcohol is not permitted. Tests of the Bayside Blaster crew for alcohol immediately after the collision were negative. Urine samples were taken about 8 hours after the accident to test for drugs. The result was negative for the master of the Bayside Blaster but was positive for the deckhand for cannabinoids/THC, indicating that he had used marijuana sometime before the collisions. The deckhand had been on duty since 1030 that morning and had served on three cruises that day; thus, any incapacitation should have been detected by coworkers or passengers. Witnesses said that the deckhand performed his duties in a seamanlike manner and did not appear to be impaired by drugs. The deckhand was placed in a drug- monitoring program and his subsequent test results were negative. Because the deckhand’s performance did not indicate that he was impaired at the time of the accident, the use of drugs is not discussed further in this report. Therefore, the Safety Board concludes that the crewmembers of both vessels were well rested and not impaired by drugs or alcohol, and that the weather and sea conditions were not factors in this accident. Collision The Bayside Blaster, with 2 crewmembers and 53 passengers on board, was on a routine evening tour in Biscayne Bay and was idling off Palm Island when the sightseeing vessel was sideswiped by Coast Guard patrol boat CG242513. The Coast Guard patrol boat, with two crewmembers on board, was traveling at an excessive speed for the restricted zone. The impact caused the Coast Guard crewmembers to be thrown overboard. The kill switch system to the patrol boat’s engines failed to operate, and CG242513 proceeded to run in circles. The circling occurred because the coxswain had made a hard turn to port in an effort to avoid hitting the sightseeing vessel, and the steering wheel remained in the turned position. The patrol boat subsequently struck one of the Coast Guard crewmembers in the water, the Bayside Blaster a second time, and another recreational boat before it came to rest against pilings near Palm Island. As a result of the accident, the two Coast Guard crewmembers sustained minor injuries requiring hospitalization, and five Bayside Blaster passengers reported injuries requiring treatment. Operation of the Coast Guard Patrol Boat There was no safety or law enforcement reason for the coxswain to operate his vessel at 32 knots while conducting a routine patrol at night in restricted waters close to shore. The coxswain knew he was nearing a no-wake, manatee-protection zone as the patrol boat rounded Hibiscus Island and that the area had strict speed restrictions, which

Analysis 34 Marine Accident Report he claimed to be enforcing on the patrol. High-speed operations reduce the reaction time for collision avoidance and require the utmost vigilance on the part of the coxswain and crew. Such high speeds should be reserved for emergency responses, such as distress calls or pursuit of lawbreakers. According to the OOD, the coxswain asked “to get under way for recreational boating safety . . . . and while in the area, go see [another Coast Guardsman] at a private residence on Palm Island.” The OOD agreed to the boating safety patrol and the residential visit. Coast Guard patrol boats are not exempt from the no-wake speed restrictions in Florida’s manatee-protection zones. The CG242513 was on a routine, nonemergency boating-safety patrol the night of the accident. The coxswain testified that he knew he was approaching a no-wake zone. Yet, he entered the no-wake zone, about 400 yards from the accident location, at full speed. At 32 knots,17 the boat would take about 22 seconds to cross the distance from the turn around Hibiscus Island to the collision point. The coxswain stated that he knew there was a blind spot coming around the end of Hibiscus Island but that he took the turn at nearly full throttle. Even in daylight, the speed at which the coxswain was operating would have been illegal and inappropriate in the area. The Safety Board, therefore, concludes that the coxswain of the Coast Guard patrol boat was operating his vessel in excess of Florida speed restrictions for no safety or law enforcement reason in a no-wake, manatee-protection zone. The coxswain stated that he was familiar with the Bayside Blaster and had seen it operating in the area before. He acknowledged that background lighting in the area commonly interfered with visibility at night. A highway causeway and a brightly lit container port are located south of the accident site, and white and red lights on islands and bridges are west and north of the accident site. The darkness also limited the coxswain’s ability to clearly see and distinguish other vessels that could have been operating in the vicinity of his vessel. Knowing that passenger vessels like the Bayside Blaster routinely operated in this area at night and that visibility could be a problem should have prompted the coxswain to enter the turn around Hibiscus Island at a much slower speed. Had he done so, he or his crewmember would probably have sighted the passenger vessel in ample time to avoid a collision. The high speed of the Coast Guard patrol boat reduced the time the coxswain had to sight the Bayside Blaster, to evaluate the situation, and to take effective action to avoid the collision. It likewise severely limited the time available for the crewmember, who was acting as lookout, to see and evaluate the developing situation. Both the coxswain and the crewmember reported seeing the Bayside Blaster’s silhouette mere seconds before impact. Therefore, the Safety Board concludes that even if there were no speed restrictions, the coxswain’s speed was imprudent for the prevailing conditions of darkness, background lighting, and potential for encountering passenger and recreational vessels in the area of the accident. High-speed operations at night in nonemergency situations, particularly in restricted waters, needlessly endanger the safety of other users of the waterway, as well as 17 At 32 knots or 36.8 mph, the boat would travel 54.0 feet per second.

Analysis 35 Marine Accident Report Coast Guard personnel. That sentiment was emphasized in a March 11, 2002, message from Coast Guard headquarters that encouraged boat force leaders to “impress upon all hands that throttles have more than two [stop and full] operational positions” and that “normal operating speeds must be something less than maximum speeds, and coxswains must have time to see, react, and avoid obstacles.” At the time of the accident, no guidance mandated that commanding officers mitigate the risks in small boat operations by imposing specific operating restrictions such as speed limits and safe operating distances from known hazards.This lack of Coast Guard policies and procedures regarding operating speeds for nonstandard boats at the time of the accident gave wide latitude to Coast Guard personnel undertaking routine patrols using small, high-powered vessels. Consequently, the Safety Board concludes that the lack of Coast Guard speed restrictions for conducting routine patrols allowed coxswains too much latitude in selecting patrol speeds, which could endanger other boaters as well as Coast Guard crewmembers. Appropriately, the new Coast Guard Navigation Standards Manual, which was issued after the accident, requires the commanding officers of Coast Guard stations to establish speed limits in specific areas of the AORs “that pose significant navigational or environmental risks to boats.” (For further discussion, see “Coast Guard Oversight of Routine Patrols” section.) Operation of the Bayside Blaster The master of the Bayside Blaster operated the vessel over the same route it normally took for conducting sightseeing tours in Miami Harbor, a route on which it was permitted to operate under the terms of its COI. Thus, at the time of the accident, the Bayside Blaster was operating on the waters where it was authorized to be, and the local Coast Guard station personnel were aware of the routes of the Bayside Blaster and other small passenger vessels. The master of the Bayside Blaster was operating his vessel at idle speed, about 3 to 4 knots, while conducting a boat tour of the area. Idle speed was correct and appropriate in a no-wake zone and close to shore. The vessel probably could not have gone much slower and still maintained steerage. The Safety Board, therefore, concludes that the Bayside Blaster was on an appropriate route for its service, and that the master was operating his vessel at a safe and prudent speed for the conditions and circumstances. The Coast Guard patrol boat was moving at 32 knots, or 54.0 feet per second. At such a high speed, the boat would have covered the 400 yards from the turn around Hibiscus Island to the position of the Bayside Blaster in seconds. Under the circumstances, the master of the Bayside Blaster had little or no time to react to avoid a collision. Because the Bayside Blaster was operating at an appropriate speed in the no- wake zone, the master could logically expect that other vessels operating in the same area would also be operating within the mandated speed restrictions. He therefore had no reason to anticipate that he would encounter a craft operating at high speed in the area where he was operating, especially in the darkness.

Analysis 36 Marine Accident Report Despite the nighttime darkness and background lighting, the master and deckhand observed the approaching Coast Guard vessel from their vantage point; however, they sighted the patrol boat only seconds before the collision. Consequently, the Safety Board concludes that the master and deckhand of the Bayside Blaster were maintaining a proper lookout. The master of the Bayside Blaster had no options for avoiding a collision after sighting the oncoming patrol boat. Even if the master had sighted the patrol boat the instant it rounded Hibiscus Island, he would have had only 22 seconds to evaluate the situation and to select and execute an avoidance action. The master sighted the oncoming patrol boat only after the deckhand brought it to his attention, giving him less than the full 22 seconds in which to react. He could not turn left without grounding his vessel on the rocky shore of Palm Island. He could not turn right without steering into the probable path of the patrol boat. He could not accelerate rapidly without endangering the passengers or possibly increasing the speed and severity of the impact. Consequently, the Safety Board concludes that the Coast Guard patrol boat’s high rate of speed, combined with its sudden appearance close to the Bayside Blaster, precluded the master of the Bayside Blaster from being able to take any effective action to avoid the collision. After the second collision with the patrol boat, the master of the Bayside Blaster accelerated his vessel and headed north to Monument Island. If he had remained in the immediate area of the accident, he would have risked being struck again by the circling patrol boat. Monument Island was only 800 yards away and afforded a convenient soft, sandy bottom on which the master could ground his vessel without damaging it more. In addition, immediately after the second impact, the master did not know the full extent of his vessel’s damage. For the safety of the passengers, he needed to make sure his vessel would not sink before they could disembark. Further, if the collision had ruptured a fuel tank, there could have been the added danger of fire. The master beached the Bayside Blaster on the sandy shore of Monument Island, where he could safely disembark his passengers and examine his vessel. If he had not taken that action and the hull had been breached, the vessel might have been in danger of flooding and sinking. The Safety Board, therefore, concludes that it was appropriate for the master of the Bayside Blaster to beach his vessel on Monument Island to ensure the safety of his passengers, given the circumstance that he did not know the full extent of the damage to the vessel’s hull and fuel tanks. Navigation Lights Boaters depend on other vessels to properly display navigation lights at night to help them visually detect other vessels and provide a reference to adjust their course or speed to avoid a collision. For this reason, the Safety Board reviewed the evidence related to the operation of the navigation lights on both vessels to assess their visibility on the night of the accident.

Analysis 37 Marine Accident Report The Coast Guard patrol boat was showing all the navigation lights that it was required to display (although with some technical deficiencies, as discussed below). The navigation lights had been found operational the day of the accident during the daily check by the station engineering staff. However, the coxswain did not check the navigation lights before leaving the dock. When the patrol boat got under way from Coast Guard Station Miami Beach, the crew of another Coast Guard boat informed the coxswain that the boat’s port navigation light was not operating. After being notified that the light was not lit, the coxswain tapped the light fixture with his hand, and it came on, indicating that the light might be sensitive to jarring forces. In the Safety Board’s opinion, the coxswain should have realized that the port navigation light might have been subject to intermittent operation due to the jarring effects of high-speed operations, and he should not have taken the vessel on a nighttime patrol without ensuring that the light was showing steadily. Rather than proceeding with the patrol, he should have returned to the station and either requested that the station’s engineers examine and repair the light or taken another boat on the patrol. The deckhand on the Bayside Blaster stated that he saw the sidelights and masthead light of the Coast Guard patrol boat before the collision. A passenger also said that he saw the sidelights of the Coast Guard patrol boat before the collision. Further, the Safety Board’s Materials Laboratory examined the patrol boat’s sidelights and determined that the filaments of the port and starboard running lights displayed stretching and deformation features consistent with their being illuminated at the time of the accident. The Bayside Blaster was showing all the navigation lights that it was required to display (although also with some technical deficiencies, as discussed below) and had decklights on as well. Four passengers stated that the navigation lights on the Bayside Blaster were on, and FWC officers tested the lights the evening after the collision and found them to be operating properly. Although the deckhand on the Bayside Blaster recalled seeing the white masthead light on the approaching patrol boat, postaccident examination of the vessel by the Safety Board revealed that it was partially obscured by a radar dome. Further postaccident examination of the patrol boat by the Coast Guard revealed that the vertical separation between the sidelights and the masthead light was less than the minimum required under the Inland Navigation Rules. However, because the masthead light was sighted from the Bayside Blaster before the collision, the partial obscuration and inadequate separation of the masthead light and the sidelights apparently had no effect on the accident. Partially obscured or inadequately separated navigation lights make vessels more difficult to see at night and constitute a hazard to safe operations. When Safety Board investigators checked the masthead light on the other nonstandard boat assigned to Station Miami Beach, they found the same condition. Later, a Safety Board investigator observed a similar problem on two separate occasions involving nonstandard boats operating in a different AOR and reported his observations to Coast Guard headquarters. As a direct result of information provided by the Safety Board, Station Miami Beach corrected the light problem on its remaining nonstandard boat, and Coast Guard headquarters mandated action to correct the problem nationwide.

Analysis 38 Marine Accident Report Postaccident examination of the Bayside Blaster by the Coast Guard in Miami showed that the sidelights were not properly screened, resulting in arcs of visibility approximately 30° greater than required; that the arc of visibility of the masthead light was somewhat less than required; and that the vertical separation between the masthead light and the gunwale was less than the required minimum. Nevertheless, the Bayside Blaster was showing lights that were visible from the direction of the approaching patrol boat and that were sufficient to warn the patrol boat of its presence. The Safety Board, therefore, concludes that although both vessels had technical deficiencies in the configuration of their navigation lights, they were sufficiently lighted to alert other mariners of their presence, and the deficiencies did not contribute to the cause of the accident. Coast Guard Oversight of Routine Patrols Recent accidents involving Coast Guard patrol boats, as well as cautionary messages from the Coast Guard Commandant, indicate that station commanders are not exercising adequate oversight of small boat operations. Patrols should not be undertaken without an in-depth predeparture briefing in which the OOD and the coxswain review operational details of the intended patrol. The details should include the intended purpose of the patrol, the intended route (float plan), the communications schedule for checking in with the station, and any operating restrictions on the patrol. The coxswain involved in the accident provided no detailed float plan, and the duty officer did not request one. He merely knew that the coxswain was going to operate in the north part of Biscayne Bay and that the coxswain would, at some time, end up at a private residence on Palm Island. Further, there was no discussion of speed issues or of the condition of the boat that was to be used for the patrol. Consequently, the Safety Board concludes that the coxswain’s being allowed to undertake the patrol without completing a thorough predeparture check of the patrol boat or without ensuring that critical navigation equipment was fully functional indicates a lack of effective oversight of patrol operations at Coast Guard Station Miami Beach. The problem of safety in the operation of Coast Guard small boats goes beyond the collision in Miami. Serious accidents involving Coast Guard nonstandard boats in FY 2001 resulted in more than 70 Coast Guardsmen having “unplanned departures” from their boats, with two deaths and one serious injury resulting. In response to those accidents, on April 3, 2002, Coast Guard headquarters issued a Non-standard Boat Operators Handbook that covers basic boat operation and cautions against operating vessels at excessive speed. The Coast Guard has also acted to improve equipment outfitting, maintenance, and training in the nonstandard boat program. For example, the Commandant issued a directive for area and district commanders to publish operating limits for their nonstandard boats and reexamine each boat’s suitability for its purpose. In the Safety Board’s opinion, those actions are warranted by the recent accident history of these vessels and should help improve the safety of nonstandard boat operations. In his April 25, 2002, final action letter to, among others, all area and district commanders and all Coast Guard boat stations, the Coast Guard Commandant mandated

Analysis 39 Marine Accident Report that district commanders and station commanding officers ensure compliance with all policies pertaining to filing and adhering to small boat operational patrol plans, including the requirement that the coxswain file a float plan with his station indicating the location of intended operations before departing on patrol. Further, coxswains are required to notify their controlling station if they deviate in any way from the filed plan. The float plan requirements resulted from a nonstandard boat accident in which a Coast Guard patrol boat capsized in Lake Ontario after the boat had deviated from its intended patrol route, resulting in the deaths of two Coast Guard crewmembers. In his final action letter concerning that accident, the Commandant found “that the normal boat tracking and mission monitoring process failed.” In other words, there was a failure in overseeing small boat operations by the responsible Coast Guard station. The float plan requirements, in the Safety Board’s opinion, will provide a measure of oversight over small boat operations, but by themselves, still fall short of the degree of oversight necessary to ensure operational safety. Station officials (commanding officers, executive officers, and OODs) are in the best position to provide continuing oversight of day-to-day operations at Coast Guard stations. Station level oversight of Coast Guard small boat operations could be improved by various means, including direct observation of coxswain performance by station officials and solicitation of feedback from waterway users. In addition, technological advances in transponder technology may provide an additional oversight tool if applied to station operations. Further, greater formality in the conduct of routine patrols would enhance oversight. For example, if coxswains were required to complete a written checklist before getting under way, they might be more likely to conduct thorough predeparture checks. If detailed predeparture briefings were held, as outlined above, coxswains might be more mindful of operational restraints. And if detailed postpatrol debriefings were held, coxswains might be less likely to take actions they could be held accountable for. Consequently, the Safety Board concludes that Coast Guard oversight of nonstandard boat operations was less than adequate at the time of the accident. The Coast Guard policy reflected in the Navigation Standards Manual places the responsibility for safe operation of Coast Guard small boats on station commanding officers. However, without some means of oversight, commanding officers cannot know that the speed limits are being followed or that other safety requirements are being met. Station commanding officers provide overall supervision to boat coxswains and are responsible for ensuring that coxswains perform their duties safely. An effective oversight program would make unsafe operation less common, and monitoring of coxswain performance, as part of that oversight, would make coxswains less likely to operate their vessels unsafely. The Safety Board, therefore, believes that the Coast Guard should establish oversight procedures for use by the commanding officers or officers-in-charge of Coast Guard stations to improve the safety of Coast Guard routine small boat operations, including the institution of in-depth predeparture briefings, thorough predeparture checks of boats, monitoring of coxswain performance, and thorough postpatrol debriefings. As noted earlier, the Coast Guard has issued a Non-standard Boat Operators Handbook that covers basic boat operation and cautions against operating vessels at

Analysis 40 Marine Accident Report excessive speed. The Coast Guard has also acted to improve equipment outfitting, maintenance, and training in the nonstandard boat program. Requirements for nighttime training of crews have been revised in the new edition of the Boat Crew Training Manual; training teams for nonstandard boats have been established; and commanding officers are required by the new Navigation Standards Manual to impose specific operating restrictions (speed, distance from hazards, frequency of fixes, operating area). Such changes should help improve the safety of nonstandard boat operations. Ongoing evaluation and the establishment of verification procedures are, however, essential to ensure compliance with the policies and procedures. The Safety Board, therefore, believes that the Coast Guard should evaluate on an annual basis its program for reducing nonstandard boat accidents and for ensuring compliance with Coast Guard policies and procedures related to those vessels, and should publish the results annually for use by Coast Guard stations. Boatrides International, Inc., Management Oversight The Bayside Blaster departed on the accident voyage without one of the two deckhands required by its COI. Despite the specific requirement of the company’s procedures and policy manual to report deficiencies, the master did not notify company management that he did not have the required crew before departing on the accident voyage. The master stated he made the decision that it was safe to sail with only one deckhand and that he had done so in the past, although infrequently. The operations manager stated that he was not informed the Bayside Blaster was short one deckhand before the vessel departed on the accident voyage. He also indicated that he was aware it was not the first time the Bayside Blaster had sailed shorthanded, but that it did not typically do so. The owner of the Bayside Blaster indicated that the master had never been reprimanded and that nothing negative had ever been noted in the master’s personnel file. The master was required to report the number of passengers on board before leaving the dock. It would have been a simple matter for management to require him at the same time to report whether he had a full crew on board. Moreover, because the Bayside Blaster had departed without a full crew in the past, company management should have been aware that it was possible for the vessel to be shorthanded and should have established procedures to arrange for backup crewmen so that such incidents did not occur in the future. In assessing the impact on safety of the lack of the second deckhand on the Bayside Blaster, the Safety Board considered the opinions of the vessel master. The master stated that if the second deckhand had been present, he would have been selling drinks and film to the passengers and would not have been serving as a dedicated lookout. The lack of the required second deckhand did not affect the ability of the Bayside Blaster to maintain a proper lookout. The impact of the lack of the second deckhand was that one less person was available to assist the passengers in the emergency. The second deckhand could have been helpful in handing out lifejackets to passengers, in helping passengers don and secure

Analysis 41 Marine Accident Report their lifejackets, and in helping the passengers disembark at Monument Island after the accident. Had the accident been more serious, however, the need for the second deckhand could have been critical. If, for example, passengers had been seriously injured or thrown into the water and in danger of drowning, the second deckhand would have been needed for such duties as providing medical assistance or handling the boat while the master rendered medical assistance. If the boat had been more seriously damaged and in danger of sinking, the second deckhand would have been needed to help with damage control, to help distribute lifejackets, or to help the passengers safely abandon the vessel. The Safety Board, therefore, concludes that operating the Bayside Blaster without the required number of crewmembers could have had a negative impact on the safety of the passengers, although it did not in this accident. The Safety Board believes that Boatrides International, Inc., should establish procedures to prohibit its small passenger vessel from leaving the pier with passengers on board unless the vessel has the crew required by the vessel’s COI. Kill Switch Operation on Coast Guard Nonstandard Patrol Boats If the kill switch lanyard and clips had operated properly, the engines on the Coast Guard patrol boat would have shut down as soon as the coxswain was ejected from the boat. And if the Coast Guard patrol boat engines had stopped when the coxswain was ejected, the boat would not have struck the Bayside Blaster the second time. Further, the other property damage resulting from the accident would not have occurred, and the Coast Guard crewmembers would not have been placed in jeopardy of being run over by their own vessel. According to the coxswain, he was struck by the boat but sustained only minor bruising. If the runaway vessel’s hull had struck him at a different angle or if the propellers had struck him, he could have been seriously injured or killed. Given that more than 70 Coast Guard crewmembers were ejected from nonstandard boats in FY 2001,18 ejection is a hazard in the operation of such boats. Automatic shutdown of the main engines in such circumstances is essential for the safety not only of the Coast Guard personnel involved but also of other waterway users. The Coast Guard sent a safety advisory to all Coast Guard units warning that crews operating nonstandard boats and cutter boats are at significantly higher risk for ejection from their boat than their counterparts operating larger, standard boats. The message required that Coast Guard small boat operators use kill switches at all times while such boats are under way and that kill switch lanyards be attached to a metal D-ring on the coxswain’s lifejacket or survival vest. Further, the message required that kill switches and lanyards be inspected daily, incorporated into a daily checklist, and tested weekly. It also stated that it was Coast Guard headquarters’ intention to have kill switches installed on all nonstandard boats, and that boats less than 40 feet long are to have kill switches installed within 24 months. 18 Coast Guard headquarters’ ALCOAST message, January 30, 2002.

Analysis 42 Marine Accident Report The kill switch lanyard and connections were examined at the Safety Board’s Materials Laboratory. The features on the belt clip fracture face were consistent with bending overload, and indicate that the belt clip was the weak link in the lanyard assembly. In a kill switch system, the weakest link should be the force required to operate the switch. Either the belt clip was the wrong attachment, or the lanyard may have been wrapped around another item in the console, thereby transferring all the force to the belt clip and not the kill switch. It is possible that when the coxswain turned the steering wheel hard to the left to avoid striking the Bayside Blaster, the lanyard’s position was such that it became fouled on the wheel or the steering knob. The coxswain said that he could not remember having any problems with the coiled lanyard snagging on anything. The Safety Board could not determine the most probable scenario. The two Coast Guard crewmembers confirmed that the kill switch lanyard was connected both to the kill switch and to the coxswain, and the police saw the lanyard connected to the kill switch when the patrol boat came to rest against the pilings on Palm Island. The Safety Board concludes that why the kill switch did not activate when the coxswain was ejected or whether fouling of the kill switch lanyard on the steering wheel was a factor in the engines’ failure to stop cannot be determined. The Coast Guard action and policy statement of January 30, 2002, appears to address most of the problems inherent with kill switch malfunction. However, the individual Coast Guard units are being tasked with conducting evaluations of the proper location and operation of kill switches, which may be beyond the technical qualifications of some units. The ALCOAST message does not discuss the role of the kill switch manufacturer. Because the placement and arrangement of kill switches may require special knowledge of ergonomics and human engineering, engineers and technicians with those skills should be part of any effort to redesign the kill switch system. The Safety Board concludes that the actions by the Coast Guard to improve kill switch use could be enhanced by including kill switch manufacturers and ergonomic/human engineering experts in the redesign process. The kill switch system involves not only the toggle switch, the wiring, and the lanyard-and-loop assembly, but also the person at the controls who is connected to the switch by the lanyard. All these elements must operate correctly for the kill switch to perform as intended. Therefore, the Safety Board believes the Coast Guard should evaluate the adequacy of the design of present or future kill switch systems on Coast Guard small boats, giving full consideration to ergonomic/human engineering factors. Lifejacket Stowage on the Bayside Blaster The adult- and child-size lifejackets on the Bayside Blaster were stowed so that they were properly segregated from each other. However, all the lifejackets of each size were stowed in one location, the adult jackets at the bow and the child jackets near the operator’s station. Stowing lifejackets in one location on board a vessel can make them

Analysis 43 Marine Accident Report inaccessible during an emergency. Lifejackets are essential safety appliances that should be available to passengers in the earliest moments of an emergency. If a vessel is carrying a large number of passengers who must retrieve lifejackets from a central location, the crush of people all heading to the same location at the same time can incite panic, cause injury, or delay distribution of lifejackets to all passengers. Title 46 CFR 180.78 requires that lifejackets be “stored in convenient places distributed throughout accommodation spaces” and that “each life jacket kept in a storage container must be readily available.” The Coast Guard approved the Bayside Blaster’s lifejacket stowage arrangements when it inspected the vessel in August 2001. Passengers rely on the vessel crew to advise them when to retrieve and don lifejackets in an emergency. Because of the few crewmembers relative to the number of passengers carried on small passenger vessels, the crew may not have time to advise passengers of what they should do in a rapidly developing emergency. Further, during an emergency, crewmembers can become preoccupied with saving the vessel, leaving the passengers to fend for themselves. Lifejackets must be readily available throughout the accommodation spaces so that, if the lifejackets are needed, the passengers can retrieve them. On the Bayside Blaster, the lifejackets were difficult to retrieve from the bow locker, and no lifejackets were stowed in the aft accommodation area. Further, the opening mechanism to the child-size lifejacket stowage compartment at the operator’s station was broken and had to be pried open. Both the single stowage location of adult lifejackets and the broken opening mechanism on the child lifejacket stowage compartment delayed the distribution of lifejackets to all passengers. Fortunately, the delay did not affect the outcome of the accident. However, under different circumstances, the delay in distributing lifejackets could have had serious consequences. Therefore, the Safety Board concludes that if lifejackets had been stowed throughout the accommodation space on the Bayside Blaster, they would have been more readily accessible to the passengers. Stowage of lifejackets on small passenger vessels was also an issue in the Safety Board’s recent investigation of the November 2000 fire on board the Port Imperial Manhattan. Following that accident, the owner of the Port Imperial Manhattan, New York Waterway, voluntarily elected to modify lifejacket stowage on its vessels. Lifejackets on New York Waterway vessels are now stowed under the passenger seats. While the Coast Guard approved the original stowage arrangements for lifejackets on all these vessels, the owner of the Bayside Blaster should consider voluntarily reconfiguring the stowage of lifejackets to make them readily available to passengers. Therefore, the Safety Board believes that Boatrides International, Inc., should revise the stowage of lifejackets on board its vessel so they are located throughout the passenger areas for immediate use in case of emergency. In its report of the Port Imperial Manhattan investigation, the Safety Board expressed concern that lifejacket stowage may be a widespread problem on small passenger vessels throughout the industry and issued Safety Recommendation M-02-13, asking that the Coast Guard:

Analysis 44 Marine Accident Report Issue a directive to small passenger vessel operators to review the distribution of lifejackets on board their vessels and to ensure that the lifejackets are accessible and segregated. On November 19, 2002, the Coast Guard responded, stating that it “will issue a Safety Alert reminding small passenger vessel operators of the requirements and suggest that they review the stowage arrangements on their vessels to ensure compliance with the regulations.” The Safety Board considers the issue of proper lifejacket stowage on small passenger vessels to be of the utmost importance, and that the primary responsibility for the safety of passengers rests with the small passenger vessel operating companies. Because the Passenger Vessel Association represents 65 percent of the small passenger vessel operating companies, action taken by this organization can affect most of the industry. The association has established its Safety and Loss Control Committee, which reviews, develops, and implements programs to encourage enhanced training and safety among its members. The Safety Board believes that the association should include in its Risk Management Manual the information that lifejackets on small passenger vessels should be evenly distributed throughout passenger areas for immediate use in an emergency, as prescribed by 46 CFR 117.78 or 180.78. Coast Guard Safety Oversight of Small Passenger Vessels in Miami For the Bayside Blaster to receive a COI to carry passengers, the Coast Guard must inspect and certify that the vessel meets the small passenger regulations at 46 CFR 175-

1. The Bayside Blaster was deficient in at least three respects:

• In the accident, Safety Board investigations found that lifejackets were not readily available to passengers in the aft part of the vessel. However, the Bayside Blaster had recently been inspected and approved for operation by the Coast Guard. As the oversight authority for marine safety, Coast Guard inspectors should not permit such arrangements. They should use inspections as an opportunity to review the purpose of the regulations with vessel owners and to improve the safety of passengers by ensuring that lifejackets are readily accessible in an emergency. • After the accident, the Coast Guard in Miami advised the Safety Board that the navigation lights of the Bayside Blaster were not configured in accordance with the Inland Navigation Rules. The measurements taken by the Coast Guard after the accident should have been taken during its 2001 inspection, and corrections should have been made to ensure regulatory compliance.

Analysis 45 Marine Accident Report • The statements of the master and operations manager that the Bayside Blaster had repeatedly, even if infrequently, operated shorthanded indicate that a continuing safety deficiency regarding small passenger vessel operations in Biscayne Bay remained undetected by the Coast Guard. While the owner of the vessel has a primary responsibility for safety oversight, the Coast Guard has an equally important responsibility to maintain oversight of the operations of all small passenger vessels under its inspection authority. That the Bayside Blaster operated repeatedly with improper lifejacket stowage, improper navigation lights, and without a full crew indicates that Coast Guard oversight of small passenger vessel operations in the Miami area may be less than adequate. Although it is the responsibility of the owners of the Bayside Blaster and other small passenger vessels to maintain their vessels in compliance with the rules and regulations, it is also the responsibility of the Coast Guard Marine Safety Office to ensure that a vessel is in compliance before the Coast Guard issues a COI. In view of the noted deficiencies, the Safety Board concludes that the Coast Guard’s marine safety inspection program for small passenger vessels in the Miami area may be less than adequate. The Safety Board, therefore, believes that the Coast Guard should evaluate the adequacy of the marine safety inspection program in the Miami area to ensure that small passenger vessels are in compliance with applicable regulations, including the requirements for lifejacket stowage, navigation lights, and manning.

46 Marine Accident Report Conclusions Findings 1. The crewmembers of both vessels were well rested and not impaired by drugs or alcohol, and the weather and sea conditions were not factors in this accident. 2. The coxswain of the Coast Guard patrol boat was operating his vessel in excess of the Florida speed restrictions for no safety or law enforcement reason in a no-wake, manatee-protection zone. 3. Even if there were no speed restrictions, the coxswain’s speed was imprudent for the prevailing conditions of darkness, background lighting, and potential for encountering passenger and recreational vessels in the area of the accident. 4. The lack of Coast Guard speed restrictions for conducting routine patrols allowed coxswains too much latitude in selecting patrol speeds, which could endanger other boaters as well as Coast Guard crewmembers. 5. The Bayside Blaster was on an appropriate route for its service, and the master was operating his vessel at a safe and prudent speed for the conditions and circumstances. 6. The master and deckhand of the Bayside Blaster were maintaining a proper lookout. 7. The Coast Guard patrol boat’s high rate of speed, combined with its sudden appearance close to the Bayside Blaster, precluded the master of the Bayside Blaster from being able to take any effective action to avoid the collision. 8. It was appropriate for the master of the Bayside Blaster to beach his vessel on Monument Island to ensure the safety of his passengers, given the circumstance that he did not know the full extent of the damage to the vessel’s hull and fuel tanks. 9. Although both vessels had technical deficiencies in the configuration of their navigation lights, they were sufficiently lighted to alert other mariners of their presence, and the deficiencies did not contribute to the cause of the accident.

1. The coxswain’s being allowed to undertake the patrol without completing a thorough

predeparture check of the patrol boat or without ensuring that critical navigation equipment was fully functional indicates a lack of effective oversight of patrol operations at Coast Guard Station Miami Beach.

1. Coast Guard oversight of nonstandard boat operations was less than adequate at the

time of the accident.

Conclusions 47 Marine Accident Report

1. Operating the Bayside Blaster without the required number of crewmembers could

have had a negative impact on the safety of the passengers, although it did not in this accident.

1. Why the kill switch did not activate when the coxswain was ejected or whether

fouling of the kill switch lanyard on the steering wheel was a factor in the engines’ failure to stop cannot be determined.

1. The actions by the Coast Guard to improve kill switch use could be enhanced by

including kill switch manufacturers and ergonomic/human engineering experts in the redesign process.

1. If lifejackets had been stowed throughout the accommodation space on the Bayside

Blaster, they would have been more readily accessible to the passengers.

1. The Coast Guard’s marine safety inspection program for small passenger vessels in

the Miami area may be less than adequate. Probable Cause The National Transportation Safety Board determines that the probable cause of the collision between the Coast Guard patrol boat CG242513 and the small passenger vessel Bayside Blaster was the failure of the coxswain of the Coast Guard patrol boat to operate his vessel at a safe speed in a restricted-speed area frequented by small passenger vessels and in conditions of limited visibility due to darkness and background lighting. Contributing to the cause of the accident was the lack of adequate Coast Guard oversight of nonstandard boat operations.

48 Marine Accident Report Recommendations As a result of its investigation, the National Transportation Safety Board makes the following safety recommendations: To the U.S. Coast Guard: Establish oversight procedures for use by the commanding officers or officers-in- charge of Coast Guard stations to improve the safety of Coast Guard routine small boat operations, including the institution of in-depth predeparture briefings, thorough predeparture checks of boats, monitoring of coxswain performance, and thorough postpatrol debriefings. (M-02-25) Evaluate on an annual basis your program for reducing nonstandard boat accidents and for ensuring compliance with Coast Guard policies and procedures related to those vessels; publish the results annually for use by Coast Guard stations. (M-02-26) Evaluate the adequacy of the design of present or future kill switch systems on Coast Guard small boats, giving full consideration to ergonomic/human engineering factors. (M-02-27) Evaluate the adequacy of the marine safety inspection program in the Miami area to ensure that small passenger vessels are in compliance with applicable regulations, including the requirements for lifejacket stowage, navigation lights, and manning. (M-02-28) To Boatrides International, Inc.: Establish procedures to prohibit your small passenger vessel from leaving the pier with passengers on board unless the vessel has the crew required by the vessel’s certificate of inspection. (M-02-29) Revise the stowage of lifejackets on board your vessel so they are located throughout the passenger areas for immediate use in case of emergency. (M-02-30) To the Passenger Vessel Association: Include in your Risk Management Manual the information that lifejackets on small passenger vessels should be evenly distributed throughout passenger areas for immediate use in an emergency, as prescribed by 46 CFR 117.78 or 180.78. (M-02-31)

49 Marine Accident Report BY THE NATIONAL TRANSPORTATION SAFETY BOARD CAROL J. CARMODY JOHN A. HAMMERSCHMIDT Acting Chairman Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: December 17, 2002 Recommendations

this page intentionally left blank

51 Marine Accident Report Appendix A Investigation The Safety Board learned of this accident from a news wire service report received by the Safety Board Communications Center on January 12, 2002. A two-person team, consisting of an investigator-in-charge and a survival factors specialist, arrived on scene on Sunday, January 13, 2002. The team was later augmented by two additional investigators, specializing in human performance. The investigative team documented the damage to the Bayside Blaster and the Coast Guard patrol boat CG242513 and interviewed the crews of both vessels, as well as the Bayside Blaster passengers, Boatrides International and Coast Guard officials, and emergency responders. The on-scene investigation was completed on January 20, 2002. The Safety Board investigated this public/nonpublic vessel accident under the authority of the Independent Safety Board Act of 1974, according to Safety Board rules. The designated parties to the investigation were the U.S. Coast Guard, Boatrides International, Inc. (owner of the Bayside Blaster), and the Florida Fish & Wildlife Conservation Commission.

this page intentionally left blank

FD07260 ｜ 2002_美国_NTSB_MAR0401_Sinking_of_the_US_Small_Passenger_Vessel_Panther.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2002 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Sinking of the U.S. Small Passenger Vessel Panther Near Everglades City, Florida December 30, 2002 Marine Accident Report NTSB/MAR-04/01 PB2004-916401 Notation 7539C National Transportation Safety Board Washington, D.C.

this page intentionally left blank

Marine Accident Report Sinking of the U.S. Small Passenger Vessel Panther Near Everglades City, Florida December 30, 2002 NTSB/MAR-04/01 PB2004-916401 National Transportation Safety Board Notation 7539C 490 L’Enfant Plaza, S.W. Adopted March 9, 2004 Washington, D.C. 20594

National Transportation Safety Board. 2004. Sinking of the U.S. Small Passenger Vessel Panther Near Everglades City, Florida, December 30, 2002. Marine Accident Report NTSB/MAR-04/01. Washington, DC. Abstract: This report discusses the sinking of the U.S. small passenger vessel Panther in the Ten Thousand Islands area of Everglades National Park, Florida, on December 30, 2002. The accident resulted in no deaths and one serious injury. Damage to the Panther was estimated at $60,000. From its investigation of the accident, the National Transportation Safety Board identified the following safety issues: company operations, company’s preventive maintenance program, and lifejacket stowage. On the basis of its findings, the Safety Board made recommendations to the National Park Service. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2004-916401 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Marine Accident Report Contents Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Incidents Preceding the Sinking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Previous Grounding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Postgrounding Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Preaccident Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 The Sinking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Search and Rescue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Personnel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Vessel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Construction and Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Certification and Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Wreckage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Salvage Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Postsalvage Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Waterway Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Company Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Vessel Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Toxicological Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Lifesaving Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Firefighting Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Communication Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 High-Level Bilge Alarm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Bilge Pump . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Wooden Support Block and Spacers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Enforcement Jurisdiction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Actions Taken Since the Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Passenger Vessel Association . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 The Sinking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Contents iv Marine Accident Report Vessel History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Hull Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 High-Level Bilge Alarm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Preventive Maintenance Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Company . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 National Park Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Coast Guard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Passenger Vessel Association . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Owner’s Operational Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Lifejacket Stowage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 New Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Previously Issued Recommendation Resulting from This Accident Investigation . . . . . . 44 Previously Issued Recommendation Classified in This Report . . . . . . . . . . . . . . . . . . . . . . 44 Appendix A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

v Marine Accident Report Acronyms and Abbreviations CFR Code of Federal Regulations COI certificate of inspection ICAO International Civil Aviation Organization PVA Passenger Vessel Association SIP Streamlined Inspection Program

vi Marine Accident Report Executive Summary On December 30, 2002, the U.S. small passenger vessel Panther, a 31-foot open wood-and-fiberglass boat operated by Everglades National Park Boat Tours, was on its third tour of the day in the Ten Thousand Islands area of Everglades National Park, Florida, with 33 passengers on board (including 5 children) plus a master. Midway through the tour, shortly after 1430, the vessel sank in about 12 feet of water in Indian Key Pass, about 3 1/2 miles from the National Park Service visitor center near Everglades City. Three nearby vessels responded to the accident and rescued all the passengers and the master from the water. The U.S. Coast Guard launched a search-and-rescue operation that involved five Coast Guard stations in south Florida; however, responders did not find any passengers in the water. No fatalities resulted from the accident, but one passenger suffered a serious injury. Damage to the Panther was estimated at $60,000. The Coast Guard reported that costs of the search-and-rescue operation exceeded $50,000. The National Transportation Safety Board determines that the probable cause of the Panther’s sinking was flooding through a hull breach, which resulted from an earlier grounding and which Everglades National Park Boat Tours neglected to address, instead choosing to operate the vessel with a known failure of watertight integrity and inappropriately relying on the bilge pumps to keep the vessel afloat, thus continually putting its passengers at risk. Based on its investigation, the Safety Board identified the adequacy of the following as safety issues: • Company operations; • Company’s preventive maintenance program; and • Lifejacket stowage. As a result of its investigation of this accident, the Safety Board makes two new recommendations to the National Park Service.

1 Marine Accident Report Factual Information Synopsis Shortly after 14301 on December 30, 2002, the U.S. small passenger vessel Panther, a 31-foot open wood-and-fiberglass boat operated by Everglades National Park Boat Tours (see figure 1), sank in Indian Key Pass, about 3 1/2 miles from Everglades City, a small town in Collier County, Florida (see figure 2). The Panther was inspected and certificated by the U.S. Coast Guard under the small passenger vessel regulations at Title 46 Code of Federal Regulations (CFR), parts 175-185. When it sank, the Panther was midway through a tour of the Ten Thousand Islands area of Everglades National Park, with 33 passengers on board plus a master. Three nearby vessels responded to the accident and rescued the master and all the passengers from the water. No fatalities resulted from the accident, but one passenger suffered a serious injury. 1 All times are eastern standard time, based on a 24-hour clock. Information about the sequence of events came from oral interviews as well as written Coast Guard situation reports. When the times stated by interviewees disagreed, or when no time was reported in either the interviews or the situation reports, the Safety Board used its best judgment to estimate when a particular event took place. Figure 1. Panther on tour in Everglades National Park.

Factual Information 2 Marine Accident Report Figure 2. Accident site and other locations referenced in this report.

Factual Information 3 Marine Accident Report Incidents Preceding the Sinking Previous Grounding In early December 2002, the Panther grounded in Indian Key Pass while on a regular nature tour through the Ten Thousand Islands area of Everglades National Park. Like other tours run by Everglades National Park Boat Tours, the trips began and ended at the National Park Service visitor center near Everglades City. Two passengers and a master2 were on board; it was the master’s third season with the tour boat company. The company did not report the grounding to the Coast Guard and kept no maintenance records, so the Safety Board could not precisely date the incident. However, the master recalled that it had happened during the first week in December. The master told Safety Board investigators that on his way back to the visitor center, he went outside the channel, going about half-throttle (7 knots), to show his passengers a particular bird as part of the nature tour, when the Panther grounded on mud and shells. He said he felt the boat “raise a little bit and then go down.” As he backed the boat out of the shallows, he said he heard the propeller strike a layer of seashells that covered the bottom of the bay in the area. He noticed that once under way, the Panther handled differently, exhibiting a vibration consistent with a propeller that was “nicked up,” and that the engine started to overheat. To prevent further damage, the master stopped the engine, anchored the boat, and called for assistance. One of Everglades National Park Boat Tours’s two maintenance men and one of the owner’s two sons, both of whom worked for the company, went to the anchored vessel and cleaned sand and shells out of the Panther’s engine cooling water intake (“sea strainer”). The maintenance man said he found “no indication of water in the bilge.” The master transferred his two passengers to another tour boat, and the Panther returned to the marina under its own power. The maintenance men replaced the impeller in the engine’s water pump, and the boat returned to service the day after the grounding. The vessel was not hauled out of the water to be inspected for bottom damage, and no repairs were made to the hull. The master said he did not think he had damaged the bottom of the Panther when he grounded it, and one of the owner’s sons said the hull and bilge pumps were “fine” after the grounding. However, the master also said that the maintenance men “always” seemed to be working on the Panther after the grounding. He told investigators that he and another master both noticed changes in the way the Panther handled on trips after the grounding, specifically, that they could feel a vibration in the propeller and that the boat steered with more difficulty. Both the owner and his sons said that the company’s boats commonly grounded, mostly in soft mud, and that groundings happened when the masters were “not paying 2 The Safety Board interviewed three company masters who had been on board the Panther on problematic trips during December 2002. Altogether, Everglades National Park Boat Tours had engaged five licensed masters for the 2002-2003 season. It was common practice for the masters to rotate among the various boats.

Factual Information 4 Marine Accident Report attention” and went outside the dredged channel. The sons said that when a master came in after a grounding, they would lift the hatches to see whether water was coming in.3 One of the maintenance men told investigators that it was the master’s responsibility to know whether water was in the bilges. However, one of the owner’s sons said that the maintenance men were responsible for checking the boats: “The captain walks on, flips a switch and that’s it. . . . We don’t let the captains check the boats.” The owner, the sons, and the maintenance men all indicated when interviewed by Coast Guard and Safety Board investigators that they did not know that groundings were a casualty that had to be reported to the Coast Guard.4 Postgrounding Problems Low Freeboard. The master who operated the Panther on the day of the early December grounding told Safety Board investigators that he experienced a problem with the vessel riding low in the water about 2 weeks after the grounding. Again, the Safety Board could not pinpoint the date of the low-freeboard incident because the tour boat company did not keep maintenance records. The master said he was returning to the marina with a full load of passengers, saw that he had a low freeboard, thought the vessel was taking on more water than normal, and “figured the bilge pumps were to blame.” He radioed the problem to the company’s maintenance men and after discharging his passengers, took the boat to the fuel dock. The maintenance men told the master that the bilge pumps had been checked and “all the switches were working.” The master told investigators that he assumed “maybe there was a float switch that was stuck or something.”5 He also noted that for some time, in order to pump the bilges continuously, he had had to hold the switch on the manual setting with a rubber band because the automatic setting did not work. The maintenance men did not inform the master of the cause of the reduced freeboard he experienced 2 weeks after the grounding. The master told investigators that another master had had a similar low-freeboard problem on the Panther a few days after his experience. Starboard List. On December 29, the day before the accident, the Panther returned to the visitor center marina (under a different master) listing significantly to starboard. About 29 passengers were on board. One of the owner’s sons observed the list 3 The hatches were squares of wood that had been cut out of the aft part of the deck over the starboard and port bilge pumps and that could be lifted up to access the pumps; the engine cover was also called a hatch. 4 An “unintended grounding” is the first item listed at 46 CFR 4.05-1 as requiring a notice of marine casualty: “(a) Immediately after the addressing of resultant safety concerns, the owner, agent, master, operator, or person in charge, shall notify the nearest Marine Safety Office, Marine Inspection Office or Coast Guard Group Office whenever a vessel is involved in a marine casualty consisting in (1) An unintended grounding . . . .” 5 The bilge pumps operated by built-in sensors, not float switches. See “Vessel Information” section.

Factual Information 5 Marine Accident Report and said he saw water coming through the “scupper hole.”6 He told the Coast Guard that he advised the captain to discharge the passengers as soon as possible because he believed their weight in the stern was causing the problem. Even after the full load of passengers disembarked, however, the list remained. According to the owner’s son, the master had inadvertently shut off the starboard bilge pump switch. The master, however, said that the bilge pump did not work in either automatic or manual mode. The owner’s son said he had checked the bilge pumps and that the switches worked: “I pay attention to the bilge pump.” The master told Safety Board investigators that he was not informed of what had caused the list. The next day, as described below, one of the maintenance men worked on the Panther’s starboard bilge pump before the vessel left on its first tour. Accident Narrative Preaccident Events Shortly before 0900 on December 30, 2002, the master who was scheduled to operate the Panther that day (not the same master as on the trips described above) arrived at the visitor center for the first tour. The Panther was scheduled for a tour every 2 hours, beginning at 0900 and ending at 1500. The master said that he saw one of the company’s two maintenance men working on the Panther, doing what looked to him like electrical work. The master said the maintenance man told him, “I’ve got a bilge pump to look at.” Because of the repair work in progress, another of the company’s tour boats, the Manatee, took the 0900 run. The maintenance man said that he replaced the Panther’s engine starter switch because the accident master had told him the day before that the engine was slow to shut off, and that he also replaced the wiring to the starboard bilge pump. The maintenance man said that before the Panther returned to service, he tested the bilge pumps and the starter switch and that they were working properly. The Panther left on its first trip of the day at 1000, following its usual route through a marked channel into Chokoloskee Bay and then into Indian Key Pass (see figure 2). The trip typically took about 1 1/2 hours, with its turnaround point 3 1/2 miles to 5 miles from the visitor center. (The distance of a trip depended on the natural sights, the weather, and other factors, at the master’s discretion.) The master said that the boat handled well and showed no indications of problems on the trip. The Panther left on its second trip of the day at 1200, with the same master on board. He reported that the second trip was uneventful. After the passengers disembarked, he prepared for his third trip at 1400. Passengers for the 1400 trip waited at the dock for the master, who was taking a short break and had asked that no one board until he returned. One of the passengers, a 6 By “scupper hole,” the owner’s son was referring to one of the Panther’s freeing ports, which are bulwark openings close to the deck that are designed to allow water to drain overboard. See “Vessel Information” section for details of the Panther’s construction.

Factual Information 6 Marine Accident Report mechanical engineer, told Safety Board investigators that while he was waiting for the master to return, he heard the Panther’s bilge pumps cycling on and off every 30 seconds and observed a steady stream of water discharging from the vessel. The passenger estimated each discharge at 3 to 4 gallons. He also said that the Panther looked to be riding low in the water: “. . . like if you leaned over from the seats in the stern, you could touch the water with your elbow.” At 1340, the master returned to the boat and started boarding the passengers. He said the passengers chose their own seats, although he advised them to sit aft if they wanted to avoid the sea spray. After the passengers were seated, the master said he determined by counting the empty seats that he had 34 on board.7 He did not count the number of passengers or the number of tickets or inform personnel at the company office of the number of passengers on board. When the office personnel waved for the master to leave, he hooked a chain across the boarding area, started the engine, released the mooring lines, and moved the boat away from the dock. The master said he departed at 1355. As the Panther moved away from the dock, the master, who was the only crewmember, introduced himself to the passengers and, using the boat’s public address system, gave them his standard safety briefing, which he had developed himself, rather than receiving it from the company. He told the passengers that lifejackets were located under the seats in front of them; he did not take any of the lifejackets out of the storage lockers or demonstrate how to put one on. He also told them that the boat had a fire-extinguishing system and a VHF radio, and that he held “a master mariner’s license administered by the Coast Guard.” He predicted “a very safe and stable ride.” After departing from the marina at the Everglades National Park visitor center, the master steered the Panther along a marked channel into Chokoloskee Bay and then entered Indian Key Pass (see “Waterway Information,” below, for details of the area). The master told investigators that he noticed no problems with the boat, that the engine was working properly, and that no bilge pump indicator lights were on. He said the boat was making 3 1/2 or 4 knots during this part of the trip. At 1400, according to the master, he began a nature narration while moving slowly through Indian Key Pass, pointing out birds to the passengers and asking them to look for dolphins. He told investigators “the vessel maneuvered properly,” with no indication of problems. When the master saw a pod of about three Atlantic bottlenose dolphins, he increased the Panther’s speed to 8 or 10 knots and tried to pull alongside the animals to give the passengers a good view of them. He said some of the passengers stood up and moved to the railing, and that the boat “heeled just slightly to port, but nothing in any way strange.” After the dolphins submerged, he turned slowly to starboard to see if the animals would surface nearby. He told investigators that he was going at half speed and that the passengers were standing. He said he still had no indication of problems with the Panther, but that when he “brought the throttle back” (decreased speed), he felt the “stern set a little bit more than usual,” which he attributed at the time to “heavy-set” passengers seated in the stern. 7 Safety Board investigators later determined that, although the master repeatedly stated that he had 34 people on board the Panther, he actually had only 33.

Factual Information 7 Marine Accident Report The passengers told investigators that when the master entered Indian Key Pass, he sped up until a large wake formed behind the vessel. The master told them he was trying to prompt dolphins into jumping over the wake, which other witnesses told investigators was standard practice on the tour boats. The jumping dolphins entertained the passengers and created an opportunity for them to take photographs (see figure 3). According to the passengers, the master made two or three sharp 180-degree turns into the vessel’s wake and was “revving” his engine. They said that between turns, the master moved passengers to the aft seats so their extra weight would push the stern lower into the water and increase the wake. Passengers who sat near the stern said that while the master was taking the Panther through these maneuvers, water began to accumulate in the stern of the boat and that by the last turn, the water was ankle deep. One person said, “With each turn, more water would come in, first through the bottom, then over the top.” Another passenger stated, “Water was constantly coming over the wall of the boat and into the passenger compartment. Five or six times during the trip water was ankle- to knee-deep where I was sitting” (at the stern). About a half-hour into the trip, the master turned the Panther around near channel marker 7 in Indian Key Pass (see figure 4) to return to the visitor center (marker 7 is about 3 1/2 miles from the center). So much water began spilling over the sides of the boat at this point that the master stopped the boat. Passengers said that the master did not seem to realize the Panther was flooding “until it was too late” and that by the time the boat stopped, people in the stern had water up to their knees. Figure 3. Dolphin leaping in Panther’s wake (photograph taken about a year before accident trip).

Factual Information 8 Marine Accident Report About the time the Panther stopped, a commercial crab boat, the Red Rock, came into Indian Key Pass on its return to Everglades City, moving at less than 5 knots because it had broken a propeller strut earlier in the day. The three occupants of the Red Rock—the captain, his son, and his son’s friend—saw the Panther ahead of them, noticed that it was low in the water, and changed course to have a closer look. Their position at the entrance to Indian Key Pass was about a mile from the Panther’s location. Passengers reported that the Panther remained stopped for between 5 and 10 minutes. The master told investigators that he noticed water on the deck and switched the bilge pumps on manually. He said that all the bilge pump lights were on (an indication that the pumps were operating), but that he “questioned whether they were pumping.” He said that the bilges often held water and “sloshed,” especially when moving through other Figure 4. Panther’s route from National Park Service visitor center to site of sinking.

Factual Information 9 Marine Accident Report boats’ wakes and with water leaking through the Panther’s propeller shaft packing gland.8 Because he could not see the bilge discharge from the helm, he asked a passenger to look overboard to check whether the bilge pumps were working. The passenger looked over the side and told the master that “the water was almost even with the top of the boat so he could not tell” whether water was discharging through the bilge overboard discharge line. The Sinking Master’s Account. According to the master, when the passenger looked over the side to check the bilge discharge, the Panther was hit by the wake from a passing crab boat and immediately sank stern first. The master said that he told the forward passengers to “grab a life preserver” because the water in the boat was already too deep for the passengers in the back to reach their lifejackets. He told investigators that “there was a lot of panic” and that he tried to calm the passengers. He said the engine cover (measuring about 6 feet by 4 feet) floated off and some of the passengers hung onto it. As the boat sank, about 6 to 8 feet of the bow rail on the port side remained above water, he said, “so we all started grabbing the forward rails, and everyone was holding on to one another.” At this point, the master said that he waved “frantically” to the Red Rock, which he said “circled the boat and approached us stern first.” The master said he told the passengers to stay on the boat and that he yelled to the crab boat to “notify the Coast Guard.” He said that “when the crab boat got within about 20 to 25 foot [sic] of our vessel, everyone in distress started swimming towards the crab boat.” He then yelled to the crab boat captain to put the crab boat in neutral to protect the swimming passengers from the propeller. The master told investigators that “if it had not been for the crab boat . . . we would have had fatalities in that accident.” The master said he hung onto the Panther’s exposed bow rail with an elderly couple who were poor swimmers. The master swam away from the Panther to look for one of the child passengers, but the child turned out already to be on the crab boat. A recreational boat (a 30-foot “Royal” cabin cruiser, the Hoosier Daddy) that happened to be in the area threw the master a lifejacket. The master said that he returned to the Panther, and that the Hoosier Daddy rescued him and the two elderly passengers from the railing. Account of First Responders and Passengers. The Red Rock’s captain told Safety Board investigators that after being hailed by the master of the Panther, he turned to starboard and motored forward of the Panther’s bow, intending to bring his boat along the other’s port side. When the Red Rock was within 2 feet of the tour boat, the Panther’s master told him that his boat was sinking and that the Red Rock would have to take his passengers. Within a few seconds of the Red Rock’s arrival, the Panther sank. One of the passengers told investigators that as the Red Rock approached the Panther, the master “yelled to the passengers that the vessel was sinking.” He said the passengers “lunged to the port side,” toward the Red Rock, which caused the boat to heel to port, which then caused the deck to go underwater and the vessel to sink quickly. The 8 The shaft packing gland is a sleeve that fits loosely around the engine’s propeller shaft and presses on packing that surrounds the shaft; the purpose of the packing is to make watertight the hole through which the shaft passes.

Factual Information 10 Marine Accident Report other passengers described the Panther as sinking in seconds after the Red Rock came alongside. One passenger said, “The boat just disappeared from underneath us.” One passenger told investigators that a wave from the Red Rock swamped the Panther. The captain of the Red Rock confirmed that the passengers rushed to the Panther’s port side when he pulled alongside. Some passengers said they jumped (or passed their children) directly onto the Red Rock, while others swam to it. About 1440, the captain of the Red Rock radioed the news of the Panther’s sinking to the radio operator at Everglades City Seafood (the commercial crab boats did business with that company and kept in contact with the operator). From 5 to 8 passengers remained in the water. The Red Rock captain said he drifted until all the swimmers were on board, then motored to pick up three passengers clinging to a life buoy. About the same time, a National Park Service ranger boat that was patrolling in Indian Key Pass radioed the Park Service visitor center that the Panther had sunk and that passengers were in the water. The ranger said he then rescued the two passengers who were clinging to the Panther’s railing, which those passengers confirmed. About 3 feet of bow rail remained above the water when the Panther sank (see figure 5). According to measurements made by Safety Board investigators, the water at the accident site was 10 to 12 feet deep. Search and Rescue Once on board the Hoosier Daddy, the master of the Panther sent out a distress call over VHF-FM channel 16 that, according to the Coast Guard situation report, was picked up at 1450 by the Coast Guard Group in St. Petersburg, about 150 air miles north of the accident site (see figure 2). The Coast Guard described the transmission as “weak and broken” and lost communication shortly after receiving the call. Within minutes, the Coast Guard launched a 6- hour search-and-rescue mission that would eventually involve District 7 headquarters in Figure 5. Panther submerged in Indian Key Pass.

Factual Information 11 Marine Accident Report Miami, Group St. Petersburg (which took the lead role), and three other Coast Guard stations: Air Station Clearwater (169 air miles north of the accident site), which launched an HH-60 Jayhawk helicopter; Station Ft. Myers Beach (53 air miles north), which launched a 41-foot patrol boat; and Air Station Miami (73 air miles east), which diverted an HU-25 “Guardian” Falcon surveillance jet from a law-enforcement patrol to the accident scene. A Coast Guard Auxiliary twin-engine Piper Aztec was also diverted from a law-enforcement flight to the scene. The Coast Guard reported that the search-and-rescue mission cost over $50,000. Two boats sent by the tour boat company helped return the rescued passengers to shore. Collier County emergency medical services in Everglades City sent emergency vehicles and personnel to the National Park Service visitor center to check the passengers for injuries. All passengers were accounted for and safely returned to the visitor center. Injuries Four of the passengers reported minor injuries (cuts, sprains) but did not seek medical attention. One passenger suffered a broken rib, revealed by X-rays taken the day after the accident. She believed the injury occurred when she hit the side of the crab boat after jumping from the sinking Panther. The injuries sustained in the accident are listed in table 1. Table 1. Injuries sustained9 Damage The Panther’s owner did not commission a damage survey of the vessel. The Safety Board estimated the vessel damage at $60,000. The owner salvaged the vessel and removed it from the water but has not yet repaired it (see “Wreckage” section for more information). Injuries Crew Passengers Total Fatal 0 0 0 Serious 0 1 1 Minor 0 4 4 None 1 28 29 Total 1 33 34 Title 49 CFR section 830.2 defines a fatal injury as any injury that results in death within 30 days of an accident. It defines serious injury as that which requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; results in a fracture of any bone (except simple fractures of fingers, toes, or nose); causes severe hemorrhages, nerve, muscle, or tendon damage; involves any internal organ; or involves second- or third- degree burns, or any burn affecting more than 5 percent of the body surface. 9 Injuries are categorized according to the injury criteria of the International Civil Aviation Organization (ICAO). For uniformity, the Safety Board uses the ICAO injury criteria in all its accident reports, regardless of transportation mode.

Factual Information 12 Marine Accident Report Personnel Information The 46-year-old master was hired by Everglades National Park Boat Tours in January 2002 for a seasonal position (usually, December to May). He worked until July, left for a vacation, then returned to Everglades National Park Boat Tours on December 1 for the new season. He told Safety Board investigators that he normally made four trips a day during the season, sometimes five a day during high-volume periods such as Easter week. Each tour lasted about 1 1/2 hours, with a 30-minute break between. The master had previously been employed as an operator of small tourist boats at a resort on Marco Island, Florida, 15 miles north of Everglades City (see figure 2). The master was laid off when tourism declined after the September 11, 2001, terrorist attacks. According to his résumé, the master also had recreational boating experience in the Gulf of Mexico, the eastern and western Caribbean, and the eastern Pacific. He had been a private boat owner since 1985, and had delivered yachts and operated private sailboats. On May 15, 2000, the master received a Coast Guard license as “master of steam, motor or auxiliary sail vessels of not more than 25 gross registered tons (domestic tonnage) upon near coastal waters.” The license, due to expire on May 15, 2005, also authorized the master to engage in commercial assistance towing. The master’s license permitted him to operate all but the largest tour boat (the 55-foot Manatee II) owned by Everglades National Park Boat Tours. Coast Guard regulations did not require the master to receive any formal training in emergency response or crowd control, nor did he receive any. The master reported that he had slept at least 8 hours a night during the 72 hours before the accident. He said that his overall medical condition was good and that he was not taking any prescription or over-the-counter medications. The Coast Guard told Safety Board investigators that it had found no information to indicate that the master had ever before been involved in a marine accident. As a result of the Panther accident (again according to information received from the Coast Guard), in May 2003 the Coast Guard charged the master with failure to have the required number of crewmembers,10 failure to have a written account of all passengers and to report that count, and failure to require the passengers to put on lifejackets after the boat began to sink. In a consent agreement, the Coast Guard suspended the master’s license for 3 months beginning June 1, 2003, and placed him on probation until September 1, 2004. Vessel Information The Panther was an open, flat-bottomed wood-and-fiberglass boat built in 1968 in Chokoloskee, Florida (see figure 2). The owner of Everglades National Park Boat Tours had operated the Panther since it was built to carry passengers on tours of the Everglades. The principal characteristics of the Panther are listed below: 10 As noted in the “Vessel Information” section, the Panther was required to carry a deckhand if, as on the accident trip, the vessel had 30 or more passengers.

Factual Information 13 Marine Accident Report Length: 31 feet Beam: 10 1/2 feet Depth: 2 1/2 feet Gross tonnage: 4 Crew: 1 (master, plus 1 deckhand if 30 or more passengers on board) Passenger capacity: 37 Propulsion: 225-horsepower Perkins-Sable diesel engine Construction and Equipment The hull of the Panther consisted of fir frames planked with sheets of fiberglass- covered, 1/2-inch-thick marine plywood. The deck beams were made of cypress. A continuous bulwark enclosed the boat’s flat deck and extended 13 inches above it, with deck rails mounted on top of the bulwarks. At the stern, two 3-inch-diameter freeing ports, designed to allow water to run off the deck, cut through the bulwark about 6 inches above the light-load waterline. The bottoms of the freeing ports were about level with the deck. The Panther’s freeboard was thus approximately 6 inches when no passengers were on board. The engine was located in the center of the boat, with the steering console immediately behind it. A shaft tunnel 7 1/2 feet long ran aft along the centerline beneath the deck, reinforced by fore-and-aft timbers (stringers) along the outside. The bilges (each measuring 7 1/2 feet long, 3 feet wide, and 1 1/2 feet high, or about 34 cubic feet in volume) were on either side of the tunnel, under the main deck, and did not connect with the tunnel. The fuel line, engine exhaust hose, and bilge pump discharge lines ran through the tunnel. The Panther’s certificate of inspection (COI) 11 listed the original engine, rated at 160 horsepower. The tour boat owner had no records indicating when the new 225- horsepower engine had been installed, but he estimated that it had been done about 2 years before the accident. According to the master on the day of the accident, the vessel’s normal operating speed was 5 to 6 knots, with a maximum light-load speed of 12 to 14 knots and a half-throttle speed of about 7 knots. Federal regulations at 46 CFR 182.520 stipulate that vessels must be equipped with bilge pumps. The number of required pumps and their minimum capacity depend on the length of the vessel and the number of passengers it carries. The Panther was required to have two bilge pumps: one with a pumping capacity of 10 gallons per minute (600 gallons per hour) and a second with a pumping capacity of 5 gallons per minute (300 gallons per hour). The Panther had three bilge pumps manufactured by Rule Industries of Gloucester, Massachusetts (now part of ITT Industries). According to the Coast Guard, the bilge pumps in the starboard quarter and the engine compartment were rated at 1,500 gallons per hour, while the pump in the port 11 Small passenger vessels carrying more than six passengers for hire may not operate without a valid Coast Guard COI, which is issued by the Coast Guard Officer in Charge, Marine Inspection, for the zone in which the boat operates. The COI, among other conditions, stipulates minimum firefighting, lifesaving, and crew requirements. When determining the number and competencies of the crewmembers, the Officer in Charge, Marine Inspection, considers many factors, including the size of the vessel, its route, the type and horsepower of the vessel’s propulsion machinery, the number of passengers, the type and location of lifesaving equipment, and the hazards peculiar to the route and service.

Factual Information 14 Marine Accident Report quarter was rated at 2,000 gallons per hour. The housings of the bilge pumps contained printed circuit boards (bases on which pathways for electrical circuits are printed and electronic components are mounted). A timer built into the circuit boards cycled the pumps on every 2 1/2 minutes. Unless the pumps sensed resistance to their impellers (from either fluids or solids such as dirt), they would shut off after operating for 1 second. If the pumps sensed resistance, they would continue to operate until the impellers moved freely again. The printed circuit boards had three electrical leads, two going to the pump motor and one going to an indicator light. Each time a pump cycled on, the indicator light would illuminate. Thus, if the impeller encountered no resistance, the bilge pump indicator light would go off for 2 1/2 minutes, on for 1 second, and then off again. The bilge pumps were controlled by three separate switches mounted on the steering console, each having a neutral, automatic, and manual position. In neutral position, the pumps were off. In automatic position, the pumps cycled on and off as described above. In manual position, the pumps were on continuously (as were the indicator lights). According to the Coast Guard, which was on scene immediately after the accident, each pump discharged through a separate overboard discharge line. In discussions with Safety Board investigators, however, the Panther’s owner and maintenance men indicated that the discharge from all three bilge pumps was directed through a manifold to a single 1/2-inch (outside diameter) line that discharged on the vessel’s starboard side. The mounting plate for the steering assembly was in the tunnel near the stern. The plate was bolted through a wooden support block, through both stringers, and to the strut. The support block was made of southern yellow pine. Two spacers ran between the stringers, the upper made of plywood and the lower of bald cypress. The tunnel was covered with removable deck boards that were flush with the main deck. The boards had to be removed to inspect the tunnel. The engine compartment was fitted with a 12-volt d.c. high-level, float-switch- type bilge alarm manufactured by the Cole Hersee Company (4112 series).12 The device was designed so that when water entered the engine compartment, the float would rise and at a predetermined height of 4 inches (that is, when 4 inches of water had accumulated in the engine compartment bilge), would activate a switch that would energize an audible alarm and illuminate a red light under a plastic housing on the vessel’s console. Two of the masters interviewed during the investigation, including the Panther’s master on the day of the sinking, had no knowledge of the alarm and had never heard it sound (notwithstanding the alarm’s location on the console above the steering wheel). The alarm was submerged when the Panther sank. Safety Board and Coast Guard investigators examined the switch after the accident and found a disconnected wire. The alarm was sent for testing to the Safety Board’s Materials Laboratory (see “Tests and Research” section for the results). 12 Vessels 26 feet or longer are required by 46 CFR 182.530 to be provided with alarms that emit visible and audible signals indicating high water levels in bilges and other unmanned spaces.

Factual Information 15 Marine Accident Report Certification and Inspection The Marine Safety Office in Miami was the local Coast Guard office in charge of inspecting the Panther. The Safety Board interviewed three Coast Guard inspectors and reviewed the inspection records for the Panther for the past 7 years. None of the records noted any structural defects. The Panther had last been drydocked for a Coast Guard examination on December 31,

1. According to the inspection record, the outside hull was found to be satisfactory. On

May 3, 2001, the Coast Guard inspected “all voids, compartments, bulkheads, [and] stiffeners” on the Panther and issued a COI. The boat underwent its last Coast Guard reinspection on May 21, 2002. Nine checklist items were listed as “inspected satisfactory” (among them construction/loadline, electrical, lifesaving, and stability), and three nonstructural deficiencies were listed as “found and corrected.” Critical equipment would have been tested during the inspection, including the high-level bilge alarm. The Panther was scheduled for another Coast Guard drydock inspection on December 31, 2002—the day after the accident. The Coast Guard COI permitted the Panther to operate not more than 1,000 feet from shore in the waters between Everglades City and Chokoloskee (see figure 2). According to the COI, the total number of persons allowed on the Panther was 39, including 37 passengers and 2 crewmembers. The boat was required to have a licensed master, with the additional requirement to carry a deckhand if the boat carried 30 or more passengers. If fewer than 30 passengers were on board, the COI required no deckhand. The master told Safety Board investigators that he had never seen the COI for the Panther and that during his orientation as a new employee of Everglades National Park Boat Tours, other company masters had told him that the vessel had been “grandfathered” to previous regulations and that a deckhand was not required. The owner told investigators that it was the master’s responsibility to ensure that a deckhand was on board when the vessel carried 30 or more passengers. The owner also said that two people were on standby to serve as a deckhand if necessary. One of the owner’s sons, however, told Coast Guard investigators that he was not aware that the Panther had ever carried a deckhand. The master who had operated the Panther on the day it grounded in early December 2002 stated that in his three seasons of working for the tour boat company, the owner had never told him that the vessel was supposed to carry a deckhand when it had 30 or more passengers on board. He said he had seen the Panther’s COI stowed in a lifejacket compartment.13 13 Title 46 CFR 176.302 requires the COI to be kept on board a vessel, either displayed where it can be seen by passengers, or in the case of an open boat, “in a watertight container readily available for use by the crew and display to passengers and others on request.”

Factual Information 16 Marine Accident Report Wreckage Salvage Operations The Panther’s owner and his sons began salvage operations immediately after the accident. Just after the Panther sank, one of the sons, accompanied by one of the maintenance men, left for the accident scene in one of the company’s six-passenger boats. By the time they reached the site of the sinking, about 1515, a passing crab boat had towed the Panther to a sandbar about 300 yards away, out of the path of other vessels. The men retrieved the engine cover (which had floated free during the sinking) and one of the hatches from the Panther and returned to the visitor center. After talking with the owner, the two sons returned to the accident site, accompanied by the maintenance men, intending to tow the Panther back to the visitor center marina. Two National Park Service employees who had arrived at the site shortly before, however, told the sons that the vessel could not be moved without the Coast Guard’s permission. Everyone stayed in the area until two investigators from the Coast Guard Marine Safety Office in Miami arrived at the site about 2230. After taking photos, the Coast Guard investigators gave the sons permission to move the Panther farther onto the sandbar, so it would be above water at low tide the next morning. After pulling the Panther about 30 feet farther onto the sandbar, the sons and the maintenance men returned to shore. At low tide, or about 0900 the next morning, the owner’s sons, the maintenance men, and one of the Coast Guard investigators returned to the vessel to survey the damage. The vessel was resting on the sandbar. The sons and the maintenance men boarded the vessel and, according to their statements, found a damaged area near the strut block in the tunnel. The two sons and the two maintenance men returned to the visitor center marina and drafted a salvage plan for submission to the Coast Guard. According to the first item in the plan, the owner was to “temporarily patch hole in tunnel caused by us beaching the vessel last night.” (See “Postsalvage Examination,” below.) After the Panther had floated free on the incoming tide, the sons and the maintenance men returned to the vessel and used one of the company’s other boats to tow the Panther to the visitor center marina. During the trip, three of the men rode in the Panther, and one of them had to maintain pressure on the damaged area to prevent water from pouring into the vessel. Water continued to enter the boat, and the men had to pump the bilges, using a portable pump, four or five times before they arrived at the marina. Postsalvage Examination After the accident, the Panther was hauled out of the water and onto a marine railway owned by the tour boat company at the visitor center marina. When Safety Board investigators arrived, the vessel had already been partly dismantled and the bilge pumps disconnected. Safety Board and Coast Guard investigators examined the vessel and found a fracture in the underside of the hull, originating at the strut plate that supported the rudder post and steering assembly. The fracture was C-shaped, with each section of the C about 6 inches long (see figures 6a and 6b). The open part of the C, which surrounded the

Factual Information 17 Marine Accident Report Figure 6a. strut plate, was pushed upward, creating an irregular opening about 2 inches long and 1 inch wide (see figure 6b). The investigators examined the plywood in the area of the C-shaped fracture in the hull bottom and found no evidence of deterioration due to wastage or rot. Figure 6. C-shaped fracture around strut plate. Figure 7. Closeup of 2-inch opening in fracture around strut plate. Figure 6b.

Factual Information 18 Marine Accident Report Coast Guard inspectors directed the owner to remove the engine exhaust hose that ran over the starboard stringer. Once the steering gear assembly and mounting plate were removed, the support block was exposed. When the owner attempted to pry the support block free, it splintered and had to be removed in pieces. The two spacers were removed intact. Safety Board investigators sent all three items to the Board’s Materials Laboratory in Washington, D.C., for examination (the “Tests and Research” section describes the results). When the support block was removed, investigators observed that the starboard stringer was deflected upward about 1 inch from the bottom hull planking. The investigators further observed that a rag had been used to plug a hole in the stringer. The owner told the Safety Board that the rag had been inserted during the salvage operation. At the Coast Guard inspectors’ request, the owner removed the seats and cut pieces out of the deck so that the entire bilge area and its associated internal structural supports and frames could be thoroughly examined. No significant damage was discovered. Waterway Information Indian Key Pass, the site of the accident, is a dredged channel in Everglades National Park, off the southwest coast of Florida. The waterway runs from the Gulf of Mexico through the hundreds of low, uninhabited mangrove islands known as Ten Thousand Islands and into Chokoloskee Bay (see figure 2). The Ten Thousand Islands area covers nearly 200,000 acres along 60 miles of coastline, from Marco Island in the north to just above Cape Sable at the southwest tip of Florida. The shallow waters of the coastal estuary are brackish, a mix of freshwater flowing from the Everglades in the interior and saltwater coming from the Gulf of Mexico.14 The average low-water depth in Indian Key Pass ranges from 7 to 15 feet,15 and in June 2002, the midchannel controlling (minimum) depth was 4.8 feet16 (the site of the Panther sinking measured 10 to 12 feet deep). Outside the channel, the waters are quite shallow, in some places a foot or less deep. The mean tidal fluctuation at Indian Key Pass is 3.4 feet.17 Low tide was at 1618 the afternoon of the accident, according to National Ocean Service data. The captain of the Red Rock estimated that the tide was ebbing at 3 to 3 1/2 knots when he came alongside the Panther; the Panther’s master estimated the current at 2 knots. An ebbing tide flows toward the Gulf of Mexico; a flooding tide flows toward the National Park Service visitor center. 14 This description of the Ten Thousand Islands area uses information from the U.S. Geological Survey http://sofia.usgs.gov/virtual_tour/tirb/, the Longstreet Highroad Guide to the Florida Keys & Everglades, by R. Ferren , and the Everglades National Park boating page . 15 National Oceanic and Atmospheric Administration, National Ocean Service, Coast Survey, U.S. Gulf Coast, Florida, Map 11429, Chatham River to Clam Pass, September 2002. 16 National Oceanic and Atmospheric Administration, National Ocean Service, United States Coast Pilot, Vol. 5 (Atlantic Coast: Gulf of Mexico, Puerto Rico, and Virgin Islands), 2003, p. 213. 17 Coast Pilot, p. 213.

Factual Information 19 Marine Accident Report Average monthly water temperatures in Indian Key Pass range from 66° F (January–February) to 87° F (July–August).18 The water temperature at the accident site 2 days after the sinking was 62° F, as measured by Safety Board investigators from water samples collected at depths of 6 inches to 6 feet. Operations Company Information National Park Service Contract. Everglades National Park Boat Tours was a concessionaire of the National Park Service and had the sole concession for boat tours in the Ten Thousand Islands area, departing from the National Park Service visitor center.19 Since about 1958, the owner had operated a tour boat company in the Gulf Coast area of the Everglades that was added to Everglades National Park in 1960. For the first few years, the National Park Service granted the company monthly or yearly permits to operate boat tours from the visitor center. At the time of the accident, the company was operating under a 10-year contract that expired in January 1992 but that the Park Service had extended. The concessions management plan attached to the contract required the company’s tour boats to be properly documented. Federal regulations required the tour boats to be inspected by the Coast Guard, which the contract also stipulated. The management plan specified responsibilities for maintaining the building used by the tour boat company but not for maintaining the tour boats. On January 1, 2003, the National Park Service renewed the concessionaire contract of Everglades National Park Boat Tours for 6 months, or until a new contract was awarded, to avoid interrupting visitor services in the park.20 Under the National Parks Omnibus Management Act of 1998, the Park Service began soliciting new bids for concession contracts throughout the national park system. As of the date of this report, no company had been awarded the contract for boat tours in Everglades National Park. 18 National Oceanographic Data Center, Coastal Temperature Guide (January 27, 2003). 19 Concessionaires are private business contractors who provide various commercial services, such as food, lodging, and transportation, to visitors in the national park system. Each concessionaire signs a binding written agreement with the director of the National Park Service, which administers over 630 such contracts . The park concessions are regulated under 36 CFR 51 and the National Park Service Concessions Management Improvement Act of 1998. The National Park Hospitality Association (the concessionaires’ trade group) reports that concessions operate in about one-third of the 386 areas in the national park system . In addition to national parks such as Everglades, the park system includes national monuments, national preserves, national historic sites, national seashores, national lakeshores, national recreation areas, and other types of recreational, historic, or scientific sites. 20 Federal Register Vol. 68, No. 78 (April 23, 2003), p. 20024.

Factual Information 20 Marine Accident Report Day-to-Day Business. Besides the Panther, the owner operated four other large tour boats, all of which had current Coast Guard COIs. He also had two small excursion craft, capable of carrying six people each, which did not require Coast Guard inspection. The length, maximum number of passengers, and crew requirements of each large tour boat are shown in table 2. Table 2. Company’s large tour boats The owner also rented canoes and kayaks and operated a small gift shop on the first floor of the Park Service ranger station. The owner, his two sons, his wife, two maintenance men, and three other employees conducted the day-to-day operations of the company. A VHF radio in the company office monitored channel 78, the communication channel used by all company boats. Boat masters were hired seasonally and paid by the day, with no overtime or holiday pay and no vacations, according to the Panther’s master on the day of the accident. The company’s five large boats typically made four to five tours a day, ranging from 1 1/2 to 2 1/2 hours long. The tours covered the upper reaches of the Ten Thousand Islands area of Everglades National Park. The Manatee II provided the additional option of a sunset cruise into the Gulf of Mexico, about 6 1/2 miles from the visitor center. The boat masters were given the discretion to alter their voyages on the basis of local weather conditions. The busy season for the company was usually from December until May. Company personnel told Safety Board investigators that the Panther II (sister vessel to the Panther) had been out of service during the month before the accident, being prepared for its next Coast Guard drydock examination. The examination was scheduled for December 30, according to the vessel’s COI. Because the Panther II was out of service, the company was relying on the Panther and three other large boats to carry passengers at the beginning of its busy season. Vessel Maintenance Everglades National Park Boat Tours employed two maintenance men. One of the maintenance men had worked for the company since 1977 on a seasonal schedule, coming from his home in Ohio every winter and returning in the spring after the high season. He had been service manager for a farm equipment firm in Ohio for 15 years, where he attended manufacturer-sponsored maintenance schools and worked with manufacturers’ representatives on the equipment in the field. He had worked on vessel maintenance for 20 Boat Length (feet) Maximum Passengers Required Crew Panther 31 37 2* Panther II 31 37 2* Skimmer 31 30 2 Manatee 38.1 75 3* Manatee II 55 104** 3 *COI allows reduced crew under certain circumstances. **On protected route, COI allows 136 passengers.

Factual Information 21 Marine Accident Report years, doing mostly minor repairs to engines and bilge pumps. At the time of the accident, he was working part time. The other maintenance man had worked for the company since 1997, doing “everything”—cleaning boats, repairing boats, captaining boats. He told investigators that he had been around boats all his life, that he held a captain’s license to operate vessels of 25 gross tons, and that he had captained commercial crab boats. One of the owner’s sons also regularly helped maintain the company’s boats. Both of the sons told Safety Board investigators that the company dry-docked its boats every year to have the sides and bottoms painted. One of the masters told investigators that bottom painting was done by a commercial boatyard. The sons said they would “get underneath there and . . . see if we’ve got any problems.” They said they would check the driveshaft structure, including the strut bearings and the supporting shoe under the strut. If the shoe was thin, they said, it would be replaced. They also said they replaced rotten wood, and generally made the boat “look pretty for the winter.” Engine servicing was mainly a matter of maintaining fluid levels and changing the filters; neither of the sons recalled following any specific manufacturer’s instructions. The maintenance men normally checked the oil, the transmission, and the hoses in the morning before the boats left on tour, according to the sons. The masters did not check the boats for maintenance purposes or before getting under way with passengers. One of the maintenance men told Safety Board investigators that when boats malfunctioned or needed repairs, the masters would report the problem to the maintenance men, who would fix it. The wiring frequently needed repairing because of the saltwater, he said. He did not recall making any major repairs to the fiberglass on the Panther’s hull, except for sanding in spots. The owner of the company told Safety Board investigators that he did not maintain written maintenance and repair records for any of his boats. Meteorological Information Data from the National Weather Service in Key West, Florida, show that at the time of the accident, the air temperature was about 75° F. The sky was mostly cloudy, with winds from the southeast at 15 mph and a visibility of 10 miles. Rainfall in the area totaled less than half an inch for the month of December 2002. Sunset was at 1744 on December 30. Toxicological Testing If the sinking had been classified as a “serious marine incident,”21 testing the master for drugs and alcohol would have been mandatory. In the case of other accidents, 21 A serious marine incident is defined at 46 CFR 4.03-2 as one that results in death, injury beyond first aid, damage to property in excess of $100,000, loss of an inspected vessel, or loss of a vessel of 100 gross tons or more.

Factual Information 22 Marine Accident Report the regulations allow law enforcement officers or employers to require testing whenever they have “reasonable cause.”22 The Coast Guard advised the Safety Board that, after the accident, the Park Service law enforcement rangers contacted the Marine Safety Office in Miami to discuss toxicological testing of the master. The rangers reportedly advised the Marine Safety Office’s chief of investigations that the Panther master did not exhibit any behavior after the accident that appeared to warrant alcohol testing. None of the passengers reported any signs of alcohol use on the master’s part, and one passenger explicitly stated that the master “did not seem to be intoxicated at all.” The rangers and the Coast Guard official mutually agreed that the master should not be required to provide samples to be analyzed for alcohol. The master submitted a urine specimen for a postaccident drug screen on December 31, 2002. The laboratory report does not indicate at what time the specimen was submitted. The results were negative. Survival Aspects Lifesaving Equipment The Panther had lifesaving equipment on board for 39 people. The equipment included the following: Adult lifejackets 39 Child lifejackets 4 Ring buoys 1 (light and line attached) The lifejackets were stowed in labeled lockers under the boat’s seats, except for the bench seat in the stern. Passengers’ lifejackets were located in the seat in front of them (see figure 7), or in the case of the two small forward seats, under the bow bulwark. Access to the lifejackets was through openings in the backs of the seats, protected by covers with two barrel-bolt latches at the bottom, one on each side, and hinges at the top. To retrieve their lifejackets, passengers would have had to unlatch the bolts and swing the covers toward themselves; to open the covers completely, passengers would have had to lift their feet out of the way.23 The company’s owner said that the Coast Guard marine inspectors had advised him to install the covers. However, the Coast Guard could find no indication of “any deficiency in our inspection reports requiring that installation,” and the owner could not document his statement. 22 According to 33 CFR 95.035, reasonable cause exists when an individual is directly involved in a marine casualty, defined as any incident that results in material damage affecting the efficiency of a vessel. 23 According to 46 CFR 180.78, “life jackets must be stored in convenient places distributed throughout accommodation spaces,” and “each stowage container for life jackets must not be capable of being locked. If practicable, the container must be designed to allow the life jackets to float free.” Further, “each life jacket kept in a stowage container must be readily available.”

Factual Information 23 Marine Accident Report The Panther’s 33 passengers ranged in age from 10 to 85. Five of the passengers were 17 or under, and two of those could not swim. Three of the adult passengers were also nonswimmers. None of the passengers was able to don a lifejacket before the Panther sank. The passengers told investigators that the master gave them no instructions about donning lifejackets and did not tell them to prepare to abandon ship. The master told Safety Board investigators that when the Panther started sinking, the passengers could not see or reach the latches to the lifejacket lockers because the lockers were underwater. One passenger reported that she dived into the water, but the poor visibility (less than 1 foot) hampered her from finding the latches on the lockers, though she finally managed to retrieve a lifejacket and hand it to one of the nonswimming passengers who was hanging onto the Panther’s bow rail. None of the lifejackets floated free after the accident. Firefighting Equipment The Panther’s firefighting equipment consisted of three fire extinguishers (1 class B-I and 2 class B-II24) and a fixed, 10-pound-capacity halon fire-extinguishing system protecting the engine compartment. Figure 8. Lifejacket locker on Panther. 24 Class B extinguishers are for fires involving flammable liquid, grease, or gas. B-I extinguishers hold 2.5 pounds of dry chemical; B-II extinguishers, 10 pounds of dry chemical. Figure 7

Factual Information 24 Marine Accident Report Communication Devices A VHF-FM radiotelephone and public address system, wired together, were mounted in the Panther’s steering console. A small door gave access to the equipment. The 12-volt battery that powered the radiotelephone and public address system were housed below deck, on the engine’s port side. The same microphone was used for both systems. The master carried a portable VHF-FM radio in his personal effects as backup, but he said that he always kept it turned off. He told investigators that he did not have time to retrieve his radio during the sinking. Tests and Research High-Level Bilge Alarm Safety Board investigators removed the Cole Hersee 4112 series high-level bilge alarm from the Panther and shipped it to the Board’s Materials Laboratory for examination. The laboratory found a heavily corroded screw and cable connector on one of the alarm’s terminals. The manufacturer’s specification sheet for the 4112 series of alarms stated that it operated on 12 volts d.c. A suitable supply was connected to the terminals of the alarm and the circuit was switched on. The alarm light illuminated and the buzzer sounded, indicating that the alarm was functioning. Bilge Pump One of the tour boat company’s mechanics removed the Panther’s starboard bilge pump and gave it to Safety Board investigators, who shipped it to the Board’s Materials Laboratory for testing. The laboratory found that the pump’s impeller rotated freely in its housing and that the housing contained no debris or projections to impede water flow. When the pump was tested by applying power to the conductors in the electrical cord at the top of the pump, the pump did not operate. The laboratory removed the upper cap to reveal the printed circuit board that controlled the pump. All three electrical conductors in the electrical cord were firmly attached to the circuit board. Two other conductors also attached to the circuit board continued into the pump body. When a power supply was connected to those conductors, the pump motor operated. The impeller continued to spin, as if the pump switch were on the manual setting (that is, set for continuous pumping). Examination of the surface of the circuit board showed that it was dry and showed no signs of immersion. Rule, the pump’s manufacturer, was contacted but could not supply a formal testing procedure for the printed circuit board. Wooden Support Block and Spacers The wooden support block and the two wooden spacers from the Panther were sent to the Safety Board’s Materials Laboratory for analysis, then forwarded to the USDA Forest Products Laboratory, which confirmed that all three pieces were affected by brown rot decay. Decay occurs when wood is moist or alternately wet and dry. The Materials Laboratory

Factual Information 25 Marine Accident Report concluded that “decay to [the observed] extent probably occurred over a number of years.” The lightest decay was found on the lower spacer, which was made of bald cypress, a wood that is naturally resistant to decay. The upper spacer and the support block were more severely decayed, to the extent that the woods composing the plywood spacer could not be identified. The wood in the support block was identified as southern yellow pine. In analyzing the support block and spacers, the Materials Laboratory found evidence of “temporary repairs over the years as the decay was progressing.” The evidence included hard plastic material used to fill holes and edges, elastomeric materials (materials resembling rubber) used to fill gaps and holes, and paint covering the fill material. Other Information Enforcement Jurisdiction Designated National Park Service rangers have the responsibility for maintaining law and order in the waters of Everglades National Park, allowing them to enforce any Federal law or regulation inside the park.25 The National Park Service signed a memorandum of understanding with the Coast Guard and the Florida Fish and Wildlife Conservation Commission granting concurrent jurisdiction to those agencies for enforcing laws and regulations in the park. Actions Taken Since the Accident Coast Guard. As a result of its investigation of a previous accident in the Coast Guard’s Miami district involving the small passenger vessel Bayside Blaster,26 the Safety Board issued the following Safety Recommendation to the Coast Guard on December 30, 2002: M-02-28 Evaluate the adequacy of the marine safety inspection program in the Miami area to ensure that small passenger vessels are in compliance with applicable regulations, including the requirements for lifejacket stowage, navigation lights, and manning. On May 9, 2003, the Coast Guard replied that it concurred with the recommendation and that it had provided its marine inspectors with additional training related to the recommendation. Further, the Coast Guard said it would “continue to verify compliance with the relevant regulations during scheduled inspections and other 25 As authorized by Title 16 United States Code chapter I, subchapter 1, section 1a-6, “Law enforcement personnel within National Park System.” 26 National Transportation Safety Board, Collision Between the U.S. Coast Guard Patrol Boat CG242513 and the U.S. Small Passenger Vessel Bayside Blaster, Biscayne Bay, Florida, January 12, 2002, Marine Accident Report NTSB/MAR-02/05 (Washington, DC: NTSB, 2003).

Factual Information 26 Marine Accident Report boardings.” The Safety Board classified Safety Recommendation M-02-28 “Closed— Acceptable Action” on November 21, 2003. After the Panther accident, the Coast Guard informed the Safety Board that it had increased unannounced spot checks of small passenger vessels operating in and around Everglades National Park. An example is a joint operation conducted in August 2003 by the Coast Guard’s Marine Safety Office in Miami, Coast Guard Station Ft. Myers, the Park Service, and the Collier County Sheriff’s Department. During the operation, 21 small passenger vessels near Everglades City were boarded and five trips were terminated because of safety issues. Three Coast Guard–documented small passenger vessels were also boarded at the dock. Two of the vessels had their COIs canceled and were required to undergo complete reinspections because of safety deficiencies. National Park Service. Within 2 weeks of the Panther accident, the Park Service withdrew its prospectus for the tour boat concession at Everglades National Park “to consider safety issues related to park concession tour boat operations.” A revised prospectus was issued later in the year, which included explicit requirements for vessel maintenance. Specifically, successful bidders for the tour boat concession will be required to put in place a computerized preventive maintenance program to track scheduled and nonscheduled maintenance items “with the intention of providing the safest and most dependable service possible.” The concessionaire will also be required to maintain a computerized fleet management program that includes, among several items, all preventive maintenance inspection reports, daily vessel inspection reports, and equipment breakdown logs. Further, the concessionaire’s vessels must have a drydock survey at least once a year, conducted off site by the Coast Guard or an accredited marine surveyor. In the bidder qualification section of the prospectus, questions were added asking bidders to describe their experience in operating an effective preventive maintenance program. Bidders were also asked to indicate how they proposed to ensure that operations would be conducted safely, including the kind of safety training staff would receive. Safety Board. While investigating the Panther sinking, the Safety Board learned that Everglades National Boat Tours frequently transported large groups of children on its vessels—for example, during school tours of the Ten Thousand Islands area—but that the tour boats did not always have enough child-size lifejackets for every child on board, as required by 46 CFR 117.71 and 180.71.27 Out of concern that the same situation might exist in other parts of the national park system and to address the issue immediately, in April 2003, the Safety Board issued the following advance Safety Recommendation to the National Park Service: 27 The regulations state: “An adult life jacket must be provided for each person carried on board a vessel . . . In addition, a number of child-size life jackets equal to at least 10 percent of the number of persons permitted on board must be provided, or such greater number as necessary to provide a life jacket for each person being carried that is smaller than the lower size limit of the adult life jackets provided to meet this section.”

Factual Information 27 Marine Accident Report M-03-1 Establish oversight procedures to verify, on a regular basis, that tour boat concessionaires who operate in the national park system carry an appropriately sized lifejacket for every child on board. On July 25, 2003, the Park Service responded that it concurred with Safety Recommendation M-03-1 and that it had directed its regional directors to establish procedures and to task personnel with carrying out the recommendation. The Park Service also asked the directors to convey information about the Federal requirements for child- size lifejackets on small passenger vessels to concessionaires in their regions who operate tour boats. The Safety Board has classified Safety Recommendation M-03-1 as “Open— Acceptable Response.” Passenger Vessel Association The Passenger Vessel Association (PVA) serves the interests and concerns of more than 350 vessel owners and operators in the domestic passenger vessel industry, which represents about 65 percent of the industry nationwide. Association members operate more than 1,100 passenger vessels in the United States, carrying up to 200 million passengers annually. PVA members offer services including dinner cruises, tour and excursion services, car and passenger ferries, private charters, whale-watching trips, overnight cruises, and riverboat gaming. At the time of the Panther sinking, Everglades National Park Boat Tours was not a PVA member company. The PVA has a safety and loss-control committee responsible for reviewing, developing, and implementing programs to encourage enhanced training and safety among its members. The programs are designed to improve the loss record for the industry. The PVA has published risk management and training manuals to help its member companies improve the safety of their passenger vessel operations. The risk management manual includes a safety audit guide that contains inspection checklists for identifying hazardous conditions that could lead to slips, trips, falls, and other injuries to passengers or crewmembers. The manual contains the information that engineroom safety and deck equipment inspection logs are useful for conducting proper maintenance, but does not contain any guidance for developing and implementing preventive maintenance programs for systems that affect the safe operation of a vessel. The association also publishes maintenance checklists on its website (www.passengervessel.com).

28 Marine Accident Report Analysis General The analysis first identifies factors that can be readily eliminated as causal or contributory to the accident. The report then discusses the sinking of the Panther, followed by a discussion of the major safety issues discussed in the report: the adequacy of company operations, the adequacy of the company’s preventive maintenance program, and lifejacket stowage. Exclusions Data from the National Weather Service in Key West, Florida, show that at the time of the accident, the weather was mild, with light to moderate winds and good visibility. The vessel was operating in protected waters that had no significant wave development. In addition, the Panther’s main engine operated throughout the accident voyage without difficulty and had no effect on the flooding of the vessel. Consequently, the Safety Board concludes that the weather and sea conditions and the condition of the vessel’s engine were not factors in this accident. The master was a normally healthy individual who was not taking any prescription or nonprescription medications at the time of the accident. Further, the master reported that he was well rested in the 72 hours preceding the accident and had worked only about 5 hours up to the time of the sinking. The National Park Service enforcement rangers, trained law enforcement officers who interacted directly with the master after the sinking, stated that the master did not exhibit any obvious signs of alcohol use when they interviewed him after the accident and decided with the Coast Guard that there was no need to subject him to an alcohol test.28 Further, none of the passengers reported that the master showed any signs of alcohol use. The Safety Board considers improving postaccident drug and alcohol testing in the marine industry so important that it has placed the issue on its “Most Wanted” list of transportation safety improvements. The “Most Wanted” list is intended to increase the public’s awareness of, and support for, action to adopt safety steps that can help prevent accidents and save lives. While the Safety Board cannot definitively rule out alcohol use by the master because he was not tested, the circumstantial evidence indicates that he was not under the influence of alcohol on the day of the accident. The master underwent a postaccident drug screening the day after the accident, with negative results. Consequently, the Safety Board concludes that none of the following were factors in this 28 Under Federal regulations, both drug and alcohol testing would have been mandatory if the accident had resulted in death.

Analysis 29 Marine Accident Report accident: the master’s health, the use of prescription or nonprescription medications, fatigue, alcohol, or illicit drugs. The Sinking The Panther, with 33 passengers and one master on board, sank while on a tour of the Ten Thousand Islands area of Everglades National Park. The vessel was on its third tour of the day; the two previous tours had been completed without incident. Some passengers on the accident trip noted that the Panther had a low freeboard and that the bilge pumps were working even before they boarded. During the trip, the master took the Panther through its accustomed maneuvers, designed to attract dolphins to the boat’s wake. Near the halfway point of the tour, in Indian Key Pass about 3 1/2 miles from the National Park Service visitor center, the master stopped the boat because he noticed water spilling over the sides of the boat. Shortly thereafter, the Panther suddenly sank. A nearby crab boat rescued many of the passengers, but a few were left in the water. The rest of the passengers were rescued by a passing recreational boat and a Park Service ranger boat that was on patrol in the area. One passenger suffered a serious injury. None of the passengers was able to retrieve or don a lifejacket before the Panther sank. To determine the probable cause of the sinking, the Safety Board investigated the Panther’s recent history, examined the integrity of the vessel’s hull, and interviewed company representatives and passengers. Vessel History In early December, one of the company’s masters reported that he had run the Panther aground during a passenger tour. The grounding was reported to the company’s owner, who had to send another boat to return the passengers to shore and to retrieve the Panther. After the grounding, the owner’s sons and the company maintenance workers found that the vessel had grounded hard enough to clog the cooling water intake (sea strainer) with sand and shells from the bottom of the bay. The vessel was not taken out of the water after the grounding for a thorough examination. Nor was the grounding reported to the Coast Guard, as required by Federal regulations (46 CFR 4.05-1). In their examination of the Panther after it sank, Safety Board investigators discovered a C-shaped fracture in the hull at the propeller strut connection and a displaced stringer near the centerline. The master’s description of the grounding, as well as the report of the sand and shells that clogged the engine coolant intake, indicates that the impact with the sea bottom was more than incidental and could have been substantial enough to damage the hull. The master stated that after the December grounding, he and another master noticed that the handling characteristics of the Panther had changed. A change in the vessel’s handling characteristics could indicate propeller damage or damage to the propeller’s supporting bracket, or strut. Any grounding that was severe enough to cause the handling characteristics of a vessel to change was severe enough to justify hauling the vessel out of the water to examine it closely for damage.

Analysis 30 Marine Accident Report Touching bottom, or grounding, in soft mud was common for the tour boats, according to both masters and owner. The masters were given considerable leeway in the routes they followed. For example, on the day of the grounding in early December, the master told investigators he had gone outside the dredged channel to show tourists a particular bird. On either side of the channel are hundreds of low-lying mangrove islands, surrounded by water less than a foot to only a few feet deep. The owner’s sons said that they repeatedly told the masters to stay in the channel, but that the boats ran aground “every day.” Repeated admonitions clearly were ineffective in preventing the masters from operating their vessels outside the dredged channel, where they were susceptible to grounding in the shallow waters around the mangrove islands. Therefore, the Safety Board concludes that the owner was aware that his masters frequently took their vessels where they were susceptible to grounding, but the owner failed to prevent this practice. In mid-December, the same master who grounded the vessel in early December returned to the marina with a full load of passengers. During the voyage, he noticed what he thought was significantly less freeboard than usual. The master believed that the vessel’s bilge pumps were not operating properly and reported the problem to the two company maintenance men. According to the master, the maintenance men told him that all the bilge pumps were operating properly. Neither maintenance man made any attempt to determine the cause of the reduced freeboard. Low freeboard was an obvious indication that the vessel was taking on water that was accumulating in the bilges. Servicing or checking the bilge pumps, as the mechanics did on receiving a report of the problem, would not have stopped the ingress of water. The proper course of action would have been to identify the source of the flooding and to take remedial action to stop the leak, or to repair the problem. The master told investigators that another master had had a similar low-freeboard problem a few days afterward. It was, therefore, apparent that the problem persisted and that the masters and owner’s representatives were aware of it. The day before the Panther sank, another master was returning to the marina when the boat developed a significant starboard list. He notified the maintenance men of the condition. According to the owner’s son, the list was caused by the master inadvertently shutting off the starboard bilge pump. If the vessel was taking on water in the starboard bilge area and the starboard bilge pump was not engaged, the weight of the flooding water in the starboard side of the vessel would explain why the vessel developed a starboard list.29 Although activating the bilge pump to remove this water might have corrected the list, it would not have addressed the source of the water in the bilges. Bilge pumps are intended for the purpose of removing incidental accumulations of water, such as rainwater. During the month before the sinking, the accident area received less than a half-inch of rainfall. The water in the Panther’s bilges could not, therefore, have been attributable to rainfall. Thus, the incidents of low freeboard reported by the masters during December should have indicated that the vessel was taking on water and that its watertight integrity had been compromised. Yet after every incident, the masters 29 The bilge area on the starboard side of the tunnel was a space of about 34 cubic feet. With a cubic foot of water weighing 62 pounds, there was a potential for over 2,000 pounds of water in the starboard bilge.

Analysis 31 Marine Accident Report and owner’s representatives focused on the bilge pumps. That is, they attributed the problems to the bilge pumps either not working or not being turned on. Bilge pumps are not intended to compensate for a lack of watertight integrity and should not be relied on for that purpose. Therefore, the Safety Board concludes that the owner, maintenance men, and masters knew that the Panther was operating with a less-than-normal freeboard for about 2 weeks before the sinking and were aware that the vessel was continually taking on water but took no action to identify and eliminate the source; instead, they incorrectly relied on the bilge pumps to dewater the vessel, which placed the passengers at risk. Hull Damage The incidents in mid-December and on December 29 should have alerted the owner and the maintenance men that the Panther was taking on unusual amounts of water in the bilges. The incidents should have prompted a comprehensive examination of the vessel that, if conducted, should have discovered the C-shaped fracture in the boat’s bottom at the strut connection. The company had its own marine railway on site that could have been used at any time to haul the boat out of the water for a hull inspection. After the sinking, the owner’s sons and the company maintenance men towed the Panther back to the marina. To pump out the vessel and allow it to be towed, the bottom of the vessel beside the strut support plate had to be plugged to stop the ingress of water. Throughout the tow, one of the men had to apply pressure to the plugged area to prevent incoming water from pushing out the plug. At the postaccident examination of the hull, Safety Board investigators did not find any other damaged sections of the hull. That indicates that there could not have been any other source of water leakage than the damaged area at the boat’s shaft. To determine the cause of the sinking, the Safety Board investigators explored whether the damage to the hull occurred during the early December grounding or at the postaccident beaching. Before the vessel departed on the trip during which it sank, passengers reported hearing the bilge pumps cycling on and off and observing discharges of 3 or 4 gallons through the overboard bilge discharge lines. The Panther’s low freeboard and the discharging of water by the bilge pumps while still at the dock indicate that the vessel was taking on water before the vessel departed on the accident voyage. Although the vessel exhibited signs of flooding at the dock, the master did not check the bilges before departing on the trip. Either the master did not notice the signs of flooding, or the signs had been present for some time and had become routine operating conditions that he ignored. In either case, the master did not act correctly. On boarding the vessel and before loading passengers, a competent and careful master would have quickly examined his vessel to ensure that it was safe to operate. Finding a problem as serious as flooded bilges would have prompted such a master to cancel the voyage. The Safety Board, therefore, concludes that had the master acted correctly by ensuring that his vessel was safe to operate, he would not have taken the Panther on the voyage during which it sank.

Analysis 32 Marine Accident Report On two separate occasions with two different masters, the vessel returned to the marina with reduced freeboard or a starboard list, both of which indicate an excessive accumulation of water in the bilges. Because the only source of flooding found during the postaccident examination of the hull was the C-shaped fracture in the bottom of the boat, the fracture must have been present before the vessel left the marina on the day of the sinking. However, if the fracture had been present for a while before the accident, the Safety Board had to consider why the vessel did not sink earlier than it did. One possible explanation is that the fracture in the bottom of the boat was small in the beginning but became larger over time as the vessel was operated aggressively. As the fracture enlarged, the flooding rate would have increased until it exceeded the capacity of the bilge pumps, making the vessel vulnerable to sinking. The investigation of the accident revealed that the vessel was routinely operated in an aggressive manner. The masters regularly moved passengers aft and ran the boat at full speed over its own wake to prompt dolphins to jump out of the water for the passengers’ enjoyment. Such operations would have caused the bottom of the boat to slam as it crossed its wake. The resulting flexing of the bottom could have caused the fracture to gradually enlarge until the flooding rate reached a critical level. Safety Board investigators estimated that the fracture in the Panther’s bottom would have permitted the vessel to flood at a rate of approximately 135 gallons a minute, or 8,100 gallons an hour.30 That flooding rate would easily have overwhelmed the bilge pumps’ capacity. The maximum pumping rate of the three bilge pumps together (two rated at 1,500 gallons per hour and one at 2,000 gallons per hour) would have been 5,000 gallons an hour. The actual pumping rate would have been lower, especially if all three pumps shared a common, small-diameter discharge line, as described to Safety Board investigators. The Safety Board, therefore, concludes that the grounding in early December 2002 caused a fracture in the Panther’s hull at the strut connection that eventually sank the vessel. On the morning of the accident, one of the company’s maintenance men replaced the wiring to the starboard bilge pump. He said he tested the pumps and that they were operating properly. If the starboard bilge pump was not operating on the day of the accident, however, the vessel’s capacity to pump water out of the bilges would not have been more than 3,500 gallons per hour. Safety Board investigators had the Panther’s starboard bilge pump shipped to the Board’s Materials Laboratory for testing. The tests found that the pump did not work with the leads connected to the printed circuit board, but that when the leads were placed directly on the motor, the pump began operating. The Safety Board could obtain no diagnostic tests for the printed circuit board, and could not determine whether the circuit board problem originated before the accident or after the vessel sank. Therefore, the 30 The Safety Board’s estimate of the flooding rate assumed an area of approximately 5 square inches for the fracture; a head, or distance from the fracture to the water surface, of 2 feet; and a flow efficiency factor of 0.75 (optimal flow efficiency would be 1.0, but the irregular nature of the fracture would have slowed the flow of water through it).

Analysis 33 Marine Accident Report Safety Board cannot determine whether the Panther’s starboard bilge pump was operating at the time of the accident. Based on passenger statements that the Panther’s freeboard was noticeably low and that its bilge pumps were cycling continuously when they boarded it at the marina, the vessel’s bilges had already taken on water when the trip began. The added weight of this water would have made the boat ride lower, thereby reducing its freeboard. When the master, following normal procedures, directed the passengers to the stern and began operating the boat at full speed, the freeboard reduced even further, to the point where water began flooding onto the boat’s deck through the freeing ports.31 The master appeared to be unaware of the excessive water on the deck until he stopped the Panther shortly before it sank. Although the master told investigators that during the voyage he was aware of “a bilge problem,” he was apparently unaware of the severity of the problem of water in the Panther’s bilges and did not modify his standard way of operating the boat to attract dolphins for the benefit of tourists. The Panther had gone through the same maneuvers hundreds, if not thousands, of times during its 34 years of service, without accident, and had completed two previous trips the day of the sinking. Therefore, the Safety Board concludes that while the master’s maneuvering of the Panther was in accordance with its normal operation and may have been acceptable if the vessel’s hull had not been breached, his failure to notice that his vessel had a dangerously reduced freeboard and was taking on water through the freeing ports shows that he was inattentive to the safety of his passengers. High-Level Bilge Alarm The master did not notice the flooding until it was too late for him to take effective action. The Panther was fitted with a high-level bilge alarm that should have warned the master that the vessel was flooding, but for some reason, the alarm did not prompt the master as intended. The master told investigators that he did not know the vessel had such a warning device. However, because the alarm was located on the steering console, it seems unlikely that the master would not have known of its existence. The alarm was submerged when the Panther sank. Safety Board and Coast Guard investigators examined the alarm switch after the accident and found a disconnected wire at the console. Safety Board investigators removed the high-level bilge alarm from the Panther and shipped it to the Board’s Materials Laboratory for examination. The laboratory found a heavily corroded screw and cable connector on one of the alarm’s terminals, but when a suitable supply was connected to the terminals of the alarm and the circuit was switched on, the alarm’s light illuminated and the buzzer sounded, indicating that the alarm was functional. Investigators could not determine whether the alarm terminals were connected to a power source at the time of the accident. During the 31 As explained in the “Vessel Information” section, the freeing ports were openings at the Panther’s stern designed to allow water to run off the deck. Normally, the freeing ports were above water level.

Analysis 34 Marine Accident Report weeks after the grounding, the ingress of water through the breach in the hull would have caused continuous flooding, making it likely that the high-level bilge alarm activated frequently and created a nuisance that led to the alarm’s being disconnected. The Safety Board, therefore, concludes that it is likely that the Panther’s high-level bilge alarm was not connected at the time of the accident. Preventive Maintenance Programs Company Everglades National Park Boat Tours did not have a comprehensive preventive maintenance program, nor did it have any maintenance and repair policy. After the sinking, Safety Board investigators examined the interior of the Panther and found deterioration in the wooden support block and spacers under the steering assembly. The extent of the deterioration indicated to the Safety Board’s Materials Laboratory that the damage had occurred over a number of years. The laboratory found evidence of temporary repairs, which indicates that the owner was aware of the deterioration. However, the repairs he made were improper, because rotten wood should be replaced. The Safety Board, therefore, concludes that the wood rot discovered during the postaccident examination of the Panther indicates that the owner failed to maintain the material condition of the vessel. An effective maintenance and repair policy should include, as a minimum, a routine maintenance schedule, as well as actions to be taken in the event of a casualty, such as the Panther’s early December grounding. After a grounding, in addition to reporting the incident to the Coast Guard, a vessel owner should perform a thorough hull inspection and assess whether a drydock inspection is necessary. The Panther’s owner did not perform a thorough inspection after the grounding. To perform a thorough internal inspection of the Panther, the seats would have had to be removed to see the hull’s structural members. To conduct a thorough inspection of the starboard stringer, the engine exhaust hose would have had to be removed. Neither action was taken. The Safety Board’s investigation of the Panther accident indicated serious deficiencies in the vessel’s maintenance. The investigation revealed interior wood rot and raised questions regarding the operational status of the starboard bilge pump and the high- level bilge alarm, in addition to uncovering the hull damage that allowed the vessel to flood and ultimately sink. A maintenance and repair program should include, among other things, actions a company should take if flooding is indicated. Two separate incidents in December indicated that the Panther was flooding. The maintenance procedures after those incidents centered on bilge pump repair and not on finding and eliminating the source of the flooding. If the owner could not identify the source of the flooding while the Panther was waterborne, the vessel should have been drydocked. As noted earlier, the company had an on-site marine railway and could have hauled the boat out of the water at any time. Such

Analysis 35 Marine Accident Report an examination would have taken place if the company had reported the grounding to the Coast Guard, as required by Federal regulations. The Coast Guard would have required the underwater part of the hull to be examined before allowing the Panther to return to service. The Safety Board, therefore, concludes that had Everglades National Park Boat Tours had a comprehensive maintenance and repair program in place that included, but was not limited to, drydocking the vessel after a grounding, and had the company followed such a program, the vessel would have been drydocked, the fracture in the bottom would have been discovered and repaired, and the accident would have been avoided. National Park Service Everglades National Park Boat Tours was a concessionaire of the National Park Service, and was one of at least 30 private contractors that operate tour boat concessions in the national park system. At the time of this accident, the Park Service did not place any requirement on Everglades National Park Boat Tours or other concessionaires to demonstrate that they had and followed a comprehensive maintenance and repair program for their vessels. After the accident, the National Park Service inserted a provision in its request for proposals for the Gulf Coast tour boat concession at Everglades National Park, stipulating that the successful bidder must implement a computerized preventive maintenance program to track and schedule maintenance items. Bidders were also asked about their experience in operating effective preventive maintenance programs for their vessels, and how they proposed to ensure that their operations are conducted safely.32 In the Safety Board’s opinion, if this action were extended to all tour boat concessions in the national park system, it would increase the safety of passenger vessels operating from National Park Service facilities. The Safety Board, therefore, believes that the National Park Service should require that concessionaire companies operating passenger vessels in its jurisdictions develop and implement a preventive maintenance program for all systems affecting the safe operation of their vessels, including the hull and mechanical and electrical systems. Further, the National Park Service needs to ensure that such preventive maintenance programs adequately provide for public safety. The Safety Board, therefore, believes that the National Park Service should establish oversight procedures to verify, on a regular basis, that concessionaires who operate passenger vessels in the national park system have adequate preventive maintenance and safety programs. Coast Guard Any action taken by the National Park Service would affect only contracting concessionaires and would not affect other small passenger vessel operators. Such operators must meet Coast Guard regulations, which contain requirements for vessel construction and arrangement, vessel stability, firefighting equipment, lifesaving 32 Other provisions include a requirement to maintain a computerized fleet management program and to conduct a yearly off-site drydock survey.

Analysis 36 Marine Accident Report equipment, and vessel operations. The regulations do not require small passenger vessel owners to have preventive maintenance programs, which thus are not checked as part of Coast Guard vessel inspections. The Safety Board addressed this issue in its investigation of the November 2000 fire on board the U.S. small passenger vessel Port Imperial Manhattan. In its report, the Safety Board stated33: The Coast Guard does not have specific regulations requiring a preventive maintenance program for small passenger vessels. The Federal regulators of other transportation modes recognize the importance of preventive maintenance to the safety of operations and require that operators have a systematic program for performing inspections and maintenance. The Federal Aviation Administration has promulgated for all airplane operators comprehensive maintenance requirements, which include provisions for inspections, repairs, and preventive maintenance. The Federal Motor Carrier Safety Administration requires that every motor carrier systematically inspect, repair, and maintain, or cause to be systematically inspected, repaired, and maintained, all motor vehicles subject to its control. In addition, the Federal Railroad Administration has extensive inspection and maintenance requirements for locomotives, train cars, crossing signals, and tracks. Because no authority other than the Coast Guard exercises oversight over domestic small passenger vessels, the Safety Board believes that the Coast Guard should require that companies operating domestic passenger vessels develop and implement a preventive maintenance program for all systems affecting the safe operation of their vessels, including the hull and the mechanical and electrical systems. Consequently, on July 3, 2002, the Safety Board issued the following Safety Recommendation to the Coast Guard: M-02-5 Require that companies operating domestic passenger vessels develop and implement a preventive maintenance program for all systems affecting the safe operation of their vessels, including the hull and mechanical and electrical systems. In response to Safety Recommendation M-02-5, the Coast Guard Commandant stated on November 21, 2003: We do not concur with this recommendation. Small passenger vessels are subject to a comprehensive set of regulations that are designed to promote vessel safety. The operators of these vessels are responsible for maintaining the vessel in compliance with all applicable regulations at all times. Additionally, the Coast 33 National Transportation Safety Board, Fire On Board the Small Passenger Vessel Port Imperial Manhattan, Hudson River, New York, New York, November 17, 2000, Marine Accident Report NTSB/MAR- 02/02 (Washington, DC: NTSB, 2002), pp. 27-28.

Analysis 37 Marine Accident Report Guard allows vessel operators to participate in the Streamlined Inspection Program34 (SIP) that enables the owners to more effectively manage the oversight of inspection requirements. We believe that the recommended requirements would be unnecessarily burdensome and duplicative of existing requirements. We intend to take no further action on this recommendation and request that it be closed. While in general agreement with the Coast Guard that small passenger vessels are subject to “a comprehensive set of regulations,” the Safety Board does not believe that the regulations are as comprehensive as they ought to be because they do not address vessel maintenance and contain no maintenance oversight requirements. The Coast Guard response states that vessel operators are “responsible for maintaining the vessel in compliance with all applicable regulations at all times.” However, those regulations do not address preventive or periodic maintenance of a vessel or its critical systems. It is, therefore, difficult to understand how the recommended action could be considered “duplicative of existing requirements.” Preventive or periodic maintenance programs should be an integral part of any well-run vessel operation. A requirement to develop and implement such programs should not be “burdensome” to vessel operators who already have them in place. Only substandard operators would not have such programs in place. Without an ongoing preventive maintenance program, substandard operators can continue to operate substandard vessels and in so doing, place the public at risk. The Commandant’s reply states that the Coast Guard’s participation in the SIP “enables the [vessel] owners to more effectively manage the oversight of inspection requirements.” Under the SIP, the vessel owner or operator works with a Coast Guard representative to develop a company action plan and a vessel action plan. The development and approval procedures for those plans (46 CFR 8.530) specifically require a description of the company’s safety program, environmental protection program, and training infrastructure, but they do not require a description of the company’s preventive maintenance program. Although it is not clear how participation in the SIP will ensure that proper preventive maintenance is carried out on critical vessel systems, the outcome of the overall program could offer an equivalent level of safety for participants. However, according to the Coast Guard, only 29 small passenger vessels had enrolled in the SIP as of October 2003 (representing 0.29 percent of the 10,125 small passenger vessels the Coast Guard inspects). The Safety Board plans to meet with the Coast Guard to discuss its response in more detail. Passenger Vessel Association Although the PVA does not encompass the entire domestic small passenger vessel fleet, its members represent a large enough part of the industry (65 percent) that safety improvements enacted by the PVA can significantly improve the level of small passenger 34 The SIP is a program set up by the Coast Guard that allows certain vessel operators to inspect their own vessels. Because the owner of the Panther was not operating under the SIP, the program is not an issue in this accident.

Analysis 38 Marine Accident Report vessel safety. The PVA has published both a risk management manual that includes checklists for inspecting vessels for hazardous conditions and a training manual for instructing deckhands in engineroom safety and other areas; it also publishes checklists for preventive maintenance on its website. However, those materials do not give companies adequate guidance for establishing preventive maintenance programs. The Safety Board discussed this issue in its report on the November 2000 Port Imperial Manhattan fire35: While the PVA’s voluntary guidelines cover several areas of passenger and vessel safety, they do not provide adequate guidance to companies for establishing preventive maintenance programs for the hull and the machinery and electrical systems. In addition to operational checks, PVA guidelines should stress the importance of vessel maintenance and list machinery, electrical, and hull items that require periodic inspection and maintenance by a company’s maintenance staff. The guidelines for preventive maintenance should describe, for example, procedures for reporting maintenance and repair needs, for ensuring good interaction between vessel-operating personnel and shoreside maintenance staff, for conducting vessel inspections and repairs, for verifying and testing repair work, for retaining and reviewing maintenance and repair records, and overseeing the maintenance and repair process for its fleet. Given the large number of passengers that are carried on small passenger vessels and ferries today and the commensurate safety risks, preventive maintenance should be performed on a regular basis. Recognizing that rulemaking by the Coast Guard to require preventive maintenance programs on small passenger vessels would take time, the Safety Board issued the following Safety Recommendation to the PVA on July 3, 2002: M-02-16 Provide your members with guidelines for developing a preventive maintenance program for all systems affecting the safe operation of their vessels, including the hull and the mechanical and electrical systems. In its response to Safety Recommendation M-02-16 on August 23, 2002, the PVA stated that it would review the Safety Board’s accident report and recommendation during the association’s Board of Directors Meeting and Safety and Security Committee meeting, both scheduled for October 2002. In followup correspondence, the Safety Board informed the PVA that it would appreciate receiving information regarding the outcome of those meetings and whether Safety Recommendation M-02-16 would be implemented. The recommendation was then classified “Open—Initial Response Received.” On January 20, 2004, the Safety Board received the PVA’s response to Safety Recommendation M-02-16. The association’s response is now under review. 35 NTSB/MAR-02/02, p. 28.

Analysis 39 Marine Accident Report Owner’s Operational Practices According to the terms of the Panther’s COI, the vessel was required to carry a deckhand whenever the number of passengers exceeded 30. Thus, because 33 passengers were on board the day of the accident, the Panther should have carried a deckhand. The owner of the Panther stated that it was the master’s responsibility to ensure that a deckhand was on board when necessary. But the master stated that he had never seen the COI and understood that a deckhand was not required. In the Safety Board’s opinion, the owner shares the responsibility to see that his vessels are properly manned in accordance with their COIs, and the owner cannot escape his responsibility by attempting to lay blame on the master. While the master cannot be excused for not knowing the manning requirements of his vessel, the owner should have had a program in place to ensure that his vessels were properly manned in accordance with their COIs. In this instance, he did not. The deckhand provides a second set of eyes and ears as to what is going on board a vessel when it is under way. He can help monitor vessel conditions while the master is involved in operating the boat and, in the Panther’s case, also narrating a tour. Had a deckhand been on the accident voyage, he might have noticed the flooding earlier, with the possible result that the master might have been able to take corrective action before the flooding became critical. A deckhand might also have been able to help passengers retrieve lifejackets from the sinking vessel (see below). Alternatively, with earlier warning, the master might have been able to return the vessel to the marina before it sank. The lack of a deckhand had a detrimental impact on the safe operation of the Panther. That shortcoming was, however, only one in a series of safety deficiencies. The owner failed to report the Panther’s early December grounding to the Coast Guard, as required; failed to pull the vessel out of the water for a thorough examination after the grounding; and failed to prevent his vessel masters from regularly operating outside the dredged channel, where they were in danger of grounding. Furthermore, the owner, maintenance men, and masters knew that the Panther was operating with low freeboard in the weeks before the accident, but they did not correct the problem. The masters were unaware that the vessels were equipped with high-level bilge alarms, and they repeatedly operated the Panther when it had an uncorrected flooding problem. It is likely that the high-level bilge alarm was not connected at the time of the accident, and it is uncertain whether the vessel’s starboard bilge pump was operating. The wood rot discovered when the Panther was examined after the accident indicates the owner’s failure to properly maintain his vessel. Any company, no matter how safe its operation, can experience occasional safety problems. But for Everglades National Park Boat Tours, the deficiencies were chronic. Considering all the deficiencies together, the Safety Board concludes that Everglades National Park Boat Tours operated its vessels in a substandard manner.

Analysis 40 Marine Accident Report Lifejacket Stowage The Panther was properly equipped with lifejackets for its intended voyage. The lifejackets were stowed in lockers under 14 of the boat’s 16 seats (not counting the bench seat at the stern). The lockers were fitted with covers that had two barrel-bolt latches at the bottom, one on each side, and a piano hinge at the top. To open the lockers to retrieve the lifejackets, passengers had to bend down and swing the locker cover toward themselves. However, the space between the seats and the lockers was where the passengers’ feet and legs would be located and was insufficient to allow the cover to swing completely open, unless passengers lifted their legs onto the seat. Such an arrangement made it awkward and difficult for passengers to retrieve lifejackets, especially if the boat had a full load of passengers. It is no wonder that none of the passengers on the Panther could retrieve a lifejacket before the vessel sank. The Safety Board, therefore, concludes that the lifejacket stowage arrangement on board the Panther prevented the passengers from retrieving lifejackets. After the Panther accident, the owner had all the lifejacket locker covers removed from the vessel and from the other vessels in his fleet that had similar lifejacket stowage arrangements. The Safety Board is satisfied that removing the lids from the stowage lockers will permit lifejackets to be immediately available to passengers in the future and proposes no further action regarding this issue to Everglades National Park Boat Tours. Lifejacket stowage was identified as a problem in two other accidents recently investigated by the Safety Board. As a result of its investigation of a fire aboard the small passenger vessel Port Imperial Manhattan,36 the Safety Board issued the following Safety Recommendation to the Coast Guard on July 3, 2002: M-02-13 Issue a directive to small passenger vessel operators to review the distribution of lifejackets on board their vessels and to ensure that the lifejackets are accessible and segregated. On November 19, 2002, the Coast Guard responded, stating that it “will issue a Safety Alert reminding small passenger vessel operators of the requirements and suggest that they review the stowage arrangements on their vessels to ensure compliance with the regulations.” The safety alert was issued on December 12, 2003. Accordingly, Safety Recommendation M-02-13 is classified “Closed—Acceptable Action.” 36 NTSB/MAR-02/02.

Analysis 41 Marine Accident Report Emergency Response The first responders to the Panther’s sinking were a commercial crab fishing boat (the Red Rock), a pleasure craft (the Hoosier Daddy), and a National Park Service boat operated by a park ranger, all of which happened to be operating in the area at the time of the sinking. The Red Rock was nearly alongside the Panther when it sank and was, therefore, immediately available to render assistance. Some of the Panther’s passengers climbed directly onto the Red Rock from the Panther without even entering the water. The happenstance that these vessels were all close to the Panther when it sank is probably the main reason the accident caused no fatalities or more than one serious injury. Five passengers on board the Panther could not swim. Had the first responding vessels not been in the immediate area when the Panther sank, especially if the Panther had sunk completely so that the nonswimmers had nothing to support them in the water, it is likely that the accident could have resulted in multiple fatalities. The ebbing tidal current was estimated at 2 to 3 1/2 knots, and Safety Board investigators measured the water temperature at about 62º F 2 days after the accident. Since water temperatures do not change rapidly, it is reasonable to assume that the water temperature at the time of the sinking was approximately the same. Without timely rescue from the water, the strong ebbing current and the relatively cold water may have made survival problematic, even for the passengers who could swim, especially since they did not have lifejackets to support them in the water. The Safety Board, therefore, concludes that the timely arrival of other vessels to the scene of the Panther sinking prevented loss of life in this accident.

42 Marine Accident Report Conclusions Findings 1. The weather and sea conditions and the condition of the vessel’s engine were not factors in this accident. 2. None of the following were factors in this accident: the master’s health, the use of prescription or nonprescription medications, fatigue, alcohol, or illicit drugs. 3. The owner was aware that his masters frequently took their vessels where they were susceptible to grounding, but the owner failed to prevent this practice. 4. The grounding in early December 2002 caused a fracture in the Panther’s hull at the strut connection that eventually sank the vessel. 5. The owner, maintenance men, and masters knew that the Panther was operating with a less-than-normal freeboard for about 2 weeks before the sinking and were aware that the vessel was continually taking on water but took no action to identify and eliminate the source; instead, they incorrectly relied on the bilge pumps to dewater the vessel, which placed the passengers at risk. 6. Had the master acted correctly by ensuring that his vessel was safe to operate, he would not have taken the Panther on the voyage during which it sank. 7. The Safety Board cannot determine whether the Panther’s starboard bilge pump was operating at the time of the accident. 8. It is likely that the Panther’s high-level bilge alarm was not connected at the time of the accident. 9. While the master’s maneuvering of the Panther was in accordance with its normal operation and may have been acceptable if the vessel’s hull had not been breached, his failure to notice that his vessel had a dangerously reduced freeboard and was taking on water through the freeing ports shows that he was inattentive to the safety of his passengers.

1. The wood rot discovered during the postaccident examination of the Panther

indicates that the owner failed to maintain the material condition of the vessel.

1. Had Everglades National Park Boat Tours had a comprehensive maintenance and

repair program in place that included, but was not limited to, drydocking the vessel after a grounding, and had the company followed such a program, the vessel would have been drydocked, the fracture in the bottom would have been discovered and repaired, and the accident would have been avoided.

Conclusions 43 Marine Accident Report

1. Everglades National Park Boat Tours operated its vessels in a substandard manner.
2. The lifejacket stowage arrangement on board the Panther prevented the passengers

from retrieving lifejackets.

1. The timely arrival of other vessels to the scene of the Panther sinking prevented loss

of life in this accident. Probable Cause The National Transportation Safety Board determines that the probable cause of the Panther’s sinking was flooding through a hull breach, which resulted from an earlier grounding and which Everglades National Park Boat Tours neglected to address, instead choosing to operate the vessel with a known failure of watertight integrity and inappropriately relying on the bilge pumps to keep the vessel afloat, thus continually putting its passengers at risk.

44 Marine Accident Report Recommendations New Recommendations As a result of its investigation, the National Transportation Safety Board makes the following safety recommendations. To the National Park Service: Require that concessionaire companies operating passenger vessels in your jurisdictions develop and implement a preventive maintenance program for all systems affecting the safe operation of their vessels, including the hull and mechanical and electrical systems. (M-04-01) Establish oversight procedures to verify, on a regular basis, that concessionaires who operate passenger vessels in the national park system have adequate preventive maintenance and safety programs. (M-04-02) Previously Issued Recommendation Resulting from This Accident Investigation To the National Park Service: Establish oversight procedures to verify, on a regular basis, that tour boat concessionaires who operate in the national park system carry an appropriately sized lifejacket for every child on board. (M-03-1) Safety Recommendation M-03-1 is discussed in the “Actions Taken Since the Accident” section of this report. The Safety Board has classified Safety Recommendation M-03-1 as “Open—Acceptable Response.” Previously Issued Recommendation Classified in This Report To the U.S. Coast Guard: Issue a directive to small passenger vessel operators to review the distribution of lifejackets on board their vessels and to ensure that the lifejackets are accessible and segregated. (M-02-13)

Recommendations 45 Marine Accident Report Safety Recommendation M-02-13 (previously classified “Open—Acceptable Response”) is classified “Closed—Acceptable Action” in the “Lifejacket Stowage” section of this report. BY THE NATIONAL TRANSPORTATION SAFETY BOARD Ellen Engleman Conners Mark V. Rosenker Chairman Vice Chairman Carol J. Carmody Member Richard F. Healing Member Adopted: March 9, 2004 Member John J. Goglia did not participate in the adoption of this report.

this page intentionally left blank

47 Marine Accident Report Appendix A Investigation The Safety Board learned of the Panther sinking at 0730 on December 31, 2002, when the Safety Board Communications Center discovered an Internet news item concerning the accident. A two-person investigative team arrived in Everglades City the next day (January 1, 2003) and began the investigation. The investigative team documented the damage to the Panther and interviewed company employees, National Park Service rangers, U.S. Coast Guard personnel, and passengers. The on-scene investigation was completed on January 12, 2003. The Safety Board investigated the accident under the authority of the Independent Safety Board act of 1974, according to Safety Board rules. The designated parties to the investigation were the National Park Service, the U.S. Coast Guard, and Everglades National Park Boat Tours, the owner of the Panther.

this page intentionally left blank

FD07261 ｜ 2002_美国_NTSB_PAR0401_Rupture_of_Enbridge_Pipeline_and_Release_of_Crude_Oil.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2002 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Rupture of Enbridge Pipeline and Release of Crude Oil near Cohasset, Minnesota July 4, 2002 Pipeline Accident Report NTSB/PAR-04/01 PB2004-916501 Notation 7514A National Transportation Safety Board Washington, D.C.

this page intentionally left blank

Pipeline Accident Report Rupture of Enbridge Pipeline and Release of Crude Oil near Cohasset, Minnesota July 4, 2002 NTSB/PAR-04/01 PB2004-916501 National Transportation Safety Board Notation 7514A 490 L’Enfant Plaza, S.W. Adopted June 23, 2004 Washington, D.C. 20594

National Transportation Safety Board. 2004. Rupture of Enbridge Pipeline and Release of Crude Oil near Cohasset, Minnesota, July 4, 2002. Pipeline Accident Report NTSB/PAR-04/01. Washington, DC. Abstract: About 2:12 a.m., central daylight time, on July 4, 2002, a 34-inch-diameter steel pipeline owned and operated by Enbridge Pipelines, LLC ruptured in a marsh west of Cohasset, Minnesota. Approximately 6,000 barrels (252,000 gallons) of crude oil were released from the pipeline as a result of the rupture. The cost of the accident was reported to the Research and Special Programs Administration Office of Pipeline Safety to be approximately $5.6 million. No deaths or injuries resulted from the release. The safety issues identified in this accident are the effectiveness and application of line pipe transportation standards and the adequacy of Federal requirements for pipeline integrity management programs. As a result of its investigation of this accident, the Safety Board issues safety recommendations to the Research and Special Programs Administration, the American Society of Mechanical Engineers, and the American Petroleum Institute. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2004-916501 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Pipeline Accident Report Contents Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iv Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Postaccident Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Preaccident Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Fatigue Cracking in Enbridge Pipe Manufactured by U.S. Steel . . . . . . . . . . . . . . . . . . 8 Operational Reliability Assessments of the Pipeline . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Elastic Wave In-Line Inspection at Rupture Location . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Pipe Movement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Railroad Transportation of Thin-Walled Pipe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Railroad Transportation of Accident Pipe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Safety Board Materials Laboratory Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 RSPA Postaccident Corrective Action Order . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Enbridge Postaccident Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 American Society of Mechanical Engineers Pipeline Codes . . . . . . . . . . . . . . . . . . . . . . . . 23 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Transportation of Accident Pipe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Transportation Fatigue Cracking in Line Pipe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Natural Gas Pipeline Safety Regulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Liquid Pipeline Safety Regulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Marine Transportation of Pipe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Truck Transportation of Pipe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 ASME Pipeline Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Pipeline Integrity Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Appendix A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

iv Pipeline Accident Report Executive Summary About 2:12 a.m., central daylight time, on July 4, 2002, a 34-inch-diameter steel pipeline owned and operated by Enbridge Pipelines, LLC ruptured in a marsh west of Cohasset, Minnesota. Approximately 6,000 barrels (252,000 gallons) of crude oil were released from the pipeline as a result of the rupture. The cost of the accident was reported to the Research and Special Programs Administration Office of Pipeline Safety to be approximately $5.6 million. No deaths or injuries resulted from the release. The National Transportation Safety Board determines that the probable cause of the July 4, 2002, pipeline rupture near Cohasset, Minnesota, was inadequate loading of the pipe for transportation that allowed a fatigue crack to initiate along the seam of the longitudinal weld during transit. After the pipe was installed, the fatigue crack grew with pressure cycle stresses until the crack reached a critical size and the pipe ruptured. The following safety issues were identified during this investigation: • The effectiveness and application of line pipe transportation standards. • The adequacy of Federal requirements for pipeline integrity management programs. As a result of its investigation of this accident, the Safety Board issues safety recommendations to the Research and Special Programs Administration, the American Society of Mechanical Engineers, and the American Petroleum Institute.

1 Pipeline Accident Report Factual Information Accident Synopsis About 2:12 a.m., central daylight time, on July 4, 2002, a 34-inch-diameter steel pipeline owned and operated by Enbridge Pipelines (Lakehead), LLC1 ruptured in a marsh west of Cohasset, Minnesota. (See figure 1.) Approximately 6,000 barrels (252,000 gallons) of crude oil were released from the pipeline as a result of the rupture. No deaths or injuries resulted from the release. Accident Narrative The crude oil pipeline involved in the accident originated at Edmonton, Alberta, Canada, and terminated at Superior Terminal in Superior, Wisconsin. The 34-inch- diameter pipeline, designated line no. 4 at the time of the accident, was operated by pipeline controllers in the Enbridge control center in Edmonton using a supervisory control and data acquisition (SCADA) system.2 About 2:12 a.m. on July 4, 2002, the 1 Enbridge Pipelines (Lakehead), LLC is the operator of the pipeline system formerly named Lakehead Pipe Line Company. Figure 1. Enbridge pipeline system. 2 Pipeline controllers use a computer-based SCADA system to remotely monitor and control movement of oil through pipelines. The system makes it possible to monitor operating parameters critical to pipeline operations, such as flow rates, pressures, equipment status, control valve positions, and alarms indicating abnormal conditions.

Factual Information 2 Pipeline Accident Report controller operating the line observed a SCADA system indication of a loss of suction and discharge pressure at the Deer River pump station. (See figure 2.) At 2:13 a.m., the Floodwood pump station suction pressures began dropping, and then audible and visual alarms were received for an invalid suction pressure. The controller initially suspected an inaccurate pressure transmitter at Floodwood, because the suction pressure had gone to zero. Subsequently, he noticed that the discharge pressure for Floodwood was also dropping and realized that he had an abnormal condition. The controller showed the shift coordinator the situation, and, suspecting a possible leak, they agreed at 2:14 a.m. to shut the pipeline down. At 2:15: a.m., the controller initiated closure of the pipeline injection valve at the Clearbrook Terminal and began shutting down pumps and remotely closed valves to isolate the suspected leak. The upstream valve at Deer River and the downstream sectionalizing valve at milepost (MP) 1017.9 were remotely closed by 2:21 a.m., which isolated the ruptured section. All remotely controlled valves on the pipeline from Clearbrook to Superior Terminal were closed by 2:32 a.m. About 2:25 a.m., the Enbridge control center notified the Deer River and Floodwood police departments of the suspected leak, and about 2:30 a.m., Enbridge field personnel were notified. About 5:20 a.m., Enbridge field personnel dispatched to investigate along the pipeline right-of-way detected the odor of crude oil in a marshy area near Blackwater Creek and manually closed the closest valve to the failure. This valve was near MP 1007.32, about 4 1/2 miles downstream (east) of the rupture. Figure 2. Enbridge pipeline facilities and rupture site.

Factual Information 3 Pipeline Accident Report At 7:00 a.m., after Enbridge field employees verified the release, Enbridge notified the National Response Center of a crude oil leak in the company’s 34-inch pipeline. This notification indicated that an unknown amount of crude oil had been released. The pipe was found to have ruptured at MP 1002.73, about 7 miles downstream of the Deer River pump station. The company then contacted local, State, and Federal officials, as well as Enbridge spill response contractors, who proceeded to the spill site. Enbridge also had right-of-way representatives contact landowners in the vicinity of the spill. At 12:09 p.m., Enbridge called the National Response Center again and updated the spill volume to 6,000 barrels of crude oil. At the time of the accident, Enbridge had not designated the area where the rupture occurred as a high-consequence area3 based on the criteria defined in 49 Code of Federal Regulations (CFR) Part 195, “Transportation of Hazardous Liquids by Pipelines.” Emergency Response Booms were placed in Blackwater Creek as a precaution to prevent crude oil from moving away from the spill site toward nearby waterways, including the Mississippi River. Enbridge started building a 1/4-mile-long road along the right-of-way to the spill site using wood mats. With heavy rain forecast, responders were concerned that the crude oil might spread farther and contaminate the Mississippi River. The unified command for the accident response was established and included the Cohasset Fire Department, Enbridge, the Minnesota Pollution Control Agency, the Minnesota Department of Emergency Management, and the Forestry Division of the Minnesota Department of Natural Resources. The unified command decided that the best way to prevent the crude from entering nearby waterways was to perform a controlled burn. As a precaution, the command designated 12 homes in the local area to be evacuated, and seven residents were evacuated. Later in the afternoon, the Minnesota Department of Natural Resources coated the spill’s perimeter with chemical fire retardant from tanker planes. After the chemical was placed, flares were shot into the crude oil to ignite the oil. The controlled burn was ignited about 4:45 p.m. (See figure 3.) The burn created a smoke plume about 1 mile high and 5 miles long. (See figure 4.) The controlled burn lasted until about 5:00 p.m. the next day, July 5. While they monitored the fire, Enbridge personnel, firefighters, and environment authorities also monitored the spill perimeter to ensure that no crude was getting into area waterways. Reportedly, no free-flowing product reached any of the boomed areas. 3 High-consequence area refers to commercially navigable waterways, high population areas, concentrated population areas, or unusually sensitive areas that might be affected by an accident involving the pipeline in that area. Title 49 CFR 195.450, 195.452, and 195.6 contain the criteria for designating an area a high-consequence area for hazardous liquid pipelines.

Factual Information 4 Pipeline Accident Report Figure 3. Controlled burn surrounded by white fire retardant. Figure 4. Smoke plume 1 mile high and 5 miles long.

Factual Information 5 Pipeline Accident Report Damage The cost of the accident was reported to the Research and Special Programs Administration (RSPA) Office of Pipeline Safety to be approximately $5.6 million.4 Enbridge recovered 2,574 barrels of oil and estimated that the in situ burn consumed approximately 3,000 barrels, with the remainder being lost to evaporation or entrapment in the soil. Postaccident Inspection On July 6, after vacuum trucks had removed the remaining oil and water, the ruptured pipe was exposed. The pipe was fractured along the edge of a longitudinal weld. When the pipe that failed was installed, the longitudinal weld was at the 5:30 clock position when viewed facing downstream (eastward). The rupture was about 69 inches long and gapped open about 6 1/4 inches at the center. (See figure 5.) At the rupture location, the pipeline was rated for a regulatory maximum operating pressure of 687 pounds per square inch, gauge (psig). The pressure at this location at the time of failure was calculated to be 526 psig. The United States Steel Corporation (U.S. Steel) manufactured the pipe at its National Tube Works in McKeesport, Pennsylvania. 4 This total includes estimated property damage, including cost of cleanup and recovery, value of lost product, and damage to the property of the pipeline operator and others. Figure 5. Rupture in accident pipe.

Factual Information 6 Pipeline Accident Report Tests and Research Two sections of pipe, one containing the rupture and one from the same length of pipe, were removed and sent to the Safety Board’s Materials Laboratory for metallurgical examination. The pipe that ruptured was manufactured in accordance with American Petroleum Institute (API) standard 5L, grade X52, indicating that the steel had a specified minimum yield strength5 of 52,000 pounds per square inch (psi). The 34-inch outside diameter pipe was specified as 0.312-inch nominal wall thickness with a double submerged arc weld (DSAW) longitudinal seam weld. The pipe had a diameter-to-wall thickness (D/t) ratio of 109:1. The pipe was coated with a spiral wrap tape that was applied in the field during construction in 1967. Surface corrosion was visible on the outer surface of the pipe adjacent to the rupture, but no dents, scratches, or gouges were present at any location on the pipe sections examined. The corrosion was assessed as light, with no apparent pitting and little apparent loss of wall thickness. Both pipe sections were ultrasonically inspected for cracks along the longitudinal seam weld, and, other than the rupture that caused the accident, no additional cracks or discontinuities were uncovered. Fatigue cracking6 has been shown to initiate at seam welds because of changes in geometry, residual stress, and material properties associated with the weld. Metallurgical testing and examination of the ruptured area found no material or manufacturing defect in the steel or the welded seam of the pipe. Initial examination of the rupture revealed a preexisting fatigue region at the center of the rupture. The fatigue region was 13 inches long adjacent to the inside surface of the pipe and did not extend all the way through the pipe wall. (See figure 6.) More detailed examination showed that the fatigue cracking initiated at multiple locations along the inside surface (see figure 7) at the toe of the longitudinal weld bead. (See figure 8.) Examination of the cleaned fracture surface revealed a darker, more heavily oxidized band adjacent to the inside surface of the pipe that extended the entire length of the fatigue area. The more heavily oxidized portion of the fatigue area penetrated a maximum of about 0.04 inch deep at the center of the rupture. The oxidized band was visible for almost the entire length of the fatigue area. Near its ends, the oxidized portion of the fatigue crack extended about 0.010 inch into the pipe wall. The remainder of the fatigue crack was less oxidized and extended more deeply into the pipe wall over the central 6 inches of the fatigue region. Along approximately 2.5 inches in the central region, the fatigue crack almost penetrated the pipe wall. At its maximum depth, the fatigue crack penetrated through 0.270 5 Yield strength is a measure of the pipe’s material strength and is the stress level, expressed in pounds per square inch, at which the material starts to exhibit permanent deformation. Although yield strength is expressed in pounds per square inch, this value is an expression of a pipe material’s strength, which is not equivalent to a pipe’s internal pressure. 6 The term fatigue cracking is used to describe a progressive cracking of structural material that occurs under repeated loading and may eventually lead to failure. The fatigue crack grows with cyclic loading until the crack reaches a critical length at which the stresses cause it to grow unstably leading to structural failure. Fatigue cracks can initiate at microscopic flaws or weak spots in the material. Once initiated, cracks can grow at stress levels that are quite low in comparison to the material’s yield strength.

Factual Information 7 Pipeline Accident Report inch of the 0.297-inch measured wall thickness.7 Measurement and testing of the pipe showed that it met thickness and strength requirements. The pipe fracture beyond the fatigue crack contained features typical of overstress fracture. 7 The 0.297-inch measured wall thickness is within the allowable range for a pipe with 0.312-inch specified nominal wall thickness. Figure 6. View of top fracture surface of 13-inch-long crack, showing penetration nearly through pipe wall in center. Figure 7. Face of fracture in accident pipe.

Factual Information 8 Pipeline Accident Report Preaccident Events Fatigue Cracking in Enbridge Pipe Manufactured by U.S. Steel Enbridge’s 34-inch U.S. Steel DSAW pipe had a documented history of longitudinal seam weld failures due to fatigue cracks. Metallurgical analysis reports of longitudinal seam weld failures in Enbridge’s U.S. Steel pipe in 1974, 1979, 1982, 1986, 1989, and 1991 identified the causes as fatigue cracking at the toe of the weld. Enbridge’s 34-inch pipeline system also used A.O. Smith flash-welded pipe, Canadian Phoenix electric resistance welded pipe, and Kaiser Steel submerged arc welded (SAW) pipe. All of the longitudinal seam weld failures caused by fatigue cracks in this pipeline have occurred in pipe manufactured by U.S. Steel. Operational Reliability Assessments of the Pipeline After the 1991 pipe rupture at the toe of the weld in the 34-inch pipeline resulted in the release of 40,500 barrels (1,701,000 gallons) of crude oil, Enbridge signed a consent order with RSPA’s Office of Pipeline Safety to conduct an operational reliability assessment of the 34-inch pipeline from Gretna, Manitoba, Canada, to Superior, Wisconsin. The assessment was to include a review of pipeline operating conditions and an analysis of the previous pipe failures. The operator was also required to restrict Figure 8. Fatigue initiating at toe of weld on interior surface of pipe.

Factual Information 9 Pipeline Accident Report allowable operating pressures, to hydrostatically pressure test8 the pipeline to establish that the line was safe to operate, and to develop a program to ensure that the line would continue to be safe in the future. In December 1992, Enbridge performed an operational reliability assessment9 of the 34-inch pipeline in the United States. As a result of the study, changes were made in pipeline operations that reduced the number of pressure cycles10 and their associated pressure ranges. Among other actions it took as a result of the 1991 rupture, Enbridge financially and technically supported British Gas’s development of the Elastic Wave in- line inspection tool to identify pipe cracks before they precipitate a failure. British Gas did the inspections in 1995 and 1996. PII North American, Inc. (PII), the successor to British Gas, currently provides the inspection tool data report of the Elastic Wave inspection tool in the United States. The pipeline section in which the 2002 rupture occurred was pressure tested to 835 psig after its construction in 1967. Enbridge’s first longitudinal seam weld in-service failure of U.S. Steel pipe from a fatigue crack occurred in July 1974. The entire pipeline, including the pipe joint11 containing the failure, was pressure tested between 1974 and 1976 at a test pressure of 764 psig. The entire 34-inch pipeline was pressure tested in 1991 and 1992 at higher stress levels than had been used before. Because of variations in pipe wall thickness and changes in elevation in each section of the pipeline, the test pressure range was from 85 percent to 105 percent of the specified minimum yield strength of the pipe, or up to 1,002 psig.12 The 1991 test pressure at the point of the July 4, 2002, rupture was 937 psig. The operator agreed in 1991 to pressure test the pipeline again in 5 years unless an in-line inspection tool capable of identifying cracks in the longitudinal seam of the pipe was developed. RSPA did not allow the operator to raise the pressures above those in effect at the time of the 1991 accident while the consent order was in effect. During the 1991 and 1992 pressure testing program, Enbridge found four crack- like/manufacturing defects, four corrosion defects, and one blister. Two subsequent leaks occurred that resulted from pressure-cycle-induced growth of fatigue cracks in U.S. Steel pipe. The two in-service leaks occurred in the first 6 months of 1994 at the site of fatigue cracks that had survived the pressure test levels of the 1991–1992 program. A reassessment report was completed in December 1994 following those two failures. Enbridge’s metallurgical report indicated that the initiating fatigue cracks were readily apparent adjacent to the inside pipe wall and had been introduced during the transportation of the pipe, as they were smoother and darker than subsequent fatigue crack growth. The report 8 A hydrostatic test of a pipeline involves filling the pipeline with water or similar liquid, gradually increasing the pressure of the liquid to a predetermined maximum, and examining the line and/or test records for indications of a leak. 9 The 1992 assessment was updated in 1994, 1995, and 1998. 10 One pipeline pressure cycle is the pressure variation from a minimum to a maximum pressure and to the minimum again. 11 A joint is a single length of pipe, nominally 40 feet long. 12 Using the internal design strength formula in 49 CFR Part 195, a test pressure of 954 psig is calculated at 100 percent of specified minimum yield strength for line pipe with the specification of the pipe that ruptured.

Factual Information 10 Pipeline Accident Report noted that both defects at the point of failure showed evidence of having grown during the 1991–1992 pressure tests and concluded that ductile tearing of the metal caused the growth of these existing defects. Another Enbridge conclusion was that the operating histories of the upstream operating stations showed that pressure cycles also contributed to the failures. After Enbridge ran tests with the Elastic Wave inspection tool, the results were reviewed and recommendations were included in Enbridge’s 1995 integrity assessment report. As a result of the recommendations, Enbridge proposed to RSPA an in-line crack inspection program as the most appropriate means of reducing or eliminating the risk of pipeline failures. The detection level specification for the Elastic Wave tool stated that the tool would find a defect equal to or greater than 2.5 inches long with an accuracy of ±0.4 inch at 4.5 mph. The detection level specification for crack depth was 25 percent of the pipe wall thickness with a sizing accuracy of ±25 percent of the wall thickness. For an indication to be reported to the operator as a defect, both the crack length and the crack depth threshold requirements had to be met. RSPA agreed in 1995 to the use of the in-line crack inspection program in lieu of hydrostatic pressure testing. As a condition for accepting the proposal for 1996, RSPA stipulated that it would review the inspection program before deciding on future pressure testing. One of the reasons for conditional approval in RSPA’s stipulations was that RSPA wanted to know whether the Elastic Wave inspection tool would identify not only pipe crack defects that would fail during hydrostatic pressure testing but also considerably smaller defects that could then be repaired or removed before they could grow and lead to failure of the pipe. In 1995, Enbridge began inspecting its 34-inch pipeline with the Elastic Wave in- line inspection tool and found that the tool was identifying more pipe crack defects than had been identified by previous hydrostatic pressure testing. Twice during 1995 and again in early 1996, PII’s tool was used to inspect the pipeline section that contained the crack that ruptured in this accident, but various mechanical problems with the inspection tool resulted in unusable data. PII acquired usable data in a May 1996 inspection. (The details of this inspection are discussed later in this report.) In the 4 years from 1995 through 1998, 216 miles (66 percent) of the 325 miles of 34-inch pipe from Gretna, Manitoba, to Superior, Wisconsin, had been inspected with the Elastic Wave tool, and pipeline repairs were made according to the pipeline operator’s policy. All crack defects identified by the inspections were repaired with pipe sleeves, and none were removed and subjected to metallurgical examination. During this period of time, in-line inspections were performed on all U.S. Steel manufactured DSAW pipe. As a result of these inspections, the operator excavated the pipe at 74 locations. An evaluation concluded that none of the defects found with the Elastic Wave tool would have failed a pressure test to 100 percent specified minimum yield strength. Following completion of the Elastic Wave tool inspections in the 34-inch U.S. Steel pipe, Enbridge submitted an assessment report dated April 28, 1998, that proposed reinspecting the pipeline approximately 10 years from the previous inspection. A number of reviews were made by RSPA before closure of the consent order on May 5, 1999. After the consent order was closed, Enbridge operated the pipeline up to the pressures allowed by 49 CFR Part 195.

Factual Information 11 Pipeline Accident Report Before the accident, Enbridge’s unwritten defect inspection practice for Elastic Wave data was to excavate all crack-like indications that were found by the Elastic Wave tool. Enbridge ran Elastic Wave tool inspections in all of its 34-inch pipeline sections in the United States between 1995 and 2001. Based on the results of these inspections, the company excavated 23 crack-like features; 23 weld/manufacturing defects; 16 other defects, including corrosion and laminations; and 41 spurious13 indications and made repairs where needed. Elastic Wave In-Line Inspection at Rupture Location The in-line inspection company, PII, performed a computer analysis of the May 1996 Elastic Wave inspection tool log data as part of its interpretation process after the tool was run. An indication was present at the point where the pipe ruptured on July 4, 2002. PII interpreters reviewed the indication in their initial screening of the data in 1996, but the indication did not exhibit the diamond-shaped signature signifying a crack and did not meet PII’s standard that an anomaly must meet at least 6 of 10 feature selection criteria in order to be identified as a crack. After the accident, PII stated that, at most, the indication would have met two of the feature selection criteria. An important feature selection criterion that the indication did not meet was confirmation of the signal from both the clockwise and counterclockwise views as the tool records data while moving downstream through the pipe. PII representatives stated that during the May 1996 inspection run, one of the tool’s two sets of wheel sensors was close to the longitudinal weld, which placed the weld in proximity to the source of the tool’s ultrasonic signal and could have resulted in the masking of the signal. PII’s postaccident review of the May 1996 data also evaluated the size of the indication at the rupture and determined that it was below the detection level specification for a reportable defect (25 percent of pipe wall thickness and 2.5 inches long). The data on this indication have been recorded in a database, and PII and Enbridge have worked to determine how this information will be used to improve the feature selection criteria. Also after the accident, RSPA had an independent consultant and PII analyze the May 1996 inspection log data for the area from 0.5 mile upstream to 0.5 mile downstream of the rupture location. No indications were found with characteristics similar to those of the July 4, 2002, rupture. In addition, PII personnel reviewed the log data from two 1995 Elastic Wave tool inspections that had shown no significant defect at the point of the 2002 rupture. They found that on the first run, the clockwise sensor was functioning properly and was not on the longitudinal weld at the point that ruptured. The counterclockwise channel was working but was electronically noisy and provided a weak signal at the point that ruptured. Thus the signal on this run did not meet feature selection criteria for confirmation of the signal from both the clockwise and counterclockwise views. The signal on this run also did not exhibit the diamond-shaped crack signature. On the second 1995 log, the clockwise channel was not providing acceptable quality data when it was in the area of the point of rupture. 13 Spurious features were those that did not have a corresponding defect associated with them, had qualities not considered a defect (for example, weld profile), or were under sleeves and could not be assessed.

Factual Information 12 Pipeline Accident Report All of the 1995–1996 in-line Elastic Wave tool inspections were performed by the Mark II version of the device. In 1997 the tool was upgraded to the Interim Mark III, which contains an additional set of wheel sensors that are offset so at least one set of sensors is not riding on the longitudinal seam weld. Both before and after the accident, Enbridge provided PII with feedback on its findings from actual excavations and field inspections. This feedback is a part of the continuing development effort on Elastic Wave technology. PII advised the Safety Board that it always requests feedback from its customers on field excavation data to improve accuracy and reliability. However, the amount and quality of feedback for in-line inspection tools varies with each pipeline company. Pipe Movement On February 5, 2002, Enbridge detected movement in the 34-inch pipeline in the same marsh where the subsequent July 4 failure occurred. The movement occurred as Enbridge was excavating a ditch for the construction of a parallel 36-inch-diameter pipeline. At this point, the existing and new lines were separated by about 20 feet. As the ditch for the new line was being opened, the peat began to settle down toward the ditch, and the existing 34-inch pipeline began to move laterally toward the ditch. Enbridge workers saw the movement of the line and had the pipeline shut down for evaluation. The pipeline was found to have moved down and laterally a maximum of 18 inches. The maximum movement had occurred at MP 1002.8 and involved more than 750 feet of pipeline. Enbridge stated that it had calculated the stresses in the pipe caused by the movement and found them to be well within the parameters for movement of an in-service pipeline as specified in API recommended practice RP 1117, Movement of In-Service Pipelines. Enbridge continued to monitor the site after the construction of the parallel pipeline and observed that the 34-inch pipeline had returned to within 6 inches of its original position. The return toward the original position was believed to have been caused by the rehydration of the peat. Railroad Transportation of Thin-Walled Pipe A 1962 technical paper14 prepared from research by Battelle Memorial Institute discusses the prevention of pipe stresses that can occur during the transportation, handling, and laying of thin-walled pipe. As noted in the paper, advances in technology and the availability of higher strength materials have led to the widespread use of thinner walled, larger diameter pipe that is more susceptible than thicker walled, smaller diameter pipe to stresses that could be introduced during transportation. The paper states: 14 Atterbury, A. T., “Stresses During Shipping, Handling and Laying Thin Walled Pipe,” Pipe Line News, December 1962, pp. 44–47.

Factual Information 13 Pipeline Accident Report Damage to line pipe during shipment has been confined to a very small number of pipe shipped. This damage has mostly taken the form of local abrasions and dents caused by contact with rivet heads or other protrusions in the rail car or truck. In a few instances, however, leaks have been attributed to fatigue cracks initiated due to cyclic stresses that are induced during shipment. It is possible for these cracks to initiate with no noticeable surface damage to identify them. The paper goes on to say: The stresses developed during shipment (usually most severe during rail shipments because of higher stacks and higher g-loadings) depend on the diameter, thickness, loading configuration, and number of bearing strips. The potential damage done, of course, depends on the number of cycles of stress which are imposed during shipment. In January 1965, the API addressed the prevention of fatigue cracks initiating during railroad transportation of pipe by publishing a recommended practice, API RP 5L1, Railroad Transportation of Line Pipe. API RP 5L1, which applied to 24-inch- to 42-inch- diameter pipe, included recommendations on the design of bearing strips, banding, separator strips, and longitudinal weld placement during pipe loading. The weld was to be placed at the point of least stress during loading, approximately 45° from the vertical (clock positions 1:30, 4:30, 7:30, or 10:30) and not in contact with adjacent pipes. Subsequently, API’s April 1972 revision of RP 5L1 expanded the applicability of the recommended practice to include a range of diameters, 2 3/8 inches and larger, and specified that it applied to pipe having a D/t ratio of 70:1 and larger. The hazardous liquids pipeline safety regulations in 49 CFR Part 195 do not contain requirements that address railroad transportation or any transportation of pipe. The natural gas pipeline safety regulation contained in 49 CFR 192.65, “Transportation of Pipe,” which became effective on November 12, 1970, states: In a pipeline to be operated at a hoop stress of 20 percent or more of the specified minimum yield strength, no operator may use pipe having an outside diameter-to- wall thickness ratio of 70 to one, or more, that is transported by railroad unless the transportation was performed in accordance with API RP 5L1. When the natural gas pipeline safety regulations became effective, pipeline operators were prohibited from using an estimated $13 million of stockpiled pipe because operators were unable to verify that the pipe, which had been transported by railroad, was transported in accordance with API RP 5L1. On February 14, 1973, RSPA amended section 192.65 of the natural gas pipeline safety regulations with paragraph (b) of the regulation, which allowed pipe meeting the above criteria that was transported before November 12, 1970, to be installed in pipelines if the pipe was pressure tested to certain requirements detailed in the section. Colonial Pipeline Company also has experienced ruptures in its 32- and 36-inch liquid pipelines that its metallurgical report attributed to fatigue cracking in U.S. Steel manufactured pipe. Two Colonial 36-inch (D/t ratio 128:1) pipeline fatigue crack ruptures

Factual Information 14 Pipeline Accident Report in U.S. Steel pipe transported by railroad occurred in Greenville County near Spartanburg, South Carolina, on May 13, 1979, and June 16, 1979. The May rupture released 136,000 gallons of fuel oil that damaged vegetation and killed fish. The June rupture released 395,000 gallons of fuel oil that damaged vegetation and killed wildlife and fish. In 1980, the Safety Board investigated an accident involving a 32-inch-diameter U.S. Steel pipe (D/t ratio 114:1) in a Colonial Pipeline Company pipeline near Manassas, Virginia, in which 92,000 gallons of fuel oil leaked from a fatigue crack that was initiated during rail shipment of the pipe.15 The rupture damaged vegetation and killed approximately 5,000 fish and some waterfowl and small animals. At the time, hydrostatic pressure testing was the only method available for finding crack defects; however, the accident report noted that hydrostatic pressure testing is inadequate because the test itself may cause small cracks to propagate without causing them to fail during the test. As a result of its investigations of the 1980 accident, the Safety Board issued Safety Recommendations P-81-13 and P-81-14 to RSPA: P-81-13 Expedite, in cooperation with the American Petroleum Institute and the American Gas Association, the jointly sponsored program to determine the extent of pipe failures in existing pipeline systems with a diameter-to- thickness ratio of 70 or greater due to fatigue cracks initiated during the rail shipment of the pipe. P-81-14 If it is determined that pipe failures in existing pipeline systems with a diameter-to-thickness ratio of 70 or greater due to fatigue cracks initiated during the rail shipment of the pipe are a continuing problem, develop operating and testing guidelines to assist pipeline operators in minimizing pipe failures. RSPA responded that the Materials Transportation Board had reviewed the extent and seriousness of a series of pipeline failures due to fatigue cracking that developed during rail transportation. As a result of the review, seven failures were found that were attributable to fatigue cracking due to railroad transportation. RSPA responded that it considered this a limited problem that did not require regulatory action at that time but that the agency would continue to monitor failures for any indications of future problems. Safety Recommendation P-81-13 was classified “Closed–Acceptable Action” on February 23, 1982. Safety Recommendation P-81-14 was classified “Closed–No Longer Applicable” on March 21, 1983. 15 National Transportation Safety Board, Colonial Pipeline Company Petroleum Products Pipeline Failures, Manassas and Locust Grove, Virginia, March 6, 1980, Pipeline Accident Report NTSB/PAR-81/2 (Washington, DC: NTSB, 1981).

Factual Information 15 Pipeline Accident Report On December 18, 1989, another fatigue crack failure occurred on Colonial’s 32- inch pipeline in U.S. Steel pipe. As a result of the 1989 failure, RSPA’s Office of Pipeline Safety created a task force to study Colonial pipeline failures attributable to fatigue cracking. U.S. Steel, Kaiser Steel, A.O. Smith, Bethlehem Steel, and Republic Steel manufactured the pipe involved in the study, and the pipelines were constructed between 1962 and 1964. Of these manufacturers’ pipes, all had a submerged arc weld in the longitudinal seam except the A.O. Smith pipe, which had a flash-welded longitudinal welded seam. The RSPA task force concluded in its September 14, 1990, report that six Colonial pipeline failures from 1970 through 1989 resulted from fatigue cracking that was probably initiated during rail transportation of the pipe. The task force report stated that five fatigue crack failures were found in U.S. Steel pipe and that one was found in Republic Steel pipe. The report stated that crack growth by fatigue is a greater possibility in liquid lines than in gas lines because liquid lines are subjected to frequent and substantial cycles of pressure variations during normal operations. The RSPA task force report describes the loading method tests that Battelle Laboratories conducted in 1962 under contract from Colonial Pipeline Company. Battelle reported that the susceptibility to fatigue cracking during rail transportation increases for pipe with larger D/t ratios because such pipe is more susceptible both to static stresses from the weight of the pipe and to cyclic stresses during transportation. RSPA’s report also noted that the American Gas Association conducted research to develop solutions to transportation fatigue and found that the higher the D/t ratios, the more susceptible the pipe to fatigue crack initiation. The American Gas Association research concluded that pipe with a D/t ratio greater than 70:1 has a possibility of fatigue crack initiation and requires special care in railcar loading. RSPA’s 1990 task force report stated that with the implementation of API RP 5L1 in 1965, the occurrence of railroad transportation cracks had been virtually eliminated. A 1988 paper16 documented numerous transit fatigue crack failures that occurred during initial hydrostatic pressure testing of the pipe. The types of pipe included DSAW, electric resistance weld, and seamless steel pipe that had been shipped by rail or marine vessels. In nine fatigue failures that occurred between 1969 and 1982, the pipe had been transported by railroad and the diameters ranged from nominal 6-inch to 20-inch pipe with D/t ratios from 42:1 to 64:1. In 17 fatigue failures that occurred between 1976 and 1987, the pipe had been transported by marine vessel and ranged from 6 inches to 24 inches in diameter with D/t ratios from 28:1 to 85:1. The paper stated: Transit fatigue results from cyclic stresses induced by gravitational and inertial forces. The weight of a load of pipe imposes a steady stress of a given magnitude. As the load moves up and down, the pipe flexes, inducing alternating tension and compression at both the inside and outside surfaces. The alternating stresses initiate cracks. 16 Bruno, T.V., “Transit Fatigue of Tubular Goods,” Pipe Line Industry, July 1988, pp. 31–34. (This paper is also referenced in the foreword of the sixth edition of API RP 5L1, July 2002.)

Factual Information 16 Pipeline Accident Report The D/t ratios that could lead to fatigue cracking during transportation were changed in the 1990 edition of API RP 5L1. The ratio was reduced from 70:1 to 50:1 because fatigue cracking had been reported in pipe with D/t ratios lower than 70:1. The latest edition of API RP 5L1, issued in July 2002, also states that pipe with D/t ratios well below 50:1 may suffer fatigue in transit under some circumstances. No statistics on transportation damage were specifically tracked before RSPA instituted a change in 2002 to gather more detailed accident statistics. However, RSPA is now gathering information on whether an accident is caused by pipe damage sustained during transportation and whether the failure is a longitudinal tear or crack. Railroad Transportation of Accident Pipe The section of pipeline where the rupture occurred was constructed in 1967. The Enbridge 1966 purchase specification for the pipe included a requirement that pipe loading details be provided subject to its approval. In its quotation, U.S. Steel provided a diagram for railroad car loading (see figure 9), which Enbridge subsequently approved. The railcar loading instructions consisted of a drawing with notes specifying the blocking supports and banding to be used under and around the pipe and the required positioning of the longitudinal weld. U.S. Steel also noted in its specifications that the purchaser would spot-check railcar loadings at the mill before transportation. U.S. Steel transported the pipe by railcar to its storage facility near the mill, where it was unloaded and stored. Later, U.S. Steel loaded the pipe for transportation by rail. Finally, the pipe was loaded on trucks for transportation to the construction sites.17 Enbridge had arranged with Moody Engineering Company (Moody) to inspect the manufacturing of the pipe. The handling and loading of the pipe for transportation from the mill to storage was a part of that inspection. These activities were summarized in Moody’s final report. The Moody report indicates that the pipe was periodically inspected at a nearby storage facility to ensure that the pipe was being handled and unloaded with care. The report indicates that the pipe was accepted for shipment subject to the operator’s shipping instructions. U.S. Steel did not document inspections of pipe loading. No records were found to indicate that the engineering company or the pipeline operator inspected the loading of the pipe on railroad cars for transportation from the U.S. Steel storage facility. 17 Records related to the production activities at U.S. Steel’s McKeesport pipe mill were destroyed several years ago after the mill was closed for a period of time.

Factual Information 17 Pipeline Accident Report The U.S. Steel employees who had loaded the 1966 DSAW pipe order could no longer be found. According to a former shipping department employee (who was not present at the time of the Enbridge pipe loading), a typical pipe loading practice before and after this pipe order was to position the longitudinal weld at the 2, 4, 8, or 10 o’clock position so the pipe weld would not touch lumber, bands, or other pipe. If a 40-foot joint Figure 9. U.S. Steel loading diagram for railcars.

Factual Information 18 Pipeline Accident Report of pipe was not loaded in this position, it was to be rotated as necessary to attain one of these positions. Except for the loading diagram, there were no written procedures for loading pipe, nor did U.S. Steel use checklists or other methods to confirm that the pipe was loaded according to specifications. U.S. Steel does not currently manufacture DSAW or SAW pipe. U.S. Steel Tubular Products does produce seamless and electric resistance weld pipe, and the current loading procedures for the pipe are described in the company’s Pack, Mark, and Load Manual. The procedures to be used for each order are entered into the order entry system from the purchase order and are designated on the mill order sent to the production mill. All pipe manufactured to API standards and destined for railroad transportation from the pipe mill is to be loaded to the requirements of the Association of American Railroads’ Open Top Loading Rules Manual18 and the supplementary recommended practices in API RP 5L1. Any additional transportation requirements are referenced in the mill order for the shipping department personnel and, if applicable, are attached to the mill order. A preproduction meeting is held at the mill to review the order and shipment requirements. At pipe mills currently producing tubular products for U.S. Steel, shipping department workers are trained in the department’s standard operating procedures. The group leader in the loading area discusses the loading requirements for each order with the crew. A load tally sheet is created that shows the length of each pipe joint with the referenced heat number for the material. The yard foreman checks the railcars periodically to confirm that the pipe is loaded according to the written requirements. Before 1991, Enbridge specified that the manner of loading pipe for rail transportation should be provided in the pipe manufacturer’s quotation, which was subject to Enbridge’s approval. Currently Enbridge includes the use of API RP 5L1 in its specification for purchase of pipe transported by rail from a pipe mill. Enbridge also inspects the pipe during loading at the pipe mill to confirm that the requirements of API RP 5L1 are being met. Safety Board Materials Laboratory Study The Safety Board performed a finite element study of the U.S. Steel loading practice to determine the static stresses in pipe loaded for rail transportation. The study showed that the peak circumferential tensile stresses would have been highly localized to the areas in contact with the bearing and separator strips and that the stresses would have occurred at the inner surface of the pipe. The length of the fatigue crack in this accident was similar to the length over which the peak circumferential tensile stress was predicted in the finite element model, and the fatigue crack initiated at the inner surface of the pipe. The finite element model 18 The Association of American Railroads’ Open Top Loading Rules Manual includes Section 1, General Rules Manual for Loading all Commodities, and Section 2, Loading Metal Products Including Pipe.

Factual Information 19 Pipeline Accident Report indicated that the circumferential tensile stresses decreased rapidly away from the bearing or separator strips. Aligning the welded seams at 45° to the vertical results in very small levels of circumferential tensile stress at the welds during transport. (See figure 10.) The results of the finite element model also indicate that aligning the welds at the 2, 4, 8, or 10 o’clock positions instead of exactly 45° from vertical does not increase the stress levels significantly. Figure 10. Typical pipe configuration on railroad car.

Factual Information 20 Pipeline Accident Report The Safety Board also studied API loading practices for rail transportation to determine the static stresses in pipe loaded for transportation. API RP 5L1 provides an equation for calculating the peak circumferential tensile stress in a pipe at a bearing strip as a function of the geometry of the loading. API RP 5L1 does not indicate the source of the equation. The purpose of this equation is to calculate the number of flat bearing strips needed to keep the stress below a specified level. The stress determined from the finite element model was compared to the stress calculated by the equation from API RP 5L1 under the same conditions. For a 40-foot-long, 34-inch-diameter, 0.300-inch-wall thickness pipe, the comparison indicates that the equation from API RP 5L1 underestimates the peak circumferential tensile stress by a factor of approximately 2. The API has also published guidelines for loading pipe for transport onboard marine vessels, API RP 5LW, Recommended Practice for Transportation of Line Pipe on Barges and Marine Vessels. API RP 5LW also includes an equation for calculating the peak circumferential tensile stress in a stack of pipe supported by bearing strips. However, this equation differs significantly from the API RP 5L1 equation, and no source is given for the equation. The stress determined from the finite element model was also compared to the stress calculated by the equation from API RP 5LW under the same conditions. For a 40-foot-long, 34-inch-diameter, 0.300-inch-wall thickness pipe, the comparison indicates that the equation from API RP 5LW also underestimates the peak circumferential tensile stress by a factor of approximately 2. The Safety Board also evaluated the pipe movement attributed to the nearby excavation on February 5, 2002. The pipeline moved down and laterally a maximum of 18 inches. The deflection of the pipe led primarily to longitudinal tension and compression stresses that would not have affected the fatigue crack (oriented on a plane radially outward along the welded seam). Circumferential tensile stresses and shear stresses associated with the pipe deflection were calculated to be in the range of 1 to 10 psi in comparison to the circumferential tensile stress of 29,750 psi caused by the internal pressure of the oil in the pipe at the time of the rupture. RSPA Postaccident Corrective Action Order On July 5, 2002, RSPA issued to Enbridge a corrective action order that required the pipeline operator to conduct a detailed metallurgical analysis of the July 4 failure to determine the cause and contributing factors. The corrective action order also prohibited Enbridge from operating the pipeline until it had submitted a return-to-service plan, which was to incorporate a program to verify the integrity of the 34-inch pipeline from the Deer River Pump Station to Superior Terminal. The plan was to include, if relevant, an in-line inspection survey using a technologically appropriate tool capable of assessing the type of failure that had occurred, including the detection of longitudinal cracks, and remedial action. If relevant, the return-to-service plan was to include an evaluation of the pipeline coating system, a hydrostatic pressure test of the line segment, and a review of all available pipeline data and records.

Factual Information 21 Pipeline Accident Report Enbridge submitted its return-to-service plan to RSPA on July 8, 2002. On July 9, RSPA allowed the pipeline to be restarted with pressure restrictions. On July 11, RSPA amended the corrective action order to include an operating pressure restriction on pipeline segments between the U.S./Canadian border and Superior Terminal that contained any U.S. Steel pipe. The amended order required that pump station pressure discharges be no higher than 80 percent of the pressure in the line at the time of rupture and that line pressure at the failure site not exceed 80 percent of the pressure at the time of rupture. On December 2, RSPA permitted Enbridge to raise pressures at pump stations on the Gretna to Clearbrook section of pipe from 80 percent of discharge pressures at the time of the July 4 accident to 80 percent of the highest discharge pressure reached within 30 days of the accident. On June 5, 2003, RSPA allowed the operation of Viking Station, which did not have pump units installed on the 34-inch line at the time of the accident. Enbridge Postaccident Actions Before the accident, the area where the pipeline ruptured was not designated a high-consequence area. According to the 2000 census, the population in the area had increased enough to make it a high-consequence area. Enbridge’s data on the crude oil released in this area were also used in the 2002 evaluation of Enbridge’s high- consequence area pipeline segment identification program. The amount of crude oil released did not trigger the addition of the Cohasset segment as a high-consequence area. In May 2003, as a result of the population change only, the pipeline segment containing the rupture site was classified as a high-consequence area. Enbridge had begun using a more technologically advanced in-line crack inspection tool, the UltraScan CD, in Canada in 1997. The company ran the tool for the first time in the 34-inch line in the United States in 2001. The detection level specification for the tool states that it will find a defect equal to or greater than 2.50 inches long with an accuracy of ±0.2 inch at 4.5 mph. The detection level specification for crack depth is 0.040 inch with accuracy of ±0.040 inch. Both the crack length and crack depth thresholds must be met for the indication to be reported to the operator as a defect. Since the accident, Enbridge has developed and documented a methodology for determining the need for an investigative excavation from the data obtained from an UltraScan CD. Enbridge also has prepared a pipeline inspection procedure, “Excavation Program for Crack Feature Assessment,” as guidance for personnel performing field excavations based on data from the UltraScan CD. The new policy calls for the excavation of all crack-like indications unless an engineering assessment determines that either the indication is acceptable based on a fitness-for-purpose calculation or the indication is not a crack. Enbridge had reviewed its in-line inspection program and updated it to run the UltraScan CD tool from Gretna, Manitoba, Canada, to Clearbrook, Minnesota, in 2001 and from Clearbrook to Deer River in 2003. The UltraScan CD tool inspected the pipeline

Factual Information 22 Pipeline Accident Report section from Gretna to Clearbrook in July 2001, about 1 year before the accident. The data interpretation was completed in September 2002, about 2 months after the accident. No new crack-like indications19 were reported in the longitudinal seam weld of this pipeline section by the in-line inspection. One notch-like feature20 identified in a segment of U.S. Steel pipe was excavated and found to be in the middle of a weld cap. Enbridge determined that the feature was an external weld shrinkage crack that was not likely to be related to transportation fatigue. A second notch-like feature was classified as a low- priority feature to be excavated in the future. Other indications were inspected, and no longitudinal cracks were found in any of the field inspections. Enbridge representatives told the Safety Board that, in addition to excavating all crack-like indications reported by the UltraScan CD tool, the company currently excavates for field examination all notch-like indications in U.S. Steel pipe that are reported at the longitudinal weld to determine whether they are cracks. Currently, the UltraScan CD in- line inspection report does not include a depth estimate for notch-like indications. PII is working with Enbridge to develop a depth estimate of notch-like indications for future inspections. The UltraScan CD inspection tool was run from Clearbrook, Minnesota, to Superior, Wisconsin, in November 2002, and in February 2003 the analysis of the indications found in U.S. Steel pipe was completed. Interim reports allowed for an earlier start of the excavation program for the highest priority indications. The UltraScan CD tool reported 285 defect indications in 121 pipe joints that Enbridge excavated, inspected, and assessed by nondestructive test methods. Included in these defect indications were 6 crack-like and 29 notch-like indications that were either adjacent to or in the longitudinal weld on U.S. Steel pipe. Enbridge has excavated the 6 crack-like indications and 4 of the 29 notch-like indications to visually inspect and examine the pipe by nondestructive means. The field examination of five of the crack-like indications showed that three were stress corrosion cracking,21 and two were at the toe of the longitudinal weld. The sixth crack-like indication was found to be a sharp weld contour. One notch-like indication was a defect that was found to have a 42-percent-depth wall thickness crack. Two notch-like indications were an internal gouge and a weld profile (a higher than normal weld cap) feature. The final notch-like indication that was examined was a low-priority feature that was found to be an external shrinkage crack in the center of a weld. The remaining 25 notch-like indications near or in the longitudinal weld were classified as low priority. Enbridge plans to excavate these notch-like indications. Stress corrosion cracking was also found by the UltraScan CD tool and reported as crack-field22 indications. 19 In PII terminology, a crack-like indication is one that is interpreted from UltraScan inspection data as a crack, which is typically at or in the longitudinal weld. 20 Notch-like defects are grooves in the toe of the DSAW longitudinal seam weld, manufacturing defects in flash-welded or electric resistance welded longitudinal seam welds, weld trimming tool marks adjacent to the longitudinal seam weld, or handling marks made during transportation or construction. Although not interpreted to be crack-like features, depending on their characteristics, these indications may need to be considered for excavation because field inspection may reveal them to be cracks. 21 Stress corrosion cracking is the formation of cracks, typically in a colony or cluster, as a result of the interaction of tensile stress, a corrosive environment, and a susceptible material. A colony of very short, axially aligned cracks seen in the field is the typical result of such cracking. 22 In PII terminology, crack-field refers to a crack interpreted as stress corrosion cracking.

Factual Information 23 Pipeline Accident Report The UltraScan CD tool found all internal cracks, now under pipe sleeve repairs, that were previously found by the Elastic Wave tool. No new internal crack-like indications were reported by the UltraScan CD tool under the sleeves, nor were any found during nondestructive field examination of the pipe. During the field excavations, Enbridge found 21 additional external weld toe cracks on U.S. Steel pipe that were not reported by the inspection tool. According to the field examinations, all 21 of the cracks were below the detection limit specification of the tool. The field information gathered from the entire excavation program will help PII evaluate defect parameters. Of the 285 indications, approximately 60 reported by the tool had field-verified features that were below the contracted threshold limit of the tool for depth, length, or both. The UltraScan CD tool was designed to detect even smaller defects with a higher degree of reliability than the Elastic Wave tool. Enbridge had an analysis performed that established ranges of key input parameters for predicting reinspection intervals. Using the knowledge learned from the July 2002 failure, Enbridge had crack growth rates for a variety of defect sizes. The most conservative (worst-case) scenario evaluated was a defect 0.080 inch deep by 7.5 inches long, two times the depth and three times the detection threshold of the UltraScan CD tool. This defect has a predicted time until failure of approximately 6.5 years. Enbridge has proposed to RSPA that an alternative to hydrostatic pressure testing is reinspecting the Clearbrook to Superior section of the 34- inch pipeline within 3 years of the previous in-line crack tool inspection. Enbridge currently has a program to evaluate and repair stress corrosion cracking when it is found in the pipeline. Enbridge has provided field feedback to PII on the UltraScan CD tool data gathered from Gretna to Superior on stress corrosion cracking in the pipe. Enbridge also has asked PII to recalibrate the UltraScan CD tool data using Enbridge’s field information to improve the accuracy of stress corrosion crack depth estimates. In addition, a metal loss in-line inspection was completed from the U.S./Canadian border to Superior, Wisconsin. As a result of these in-line inspections, Enbridge has stated that repairs have been made according to company procedures to all defects that were excavated and examined. American Society of Mechanical Engineers Pipeline Codes American Society of Mechanical Engineers (ASME) code B31.8, 2003 edition, Gas Transmission and Distribution Piping Systems, section 816, contains guidance on transporting pipe in accordance with the API railroad or marine vessel recommended practices:23 23 API RP 5L5, Transportation of Line Pipe on Barges and Marine Vessels, was created in 1975 and later was designated API RP 5LW.

Factual Information 24 Pipeline Accident Report Any pipe having an outer-diameter-to-wall thickness ratio of 70 to 1 or more, that is to be used in a pipeline at a hoop stress of 20 percent or more of the specified minimum yield strength that has been or will be transported by railroad, inland waterway, or by marine transportation, must have been or shall be loaded in accordance with API RP 5L1 or API RP 5LW, respectively. When it is not possible to establish that pipe was transported in accordance with the appropriate practice, the pipe must be hydrostatically tested for at least 2 hours to at least 1.25 times the maximum allowable pressure if installed in a Class 1 location, or at least 1.5 times the maximum allowable pressure if installed in a Class 2, 3, or 4 location. ASME B31.4, 1998 edition, Pipeline Transportation Systems for Liquid Hydrocarbons and Other Liquids, section 434.4, states: “When applicable, railroad transportation of pipe shall meet the requirements of API RP 5L1.”

25 Pipeline Accident Report Analysis A metallurgical examination of the failed pipe segment of Enbridge’s 34-inch- diameter crude oil pipeline indicated that the rupture had occurred at a fatigue crack along a longitudinal seam weld. Hydrostatic pressure testing and an in-line inspection tool specifically designed to find cracks did not detect the crack before failure. In its investigation of this accident, the Safety Board attempted to determine how and when the initial fatigue crack occurred and to assess methods used to detect cracking in older pipelines before it propagates to pipe failure. The investigation identified the following safety issues: • The effectiveness and application of line pipe transportation standards. • The adequacy of Federal requirements for pipeline integrity management programs. The Accident The Enbridge Control Center SCADA system’s first indication of a release on line no. 4 was dropping suction and discharge pressures at the Deer River station at 2:12 a.m. on July 4, 2002. Subsequently, the Floodwood station suction pressures began dropping, and the controller realized that he had an abnormal condition and suspected a leak. At 2:13 a.m., the pipeline controller called for the shift coordinator, and at 2:14 a.m., about 2 minutes after the rupture, they decided to shut the line down. Within 3 minutes of this decision, all pumps were shut off, and the valves had begun to close. About 4 minutes later, the final closure of remotely controlled valves at Deer River and the remotely controlled valve at MP 1017.9 isolated the ruptured section from the remainder of the pipeline. About 2:25 a.m., the Deer River and Floodwood police departments were notified of the suspected leak, and at 2:30 a.m. the responsible Enbridge regional personnel were notified. The control center then began analyzing the SCADA data to locate the leak and estimate the volume of the release. The Safety Board concludes that Enbridge’s pipeline control center personnel responded in a timely manner to the indications of a pipeline leak. Transportation of Accident Pipe At the time Enbridge purchased the pipe that ruptured in this accident, the pipeline industry was aware that thin-wall, large-diameter pipe (such as the 109:1 D/t ratio pipe that ruptured in this accident) was particularly susceptible to cyclic stresses encountered during transportation, especially by rail, and that such stresses could lead to the initiation of fatigue

Analysis 26 Pipeline Accident Report cracking in the pipe unless the pipe was properly loaded and transported. Welded areas were also known to be the areas most susceptible to fatigue crack initiation during transportation. To address concerns about pipe stress during transportation, Enbridge had required in its purchase specification that pipe loading details be provided subject to its approval. U.S. Steel submitted a diagram with specifications for rail car loading that was designed to protect the pipe, and Enbridge approved it. Enbridge retained an engineering company to inspect the manufacturing, handling, and loading of the pipe by U.S. Steel at the mill and the subsequent unloading at its storage site near the mill. The engineering firm’s final report indicated that the pipe was accepted at the storage site for shipment subject to Enbridge's instructions. Final transportation of the pipe was done later from storage, with the pipe traveling by both rail and truck. The U.S. Steel loading diagram for the railroad shipment that included the accident pipe provided for leveling bearing strips and placing separator strips for support of the pipe, orienting longitudinal welds at 45° to the vertical, and avoiding contact with adjacent pipes. The U.S. Steel diagram was similar to the loading specifications for railroad transportation of line pipe in the January 1965 edition of API RP 5L1. As noted previously, this recommended practice addressed loading pipe to minimize stresses across the longitudinal welded seams of pipe, which are susceptible to fatigue cracking. The Safety Board’s review determined that the provisions in the U.S. Steel loading diagram for rail transportation satisfied the requirements of the January 1965 edition of API RP 5L1. The metallurgical testing and examination of the fatigue crack and ruptured area of the accident pipe found no material or manufacturing defect in the steel or in the welded longitudinal seam. In the absence of manufacturing or material defects, the creation of a fatigue crack would be unlikely to result from normal operational pressure cycles. However, once a fatigue crack has been created it may grow with the repetitive stresses from normal operational pressure cycles. The fracture surfaces of the fatigue crack in the accident pipe had multiple arrest lines and other indications of progressive cracking starting from the inside surface of the pipe wall. There were two regions paralleling the inside surface; the region next to the pipe wall was darkened and oxidized and contained multiple crack initiation sites. The adjacent region where the crack extended further into the pipe wall was lighter and cleaner, exhibiting little or no oxidation. The oxidation found in the darkened region most likely occurred while the faces of the fatigue crack were exposed to the atmosphere before the pipe was placed in service. The lighter region indicates that the fatigue crack grew while oil was protecting the crack surfaces from oxidation. The Safety Board's finite element analysis revealed that the length of the fatigue crack was consistent with the high stress region predicted on the inside surface of the pipe at a bearing or separator strip. Documents show that Enbridge used an engineering company for the specific purpose of inspecting the U.S. Steel pipe until it was stored near the mill. Further, the pipe was transported only a few miles before storage, whereas it was transported about 1,000 miles by rail and truck from storage to construction sites in Minnesota, suggesting a greater likelihood that the pipe was damaged after it was removed from storage. Further, there is no documentation to substantiate that instructions for loading pipe on railroad cars were

Analysis 27 Pipeline Accident Report followed after storage, and no evidence was found to indicate whether pipe loading instructions existed for transportation by truck. Therefore, the stress levels necessary for the initiation and initial growth of the fatigue crack were most likely caused by cyclic forces acting on the pipe during transportation after storage. The finite element analysis for the accident pipe shipment showed that following the rail loading standard, which prescribes size and placement of bearing/separator strips and alignment of the welded seams at 45° to the vertical, would not have resulted in stress levels high enough to initiate fatigue cracking during transportation. Therefore, the Safety Board concludes that, after storage, the accident pipe was likely inadequately loaded for transportation, which led to the initiation of fatigue cracking along a longitudinal seam weld before the pipe was placed in service. The Safety Board further concludes that after installation the preexisting fatigue crack grew with pressure cycle stresses until the crack reached a critical size and the pipe ruptured. Transportation Fatigue Cracking in Line Pipe A number of fatigue cracks similar to the one in the Enbridge pipe have led to failures in DSAW (double submerged arc weld) pipe at other locations. Improper positioning of welds when loading pipe joints can create stress in the longitudinal weld during rail transportation that is sufficient to initiate fatigue cracks that are consistent with the type of damage observed in the Enbridge and Colonial pipeline DSAW pipe. As shown in the 1988 metallurgical study of pipe referenced in the current API RP 5L1, fatigue cracks occurring in pipe having various seam types led to 26 pipe failures during initial hydrostatic testing between 1969 and 1987. All of these failures occurred after the pipe had been transported by rail or marine mode. When compared to the Safety Board’s finite element analysis of the static stress developed in the area of a bearing or separator strip (see figure 10) in a stack of 34-inch- diameter, 0.300-inch-wall thickness pipe, the equation in API RP 5L1 for calculating static load stresses underestimated the stresses in the pipe by a factor of approximately 2. However, the Safety Board’s analysis indicates that the effectiveness of API RP 5L1 in preventing fatigue crack initiation can be explained by the emphasis on leveling the bearing strips and on the proper alignment of welded seams at 45° to the vertical, leading to a significant reduction in stress at the welds, which are the areas most susceptible to the initiation of fatigue cracking. Although implementation of the recommended practice has resulted in a reduction of railroad transportation fatigue crack initiation, the Safety Board concludes that API RP 5L1, Recommended Practice for Railroad Transportation of Line Pipe, may significantly underestimate the stresses in the pipe at the bearing or separator strips. In the case of the accident pipe shipment, regardless of whether the stress levels were underestimated in the rail loading standard, as noted previously, following the rail loading standard would not have resulted in stress levels high enough to initiate fatigue cracking. API RP 5LW, Recommended Practice for Transportation of Line Pipe on Barges and Marine Vessels, also provides an equation for calculating the static load stress in a stack of pipe for shipment, but this equation is significantly different from the equation in API RP 5L1. When the Safety Board compared the stresses calculated using the equation in API RP

Analysis 28 Pipeline Accident Report 5LW to those determined by the finite element analysis for 34-inch-diameter, 0.300-inch- wall thickness pipe, it found that the equation in API RP 5LW also underestimates the stresses in pipe loaded for transport by a factor of approximately 2. The Safety Board, therefore, concludes that API RP 5LW may significantly underestimate the stresses in the pipe at the bearing or separator strips. The Safety Board believes that the API should review the equations in API RP 5L1 and API RP 5LW for calculating the static load stresses at the bearing or separator strips and revise the recommended practices based on that review. Natural Gas Pipeline Safety Regulations To prevent the formation of fatigue cracks during railroad transportation of pipe that is to be used in natural gas service, 49 CFR Part 192.65 (effective November 12, 1970) required shippers to follow the requirements of API RP 5L1 when transporting pipe for which the expected hoop stress during service was equal to or greater than 20 percent of the specified minimum yield strength. When the regulation became effective, pipeline operators were prohibited from using an estimated $13 million of stockpiled pipe that had been transported by rail because operators were unable to verify that the pipe had been transported in accordance with API RP 5L1. RSPA granted an exemption in February 1973 that allowed the installation of this pipe if it were pressure tested to higher pressures than normally required. However, transportation fatigue cracks can grow to failure in service after the pipeline has been pressure tested. Therefore, the Safety Board concludes that hydrostatic pressure testing of a pipeline is insufficient to expose all transportation fatigue cracks that may eventually cause pipe failure. Although the amount of pipe still in stock that was transported before November 12, 1970, without documentation that API RP 5L1 was followed is likely not significant, such pipe could be placed in service. Therefore, the Safety Board believes that RSPA should remove the exemption in 49 CFR 192.65 (b) that permits pipe to be placed in natural gas service after pressure testing when the pipe cannot be verified to have been transported in accordance with API RP 5L1. Liquid Pipeline Safety Regulations The RSPA task force report noted that crack growth from fatigue in pipelines is a greater possibility in liquid lines than in gas lines because liquid lines are subject to frequent and substantial pressure cycle variations during normal operations. In contrast to the regulations for transport of natural gas pipe, no similar Federal requirements are applicable to hazardous liquid pipe to ensure that such pipe is protected from fatigue crack initiation during railroad transportation. In a letter to the Safety Board dated July 21, 2003, RSPA indicated that it intends to revise 49 CFR Part 195 for hazardous liquid pipelines to require the use of API RP 5L1, consistent with Part 192 for pipe transportation for gas pipelines. The Safety Board encourages RSPA to promptly amend 49 CFR Part 195 to require that hazardous liquid pipeline operators follow API RP 5L1 for railroad transportation of pipe.

Analysis 29 Pipeline Accident Report Marine Transportation of Pipe Pipe shipped by marine transportation has also exhibited transportation-related failures, but the pipeline safety regulations have no requirement that a standard be followed when pipe is transported on a marine vessel. The API recommended practice for transportation of pipe on marine vessels, API RP 5LW, was first issued in 1975 as API RP 5L5. In addition to 9 fatigue failures attributed to rail transportation in the 1988 metallurgical study, 17 fatigue failures were attributed to pipe transported by ship that failed during hydrostatic testing between 1976 and 1987 while the recommended practice was available to the pipeline industry. The Safety Board concludes that there is a potential risk of pipe damage due to fatigue crack initiation during marine vessel transportation of pipe, similar to the risk during rail transportation, for both hazardous liquid and natural gas pipelines. Therefore, the Safety Board believes that RSPA should amend 49 CFR to require that natural gas pipeline operators (Part 192) and hazardous liquid pipeline operators (Part 195) follow API RP 5LW for transportation of pipe on marine vessels. Truck Transportation of Pipe Rail transportation has generally been considered to be the most likely source of transit fatigue cracking because of the larger number of pipe rows and high loads, long distances, and long travel times involved. A number of previous pipeline failures have been attributed to rail transportation fatigue, but the pipe also was transported in the field by truck following rail transit. Since no information was available regarding truck loading and transport conditions for the pipe that ruptured, the possibility of fatigue crack initiation during truck transportation cannot be ruled out. It is reasonable to assume that pipe, in addition to incurring abrasions or dents, could incur fatigue damage during truck transportation. A pipeline industry standard does not exist for the loading requirements for transportation of steel pipe on trucks. Although the Safety Board does not have any data with which to determine the extent of fatigue crack initiation that may occur as a result of highway transportation induced stresses, the Safety Board concludes that the absence of industry loading standards for truck transportation of pipe might create risks to the integrity of both natural gas and hazardous liquid pipelines. The Safety Board, therefore, believes that RSPA should evaluate the need for a truck transportation standard to prevent damage to pipe, and, if needed, RSPA should develop the standard and incorporate it in 49 CFR Parts 192 and 195 for both natural gas and hazardous liquid line pipe. ASME Pipeline Codes As noted previously, ASME B31.8, Gas Transmission and Distribution Piping Systems, section 816, contains an exemption that allows the installation of pipe that may not have been loaded and transported in accordance with the appropriate API railroad or marine

Analysis 30 Pipeline Accident Report recommended practice with no restriction on when the transportation took place. The exemption allows a hydrostatic pressure test in lieu of compliance with the API recommended practices. The exemption requires a hydrostatic pressure test for a minimum of 2 hours at higher than normally required test pressures. Even though the Federal pipeline safety regulations take precedence in cases of a conflict or apparent conflict with any industry guidance, the Safety Board is concerned that the ASME B31.8 piping code may lead pipeline operators to erroneously believe that pressure testing exposes all fatigue cracks initiated during transportation and verifies the integrity of pipe that may not have been loaded and transported in accordance with API standards. Therefore, the Safety Board believes that ASME should amend ASME B31.8, Gas Transmission and Distribution Piping Systems, section 816, to remove the provision that pressure testing may be used to verify the integrity of pipe that may not have been transported in accordance with the API recommended practices for transportation of pipe by railroad or marine vessels. ASME B31.4, Pipeline Transportation Systems for Liquid Hydrocarbons and Other Liquids, section 434.4, requires that the transportation of pipe by railroad follow API RP 5L1 but does not require that marine transportation of pipe follow API RP 5LW. The Safety Board believes that ASME should amend ASME B31.4, Pipeline Transportation Systems for Liquid Hydrocarbons and Other Liquids, section 434.4, to require the use of API RP 5LW for marine transport of pipe. Pipeline Integrity Management Hydrostatic pressure testing was performed on Enbridge’s pipeline after construction in the 1960s and at various times through the 1980s. As a result of a 1991 fatigue crack rupture, RSPA required Enbridge to develop an operational reliability assessment that included additional pressure tests and to make changes to pipeline operations that included lowering pressure cycle stress in order to improve pipeline integrity. A number of defects failed during the 1991–1992 hydrostatic pressure testing, including some fatigue cracks. By 1995, RSPA had approved Enbridge’s use of an in-line inspection tool, the Elastic Wave tool, to find pipe cracks, rather than hydrostatic pressure testing. By using this tool, Enbridge found a number of cracks that the company repaired before failure. By 1998, the interval for in-line crack tool reinspection had been established as 10 years from the previous inspection. The pipeline section that failed in this accident had last been inspected in May 1996 with an in-line crack-detection tool, which was run approximately 6 years before the rupture. In the May 1996 inspection, an indication was present at the point where the pipe later ruptured on July 4, 2002, but the indication did not exhibit the diamond-shaped signature typical of a crack and did not meet the inspection company’s interpretation standard of at least 6 of 10 feature selection criteria to identify it as a crack. After the accident, the inspection company’s analysis confirmed that the indication did not meet the feature selection criteria. RSPA’s postaccident review concurred with this analysis. The Safety Board concludes that the Elastic Wave in-line inspection conducted before the accident recorded an indication at the point where the pipe eventually failed; however, preaccident and postaccident interpretations of the recorded data found that the indication

Analysis 31 Pipeline Accident Report did not meet the feature selection criteria to identify it as a crack. Relatively large cracks can be found when a pipe fails during hydrostatic pressure testing; however, the potential also exists for smaller cracks to grow but not fail during a pressure test and then continue to grow due to normal operational pressure cycle stress. In its report of the 1980 accident in Manassas, Virginia, the Safety Board noted that it is unlikely that all fatigue cracks will be found during hydrostatic pressure testing. To expose fatigue cracks on the 34-inch pipeline in 1991, Enbridge used hydrostatic pressure testing. However, smaller fatigue cracks that remained in the pipe continued to grow to the point of failure before the next pressure test. Within 2 1/2 years of an Enbridge pressure test, two fatigue cracks failed, resulting in crude oil leaks. The Enbridge metallurgical evaluation indicated that the stress developed during hydrostatic testing was sufficient to propagate the cracks but insufficient to cause an immediate failure. Beginning in 1995, Enbridge inspected its entire 34-inch pipeline in the United States using the Elastic Wave in-line inspection tool. Enbridge’s policy was to excavate all reported crack defects for evaluation whether or not the affected pipeline segment was in a high-consequence area. After this accident, RSPA reviewed the data from the 1995–1996 Mark II Elastic Wave inspection tool for the failed joint of pipe. That review confirmed that the inspection log data showed an indication in the pipeline at the point of rupture; however, the data did not meet the crack identification criteria established by the inspection company. As a result of this accident, RSPA informed the Safety Board on July 21, 2003, that it plans to issue an advisory bulletin to all pipeline operators about reevaluating previous Mark II Elastic Wave tool inspections used to detect crack-like defects near the longitudinal weld and taking remedial action necessary to ensure the continued integrity of the pipeline. In addition, according to RSPA, pipeline operators will be issued a directive to monitor pressure cycles to verify that assumptions made in the original remaining life analyses for cracks remain valid and to ensure that input parameters are within the tool tolerance range and detection level when analytical methods are used to establish retesting intervals. Furthermore, RSPA will modify the forms it uses to guide comprehensive integrity management audits to ensure that pipeline operators adhere to the requirements of the advisory bulletin. The Safety Board supports the completion of these actions that can be taken now by pipeline operators to improve pipeline integrity. RSPA, with the financial assistance of industry trade associations, is also conducting research leading to the development of a quantitative basis for evaluating the significance of pipe material and construction features having time-, environment-, and cycle-dependent growth mechanisms (which includes fatigue cracking) that threaten pipeline integrity in natural gas transmission pipelines. In addition to evaluating the significance of defects in pipe seams, the study will assess defects in pipe manufacturing, pipeline construction, pipe base metal, girth welds, and fabrication welds to quantify conditions under which otherwise benign material and construction features can become active and grow to failure. The research will examine the threats to natural gas pipeline integrity including external and internal corrosion, stress corrosion cracking, and fatigue cracks. The research is intended to identify the conditions that cause the defects to grow and will not be limited to operating pressure or hydrostatic pressure testing. An evaluation technique will also be created for pipeline operators to develop effective mitigation criteria for their pipelines. The Safety Board agrees that, in addition to fatigue cracking,

Analysis 32 Pipeline Accident Report other types of time-, environment-, and cycle-dependent defects need to be considered when evaluating threats to hazardous liquid pipeline integrity. If RSPA is satisfied with the results of the natural gas research, the study could be extended to include hazardous liquid pipelines, and the Board encourages RSPA to proceed with the hazardous liquid pipeline research to better evaluate pipeline integrity. In the past, Enbridge had modified the expected crack growth rate from pressure cycle stress based on knowledge gained from investigating prior failures that occurred on the 34-inch-diameter pipeline system. However, in 2001 Enbridge started using the UltraScan CD, a more technically advanced in-line crack inspection tool, for in-line inspections of its 34-inch line in the United States. Since the accident, Enbridge has studied crack growth due to pressure cycle stress using its current crack growth rate model. The company based the study on various sizes of potential fatigue cracks that the UltraScan CD tool was specified to find. For this study, Enbridge assumed that cracks of various sizes would not be found by the inspection tool, then performed an analysis, with the reduced pipeline pressure cycles Enbridge intends to achieve, to project how long those cracks would continue to grow until they might fail. The largest potential crack evaluated in the study was one that was two times the depth and three times the length of the threshold size of a crack that the UltraScan CD tool could detect. The analysis concluded that a crack this large would still have a predicted remaining life of 6.5 years. As a result of the crack-growth evaluation, Enbridge is now proposing to RSPA that it perform the next in-line inspection in the Clearbrook to Superior 34-inch pipeline section using the more advanced in-line crack inspection tool within 3 years of the last inspection. On September 5, 2003, RSPA requested modifications to Enbridge’s return-to- service plan, which include running the UltraScan CD tool in 2005 and analyzing crack growth rate after the reinspection. Enbridge responded that it would reinspect the line between Clearbrook and Superior in 2005 and use the resulting data to refine crack growth rates and determine future integrity requirements. Because cycle-dependent growth is a factor in fatigue crack failures, adhering to operating practices that limit the number and magnitude of pipeline pressure cycles is critical to limiting crack growth. Enbridge also has committed to monitoring and analyzing pressure cycle data on a quarterly basis and to sending each analysis to RSPA at least until the in-line crack tool inspection of the Clearbrook to Superior section is completed in 2005. The Safety Board supports efforts to monitor operating data and refine crack growth rate estimates to help determine appropriate in-line reinspection intervals. The Federal pipeline safety regulations require that certain actions be taken when conditions are found that could affect pipeline safety. Enbridge’s policy regarding fatigue cracks has been and still is to run an in-line crack inspection tool in the entire 34-inch pipeline regardless of high-consequence area designation. Before RSPA’s integrity management rule, Enbridge analyzed the crack failure data and established a reinspection time interval for its 34-inch pipeline based on an engineering evaluation of the crack growth rate. Now, RSPA’s integrity management rule for high-consequence areas, 49 CFR 195.452 (e), requires that a hazardous liquid operator consider all risk factors to establish an assessment schedule, including the “results of a previous assessment, the defect type and size that the defect assessment method can detect, and the defect growth rate.”

33 Pipeline Accident Report Conclusions Findings 1. Enbridge’s pipeline control center personnel responded in a timely manner to the indications of a pipeline leak. 2. After storage, the accident pipe was likely inadequately loaded for transportation, which led to the initiation of fatigue cracking along a longitudinal seam weld before the pipe was placed in service. 3. After installation the preexisting fatigue crack grew with pressure cycle stresses until the crack reached a critical size and the pipe ruptured. 4. The American Petroleum Institute recommended practice 5L1, Recommended Practice for Railroad Transportation of Line Pipe, and American Petroleum Institute recommended practice 5LW, Recommended Practice for Transportation of Line Pipe on Barges and Marine Vessels, may significantly underestimate the stresses in the pipe at the bearing or separator strips. 5. Hydrostatic pressure testing of a pipeline is insufficient to expose all transportation fatigue cracks that may eventually cause pipe failure. 6. There is a potential risk of pipe damage due to fatigue crack initiation during marine vessel transportation of pipe, similar to the risk during rail transportation, for both hazardous liquid and natural gas pipelines. 7. The absence of industry loading standards for truck transportation of pipe might create risks to the integrity of both natural gas and hazardous liquid pipelines. 8. The Elastic Wave in-line inspection conducted before the accident recorded an indication at the point where the pipe eventually failed; however, preaccident and postaccident interpretations of the recorded data found that the indication did not meet the feature selection criteria to identify it as a crack. Probable Cause The National Transportation Safety Board determines that the probable cause of the July 4, 2002, pipeline rupture near Cohasset, Minnesota, was inadequate loading of the pipe for transportation that allowed a fatigue crack to initiate along the seam of the longitudinal weld during transit. After the pipe was installed, the fatigue crack grew with pressure cycle stresses until the crack reached a critical size and the pipe ruptured.

34 Pipeline Accident Report Recommendations As a result of its investigation of the July 4, 2002, pipeline rupture near Cohasset, Minnesota, the National Transportation Safety Board makes the following safety recommendations: To the Research and Special Programs Administration: Remove the exemption in 49 Code of Federal Regulations 192.65 (b) that permits pipe to be placed in natural gas service after pressure testing when the pipe cannot be verified to have been transported in accordance with the American Petroleum Institute recommended practice 5L1. (P-04-01) Amend 49 Code of Federal Regulations to require that natural gas pipeline operators (Part 192) and hazardous liquid pipeline operators (Part 195) follow the American Petroleum Institute recommended practice 5LW for transportation of pipe on marine vessels. (P-04-02) Evaluate the need for a truck transportation standard to prevent damage to pipe, and, if needed, develop the standard and incorporate it in 49 Code of Federal Regulations Parts 192 and 195 for both natural gas and hazardous liquid line pipe. (P-04-03) To the American Society of Mechanical Engineers: Amend American Society of Mechanical Engineers B31.8, Gas Transmission and Distribution Piping Systems, section 816, to remove the provision that pressure testing may be used to verify the integrity of pipe that may not have been transported in accordance with the American Petroleum Institute recommended practices for transportation of pipe by railroad or marine vessels. (P-04-04) Amend American Society of Mechanical Engineers B31.4, Pipeline Transportation Systems for Liquid Hydrocarbons and Other Liquids, section 434.4, to require the use of the American Petroleum Institute recommended practice 5LW for marine transport of pipe. (P-04-05) To the American Petroleum Institute: Review the equations in American Petroleum Institute recommended practice 5L1, Recommended Practice for Railroad Transportation of Line Pipe, and American Petroleum Institute recommended practice 5LW, Recommended Practice for Transportation of Line Pipe on Barges and Marine Vessels, for calculating the static load stresses at the bearing or separator strips and revise the recommended practices based on that review. (P-04-06)

Recommendations 35 Pipeline Accident Report BY THE NATIONAL TRANSPORTATION SAFETY BOARD MARK V. ROSENKER

Vice Chairman JOHN J. GOGLIA Member CAROL J. CARMODY Member RICHARD F. HEALING Member Adopted: June 23, 2004 Chairman Ellen Engleman Conners did not participate in the adoption of this report.

this page intentionally left blank

37 Pipeline Accident Report Appendix A Investigation The National Transportation Safety Board was notified on July 4, 2002, through the National Response Center, of a pipeline release in an isolated, swampy area west of Cohasset, Minnesota. The Safety Board dispatched an investigative team from its Washington, D.C., headquarters. The team comprised investigative groups in pipeline operations, SCADA, and emergency response. No Board member accompanied the investigative team. No depositions or hearings were held in conjunction with the investigation. Enbridge Pipelines (Lakehead), LLC; PII North American, Inc.; United States Steel Corporation; the Minnesota Office of Pipeline Safety; Minnesota Pollution Control; the Minnesota Department of Natural Resources; the Cohasset Fire Department; and RSPA’s Office of Pipeline Safety were parties to the investigation.

this page intentionally left blank

FD07262 ｜ 2002_美国_RAR0201.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2002 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 RAILROAD ACCIDENT REPORT PB2002-916301 NTSB/RAR-02/01 COLLISION OF NATIONAL RAILROAD PASSENGER CORPORATION (AMTRAK) TRAIN 59 WITH A LOADED TRUCK-SEMITRAILER COMBINATION AT A HIGHWAY/RAIL GRADE CROSSING IN BOURBONNAIS, ILLINOIS, MARCH 15, 1999 7168A

THIS CORRECTION IS INCLUDED IN THIS VERSION OF THE PUBLISHED REPORT: RAILROAD ACCIDENT REPORT NTSB/RAR-02/01 (PB2002-916301)

COLLISION OF NATIONAL RAILROAD PASSENGER CORPORATION (AMTRAK) TRAIN 59 WITH A LOADED TRUCK-SEMITRAILER COMBINATION AT A HIGHWAY/RAIL GRADE CROSSING IN BOURBONNAIS, ILLINOIS, MARCH 15, 1999

• Page 29 has been updated to include coach car #34089. (11 Sep 2002) Coach car #34089 was excluded from the original printed version. Car numbers were also added for the sleeping car (32035) and diner car (38020).

Railroad Accident Report Collision of National Railroad Passenger Corporation (Amtrak) Train 59 With a Loaded Truck-Semitrailer Combination at a Highway/Rail Grade Crossing in Bourbonnais, Illinois, March 15, 1999 NTSB/RAR-02/01 PB2002-916301 National Transportation Safety Board Notation 7168A 490 L’Enfant Plaza, S.W. Adopted February 5, 2002 Washington, D.C. 20594

National Transportation Safety Board. 2002. Collision of National Railroad Passenger Corporation (Amtrak) Train 59 With a Loaded Truck-Semitrailer Combination at a Highway/Rail Grade Crossing in Bourbonnais, Illinois, March 15, 1999. Railroad Accident Report NTSB/RAR-02/01. Washington, DC. Abstract: About 9:47 p.m. on March 15, 1999, National Railroad Passenger Corporation (Amtrak) train 59, with 207 passengers and 21 Amtrak or other railroad employees on board and operating on Illinois Central Railroad (IC) main line tracks, struck and destroyed the loaded trailer of a tractor-semitrailer combination that was traversing the McKnight Road grade crossing in Bourbonnais, Illinois. Both locomotives and 11 of the 14 cars in the Amtrak consist derailed. The derailed Amtrak cars struck 2 of 10 freight cars that were standing on an adjacent siding. The accident resulted in 11 deaths and 122 people being transported to local hospitals. Total Amtrak equipment damages were estimated at $14 million, and damages to track and associated structures were estimated to be about $295,000. The safety issues discussed in this report are as follows: truckdriver performance, emergency response, and signal system performance. As a result of this investigation, the Safety Board makes safety recommendations to the U.S. Department of Transportation, the Federal Railroad Administration, all class I and regional railroads, Amtrak, the International Association of Fire Fighters, and the International Association of Fire Chiefs. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2002-916301 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Railroad Accident Report Contents Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Personnel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Truckdriver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Train Operator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Train Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Motor Carrier Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Truck Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Track and Signal Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Track Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Roadway and Grade Crossing Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Toxicological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Truckdriver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Amtrak Crew . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Postaccident Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Site Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Examination of Gate Arm Mechanism Components . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Sight Distance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Wreckage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Tractor and Semitrailer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Train Air Brakes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Grade Crossing Warning System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Grade Crossing Signal Malfunction History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Laboratory Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Fire Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Locomotive Event Recorders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Accident Reconstruction and Computer Simulations . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Emergency Preparedness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Current Status of McKnight Road Crossing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Truckdriver Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Truck Speed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Warning Signal System Activation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Crossing Gate Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Contents iv Railroad Accident Report Fatigue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Motor Carrier Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 Flammability of Interior Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 Train Evacuation Effort . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Roadway Geometry/Highway Condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Reducing Traffic Violations at Grade Crossings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 New Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 Recommendations Reclassified in This Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 Appendixes A: Investigation and Hearings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

v Railroad Accident Report Executive Summary About 9:47 p.m. on March 15, 1999, National Railroad Passenger Corporation (Amtrak) train 59, with 207 passengers and 21 Amtrak or other railroad employees on board and operating on Illinois Central Railroad (IC) main line tracks, struck and destroyed the loaded trailer of a tractor-semitrailer combination that was traversing the McKnight Road grade crossing in Bourbonnais, Illinois. Both locomotives and 11 of the 14 cars in the Amtrak consist derailed. The derailed Amtrak cars struck 2 of 10 freight cars that were standing on an adjacent siding. The accident resulted in 11 deaths and 122 people being transported to local hospitals. Total Amtrak equipment damages were estimated at $14 million, and damages to track and associated structures were estimated to be about $295,000. The National Transportation Safety Board determines that the probable cause of the collision between Amtrak train 59 and a truck tractor-semitrailer combination vehicle at the McKnight Road grade crossing in Bourbonnais, Illinois, was the truckdriver’s inappropriate response to the grade crossing warning devices and his judgment, likely impaired by fatigue, that he could cross the tracks before the arrival of the train. Contributing to the accident was Melco Tranfer, Inc.’s failure to provide driver oversight sufficient to detect or prevent driver fatigue as a result of excessive driving or on-duty periods. The safety issues identified during this investigation are as follows: • Truckdriver performance; • Emergency response; and • Signal system performance. As a result of this investigation, the Safety Board makes safety recommendations to the U.S. Department of Transportation, the Federal Railroad Administration, all class I and regional railroads, Amtrak, the International Association of Fire Fighters, and the International Association of Fire Chiefs.

this page intentionally left blank

1 Railroad Accident Report Factual Information Synopsis About 9:47 p.m. on March 15, 1999, National Railroad Passenger Corporation (Amtrak) train 59, with 207 passengers and 21 Amtrak or other railroad employees on board and operating on Illinois Central Railroad (IC) main line tracks, struck and destroyed the loaded trailer of a tractor-semitrailer combination that was traversing the McKnight Road grade crossing in Bourbonnais, Illinois. (See figure 1.) Both locomotives and 11 of the 14 cars in the Amtrak consist derailed. The derailed Amtrak cars struck 2 of 10 freight cars that were standing on an adjacent siding. The accident resulted in 11 deaths and 122 people being transported to local hospitals. Total Amtrak equipment damages were estimated at $14 million, and damages to track and associated structures were estimated to be about $295,000. Figure 1. Accident Location. ILLINOIS ILLINOIS Bourbonnais Lake Michigan Chicago Bourbonnais Chicago INDIANA

Factual Information 2 Railroad Accident Report Accident Narrative Shortly after 8:30 p.m. on March 15, 1999, the driver of the truck involved in this accident picked up his truck tractor semitrailer at Melco Transfer, Inc., (Melco) in Peotone, Illinois. The driver was operating the vehicle under a 60-day probationary license that had been issued in January 1999 after his commercial driver’s license (CDL) was suspended for 90 days because of three traffic citations within a 1-year period.1 He drove the truck to the Birmingham Steel plant in Bourbonnais, Illinois. At the plant, the semitrailer was loaded with 6 bundles of 60-foot-long, 3/4-inch-diameter steel reinforcing rods (rebar). When the loading of the flatbed semitrailer was completed, the driver secured the load and drove the truck over weigh scales. The vehicle gross weight was registered at 74,880 pounds. The truck left the plant compound, turned right onto McKnight Road, and traveled eastward about 650 feet to the highway/railroad grade crossing. The grade crossing was equipped with train-activated flashing lights, bells, and automatic gate arms. Amtrak train 59, the City of New Orleans, originated in Chicago, Illinois, and was bound for New Orleans, Louisiana. The crew reported for duty at 7:15 p.m. Before the train departed, the engineer performed an air brake test. No exceptions were taken. The engineer also stated that he checked the headlight and ditch lights and that they were working properly. The train departed Chicago at 8:03 p.m. The engineer stated that during the trip, the ditch lights oscillated properly at the crossings when he activated the train horn. He also said that the train brakes responded properly each time they were used. At the train’s first scheduled stop, in Homewood, Illinois, no passengers left the train, while an unknown number of passengers boarded. The train departed Homewood at 9:27 p.m. The accident truckdriver stated that the crossing lights started flashing when he was “right on top of the track.” He said he did not notice the position of the crossing gates. The crossing lights had activated on the approach of Amtrak train 59. The truckdriver said he was concerned about braking hard because decelerating too quickly could cause the load on the semitrailer to shift forward and strike the tractor cab. He said he believed that if he attempted to brake moderately to avoid a load shift, he might bring the truck to a halt on the crossing and in the path of the oncoming train. He said he was thus momentarily undecided about whether he should attempt to stop or continue across the crossing, but in the end he “just floored it.” He stated that as he traversed the crossing, he looked right and left and saw that the light of the train “wasn’t too far down the tracks then.” The truckdriver said he believed his vehicle was in sixth gear and traveling about 20 mph at the time of the collision. Meanwhile, an individual who stated that he was in the Bourbonnais area looking for a used car had mistaken the Birmingham Steel Company parking lot for a used car dealership. Realizing his mistake, he turned around in the parking lot and attempted to reenter McKnight Road. He said that after waiting for a truck and a passenger car to pass, he turned right onto McKnight Road. He said that the car in front of his was stopped because the lights had begun to flash, and he stopped behind it. He stated that at that time, 1 See the “Personnel Information” section of this report for more information.

Factual Information 3 Railroad Accident Report the truck “was approaching the rail” and that “when the… [gates] were coming down, the trailer was already almost on top of the track and, yes, contact was made with one crossing gate.” He said the gate struck the right side of the trailer about a third of the way back and that he saw a piece of the gate break off. The witness also stated that the truck moved from the right-hand lane toward the middle of the roadway. He estimated that the truck was traveling about 7 mph at the time. The train 59 engineer, who was the only person in the locomotive cab at the time, stated that he saw the truck slowly moving over the crossing, and he sounded the train horn to warn the truckdriver. He said that when he realized that the truck would not clear the crossing before the train arrived, he initiated emergency braking.2 Traveling at 79 mph, the train did not have sufficient distance to stop and struck the left rear of the semitrailer. (See figure 2.) The time was about 9:47 p.m. The conductor stated that he was walking through the coach behind the diner when he heard the train’s brakes apply and felt a bump. He believed that the train accelerated, and then the car rolled over on its side. The conductor stated that at this point he helped a passenger remove a window and climbed outside; once outside, he communicated by radio with the assistant conductor and the locomotive engineer. When the engineer said 2 According to the locomotive event recorder, the engineer applied the train brakes, but he did not activate emergency braking. Figure 2. Aerial view of crash scene.

Factual Information 4 Railroad Accident Report that he was trapped in the locomotive, the assistant conductor said he would go help the engineer. The conductor remained at the coach and helped passengers evacuate. At the time of the accident, a crane operator on duty at Simms Metal America, which is west of and adjacent to the Birmingham Steel plant, had a view of the accident crossing and the approach. According to a postaccident IC survey, the crane was between 1,600 and 1,800 feet from the crossing, depending on its position along its track. The crane operator said he was swinging the crane to the northeast when he noticed the grade crossing lights begin to flash. He looked to the north and, over the tops of rail cars that were parked on a siding parallel to the main line, he could see the headlight of a moving southbound train. By his estimate, he could see the train about 1/2 mile from the crossing. He then made a lift of scrap material and deposited it in a bucket for use by the steel mill. He stated that it takes between 15 to 20 seconds to pick up material, put it in the bucket, and turn around.3 He said that when he looked back toward the crossing, he saw the impact of the train and the truck. He did not remember seeing the crossing gates, nor did he remember seeing any vehicles at the crossing before the crash. A truckdriver who was in the steel plant parking lot stated that he first saw the accident-involved truck through his rearview mirror as it was rolling across the Birmingham Steel plant’s scale on its way out of the parking lot. The accident truck proceeded directly to the westernmost parking lot exit and turned right onto McKnight Road. As the accident truck came parallel to the parked truck’s position and entered the roadway, the witness was putting a tarpaulin on his load in the parking lot. The witness watched the progress of the accident truck because he was interested in the fact that it carried an oversized load of steel. He stated that he heard the accident truck’s jake brake as it rolled by him on the roadway.4 He also said he saw the truck’s brake lights illuminate for a few seconds, after which the truck proceeded across the tracks with its left tires slightly beyond the centerline of the roadway. This witness stated that he did not notice flashing lights as the truck proceeded into the intersection, and that the gates were up. He indicated that the only time he saw the lights illuminated was after the accident. He also did not notice any other vehicles on McKnight Road before the accident. A security guard employed in the scale house of the steel plant knew the accident truckdriver, and spoke briefly with him shortly before the accident. He indicated that the truckdriver’s behavior and conversation seemed normal, that there was no sign of drowsiness or other impairment. The security guard looked toward the crossing when he heard the train horn, but his view was blocked by trucks in the steel plant parking lot. He stated that he saw the crossing lights begin to flash, and that roughly 5 seconds later the train arrived at the crossing. 3 Safety Board tests verified the accuracy of this estimate. 4 A jake brake is a compression release braking system, supplemental to the main air brakes, that uses the engine to provide braking power for the vehicle. When the jake brake is turned on and the driver removes his foot from the accelerator pedal, the jake brake immediately activates. In some vehicles, the activation of the jake brake will cause the activation of the brake lights.

Factual Information 5 Railroad Accident Report The security guard’s wife was visiting the scale house at this time. She stated that she noticed the crossing lights were flashing, and she could see the taillights of the truck. At that time, she believed the truck cab was past the crossing, but she was unable to determine the position of the taillights. (See figure 3 for positions of all witnesses at the time of the collision.) A motorist driving south on Illinois Route 50 adjacent and parallel to the IC tracks about the time of the accident said that as he drove down the highway, he noticed a southbound Amtrak passenger train to his right. He said as he approached the intersection of Route 50 and McKnight Road, he looked west and saw an Amtrak passenger car stopped and blocking the crossing. He said he drove to the crossing, where he observed that an accident had taken place. He said he saw and approached a person walking near the accident truck. When this person identified himself as the truckdriver, the motorist asked him if he was injured, and the truckdriver replied that he was not, except for a cut on his hand. The motorist said that he asked the truckdriver if he had been stuck on the tracks, and the truckdriver said that he had not been stuck, that he had seen the signal lights and thought that he could get across the tracks. He quoted the truckdriver as saying, “I didn’t think the train was moving that fast.” Figure 3. Aerial view of crash scene showing locations of witnesses to accident: 1. crane operator; 2. two people in scale house, 3. truckdriver affixing tarp to his load; and

1. motorist behind accident truck.

Factual Information 6 Railroad Accident Report Emergency Response At 9:48 p.m., the Kankakee County Sheriff’s Police 911 communications desk received the initial request for emergency assistance via telephone from the Birmingham Steel security office.5 Shortly thereafter, a second call came from the Birmingham Steel Company; this was followed by a number of additional calls from various sources. While the initial call was in progress, the 911 communications dispatch center dispatched units of the Bourbonnais Fire Protection District to the accident scene and requested an ambulance response. About 9:51 p.m., an officer of the Bourbonnais Police Department, who had overheard the initial radio notification while on routine patrol, arrived at the accident scene via the unpaved roadway to the west of the tracks. At about the same time, a Bradley Police Department officer arrived on the east side of the tracks. The Bourbonnais police officer reported that a locomotive was on fire and that a number of Amtrak passenger cars had derailed. He observed that the fire was growing, and that it was working its way toward the rear of the locomotive, where a sleeper car (No. 32035) had come to rest. He radioed for additional emergency response support, and he and the Bradley police officer began helping to evacuate the passenger cars. Within a short time, more police units responded, and officers began evacuating passengers wherever they could. According to the Kankakee County Sheriff’s Department, the Kankakee County disaster plan was put into effect about the time the first responding police unit arrived on the scene. The Bourbonnais Police Department established an initial staging area on the unpaved roadway on the west side of the tracks, in the area adjacent to the wreckage pileup. The evacuated passengers and traincrew assembled in this area, where responding ambulances later arrived. The chief of the Bourbonnais Fire Protection District received the call to dispatch while on scene at a previous response call. While en route to the accident scene, he overheard radio transmissions from responders already at the scene. As incident commander, he radioed a “box alarm” to summon emergency equipment and personnel. He arrived at the accident scene at about 9:52 p.m. Upon arrival, he conducted an initial assessment of the situation and identified the locomotive fire and the necessity for passenger evacuation. About 10:05 p.m., he placed a radio call for additional mutual aid emergency response support. The chief then established a fire department field command post at the initial staging area.6 In interviews with the Safety Board, emergency responders indicated that the immediate focus of the response was the extrication of the trapped and injured passengers and traincrew. Relatively early during the response, emergency responders telephoned Amtrak’s National Operations Center in Wilmington, Delaware, to learn how many 5 Information on emergency response is based on official transcripts from Kankakee County Sheriff Radio and Fire Band transmissions, interviews by Safety Board investigators, and documentation submitted. 6 Although there is no record of a radio transmission to this effect, incident command participants reported to the Safety Board that the establishment of the command post was understood.

Factual Information 7 Railroad Accident Report passengers rescuers could expect to find. At this time, Amtrak responded that the train could be carrying as many as 400 passengers. When Amtrak management arrived on scene however, they determined from the contents of the conductor’s ticket pouch that the passenger count was 196; this passenger tally was not considered firm on the following morning. Several days after the accident, Amtrak and local authorities determined that the passenger count was 198. Another several days passed before Amtrak could produce a complete list of passenger names. Subsequent research has shown the correct passenger count to be 207. About 9:53 p.m., the first ambulances arrived at the scene. About 9:59 p.m., Bourbonnais Fire Protection District Squad 62 arrived at the scene. The squad 62 truck had a water capacity of 500 gallons dispersed through 1 3/4-inch hose lines. The truck was also equipped with 5-gallon fire suppression foam containers.7 Firefighters then began hand-line water and foam application on the burning locomotive, but they were unable to put out the fire before exhausting their water supply. About 10:00 p.m., Bourbonnais Fire Protection District Engine 61, a pumper truck carrying about 2,000 feet of 5-inch hose line, arrived at a water hydrant about 2,600 feet from the site of the fire. Firefighters laid out the full length of the hose on their truck, then went to the accident scene. A second pumper truck connected the additional hose line needed to reach the fire scene. When the first Bourbonnais Fire Protection District personnel arrived at the accident scene, they saw that some 30 to 35 employees of Birmingham Steel had responded to the scene and had begun the rescue effort. These steel plant employees had cut a hole in the chain-link fence separating the wreckage site from the steel plant’s property and had brought a number of hand-held fire extinguishers and ladders from the plant to combat the flames. While some of the steel plant employees applied the fire extinguishers to the flames, others entered some of the damaged passenger cars to extricate entrapped passengers. These efforts were continued for about 45 minutes, when the steel plant employees were relieved by Bourbonnais Fire Protection District personnel, who continued the extrication efforts. Because the derailed train cars blocked McKnight Road at the grade crossing, three separate staging areas were established. The first, as noted above, was on the unpaved road to the west of the tracks, near the wreckage pileup. About 10:13 p.m., a second fire department field command post was established at the southeast corner of the intersection of McKnight Road and Route 50 at a vacant lumber yard. This was referred to as the “east staging area.” A police department field command post was established shortly thereafter at the northeast corner of the same intersection. About 10:22 p.m., incident command issued a radio request to responding agencies seeking fire suppression foam. Several units responded, but each carried a small number of 5-gallon containers of foam and eductor systems designed to mix the foam with water for application to a fire. 7 Refers to 5-gallon containers of aqueous film-forming foam or similar foam concentrate.

Factual Information 8 Railroad Accident Report About 10:24 p.m., the 5-inch hose supply line that was laid along the unpaved road was fully charged and supplying water at the west side of the site. Fire suppression on the burning locomotive recommenced shortly thereafter. Upon evacuation, displaced passengers and traincrew were taken to one of two triage areas initially established at the scene. Because the temperature that night was estimated to be in the low 20s, however, the incident commander became concerned about the threat of hypothermia, since most of the evacuees lacked warm clothing. A local retail store offered its facility as a temporary shelter, and starting about 10:28 p.m., responders used this facility both as a shelter and as a triage site for several persons who were later found to have sustained injuries. About 10:30 p.m., incident command requested that a medical trauma team consisting of physicians and medical equipment from local hospitals respond to the scene. About this time, police officers were extricating passengers through the emergency exit windows of an overturned coach car (No. 34089) that lay on the eastern side of the pileup. A Manteno Fire Department pumper truck depleted its water tank by supplying a stream of water to the top of this car in an effort to cool it. About 10:34 p.m., Manteno firefighters made a radio request to incident command that water be applied to the “top of the train” because they were out of water. Incident command, on the western side of the pileup, mistakenly understood the request to originate from personnel inside sleeper car 32035 (the car that was wrapped around the locomotive), and the Bourbonnais Fire Protection District chief responded with a master stream water application8 onto the west end of that car. Continuing attempts were made to set up a hydrant flow to resupply the Manteno fire trucks on the east side of the scene. About 10:38 p.m., the Braidwood Fire Department heavy rescue truck arrived at the east side staging area. It was directed to proceed to the west side staging area. About 10:39 p.m., the trauma team arrived, and they were directed by incident command to the west side staging area. A responding Braidwood Fire Department officer, who was also the emergency response administrator of a petrochemical operation in Elwood, Illinois, said that shortly after he arrived on scene about 10:40 p.m., he recognized that the fire suppression foam at the scene was almost exhausted. He said he also realized that the fire suppression effort had not been effective in extinguishing the locomotive fire. The fire, as he observed it, was “3-dimensional” and petroleum-based, and it remained entrenched within the upper confines of the locomotive carbody wreckage, which made suppression access particularly difficult. He stated that he believed the strategy being used up to that point was having only limited success, because the fire would be extinguished in one location, only to re- ignite in an adjacent location and flash back to the original location. Further, the fire was directly impinging upon and passing beneath the still-occupied sleeper car 32035. 8 A master stream is an application of a large volume of water (about 350 to 1,000 gallons per minute), typically using a vehicle-mounted “deck gun monitor” nozzle.

Factual Information 9 Railroad Accident Report From this, the Braidwood officer concluded that the application of a large volume of fire suppression foam might be an effective attack strategy and that, therefore, a heavy foam tanker truck from the nearest available facility should be used. The Braidwood officer discussed with the incident commander the possibility of organizing a mutual aid heavy foam tanker truck response to the scene. The incident commander concurred with this proposed strategy, and the Braidwood officer immediately placed a cellular telephone call asking that a heavy foam tanker truck and personnel from the Stepan Chemical Company near Joliet, Illinois, be dispatched to the accident site. The officer arranged for a similar request to be made to a Mobil Oil refinery. Both facilities are about 35 miles away from the accident scene, and the officer anticipated that the trucks might require about 45 minutes to arrive. About 10:44 p.m., a radio transmission went out requesting that the Chicago combined agency response team (CART) immediately respond to the east side of the pileup because, according to the transcript, two people were trapped inside a rail car and fire was impinging. The CART is a tactical rescue squad composed of fire and rescue departments across the suburban Chicago area. About 10:47 p.m., the Braidwood Fire Department heavy rescue truck arrived at the west side staging area. It was then used as a fire suppression field command post. About 10:55 p.m., incident command issued a request to all responding agencies for all available water tanker truck support. About 11:19 p.m., incident command radioed that the main body of the fire on the east side of the scene appeared to have been “knocked down,” which suggested that the fire was somewhat in control, although not extinguished, in that area. About 11:30 p.m., a heavy foam tanker truck from Stepan Chemical Company arrived and was directed to the west side staging area. About 11:45 p.m., the foam tanker truck reached the west side staging area and set up near the wreckage pileup. The Braidwood Fire Department officer who organized the Stepan response directed that water supply connections be made to one of the pumper trucks stationed at that location and that fire suppression by hand-line commence immediately. Fire suppression water/foam solution was applied to the main body of the fire in the proximity of the locomotive and the sleeper car until the fire was extinguished; the fire was out within a few minutes. Water/foam solution application continued periodically thereafter, because firefighters were concerned that hot metal in the wreckage might re-ignite the fire. About 12:05 a.m. on March 16, an emergency shelter established at a nearby school building began to receive the uninjured displaced passengers who were transferred from the temporary shelter established earlier at the retail store. This shelter, staffed by the American Red Cross and by the Bourbonnais Police Department, remained open until 2:30 a.m.

Factual Information 10 Railroad Accident Report Several minor rekindle events occurred in the wreckage at times throughout the night; the fires were quickly extinguished by firefighting crews that remained on the scene. The fire was completely extinguished by dawn on March 16. About 6:30 a.m. on March 16, a temporary morgue was established at the vacant lumber yard located at the intersection of McKnight Road and Route 50. About 11:00 p.m. on March 19, the Bourbonnais Fire Protection District incident command post that had opened at the onset of the event was closed. Injuries Train 59 carried 207 passengers, 17 on-duty Amtrak crewmembers, and 4 off-duty Amtrak and IC railroad employees. According to hospital records, 121 of these passengers and railroad employees, as a result of this accident, were transported to local hospitals for medical treatment. Thirty-five of the transported patients were examined and released without receiving documented medical treatment. One train crewmember was airlifted from Provena St. Mary’s Hospital to the Loyola University Medical Center in Chicago. In addition, the driver of the truck involved in the accident, a responding firefighter, and a responding sheriff’s deputy reportedly sustained minor injuries; they were treated and released at a local hospital. Eleven train passengers, all of whom were located in sleeper car 32035, sustained fatal injuries. (See table 1.) The Safety Board was unable to definitively establish how many individuals were in the sleeping car at the time of the collision, nor could it determine the precise whereabouts of those who were in the car. The degree of injury sustained by the car’s Table 1. Injuries Type Amtrak Crewmembersa Amtrak Passengers Other Total Fatal 0 11 0 11 Serious 5 29 0 34 Minor 4 51 0 55 None 12 116 0 128 Total 21 207 0 228 49 CFR 830.2 defines fatal injury as “any injury which results in death within 30 days of the accident” and serious injury as “an injury which: (1) requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; (2) results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages, nerve, or tendon damage; (4) involves any internal organ; or (5) involves second- or third-degree burns, or any burn affecting more than 5 percent of the body surface.” aIncluded in these totals are two off-duty Amtrak employees and two off-duty IC Railroad employees.

Factual Information 11 Railroad Accident Report occupants ranged from minimal or none, up to fatal. The fatally injured occupants were in the portions of the car at the vertex of the car’s bend, where the crush and intrusion were at a maximum. This portion of the car was also later consumed by fire. Rescuers reported that they were unable to immediately extricate some of the individuals they believed to be entrapped within the wreckage; the Kankakee County coroner tentatively attributed injuries of 5 of the 11 fatally injured occupants to the effects of the fire. The coroner was unable to determine whether any of these 5 might have succumbed to their traumatic injuries had they not been exposed to the fire. The Safety Board disseminated a questionnaire to the accident survivors, but relatively few forms were returned; for this reason, it is not possible to determine which car any individual was occupying at the time of the accident. Five cars on the train were deadheading (not in service). These cars, in addition to the second locomotive and the baggage car, were reportedly unoccupied at the time of the collision.9 The occupants of the other passenger cars in the consist sustained injury severities ranging from no injury to critical injuries. Personnel Information Truckdriver The accident-involved truckdriver, aged 58, had been driving commercial vehicles since about 1960. He had been traversing this crossing 5 days per week for about 7 years at the time of the accident. The truckdriver had worked for Melco Transfer, Inc., as an owner-operator since 1990. According to the accident truckdriver’s motor vehicle record as certified by the Illinois Secretary of State, the accident driver was cited and had convictions entered for the following speeding violations before the accident: 9 Because of the order of the cars in the consist, passengers in car 13, in order to reach the lounge car or the dining car, would have had to pass through two of the deadheading cars. Date Reason State License cited February 9, 1992 70/60 mph zone Illinois CDL June 12, 1996 70/60 mph zone Illinois CDL August 20, 1997 70/60 mph zone Indiana CDL June 18, 1998 75/60 mph zone Indiana CDL February 9, 1998 1-10 mph over Indiana CDL

Factual Information 12 Railroad Accident Report The accident driver’s CDL was suspended for failure to pay the fine associated with the June 18, 1998, speeding citation, but it was reinstated on September 29, 1998. Illinois has a uniform citation form that indicates whether a violator holds a CDL and whether the violator was operating a commercial vehicle. This information is entered in the driver’s motor vehicle record. Illinois also enters violation information from other States. Because of this information interchange, the State of Illinois noted that the truckdriver had received three citations within 1 year in Indiana. On this basis, in the fall of 1998, the State of Illinois informed the truckdriver that his CDL would be suspended after 90 days, effective January 25, 1999. When the truckdriver was notified that his CDL was subject to suspension, he enrolled in the National Safety Council’s driver improvement program. Following the truckdriver’s successful completion of this course in January 1999, the State of Illinois issued the accident driver a probationary license for a period of 60 days beginning on January 25, 1999, and ending on March 25, 1999.10 In May 1999, following the accident, the truckdriver’s license was again suspended for 60 days, because he was convicted of two serious traffic violations during a 3-year period (two of the four speeding violations). The driver’s CDL was reinstated on August 1, 1999. In November 1999, the same truckdriver was cited for a moving violation and received court supervision. He was not convicted, and his license was not suspended. The citations instigating the initial license suspension were related to speeding, and not to grade crossings. However, in 1999, the U.S. DOT’s Federal Highway Administration added a regulation creating a new category of offenses for which a CDL holder may be disqualified from operating a commercial motor vehicle. The rule specifically covers convictions for six types of offenses, including failure to obey traffic control devices at grade crossings. Under the rule, conviction for one of six specific violations at a grade crossing results in an automatic CDL suspension of not less than 60 days. Upon the second conviction within a 3-year period (for a separate incident), the driver must be disqualified for 120 days. Following a third and subsequent violation within a 3-year period, a driver must be disqualified for not less than 1 year. The accident truckdriver was not charged with a grade crossing violation as a result of this accident. Following the accident, however, the Federal Office of Motor Carrier Safety11 conducted a compliance review of Melco Transfer, Inc., that resulted in fines for both the motor carrier and for the accident truckdriver. The Federal Motor Carrier Safety Administration has elected not to pursue the case further, but instead has turned the case over to the DOT’s Office of the Inspector General, who is conducting a criminal investigation into circumstances surrounding this accident. In October 2001, the accident-involved truckdriver was indicted by a Kankakee County grand jury on two counts. One count of the indictment alleges that he falsified his logbook. The second alleges that he violated the hours of service regulations. Both are felony charges. 10 Under the Motor Carrier Safety Improvement Act of 1999, effective January 23, 2000, States are now prohibited from awarding a probationary license to a CDL holder while he or she has been disqualified from operating a commercial motor vehicle. 11 On January 1, 2000, the Office of Motor Carrier Safety was redesignated the Federal Motor Carrier Safety Administration.

Factual Information 13 Railroad Accident Report The truckdriver possessed a valid medical examiner’s certificate at the time of the accident. The certificate indicated that the driver was qualified for his duties only when wearing corrective lenses. The driver stated that he wears glasses for reading and while driving, although his driver’s license has no vision restrictions. He stated that he wears the glasses when he drives because they are light-sensitive lenses. He was wearing the glasses, which corrected his vision to R=20/20 and L=20/30, at the time of the accident. He reported that his hearing is normal. The truckdriver characterized himself as a social drinker. He said he had never been treated for alcohol or other substance abuse, and he said he had never used any illicit drugs. Shortly after the accident, Safety Board investigators compiled the activities of the truckdriver for the 72-hour period before the accident using the truckdriver’s statements, his logbook, and materials from the Illinois State Police investigation. A preliminary compilation indicated that the truckdriver had been driving for about 10 hours and had been on duty for another 2 hours in the 24-hour period before the accident. However, during the accident investigation, investigators discovered a fuel receipt that contradicted the driver’s account of his whereabouts on the day before the accident. When confronted with the evidence by investigators, the truckdriver submitted a revised statement. Based on the driver’s revised statement, the driver’s logs, fuel receipts, mileage/speed estimates, and interviews with shippers and receivers involved in the truckdriver’s deliveries on the day of the accident, the Safety Board compiled the following list of activities for the truckdriver for the 72-hour period before the accident: (The times listed are approximate.) Friday, March 12, 1999 8:00 p.m.: Arrived at home near Peotone, Illinois, after loading his truck with steel at Birmingham Steel in Bourbonnais. The driver parked his truck at Melco Transfer, about 2 miles from his home. On his way home, he stopped at a tavern in Manteno, Illinois, where he ate dinner and had several beers. 10:00 p.m.: Went to bed after falling asleep while watching television. Saturday, March 13, 1999 7:00 a.m.: Awoke, ran errands during the day, and stayed at home. Slept during the night at home. Sunday, March 14, 1999 7:00 a.m.: Awoke, and stayed at home throughout the day attending to personal matters. 9:30 p.m.: Went to bed. Monday, March 15, 1999 12:00 a.m.: Awoke and got ready for work.

Factual Information 14 Railroad Accident Report 2:00 a.m.: Arrived at Melco Transfer in Peotone, Illinois, checked truck and departed for Dayton, Ohio. 3:20 a.m.: Stopped in Rensselaer, Indiana, (62 miles, see figure 4) for fuel and a coffee break. 3:45 a.m.: Departed Rensselaer. 7:30 a.m.: Arrived at Dayton, Ohio, (210 miles) where rebar was off-loaded by others. (The driver reported that he rested in the sleeper of his truck while the off-loading was taking place.) 8:45 a.m.: Departed Dayton en route to Canal Winchester, Ohio, to pick up a load of lift-trucks and various accessories. 10:25 a.m.: Arrived in Canal Winchester, (87 miles) where his truck was loaded. (The driver reported that he rested in the sleeper berth during loading, but the shipper indicated that drivers usually participate in the loading of their trucks.) 11:00 a.m.: Departed Canal Winchester en route to Country Supply in Peotone, Illinois. 1:10 p.m.: Stopped in Eaton, Ohio, (112 miles) for food and fuel. 2:30 p.m.: Departed Eaton. 7:00 p.m.: Arrived at Country Supply (251 miles) and assisted with off-loading. 8:00 p.m.: Departed Country Supply and went home, about 2 miles from Country Supply. (The driver stated that he slept at home.) 8:30 p.m.: Departed home en route to Birmingham Steel. 8:45 p.m.: Arrived in Bourbonnais (10 miles). Went off duty for about 45 minutes while his truck was being loaded with rebar. 9:30 p.m.: Secured the cargo on his trailer. 9:45 p.m.: Departed the steel mill, just before the accident. Train Operator Title 49 Code of Federal Regulations (CFR) 217.11 stipulates that each railroad must periodically test and train its employees on the company’s operating rules. Title 49 CFR 240 requires that locomotive engineers be certified every 3 years.

Factual Information 15 Railroad Accident Report In testimony at the Safety Board’s public hearing, the train engineer, aged 52, stated that he had worked as a railroad engineer for almost 25 years before this accident. Records indicate that he was hired by Amtrak on March 18, 1987. According to his testimony, the engineer had operated over the territory in which the accident occurred for 12 years before the accident date, and records showed that his original qualification date over that territory was December 2, 1988. Amtrak terminated the engineer’s employment on July 18, 1989, for passing a stop signal. He was reinstated on August 10, 1989. He was again terminated on March 26, 1990, for incurring three rules violations.12 Amtrak subsequently rehired the engineer on October 1, 1990. Records showed that the engineer was recertified in 1990, 1994, and 1996. His most recent engineer evaluation before the accident occurred on August 1, 1998. The engineer’s most recent medical examination before the accident was on October 13, 1998. His most recent vision and hearing test before the accident took place on September 23, 1996. No restrictions were placed on the engineer relating to his hearing or vision. The Safety Board was not able to obtain from the train engineer a description of his activities, including a detailed work/rest history for the 72 hours before the accident. The engineer was hospitalized with injuries sustained during the collision and could not recall his activities beyond the fact that he slept much of the day on March 15, 1999, and that he went on duty that evening at 7:15 p.m. He also stated that he had been off duty Figure 4. Truckdriver’s route on Monday, March 15, 1999 12 The violations involved derailing cars, failure to observe and obey speed limit, and violations of operating rules and instructions.

Factual Information 16 Railroad Accident Report Saturday and Sunday, March 13 and 14. He was unable to provide specific information about the duration of his sleep periods over those 2 days. He did state that he felt rested when he reported for duty on the evening of the accident. Records indicate that he was in compliance with Federal hours-of-service regulations. No adverse driver’s license information was developed about the engineer during a search of the national driver’s register. The engineer said that he was not overtasked/overworked on the evening of and before the accident, nor was he distracted or preoccupied before the accident. Train Information Amtrak train 59 consisted of 2 locomotive units, a baggage car, and 13 passenger cars of various types. The Safety Board examined the derailed locomotives in order to determine the extent to which the locomotive’s design provided for the survival of the traincrew members. Both locomotive units were GE model P-40 Genesis locomotives and were operating in the cab-forward position. This model locomotive is equipped with two collision posts immediately behind the front fascia panel. The impact with the truck occurred at the front of the lead locomotive, the only locomotive occupied by traincrew (the lone engineer). The front fascia panel of this locomotive sustained about 12 inches of intrusion. Despite this impact damage, however, the collision posts remained intact. Following the collision, the lead locomotive unit separated from the second, continued along the right-of-way for about 560 feet, and came to rest almost fully on its right side. The baggage car came to rest partially on top of the lead locomotive, crushing the aft end of the locomotive carbody and frame. Directly behind the two locomotives followed a baggage car, a crew dormitory (transition sleeper) car, and sleeping car 32035. The accident’s 11 fatalities were sustained in car 32035. As a result of the derailment and subsequent pileup, the sleeping car came to rest bent and wrapped around the aft end of the second locomotive unit. The carbody, bent an estimated 56 degrees, sustained substantial crush damage and a large breach area where it made contact with the second locomotive. In addition, the aft end of the car experienced a longitudinal twist of about 50 degrees. The left front sidewall was displaced and crushed inward about 6 feet through impact with the forward end of coach 34089, a following car. A length of running rail also longitudinally penetrated the lower level of the carbody, piercing several of the sleeping compartments. In addition to the crush and deformation damage caused by the derailment, a fire, ignited in fuel that spilled from the second locomotive and that migrated underneath the sleeping car, impinged on this car, which then itself ignited. An inspection of the interior of the sleeping car revealed that most of the partitions, fittings, and fixtures in the forward two-thirds of the car were catastrophically crushed and consumed by fire; the material in the aft one-third showed evidence of smoke damage.

Factual Information 17 Railroad Accident Report The Federal Railroad Administration (FRA) requires locomotives to receive a daily inspection. The locomotives of train 59 received this inspection in Minneapolis/St. Paul at 7:00 a.m. on March 15. The locomotive units, fueled and serviced in Minneapolis, were scheduled to be refueled at Memphis, Tennessee. An initial terminal air brake test and an equipment inspection, as required by 49 CFR 232.12, were performed on train 59 by Amtrak mechanical personnel (carmen, machinists, and electricians) at Chicago Union Station at 6:50 p.m. on March 15. No defects were noted. While train 59 was operating over IC track, its movements were governed by Illinois Central Railroad System, Operating RulesSecond Edition, effective November 1,

1. The accident occurred on the Chicago District, which was a single main track

controlled by a train dispatcher at Homewood, Illinois, according to a traffic control system.13 The trains were authorized by signal indication through a centralized traffic control (CTC) system, whereby train movements over routes and through blocks is directed by signals controlled from a single point.14 Motor Carrier Information The truckdriver was an owner-operator and owned the accident truck tractor, while Melco owned the trailer. The accident load was being transported under Melco authority. Melco is an authorized for-hire interstate carrier that was established in 1986. At the time of the accident, the carrier operated 41 trucks and owned or leased 55 trailers, primarily hauling steel throughout the Midwest. According to the company, about 95 percent of Melco drivers were owner-operators. Melco vehicles accumulated a total of 2,926,355 miles in the 12 months ending February 28, 1999. After the accident, on March 17, 1999, the Federal OMC conducted a compliance review of Melco. The five evaluation areas and the final ratings were as follows: • General (49 CFR Parts 387, 390): RatingSatisfactory • Driver Qualification (49 CFR Parts 382, 383, 391): RatingSatisfactory • Operational Driving (49 CFR Parts 392, 395): RatingUnsatisfactory • Vehicle Maintenance (49 CFR Parts 393, 396): RatingConditional • Accidents (1.367 per million miles): RatingSatisfactory 13 According to 49 CFR Part 236, a traffic control system is a block signal system under which train movements are authorized by block signals whose indications supersede the superiority of trains for both opposing and following movements on the same track. 14 Association of American Railroads. 1991. Recommended definitions for technical terms used in railway signaling. Washington DC.

Factual Information 18 Railroad Accident Report Title 49 CFR Part 395 requires motor carriers to maintain drivers’ log records for a period of 6 months. The OMC compliance review determined that the company had not kept accurate records of duty status15 for about one-half of the drivers reviewed.16 As noted above, this category was rated “Unsatisfactory.” The OMC review of the carrier’s maintenance records revealed that the carrier had failed to maintain records of repairs and maintenance. The OMC noted that the carrier also lacked a means to indicate the nature and due dates of these repairs and maintenance. Melco Transfer, Inc., was given a “Conditional” rating and fined $4,050 as a result of the review. The driver was also fined $2,000 for falsifying his records of duty status. The OMC conducted a return review in August 1999; this review indicated that Melco had corrected the majority of the violations for which it had been cited. As a result, the motor carrier’s rating was upgraded from “Conditional” to “Satisfactory.” Previous OMC reviews of Melco were as follows: • August 26, 1987, Safety Review: No Rating; • July 31, 1989, Compliance Review: RatingSatisfactory; • August 5, 1995, Compliance Review: RatingSatisfactory. On the day of the accident, the truckdriver delivered a load of steel from Birmingham Steel in Bourbonnais, Illinois, to Dayton, Ohio. The driver then transported a “back-haul” of lift trucks from Princeton Products in Canal Winchester, Ohio, to Country Supply in Peotone, Illinois. The driver had begun his third trip of the day, with a load of steel, when the accident occurred. During the investigation, Melco officials indicated that the company had contracted for the two loads of steel and had assigned those loads to the truckdriver; however, these officials stated that they were unaware of the back-haul load. Further investigation revealed that Country Supplythe recipient of the back-haul of lift trucksand Melco had a routine business relationship and that Melco owned Country Supply until 1997. The two businesses were located in the same industrial complex. Driver and billing records showed that Melco drivers, including the accident driver, frequently transported loads between Princeton Products and Country Supply, and Country Supply was billed by Melco for transportation services associated with these deliveries. According to the records, these shipments were always arranged by Country Supply. According to Country Supply representatives, the company never received a bill for the back-haul load on the day of the accident. 15 Title 49 CFR Part 395(e) Failure to complete the record of duty activities of this section or 395.15, failure to preserve a record of such duty activities, or making of false reports in connection with such duty activities shall make the driver and/or the carrier liable to prosecution. 16 Since no verifiable records were available for checking the accident truckdriver’s records of duty status, scale tickets were acquired from Birmingham Steel Corporation near the accident site. About 80 percent of the freight transported by this truckdriver came out of this plant destined for Dayton, Ohio.

Factual Information 19 Railroad Accident Report Investigators attempted to determine how the companies for whom the truckdriver delivered loads on the day of the accident scheduled their loads for movement. Birmingham Steel indicated that it would not load or off-load trucks between 11 p.m. and 7 a.m., but otherwise the company did not prescribe specific pick-up or deliver schedules. Likewise, neither Country Supply nor Princeton Products, the companies involved in the back-haul load, prescribed specific schedules. A review of Melco records showed that loads involving the carrier were assigned and scheduled in a variety of ways. Melco specifically scheduled some loads, others were generally scheduled (to be accomplished during some time period), and still other loads were assigned to drivers but were self- scheduled by the drivers themselves. Some drivers called in for loads, and others picked up loads on their own and then notified the company. The Safety Board was unable to ascertain who determined the schedule for the back-haul load on the day of the accident. Truck Information The accident truck consisted of a truck tractor and semitrailer. The truck tractor was a 1994 Navistar 9400, which is a conventional cab with a sleeper berth. The semitrailer was a 1991 Reitnouer 48-foot aluminum spread-axle flatbed. The semitrailer was loaded with six bundles of rebar, with each bundle containing 88 bars. The bundles were loaded three-over-three across the center of the bed, with 4 x 4 timbers placed laterally underneath and between the two layers. The 60-foot lengths of rebar extended 5 feet beyond the front and 7 feet beyond the rear of the 48-foot trailer bed. The load was secured with six nylon straps spaced 8 to 10 feet apart. The 46,000 lbs. of rebar, added to the truck semitrailer unit empty weight of 28,880 lbs., brought the gross vehicle weight to 74,880 lbs. The estimated payload weight over the axles of the truck tractor (21,500 lbs.) and the semitrailer (24,500 lbs.) was within the rated capacity of the unit (80,000 lbs.). The overall length of the vehicle, with the load extending over the rear of the semitrailer, was estimated at 77 feet. Track and Signal Information Track Information Two parallel IC tracks, oriented geographically in a northerly to southerly direction, intersected McKnight Road at the grade crossing where the accident occurred. The westernmost track was the main track, and the easternmost track was a passing siding. At the point of collision, the distance between the two tracks, centerline to centerline, was 14 feet. A scheduled total of 4 Amtrak passenger trains, 4 Norfolk Southern Railroad freight trains, and 16 IC freight trains operated over the crossing each day. In addition, a local switch engine makes several moves daily in the vicinity of the crossing.

Factual Information 20 Railroad Accident Report The IC railroad owned, operated, inspected, and maintained the tracks and track structure. The main track met FRA standards for class 5 track, allowing a maximum operating speed of 79 mph for passenger trains, 70 mph for intermodal17 trains, and 60 mph for freight trains. The siding track was designated class 2, allowing a maximum operating speed for all trains of 20 mph. To the north and south of the McKnight Road crossing were additional siding tracks that paralleled the IC tracks on the west side of the main track. To the north of the crossing were two siding tracks owned by Lambert Grain Company. To the south were two tracks owned by Birmingham Steel. The freight cars involved in this accident were standing about 464 feet south of the centerline of McKnight Road on Birmingham No. 1 track, which was the nearest of the two siding tracks to the IC main track. Train engineers are required to sound the train horn in a standard blast sequence upon the approach to a grade crossing. To notify the engineers when they should begin the horn blast sequence, the railroad installs signs on the railroad wayside, known as whistle posts. In the case of the McKnight Road crossing, for a southbound train movement, the whistle post is located about 4,000 feet north of the crossing and about 1,400 feet north of the St. George Road crossing. The whistle post is described as a multiple crossing whistle post and bears a sign with the letter “W” above the number “3.” The sign instructed the traincrew to sound the train horn for the next three crossing: St. George Road, McKnight Road, and Larry Powers Road. Signals Railroad Traffic Control Signals. Train traffic in the accident area was governed by color light signals controlled by electronic coded track circuits. A hot box/dragging equipment detector18 equipped with an event recording device was located about 5 1/2 miles to the north of the accident crossing. A computer-aided train dispatcher’s log located in Homewood, Illinois, recorded the movement of trains in the accident area. Grade Crossing Signal System. The McKnight Road crossing was an active grade crossing protected by bells, flashing lights, and gate arms. The crossing predictor (the activation control mechanism for the crossing signal and gate system) was a Safetran Model GCP-3000, which had been installed on January 23, 1992, to replace an older system. The GCP-3000 is a micro-processor controlled system that detects the speed and location of an approaching train and uses time and distance calculations to predict the train’s arrival time at the crossing. The system then activates the crossing signal devices to provide a preset amount of warning time before the arrival of the train at the crossing. The system is designed to provide a relatively constant warning time at the crossing, regardless of the speed of the approaching train.19 17 Intermodal trains include flat cars carrying truck trailers or shipping containers and are referred to as trailer-on-flat-car (TOFC)/container-on-flat-car (COFC) trains. 18 A hot box detector determines whether any journal bearings are overheating. A dragging equipment detector determines whether any equipment, such as brake rigging or mechanical connections, is dragging or whether any debris that can damage the track connections, ties, or switches has become lodged under the train. 19 The time-and-distance calculations assume a constant-speed train. If the train should slow or accelerate appreciably after detection by the GCP system, warning time at the crossing would vary slightly.

Factual Information 21 Railroad Accident Report The number of seconds of warning time provided by the GCP-3000 can be set via a keyboard/display assembly located in the signals bungalow near the crossing. Maximum warning time is a function of the length of the track circuit and the maximum speed of trains using the circuit. In this case, the speed of the train was assumed to be the maximum authorized speed of 79 mph, and the programmed circuit warning time was 30 seconds; this was the setting for the GCP-3000 at the McKnight Road crossing. Because the system requires up to 4 seconds to determine the speed of the train and make its calculation, a 30- second setting will actually activate the warning lights about 26 seconds before the train arrives at the crossing. The McKnight Road signal system event recorder indicated that the system delivered 26 seconds of warning time. A data recorder module was installed in the GCP-3000 at McKnight Road. Safetran’s Data Recorder Module 80015 allows information pertaining to train movement events and system status messages to be stored in memory. The module maintains a date- and time-stamped record of train warning times, speed of the train when prediction occurred, average train speed (speed of train averaged over entire time train is sensed), and island speed (speed of train when entering the crossing). Additionally, any errors normally detected by the GCP, either internally or in the track circuit, are also recorded. The data recorder module 80015 recorded the information shown in table 2 at the time of the collision. The module memory can hold data on about 3,000 events; when memory is full, the oldest data is overwritten by the new data. The signal system was also equipped with a data recorder interface assembly, 80025, which monitors and records changes of the input state on 16 channels external to the GCP-3000. All 16 inputs on the 80025 assembly are electrically isolated from each other allowing direction to vital circuits. Input changes must typically consist of voltage level changes similar to those produced by relay contact closures. The crossing underwent an annual inspection on February 3, 1999, during which some buried wires were determined to no longer meet requirements. These wires were replaced with other wires that were present in the same bundle of wires. Following the accident, the Safety Board, in cooperation with the IC railroad, tested the wires in place at the time of the accident; the wires were within specifications at the time of testing. The last monthly inspection before the accident was on February 24, 1999. No exceptions were noted. Table 2. Data recorded at the time of the collision by the crossing signal system data recorder module. Warning Time 26 seconds Speed at Train Detection 73 mph Speed at Crossing 68 mph Average Speed 71 mph

Factual Information 22 Railroad Accident Report Roadway and Grade Crossing Information Roadway. McKnight Road is a two-lane, 22-foot-wide highway running in an east-west direction. Its easterly terminus is at Illinois 50, a four-lane north-south State arterial with a left-turn center median. At one time, McKnight Road continued in a westerly direction. In the 1970s, it was truncated because of construction of the nearby Interstate 57 and now dead ends about 2,000 feet west of the crossing. Between the western edge of the railroad right-of-way to a point about 800 feet to the west of the crossing, the roadway is owned by the Village of Bourbonnais. Between the eastern edge of the railroad right-of-way and the intersection of McKnight Road and Illinois 50, the Township of Bourbonnais owns the road. The village maintains the entire road by informal agreement with the township. No speed limit is posted on McKnight Road. In Illinois, the speed limit on unposted roads is considered to be 55 mph. The pavement was last resurfaced in 1992 and was in good condition. The shoulders were unpaved gravel shoulders, with grass embankments and drainage ditches on both sides of the traveled way. The northern ditch extended to the crossing, with the drainage continuing underneath the tracks via a 30-inch-diameter corrugated steel culvert. Both the eastbound and westbound approaches to the grade crossing are straight, but each meets the tracks at a slightly different angle. The angle of intersection on the east side is about 80 degrees, while on the west side, the angle of intersection is 82 degrees. McKnight Road has a descending 0.75 percent grade from a point 600 feet west of the crossing to a point 200 feet west of the crossing. From this point to the crossing, the grade raises slightly at an average rate of 0.2 percent. McKnight Road had no street lighting; however, railroad security luminaires at the railroad signal control building in the northwest quadrant of the intersection provided some illumination of the crossing. In addition, lighting from the steel plant parking lot southwest of the crossing provided some illumination of the eastbound highway approach. It also provided some light to the northwest quadrant. Security lighting on two industrial buildings in the northeast quadrant also provided some illumination. Birmingham Steel was the primary traffic generator on McKnight Road. The facility operated three work shifts that generated about 150 automobile roundtrips (300 one-way trips) per day. Trucks bringing steel scrap into and taking steel products out of the facility generated about 400 to 600 one-way trips per day. Incoming and outgoing trucks were typically loaded to near their maximum load limits. Traffic Control Devices. The Manual on Uniform Traffic Control Devices (MUTCD), published by the Federal Highway Administration and adopted as law by the States, requires special pavement markings in each approach lane of all paved approaches to grade crossings where automated signals are present.20 The required markings are an 20 According to the MUTCD, these markings may be omitted at minor crossings or in urban areas if engineering study indicates that other devices installed provide adequate traffic control.

Factual Information 23 Railroad Accident Report “X,” the letters “RR,” a no-passing-zone marking, and certain transverse lines. With the exception of no-passing-zone markings, none of these markings were present on the McKnight Road approach to the accident crossing. The no passing zone on the eastbound approach to the tracks extended 315 feet but was in poor condition. According to Village of Bourbonnais officials, the practice of the village was not to stripe roads of this type and function, and the no-passing-zone markings had not been repainted since the village acquired ownership of the road. The MUTCD also prescribes the use of certain signs on the approaches to and at grade crossings where deployment of such signs is not made impossible by physical conditions. At the McKnight Road crossing, a 36-inch-diameter railroad crossing sign for eastbound traffic was posted 512 feet west of the most westerly rail. An identical sign for westbound traffic was posted 414 feet east of the most easterly rail. Reflectorized crossbucks were mounted on the railroad masts for east- and westbound traffic. The crossing signs and crossbucks were in good condition. According to the MUTCD, an auxiliary sign indicating the number of tracks at a crossing is optional at crossings equipped with automatic gates. Such signs were not present at the accident crossing. A driver or pedestrian approaching the grade crossing would have been warned of an approaching train by bells, flashing red lights, and crossing gate arms. To the driver involved in this accident, the west gate was on the approach side of the crossing, and the east gate was on the departure side. The crossing gate masts were 12 feet from the nearest rail. According to the State of Illinois, a motorist must stop at a grade crossing if the crossing is equipped with a “Stop” sign, if a train is approaching and/or gives a warning, if a flagman indicates a stop is required, or if a train-activated warning device is activated. When approaching a crossing equipped with flashing lights, the driver is required to “always stop until it is safe to proceed.”21 If the flashing lights are accompanied by an automatic gate arm, then the motorist is required to stop and remain stopped until the gate is raised again. Following the collision at McKnight Road, the Canadian National/Illinois Central railroad installed video cameras and recording equipment at McKnight Road and several nearby crossings. Several events at these crossings have since been called to the attention of the Safety Board. In one, occurring in August 2000, a truck queued in traffic at St. George Road, the crossing immediately to the north of McKnight Road, stopped on the tracks. While the truck was stopped on the tracks, a train approached, activating the signals; the gate lowered behind the truck cab. The truckdriver succeeded in backing off the tracks but damaged the signal gate. In other instances at McKnight Road, local police received reports that the signal provided inadequate warning time. Review of the video tapes has shown that only one of these reported incidents was truly a delayed activation, which was caused by a broken bond wire in a switch south of the crossing. In the other instances, review of the tapes shows either warning times in excess of the Federally required minimum time, or truckdrivers entering the crossing in violation of the already activated signals. 21 State of Illinois Secretary of State. 2000. Illinois Rules of the Road.

Factual Information 24 Railroad Accident Report Meteorological Information The National Weather Service in Chicago, Illinois, reported unrestricted visibility at 10 statute miles and no precipitation at the time of the accident. The temperature was reported to be 33° F. The train engineer and other witnesses indicated that visibility was good, other than the darkness of the night. Toxicological Information Truckdriver Postaccident drug and alcohol testing of the truckdriver was directed by the motor carrier in accordance with Federal requirements. The tests were negative for alcohol, cocaine, marijuana, phencyclidine, amphetamines, and opiates. At the request of the Safety Board, the Civil Aeromedical Institute (CAMI) Toxicology and Accident Research Laboratory of the Federal Aviation Administration tested the blood and urine specimens submitted by the truckdriver following the accident. The CAMI tests detected tramadol, a narcotic-like painkiller, both in the urine and at very low levels in the blood. Verapamil, an antihypertensive medication, was detected in the blood and urine, and norverapamil, a metabolite of verapamil, was also detected in the blood and urine. Ephedrine, pseudoephedrine, and phenylpropanolamine, which are primarily used as decongestants but are also found in many nutritional supplements, were detected in the blood and urine, and salicylate (aspirin) was found in the urine and at low levels in the blood. The truckdriver stated that he had taken prescribed medications daily for hypertension and rheumatoid arthritis for a period of 6 years before the accident. He said he also used a painkiller as needed for a pulled leg muscle. Amtrak Crew Federal regulations do not require postaccident toxicological testing22 of train crewmembers involved in highway/rail grade crossing accidents; thus, the crewmembers of train 59 were not tested. The engineer stated that he had not used alcohol or drugs, including over-the-counter and prescription medication, before the accident. Postaccident Inspection Site Inspection Postaccident inspection of the crossing on March 16 revealed a black tire mark about 18 feet long on the rails and on the crossing timbers between the rails of the siding 22 Title 49 CFR 219.201(b).

Factual Information 25 Railroad Accident Report track. (See figure 5.) One end of the tire mark began just west of the west rail north of the centerline of the roadway. It ran over the west rail and continued diagonally between the rails to the edge of the crossing timbers near the east rail and ended on the east rail, about 4 feet from the edge of the timbers. Two additional tire marks were found on the passing siding track rails south of the crossing timbers. The first of these was found on the west rail about 12 feet from the timbers. The second mark was found on the east rail about 18 feet from the timbers. The northerly end of the black tire mark on the timbers of the easterly track indicates the position of the tires when the truck was hit by the train. The only tires showing sideways sliding were those on the left side of the fourth axle. It was therefore concluded that the marks were made from the left tires of the fourth axle. A 10-foot measurement (distance between the fourth and fifth axles) indicated that the fifth axle had to be at the center of the southbound tracks at impact. This was confirmed by noting the damage to the left outside wheel of the fifth axle, which was consistent with the geometry of the locomotive’s front coupler. (See figure 6.) Figure 5. McKnight Road grade crossing showing damage features and tire marks.

Factual Information 26 Railroad Accident Report The tire marks on the rails indicate the path of the rear of the trailer on its way to its point of final rest. The accident reconstruction study (discussed later in this report) used these marks and the tire mark noted above, among with other inputs, to determine the placement and speed of the truck at the time of collision, and its path to its point of final rest. Examination of Gate Arm Mechanism Components The base of the west crossing gate signal mast was cracked. This was the gate that was on the approach side of the crossing from the perspective of the accident truckdriver. The front edge of a flange on the case metal base and a section of the base itself bore a series of indentations. Witness marks on the concrete under the base of the crossing signal mast indicated that the cast-metal gate mast base had been moved about 1 inch to the west and south of its original position. (See figure 7). Figure 6. Left-side fifth axle of semitrailer at point of impact.

Factual Information 27 Railroad Accident Report An area of missing paint, where the outer coat was removed while the base or primer coat was left, was found on the west face of the gate at the tip. The gate counterweight, three of the four large signal lights, and the bell had broken off the signal mast. In addition, the gate arm was fractured but not broken off; the mountings for the three lights on the gate arm were broken; and the tip light and base light remained hanging from the gate arm. (See figure 8.) Safety Board investigators were unable to locate the lens for the gate arm center light. The east crossing gate was broken off, in an inward and downward direction, at a point 19 inches from the tip. As a part of the accident scene cleanup, the IC replaced the damaged west gate arm mechanism. The gate mechanism was discarded and remained in outside storage in Gilman, Illinois, until September 15, 1999, when the Safety Board asked that it be sent to Washington, D.C., for testing. The Safety Board received the mechanism on October 5,

1. Details of the initial testing and examination of the gate arm mechanism are

discussed in further detail in the “Tests and Research” section of this report. Figure 7. Cracked cast metal base of the west-side crossing gate.

Factual Information 28 Railroad Accident Report Sight Distance Sight distance, in this instance, refers to the distances along the highway and along the railroad tracks needed by a motorist to detect the presence of a train in time to stop and avoid a collision. According to the American Association of State Highway and Transportation Officials (AASHTO), which establishes guidelines for the geometric design of roadways, a grade crossing should be designed so that an approaching motorist is able to perceive the train, react to its presence, and stop the highway vehicle before reaching the crossing. Once the necessary distance is determined, a “quadrant sight distance,” or “sight triangle,” can be established. Two sides of this quadrant sight distance, or sight triangle, are formed by imaginary lines drawn from the highway vehicle to the crossing and from the crossing to the train. The third side is formed by a line drawn from the train back to the highway vehicle. The interior of this quadrant or triangle should remain clear of any visual obstructions. For a vehicle stopped at the crossing, the driver must be able to see the train far enough along the tracks to have time to accelerate the vehicle and clear the crossing before the train’s arrival. The quadrant sight distance needed varies according to the speed and stopping distances of the train and the highway vehicle. It is also affected by the angle at which the highway intersects the tracks and the slope of the roadway. Train-activated Figure 8. West (approach) crossing gate.

Factual Information 29 Railroad Accident Report crossing traffic control devices, such as those at the McKnight Road crossing, are often used where permanent visual obstructions exist within the sight distance triangle. At the McKnight Road crossing, investigators noted several sight obstructions within the sight distance triangle. The sight line across the northwest quadrant, where an eastbound motorist would look for a southbound train, was limited in part by a high berm running along the north side of the highway. From the end of the berm to the tracks, a building and trees limited visibility. At the time of the accident, about 20 freight cars were standing on the Lambert Grain Company side track closest to the main track. The freight car closest to McKnight Road was 376.5 feet north of the centerline of the grade crossing. An approaching southbound train could not be seen until it had cleared this point. In an ideally designed crossing, the approaching motorist will have adequate quadrant sight distance, allowing a clear view of approaching trains. Of equal importance, however, is the sight distance available for the motorist to see the upcoming crossing, sometimes known as the approach sight distance. Approach sight distance is the distance measured along the highway between the motor vehicle and the crossing, and it must be long enough to enable an approaching motorist to see the crossing (or its warning devices), react to its presence, and stop the highway vehicle safely before reaching the crossing. Where highway conditions such as curves in the roadway or intruding vegetation limit the approach sight distance, additonal measures, such as additional traffic control devices or brush trimming, may be considered. The Safety Board examined the crossing area to determine whether an eastbound motorist had adequate approach sight distance for the grade crossing on McKnight Road. According to formulae provided by AASHTO, a vehicle traveling about 30 mph along the highway would require about 207 feet to stop safely before encroaching on the crossing. Using an exemplar vehicle, the Safety Board determined the point along McKnight Road at which a truckdriver might first be able to see the crossing or its signals. As mentioned above, the roadway approach was straight. The flashing light signals were visible to the truck occupants at the point where the truck turned onto McKnight Road, a distance of about 650 feet. Wreckage Train. The impact caused both locomotives and 11 of the 14 cars in the consist to derail. The lead locomotive came to rest at a point about 560 feet south of the grade crossing. Adjacent to this was the second locomotive, the baggage car, a transition sleeper car, a sleeping car #32035, diner car #38020, and coach car #34089, which came to rest on its side, all of which were involved in a general pileup of wreckage. (See figure 9.) The remaining cars in the consist either derailed and remained upright or did not derail at all. None was involved in the general pileup of wreckage. These cars did not display any evidence of serious carbody breach, and damage was mostly limited to the carbody end- structures.

Factual Information 30 Railroad Accident Report When the Amtrak train derailed, it struck 2 of 10 freight cars that were on an adjacent siding west of the main track. The northernmost freight car, which was apparently the first to be struck, was a gondola loaded with bars of steel. This car, struck by Amtrak’s second locomotive, was crushed, spilling its contents. The second car struck was a covered hopper car containing about 185,000 pounds of dust that was generated by the steel plant’s electrical arc furnace and that was considered a hazardous waste. Both cars showed evidence of cargo loss. The remaining freight cars on the siding apparently separated from the first two and were propelled southward on the siding, coming to rest about 1,300 feet from their original location. Truck. The train struck the left side of the semitrailer at the last (No. 5) axle, which separated from the trailer and came to rest about 80 feet south and 60 feet east of the point of impact. The truck semitrailer combination came to rest in the eastbound lane of McKnight Road with the front of the tractor about 35 feet from the east crossing gate. The tractor’s left wheels came to rest just on the edge of the pavement. The trailer remained attached to the tractor, but rotated about 100 degrees counterclockwise around the fifth wheel coupling. (Refer to figure 5.) Figure 9. Wreckage diagram (not to scale). Car numbers reflect position in consist. 1 2 4 8 6 11 13 14 15 16 9 10 12 3 ACFX 5 Crew Dormitory Lead Locomotive Not In Revenue Service Sleeping Car Position in Consist Equip. Description Amtrak No. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 807 829 1166 39004 32035 38020 34089 31034 31540 33009 35001 31016 32031 32046 38032 32058 locomotive locomotive* bagage car* transition sleeper sleeping car dining car coach coach coach lounge car coach* coach* sleeping car sleeping car* dining car* sleeping car* *Car unoccupied at the time of the accident Cars from Siding Track IC Second Locomotive 7

Factual Information 31 Railroad Accident Report Safety Board investigators examined the truck tractor and found no indication of surface abrasion or impact. No marks of any kind were observed on the tractor except for an indentation on the outer edge of the driver’s side view mirror; the source for this indentation is unknown. The bed of the semitrailer, beginning at the fifth wheel coupling and continuing to a point just forward of axle No. 4, was intact but had a clockwise longitudinal spiral twist. The section of the bed rearward of axle No. 4 was dislodged and scattered along the railroad bed for about 100 feet; an exception to this was the left frame rail, which was bent 90 degrees to the left and twisted clockwise about 90 degrees. The semitrailer’s load of rebar was scattered along the rail bed for several hundred feet, and many of the bars were bent. The left wheel rim and drum assembly of the semitrailer’s No. 5 axle had heavy impact damage that matched the Amtrak locomotive’s coupler in size and conformation. The hub was destroyed, and the brake shoes and air chamber were dislodged. This was the only wheel assembly on the semitrailer that showed evidence of impact damage. The left side dual tires on axle No. 4 showed surface abrasions in one section of the tread area, with striations perpendicular to the tread. Tests and Research Tractor and Semitrailer The mechanical subsystems on the semitrailer could not be tested. The individual components were tested or examined, however, to determine their condition and to determine compliance with the applicable Federal regulations. No discrepancies in the brake system, the suspension system, or the tires were noted. The truck tractor did not receive any collision damage, and postaccident inspection and testing revealed no discrepancies with the steering, suspension, chassis, powertrain, drivetrain, tires, or brake systems on the tractor. Train Air Brakes The Safety Board tested the train’s air brakes and reviewed equipment maintenance records for the 60 days before the accident. A successful application and release of the train brakes was made with the following cars, 35140, 33009, 35001, 31016, 32031, 32046, 38032, and 32058. Car 31034 was present but required additional work and so was not tested at the time. After repairs were made to car 31034, it was successfully air- brake tested and moved with the rest of the cars. These cars were later joined by car 39004, and the brake system was successfully tested for movement. No defects were found that would have indicated that the equipment was impaired at the time of collision.

Factual Information 32 Railroad Accident Report Grade Crossing Warning System Beginning with their arrival at the accident scene, and at intervals during the following 2 years, Safety Board investigators conducted numerous tests and inspections on the grade crossing signaling system. Results of the testing of relays, lamp and gate control devices, cables, and the signal system event recorder indicated that all components were operating within manufacturers’ specifications. After the accident, the damaged crossing gate arms were replaced with fiberglass gates. The damaged gate mechanism on the west gate was also replaced. The accident crossing was placed back in service at 9:00 p.m. on March 17, 1999. Safety Board investigators observed the crossing and noted the warning times provided as several trains traversed the crossing. The warning times ranged from 30 to 39 seconds. These warning times were longer than those for which the system was programmed because track repairs caused the railroads to issue slow orders, reducing the authorized train speed near the crossing. On March 19, 1999, Safety Board investigators conducted tests on both the west and the east crossing gates to measure the warning times provided by the grade crossing signal system. Investigators measured the elapsed time from initial signal light activation to the beginning of the descent of the gates, elapsed time from the beginning of the descent of the gates until the gates were fully horizontal, and the length of time the gates were down (fully horizontal) before the train arrived at the crossing. The time the gates remained horizontal before the arrival of a train was estimated by assuming that the system would provide 25 seconds as a nominal warning time. For each gate, an average of 4 to 5 seconds elapsed from the time the signal lights were initially activated until the gates began to drop. Another 8 or 9 seconds elapsed before the gates were fully horizontal. The gates were down between 11 and 12 seconds before the train’s arrival. Again, the time until a train’s arrival was estimated using 25 seconds as a nominal warning time. FRA rules require that crossing gates be in the horizontal position at least 5 seconds before the arrival of the train at the crossing. Also on March 19, 1999, the Illinois State Police accident reconstruction team conducted tests on the west crossing gate. In those tests, the average elapsed time between the activation of the lights and the initial descent of the gate was also between 4 and 5 seconds. The team recorded an average elapsed time of between 6 and 7 seconds from the time the gate began to descend until it was fully horizontal.23 Using wooden replacement gate arms, Safety Board investigators, in conjunction with the Illinois State Police, conducted tests to determine the extent of damage the gates might sustain by being lowered onto a standing load of rebar. The accident truck tractor, 23 The police reconstruction team used a standard slightly different from that of the Safety Board team when it measured the time required for the gate to reach the fully horizontal position. While both groups measured from the same starting point (initiation of descent), the police team measured the time to the moment the gate reached the horizontal position, whereas Safety Board investigators waited until the gate had completed a small “bounce” when it reached horizontal.

Factual Information 33 Railroad Accident Report with a semitrailer and cargo similar to those involved in the accident, was positioned so that a lowered gate arm rested on the rebar about 7 feet from the aft end of the rebar bundles. Investigators noted and photographed several marks made on the underside of the gate arm where it struck the rebar, and Illinois State Police took custody of the wooden gate arm. No similar marks were found on the gate arm that was in service at the time of the accident. On April 15, 1999, Safetran, the manufacturer of the GCP-3000, field tested the predictor system under Safety Board observation. On May 21, 1999, the manufacturer, in the presence of a Safety Board investigator, factory tested the GCP-3000. All testing was performed in accordance with Safetran bench and pre-shipping test procedures for a newly manufactured product. The measured values for the accident-involved GCP-3000 system and modules were within the manufacturer’s specifications. On March 19, 1999, investigators conducted tests to determine whether a similar truck could maneuver around lowered gates at the McKnight Road crossing. The driver provided by the State Police was able to drive the truck-tractor semitrailer around the lowered gates at a low speed. Several timing tests conducted at this time showed that, on average, the exemplar vehicle required about 34.6 seconds to drive from the steel plant parking lot to the approximate point of impact; the vehicle averaged 23 mph on these tests. Also on this date, investigators conducted tests to determine how much time was required by the nearby crane operator to perform his task, in order to develop an estimate of the time elapsed between his first noticing the flashing lights and his witnessing the collision. The average time he required to perform his task was from 24 to 26 seconds. Grade Crossing Signal Malfunction History Safety Board investigators examined incident reports filed in 1998 and 1999 for the warning signal system installed at McKnight Road. These reports documented incidents involving both false activation and activation failure. A false activation occurs when the system indicates to a motorist that it is not safe to cross the railroad tracks when, in fact, it is safe to do so. Based on a review of the records, the Safety Board identified reports of four false activations, all of which occurred before March 15, 1999. An activation failure occurs when the signal system fails to warn of the approach of a train at least 20 seconds before the train arrives at the crossing, or when it fails to indicate the presence of a train occupying the crossing. According to FRA records, a total of 596 activation failures were recorded nationwide during 2000. For each of these activation failures, a cause was discovered. According to the FRA’s Grade Crossing Inventory System database, there are 63,243 grade crossings equipped with train-activated warning devices; an average of 15.06 trains use these crossings each day. Two activation failures at the McKnight Road crossing have been reported since the March 15, 1999, collision. On March 29, 1999, about 12:32 a.m., the signal system provided only 6 seconds of warning time before the arrival at the crossing of a northbound IC freight train. Investigation revealed a broken bond wire in a switch south of the crossing that temporarily shortened the length of the approach circuit and delayed

Factual Information 34 Railroad Accident Report detection of the train by the signal warning system. About 11:29 p.m. on April 9, 1999, the gates began to cycle up and down while a southbound IC freight train occupied the crossing. In this instance, soybean meal had leaked from a car in the train and had built up between the train wheels and the rail. The material effectively acted as an intermittent insulator that prevented the signal circuit from detecting the presence of the train. In both instances, the event recorders indicated that the signal system failed to provide the intended warning time. Laboratory Examination The west crossing gate 24 arm mechanism, the gate’s counterweight, the gate mast base, and the light bulbs from the gate arm were all examined or tested, or both, by the Safety Board’s Materials Laboratory. The wooden crossing gate arm was examined by the Materials Laboratory, and by the U.S. Department of Agriculture Forest Products Laboratory. Crossing Gate Mechanism. The crossing gate mechanism is that part of the crossing signal system that contains the motor controlling the motion of the gate arm. Normally, the gate is held in the “up” (hold clear) position by an energized relay. When the train enters the signal circuit, the GCP-3000 determines the appropriate train location to activate the lights and gates to provide the warning time. When the train reaches the calculated distance from the crossing, the GCP-3000 de-energizes the crossing control relay inside the signal bungalow, which in turn de-energizes the relay inside the gate mechanism, and a motor begins to drive the gate down.25 When the gate reaches about 50 degrees from the horizontal, the motor shuts off, and the gate continues to fall by gravity alone. As the gate nears the horizontal, the motor acts as a generator, and slows the gate’s descent. The motor again disengages when the gate reaches fully horizontal. The gate operating mechanism consists of the motor itself, two intermediate gear and pinion sets, and associated roller bearings and pins. The Safety Board’s Materials Laboratory marked, removed, cleaned, and examined the gears, roller bearings, and pins of the west gate assembly. All the gear and pinion teeth showed varying degrees of wear but were intact. Examination of the motor revealed that all the wires were firmly attached, and the commutators and brushes were in good condition. Manual operation of the hold-clear mechanism confirmed that when the gate was in the up position, the motor shaft was locked, as designed. The Safety Board then reassembled the intermediate gear assemblies using the marks that had been made to ensure that the gears engaged exactly as they had before 24 From the perspective of the accident truckdriver, the west gate was on the approach side of the McKnight Road grade crossing. This is the gate mechanism that was damaged by the collision and replaced immediately after the accident. 25 The gate and counterweight assembly are balanced so that the gate will fall by gravity alone; however, a motor is used in case additional force is needed to counteract the effects of strong winds or to overcome other resistance.

Factual Information 35 Railroad Accident Report disassembly. After assembly, and with the gate in the “down” position, power was supplied to the motor, and the gate mechanism was operated. Safety Board, FRA, and Canadian National/Illinois Central Railroad (CNIC) representatives present at the disassembly and testing demonstration agreed that the gate mechanism operated as designed. The Safety Board conducted several additional examinations of the electromechanical components of the gate mechanism. On March 29, 2000, investigators reexamined the gate arm mechanism. On May 30, 2000, Safety Board representatives participated in tests of the gate mechanism motor control relay performed at the laboratory of the mechanism’s manufacturer. On July 13, 2000, the Safety Board conducted a teardown of this same relay in its laboratory. March 29, 2000, Examination. Examinations of the mechanism and its circuits were conducted by Safety Board Railroad Division staff to identify the failure modes that might be expected to affect either the gate mechanism or the overall grade crossing signal system. Specifically, investigators attempted to determine what conditions might cause one or both of the gates to fail to lower, or that might cause a delay in the lowering of one or both gates. Representatives of the CNIC and Alstom Signaling, Inc., (Alstom) participated. The internal works of the gate mechanism were determined to have been assembled by General Railway Signals Company (GRS), now Alstom. According to records maintained by the CNIC, this particular mechanism was manufactured in 1968. A review of records dating back to 1993, the earliest date for which such records are kept by the manufacturer, found no failures of GRS gate mechanisms, and no safety notices or safety reminders relating to gate mechanisms manufactured in 1968 had been issued by the manufacturer. The hold-clear mechanism showed no evidence of contamination or material transfer that could have served to physically hold the gate in place after the activation relay was de-energized. After an examination of both the gate mechanism and the circuit diagrams for the mechanism, the examination participants could identify no failure mode within the mechanism that would cause the simultaneous delayed lowering of both gates at a crossing. Participants determined that the most likely cause of a failure of a single gate to lower would be a failure of the motor control relay to open when de-energized. Were this to happen, the hold-clear mechanism would remain energized, and the gate would not be released. The motor control relay was removed from the gate mechanism case at this time. Simple testing in the laboratory established that the relay still functioned. Participants decided to conduct more rigorous testing of the relay at the manufacturer’s laboratory. This testing was conducted on May 30, 2000. May 30, 2000, Testing. Safety Board Railroad Division representatives conducted tests at Alstom’s laboratory in Rochester, New York, to determine the exact current levels required for the accident gate mechanism’s motor control relay to function. Present were

Factual Information 36 Railroad Accident Report representatives of Alstom and the CNIC. The measured current levels met manufacturer’s specifications. July 13, 2000, Teardown. The Safety Board disassembled the gate mechanism’s motor control relay and examined the relay’s contact surfaces to determine whether either foreign material or a transfer of matter from one surface to another could have caused the relay to stick in the closed (energized) position. The contact surfaces did not show evidence of any transferred or foreign material. Counterweight Assembly and Gate Mast Base. The gate arm’s counterweight was broken off during the collision. The Safety Board examined the fracture face, which revealed features consistent with an overstress separation propagating from the inside of the arm (the side closest to the mast) toward the outside. The base of the crossing gate mast consisted of two castings fastened together around the mast. Four fasteners screwed the two base castings onto anchor bolts embedded in a concrete foundation. A series of indentations was noted on the front edge (facing the roadway) of a flange on the side of the base. The indentations were spaced about 3/4 inch apart. A second series of larger indentations, spaced about 1 inch apart, were found on the front edge of the inner half of the base. A portion of the front edge of the inner half of the base was cracked and was moved outward to close the gap between the two halves. Gate Arm Shaft Bearings. The wooden gate arms attach to the gate arm mechanism by way of a metal shaft, the rotation of which causes the gate to lower and raise. The shaft enters the gate arm mechanism and attaches to it with press-fit ball bearings. The inner bearing race rotates with the shaft, while the outer bearing race remains stationary in relation to the mechanism case. The bearing race locations, relative to the gate up and gate down positions, were vibro-peened on the outer edges of the races, and the bearings were removed from the mechanism case for examination. The bearings were found to have numerous indentations, described as Brinell marks or brinelling,26 on the active bearing surfaces. (See figure 10.) The presence of brinelling suggests that, at some time, the bearing received a severe blow, causing the bearing surfaces to impact one another. According to bearing manufacturers, typical examples of causes of brinelling include “using a hammer to install a bearing, dropping a bearing, or pressing a bearing onto a shaft by applying force to the non-rotating ring.”27 Other marks were observed and noted, but they did not show the indentations typical of Brinell marks. 26 Brinell marks are indentations at ball/roller frequency caused by any static overload or severe impact. 27 http://www.emersonbearing.com/failures/true.html as of 10/15/2001.

Factual Information 37 Railroad Accident Report To determine whether the Brinell marks on the bearing surfaces might have resulted from normal operations, investigators examined a set of bearings from another, similar gate arm mechanism. The ball grooves of the inner and outer races of the comparison bearings bore signs of the balls’ rotation in the grooves and of minor surface corrosion. The comparison bearings did not show evidence of Brinell marks on any surface. The rotational signs in the grooves of the inner and outer race aligned to indicate the range of the gate’s movement; these were more prominent on the bearing that supported the counterweight arm. Gate Arm Light Bulb Filaments. The Safety Board also examined the light bulbs from the signal gate arm. If the filaments inside incandescent light bulbs are hot when they receive a blow, instead of breaking, they may simply deform; this was in fact what happened with the two light bulbs the Safety Board was able to recover from the accident gate arm. Because of the way the light bulbs were set in their sockets on the gate arm, the deformation is principally in the direction parallel to the road. It was hoped that the shape and direction of the filament deformation might provide evidence indicating the orientation of the light bulb when it was struck. To test this hypothesis, the Safety Board tested numerous similar light bulbs at the CNIC signal shop in Homewood, Illinois. Light bulbs were inserted in a block attached to a wooden gate arm. Each light bulb was inserted with the filament oriented in a different direction, and power was supplied to make the light bulbs flash for about 30 seconds before force was applied to the free end of the gate arm. The light bulbs were then removed, labeled, and replaced with fresh bulbs to repeat the experiment. The bulb filaments were examined at the Safety Board’s Materials Laboratory under an optical microscope, and the Figure 10. West crossing gate arm mechanism main shaft bearings. Num- bered markings on inner and outer races indicate location of Brinell marks.

Factual Information 38 Railroad Accident Report deformations were noted. The examination showed that filament deformations in a specific direction could result from motion in various directions. Fire Investigation Following the accident, sleeper car No. 32035 was removed from the accident site and taken to the Amtrak facility in Beech Grove, Indiana. On April 27, 1999, investigators reexamined the car at this facility. During the course of the derailment, the sleeper car’s midsection struck and bent around the end of the train’s second locomotive. Spilled fuel from the locomotive’s breached fuel tank ignited, resulting in a large fuel-fed pool fire that severely damaged the middle one-third of the sleeper car. Because of the fire and victim recovery efforts, Safety Board investigators could conduct only a preliminary examination of the sleeper car before Amtrak removed it from the accident scene. To prepare the car for shipment, workers cut it in half, and the forward half of the car was compressed to permit it to fit into a railcar. The remaining sleeper car half was placed on another railcar. Where the car was still accessible to investigators, (on the top deck, room Nos. 5-10), little fire damage was noted, though some discoloration of the interior windows and slight sooting of interior materials was evident. Areas closer to the point of impact showed evidence of burned interior materials. In 1984, the FRA published guidelines recommending test methods and performance criteria for the flammability, smoke generation, and fire endurance characteristics of the interior materials used in the construction of new or rebuilt rail passenger equipment. The guidelines were originally developed by the Volpe Transportation Research (Volpe) Center in the late 1970s and were intended for application to rail transit vehicles. The intent of these guidelines was to prevent fire ignition and to maximize time available for the evacuation of passengers. The test methods cited in the guidelines include recommended test methods from the American Society for Testing and Materials and the Federal Aviation Administration. These guidelines were codified into full regulations in May 1999. The flammability of the interior materials (floor and wall covering, seat upholstery, and cushioning) in sleeper car No. 32035 was reviewed. According to testing records provided by Amtrak, the materials met the standards. Testing of materials directed by the Volpe Center produced similar findings.28 Two materials, both samples of foam found in the headrests on the sleeper car, were not among the materials tested before the accident. These materials were tested, however, as part of the Safety Board’s investigation. The blue headrest foam is a 28 The National Institute of Standards and Technology (NIST), under the direction of the FRA and the Volpe Center, is currently conducting research involving the fire safety of rail passenger vehicles. The NIST project is investigating the use of alternative fire testing methods and computer hazard analysis models to identify and evaluate approaches to passenger train fire safety. Amtrak provided the materials used in this testing.

Factual Information 39 Railroad Accident Report polyurethane foam manufactured by Chestnut Ridge. Kevlar cloth is bonded to the foam before installation in order to make it fire retardant. The blue foam, with the bonded Kevlar cloth, was tested by Amtrak. The white headrest foam, tested by the Safety Board, is known as IMPAK SR-10 LS. It is a rebonded foam that is manufactured by STX, Inc. The foam is bonded with fire-retardant cotton muslin to protect it from wear and dust. The white headrest foam used in the testing came from the accident car. The FRA requires that the flame spread index, which is the measure of surface flammability, fall below 25. The index was 162.6 for the white headrest foam, which is not in widespread use and is being phased out. Since the accident, Amtrak has provided test records indicating that the flame spread index for the blue foam (with cover) was 21.86. To meet FRA standards for smoke generation, the smoke generation rating must fall below 100 after 1.5 minutes of exposure to a heat source, and below 175 after 4 minutes of exposure. After 1.5 minutes of exposure to a flame source, both types of foam fell within the standard of 100. At 4 minutes of exposure to a flame, the measure rose to 249.5 for the white headrest foam. Smoke generation tests were also conducted using exposure to a nonflame heat source. During these tests, after 1.5 minutes exposure, the white headrest foam measured slightly over the limit at 105.9, while the blue foam sample measured below the limit. After 4 minutes, the white headrest foam was again above the limit at 292.2, while the blue foam sample measured below the required limit. Locomotive Event Recorders The recorders installed in both locomotives involved in the accident were Pulse Electronics solid-state permanent core memory (PCM) modules. The locomotive manufacturer integrates the PCM module into a locomotive data bus that provides data to the recorder system. The PCM records data onto non-volatile solid-state memory. Each parameter is recorded at a rate of 1 Hz (once per second), with the exception of the horn parameter, which is recorded at a rate of 10 Hz (10 times per second). A PCM module was removed from the lead locomotive, Amtrak unit 807, on March 16, 1999. Damage sustained by the locomotive prevented power from being applied to the PCM system within the locomotive, which made it impossible to extract data from the module while still in place. The module was removed and placed in another Amtrak P-40 locomotive for readout. A representative of Amtrak used locomotive power, recorder manufacturer’s software, and a laptop computer to download the recorded information onto a computer diskette. Software developed by Pulse Electronics was used to transcribe the data and to produce tabular data and data plots. Approximately 27 hours of locomotive data were present on the recording, and the accident sequence was recorded without any data loss. The tabular data indicate that the train was traveling about 79 miles per hour as it approached the accident crossing and that the train horn was sounded when the train was

Factual Information 40 Railroad Accident Report more than 3,000 feet from the accident crossing and again when it had approached to within about 1,600 feet of the crossing. The timing of these horn soundings is in accordance with the placement of the 3-crossing whistle post located north of the St. George Road crossing. A Pulse Electronics PCM module was also removed from the second locomotive, Amtrak unit 829. Unit 829 was exposed to post-impact fire for just over 90 minutes, and the group determined, after observation of the PCM, that readout of the unit was not possible at the scene. Amtrak shipped the unit to the Safety Board’s laboratory in Washington, D.C., for further examination and possible readout. Further examination, however, determined that the fire had destroyed the solid-state memory, and that extraction of the data was not possible. Accelerometers are not fitted on locomotives, and accelerations are not recorded on locomotive event recorders. Without the benefit of acceleration data, all event recorder data were examined to estimate a time of impact. At 9:47:12 p.m., the locomotive current dropped from 368 amps to zero, and, at 9:47:13 p.m., the recorded throttle position changed from 8 to idle. Train speed decreased 79 mph to 78 mph during this time. In addition, the locomotive engineer testified that upon seeing the tractor-trailer on the track and determining that impact was imminent, he reduced the throttle to idle and braced himself for the collision. Based on these data, the earliest the collision could have occurred was 9:47:12 p.m. Between 9:47:13 and 9:47:14 p.m., train speed decreased from 80 mph to 69 mph. Such a deceleration cannot be accomplished with typical locomotive performance and likely occurred when the train struck the tractor-semitrailer. Thus, based on all available information, the time of impact was most likely between 9:47:12 and 9:47:14 p.m. Accident Reconstruction and Computer Simulations The Illinois State Police Accident Reconstruction Team conducted acceleration tests using an exemplar vehicle driven in what was described as a normal manner, traveling from the point where most vehicles leave after securing the loads, and continuing through the crossing. The test vehicle, starting from a full stop, reached an average speed of 23 mph at the crossing gate in an average of 34.6 seconds. Using these data, the calculated average acceleration over that distance was .977 feet/sec2. The accident truck measured about 77 feet in length, and the distance from the west crossing gate to a clear point beyond the accident track was about 18 feet. Thus, if the truck were at the west gate, it would need to travel about 95 feet in order to reach a point where no part of it or its cargo intruded on the space required by the train. Tests indicated that, at a steady speed of 7 mph, the truck could have cleared the crossing in about 8.6 seconds. The Illinois State Police Accident Reconstruction Team attempted to determine the average minimum time for the accident vehicle to clear the accident crossing from a stopped position at the west crossing gate. In these tests, the exemplar truck accelerated across the entire crossing. Timing began when the truck started to move and stopped when the end of the overhanging steel rods passed the east crossing gate, a distance of about 118 feet. The exemplar truck took an average of 5.54 seconds to clear the crossing.

Factual Information 41 Railroad Accident Report The Safety Board also conducted a computer simulation study to determine the estimated speed of the truck at impact, the relative position of the truck as it crossed the tracks, the amount of time it took the truck to traverse the crossing, and the timing of the signal activation. The simulation was also used to help determine whether the truck-tractor semitrailer could have safely stopped short of the crossing. A Human-Vehicle- Environment (HVE) system was used to conduct the computer simulation study. The HVE System is a software package that includes several programs used by the Safety Board to simulate certain aspects of the accident. The EDSMAC4 software program, for example, was used to simulate the accident dynamics between the train and the truck and the resulting trajectories at various initial speeds. The EDVDS software program was used to determine the truck’s maneuverability as it approached the crossing. Several other programs were used to generate 3-dimensional computer models of various vehicles for the simulations. The HVE system was used to conduct hundreds of simulation scenarios and to evaluate the effects of several variables. The simulations included the truck approaching at speeds of 7 mph to 19.6 mph in the right lane, straddling the centerline, and maneuvering into the left lane. The train was modeled as two locomotives, two locomotives and two cars, and as two locomotives and two cars with the entire weight of the rest of the train on the second car. The semitrailer was modeled to the end of the semitrailer and to the end of the steel rebar. The gates were modeled with the signals and gates working properly, with the signals and gates deploying late but clearing the tractor, and with the signals and gates working properly except for the nearside gate, which remains in the upright position until after the impact. Values such as the various surface frictions for the road, the crossing timbers, the tracks, and the grass, as well as the inter-vehicle friction during contact, were varied slightly. The factors used to evaluate the relative merits of the individual simulations included how close to the actual values were the beginning of the simulated tire marks, the track of the tire marks, and the final rest positions of the truck tractor and the semitrailer. The simulation that best matched the physical evidence had the truck approaching at 15 mph, then slowing to 7 mph and maneuvering into the left lane before turning right across the crossing and heading for the right shoulder. The EDSMAC4 simulations highlighted that the truck tractor’s right front tire had to be off the right side of the pavement, beyond the crossing, at impact; that the truck’s semitrailer and the train were at an 87.1-degree angle at impact; that the truck’s left tire on the fourth axle had to be about 1 foot to the left of the centerline at impact; and that the tractor spun counterclockwise after impact. This was all validated with physical evidence. The Illinois State Police traffic crash reconstruction report stated: The furthest east point that the truck tractor reached was indicated by a tire print made in the dirt of the shoulder by the right steer axle. The furthest east point of the tire print was approximately four feet east of the actual tire at final position.

Factual Information 42 Railroad Accident Report The report also stated: Viewing the tractor from the rear, a scrub mark was visible under the vehicle. The mark began at the south edge of McKnight Road and continued onto the shoulder through the dirt and gravel. The mark was not at a right angle to the roadway. Dirt and grade crossing stone was piled up on the side of and at the base of right tires on axle 2 and 3…. This scuff mark started as a ‘V’ just west of the west rail of the passing track, approximately one foot north of the centerline of the roadway….the trailer would have been at or near perpendicular to the IC crossing at the time of impact. Since the road was at about an 8-degree angle relative to the tracks, the truck was at an angle on the road at impact as if turning right to avoid the descending far side gate or the train. Results similar to the EDSMAC4 were obtained by another analyst using m-smac, another software program developed by a different software company. Both EDSMAC4 and m-smac were based on the Simulation Model for Automobile Collisions (SMAC), which was developed by the National Highway Traffic Safety Administration in the 1970s. The approach of the truck to the crossing was simulated using the EDVDS software. EDVDS is used to model the vehicle dynamics of a commercial vehicle. Due to off-tracking (the tracking of the rear wheels inside the front wheels at low speeds), the truck had to be maneuvered into the left-hand lane and onto the left apron for the truck’s fourth axle left tire to be a foot north of the centerline of the roadway while the right front tractor wheel was off the right side of the pavement. When the truck straddled the centerline, the truck’s fourth axle left tire was about 2 feet to the right (south) of where the tire mark was found. Some of the other highlights of the simulations were as follows: • At higher speeds, such as 15.6 mph, the EDSMAC4 simulations did not replicate the arch of the tire mark left on the crossing. The m-smac simulations could match the marks with changes in the weight of the train, vehicle inter- friction, and stiffness of the semi-trailer. • If the truck straddled the centerline, the gates would have to be delayed for at least 9.9 seconds to clear the tractor’s exhaust stack but not more than 14 seconds for the east gate to be down at impact and broken inward by the spinning rebar. • In the most likely simulation, where the truck goes around the gate, the gates had no effect on the simulation, so the west gate could have been up or down.

Factual Information 43 Railroad Accident Report Other Information Emergency Preparedness Local Agencies. The emergency management agency for the county in which this accident occurred was the Kankakee County Emergency Services and Disaster Agency (ESDA). According to ESDA officials, when a relatively minor emergency occurs, the local responding agencies, such as the Bourbonnais Fire Protection District, may control the incident scene with minimal or no assistance from the ESDA. When a larger emergency occurs that requires assistance from additional, nearby municipalities, the ESDA may provide increased assistance, including the coordination of communications and logistics. The ESDA provided such services to the emergency responders on the night of the accident. The ESDA has developed several formal response plans to manage numerous aspects of response to various sorts of disasters (for example, chemical spills, hazardous materials accidents, etc.). The ESDA plan includes immediate response, incident command system (ICS) implementation, condition assessment, triage, delivery of emergency services, communications, and transportation of the injured. The fire/rescue emergency service responsible for the location in which the accident occurred was the Bourbonnais Fire Protection District. According to the district officials, the agency is able, through mutual aid requests, to call on additional support from neighboring communities; it is also available to provide mutual aid assistance to other communities. A part of the Kankakee Valley Firefighter’s Association (KVFA), the Bourbonnais Fire Protection District uses the formal documented fire/rescue emergency response plan organized and adopted by the KVFA. When implementing this emergency response plan, the Bourbonnais Fire Protection District employs a standard ICS to manage the on-scene response. Under the ICS, the chief of the department or a designated alternate serves as the incident commander, who has the overall authority and responsibility for all resources used in the incident response. The Bourbonnais Fire Protection District implemented the ICS in response to the accident, and the district chief was designated as the incident commander. Before the accident, the ESDA organized and executed emergency response exercises simulating various event scenarios; the Bourbonnais Fire Protection District participated in these drills. The exercise scenarios in previous years had included one involving a railroad accident but not one in which passenger train equipment was involved. Critiques conducted following several of these drills identified significant problems with on-scene operational communications. Because these problems were not resolved before the accident, according to the Bourbonnais Fire Protection District chief, communications difficulties hampered the emergency response efforts at the grade crossing accident scene. Amtrak. According to the requirements of 49 CFR 239.101(a)(5), every passenger railroad and every railroad hosting passenger train service must jointly adopt a single emergency preparedness plan describing the procedures to be followed in an emergency.

Factual Information 44 Railroad Accident Report The regulation requires that each railroad organize a liaison with emergency responders in order to familiarize these emergency responders with the passenger railroad equipment, facilities, and communications interfaces. In order to implement the emergency response liaison element of its emergency preparedness plan, Amtrak provides, upon request, an instructional information/training program for those local agencies most likely to respond to an Amtrak emergency. This training program includes training materials such as manuals and an instructional videotape. In addition, Amtrak offers on-site instruction sessions during which a representative of the railroad gives a training course directly to the local emergency response agencies. This training course is provided whenever possible. Amtrak, however, notes that it operates through regions that encompass about 15,000 emergency response agencies and that, because of limited resources, on-site training is not provided for all agencies that may be called upon to respond to an Amtrak emergency. For example, before the accident, Amtrak had not provided any on-site instruction or training to the Bourbonnais Fire Protection District or to other Kankakee County emergency responders. Amtrak did conduct passenger train emergency response training in Kankakee County, Illinois, after the accident, on November 12 and 13, 1999. Current Status of McKnight Road Crossing The Illinois Commerce Commission, in conjunction with the Village of Bourbonnais, has considered making improvements to the grade crossings at McKnight Road and at St. George Road, immediately to the north of McKnight Road. In October 2000, temporary highway signals were put in place at St. George Road and were interconnected with the railroad grade crossing signaling system. In addition, pre-signals, designed to stop highway traffic before reaching the crossing, were installed for eastbound traffic on St. George Road. Further improvements to St. George Road are planned, including relocating the crossing 500 feet east of the existing crossing to eliminate the need for traffic signal interconnection, widening the crossing, upgrading the crossing warning devices, and installing a barrier median at the crossing. Before agreeing to these changes, the Illinois Commerce Commission had an engineering diagnostic team evaluate the crossing. Costs for the relocation and reconfiguration of the St George Road crossing will be borne by the Illinois Department of Transportation. For the widening of the crossing and the upgrade of crossing warning devices, about $215,700 will be paid from the grade crossing protection fund, monies provided to the States by the Federal Highway Administration. Any additional costs, including the cost of future maintenance, will fall to the CNIC railroad. According to the Illinois Commerce Commission, the Village of Bourbonnais is considering closing the McKnight Road crossing and running an access road to a nearby crossing, possibly St. George Road. According to the Township of Bourbonnais road commissioner, the closing of the crossing is a long-term objective. In the meantime, the township has installed temporary median barriers at the McKnight Road crossing.

45 Railroad Accident Report Analysis General The Safety Board found no indication that the engineer at the controls of train 59 was acutely or chronically fatigued. Further, he successfully passed a physical examination 5 months before the accident. There were no problems with his vision or hearing based on a hearing and vision examination in September 1996. He stated that he had not used alcohol or drugs, including over-the-counter and prescription medication, before the accident. The engineer said that he was not overtasked/overworked on the evening of and before the accident, nor was he distracted or preoccupied before the accident. The event recorder recorded activities performed by the engineer showing the whistle being sounded, the throttle being manipulated, and the air brakes being applied on the train. These activities occurred continuously up to the point of collision. The train crew satisfactorily performed the required pretrip tests of the train and reported no deficiencies, nor did they report any problems during the operation of the train. In addition, postaccident testing revealed no track defects in the accident vicinity, and crewmembers did not mention track conditions as a concern. The Safety Board tested the train’s air brakes and reviewed equipment maintenance records for the 60 days before the accident. No defects were found that would have indicated that the equipment was impaired at the time of collision. The mechanical subsystems on the semitrailer could not be tested. The individual components were tested or examined, however, to determine their condition and to determine compliance with the applicable Federal regulations. No discrepancies in the brake system, the suspension system, or the tires were noted. The truck tractor did not receive any collision damage, and postaccident inspection and testing revealed no discrepancies with the steering, suspension, chassis, powertrain, drivetrain, tires, or brake systems on the tractor. The National Weather Service in Chicago, Illinois, reported unrestricted visibility at 10 statute miles and no precipitation at the time of the accident. The temperature was reported to be 33° F. The train engineer and other witnesses indicated that visibility was good, other than the darkness of the night. The cool temperatures were not mentioned as having an effect on the accident. Postaccident drug and alcohol testing of the truckdriver was conducted by the motor carrier in accordance with Federal requirements. The results of these tests were negative for illicit drugs and alcohol. Further analysis of the driver’s blood and urine revealed the presence of prescription medications and nonprescription medications. These drugs either have not been shown to have adverse effects on performance or were taken more than 24 hours before testing.

Analysis 46 Railroad Accident Report Although no speed studies were available for McKnight Road, the postaccident testing established that a truck could reasonably be expected to reach about 23 mph when approaching the crossing after leaving the parking lot. For a crossing with an estimated 85th percentile approach speed of 25 mph, the MUTCD recommends that the highway/rail grade crossing circular advance warning sign (W10-1) be placed a distance of 250 feet before the crossing. For stop or deceleration conditions, the distances are even less. The circular advance warning sign for eastbound traffic at McKnight Road was 512 feet away. The 320-foot distance of the railroad crossing sign on the westbound approach from the most easterly rail is also excessive when the MUTCD criteria are applied. Also, in that location, the sign was only 70 feet from the westerly curb line of the nearest intersection, Route 50, a “T” intersection. At this distance, the driver of a turning vehicle hardly has sufficient time to recognize the sign. A sign placed closer to the crossing should be more effective in alerting a driver to the crossing. However, most drivers using this highway are probably aware of the crossing and the sign primarily serves as a reminder to them. The Safety Board therefore concludes that the following factors did not cause or contribute to the accident: the physical condition or actions of the engineer of Amtrak train 59; the mechanical condition of the train and the condition of the tracks; railroad operating procedures and policies; the mechanical condition of the truck-tractor semitrailer; the equipment making up Amtrak train 59; weather; alcohol, drugs, or prescription medications; and the location of traffic control signs on the approach to the grade crossing. Truckdriver Performance The truckdriver stated that as he approached the grade crossing on the night of the accident, he saw the crossing signal lights illuminate. He said that because of his proximity to the crossing when the lights activated, he had to quickly choose a course of action from several options available to him: (1) he could brake hard and stop short of the crossing but risk a dangerous load shift, (2) he could brake moderately and prevent the load from shifting but risk advancing too far and fouling the tracks, or (3) he could accelerate in an attempt to clear the tracks before the train arrived. In the truckdriver’s estimation, the best course of action was the last, to accelerate across the tracks before the train arrived. The truckdriver, therefore, maintained that the amount of time between activation of the signal lights and the arrival of the train was insufficient to permit him to clear the crossing. Staff reviewed the driver’s testimony, and all of the postaccident tests and analyses, to determine if the preponderance of evidence supports the driver’s contention, or if an alternative scenario could explain the actual events leading up to the accident. Specifically, staff examined some of the key facts reported by the truckdriver, including: the truck’s speed before the collision; the truck’s distance from the tracks when the red crossing lights first came on; the operation of the crossing lights and crossing gate; and the time that the driver first observed the crossing lights.

Analysis 47 Railroad Accident Report Truck Speed According to the truckdriver, his vehicle was in sixth gear and traveling about 20 mph at the time of the collision. The Illinois State Police Accident Reconstruction Team conducted acceleration tests using an exemplar vehicle driven in what was described as a normal manner, traveling from the point where most vehicles leave after securing the loads and continuing through the crossing. The test vehicle, starting from a full stop, reached an average speed of 23 mph at the crossing gate in an average of 34.6 seconds. Using these data, the calculated average acceleration over that distance was .977 feet/sec2. If the accident vehicle was operated in the same manner as the test vehicle, then the speed cited by the truckdriver is consistent with the test results. In testing conducted by the Illinois State Police, it was not possible to negotiate a similar truck around the gates at speeds in excess of 15 mph. Statements by two eyewitnesses, however, suggest that the accident truckdriver applied his brakes while on the approach to the crossing. The truckdriver who was putting a tarpaulin on his load in the parking lot stated that he heard the accident truck’s jake brake as it rolled by him on the roadway and that he saw the truck’s brake lights come on. In addition, the motorist who pulled out onto the roadway following the truck stated that he saw the brake lights on the truck illuminate as the truck approached the crossing. In his statement at the Safety Board’s public hearing, this witness also estimated that the truck’s speed before reaching the crossing was about 7 mph. Pivoting around its fifth wheel connection upon impact, the semitrailer left tire marks on the pavement and rail. The Safety Board used data about the location, angle, and length of these tire marks to provide a benchmark for the validity of its computer simulations. When the simulated truck was run at various speeds, the simulated tire marks created were compared with the locations of the real ones, and the final rest position of the simulated truck was compared with the truck tractor’s actual final rest position. Two analysts used differing software to generate the simulations; both came up with similar results. Based on these simulations, it was determined that the existing tire marks were more likely to have been left by a vehicle traveling between 7 and 14 mph, not 20 mph. Based on both the eyewitness testimony and the simulation analyses, the Safety Board concludes, therefore, that the accident-involved truck-tractor semitrailer was probably traveling between 7 and 14 mph at the time of the collision. The crossing warning signal system was programmed to activate about 26 seconds before the arrival of a train at the crossing. If the truck had been approaching the crossing at an average speed of 7 to 8 mph, it would have been about 284.5 feet from the crossing 26 seconds before impact. At 14 mph, the truck could have traversed more than 500 feet in 26 seconds; this would place the truck near the driveway from which it entered McKnight Road. The speed of the accident truck undoubtedly varied as it accelerated, then braked on its course down McKnight Road, and, therefore, the truck was likely to be somewhere between 285 and 500 feet from the crossing when the lights were programmed to begin flashing.

Analysis 48 Railroad Accident Report Warning Signal System Activation The only scenario under which the time from activation of the warning signals until the arrival of the train would not have allowed the truckdriver to either stop his truck short of the crossing or accelerate safely across would involve some malfunction of the signal warning system. A malfunctioning system that first activated when both the train and truck were close to the crossing, for example, could conceivably place a driver in a situation in which, regardless of the speed he was traveling, he would not be able to take measures to prevent the accident. However, as discussed previously, postaccident testing of the lights found no evidence that they were not operating as designed. Statements made by eyewitnesses to the accident, however, raised the question of whether the grade crossing signal worked as designed. According to the accident-involved truckdriver, the lights began flashing just as he reached the crossing. He also indicated that he did not believe he could safely stop the truck before reaching the tracks, and therefore he accelerated in an attempt to get the truck across the tracks. The motorist who followed the accident truck stated that he also thought that the lights began flashing just as the truck reached the crossing, and added that the crossing gate came down on the back of the truck. The truckdriver in the parking lot indicated that he did not see the lights flash or the gates deploy. The security guard in the steel plant’s scale house said he saw the lights flash about 5 seconds before the train’s arrival at the crossing, and his wife, who was visiting him, stated that when she first noticed the lights flash, she thought the truck’s cab was on the crossing. In an attempt to determine the relative accuracy of these eyewitness accounts, the Safety Board reexamined the function of the grade crossing signaling system and studied the vehicle dynamics to determine whether the collision could have occurred as they indicated. Based on accident reconstruction scenarios, a truck of the kind involved in this accident, traveling at a steady speed of 7 mph, could have cleared the crossing in about 8.6 seconds. Tests in which an exemplar truck was stopped at the west gate and then accelerated across the crossing showed that the truck could have completely cleared the crossing in an average of 5.54 seconds. If, then, the warning signals at the crossing provided the designed 26 seconds of warning time before the arrival of the train and if the truck had been at the approach to the crossing when the signals activated, the truck would have had more than ample time to successfully traverse and clear the crossing. Although recollections of some witnesses seemed to indicate that the signal activation may not have occurred sufficiently in advance of the arrival of the train, several factors suggest that those recollections may not accurately reflect the timing of the event. First, the crane operator said he saw the signal lights flashing before he turned to complete a task that was verified to require about 15 to 20 seconds. He said that when he finished the task and looked back at the crossing, he saw the collision. These statements suggest that the flashing lights provided more warning time than the truckdriver and other witnesses said they remembered.

Analysis 49 Railroad Accident Report Secondly, the on-scene testing of the signal system found no evidence of a failure in the electronic components of the system. And, finally, the event recorder for the signal system indicated that the signals did indeed provide about 26 seconds of warning time. The recorder was tested on-scene, then removed and tested at the manufacturer’s facility. The laboratory testing showed that the recorder was operating within the parameters specified for a newly manufactured product; this suggests that the events were recorded accurately and that the GCP 3000, the computer governing the timing of the signal activation, functioned as designed. The Safety Board concludes, therefore, that the grade crossing signal lights began flashing at least 26 seconds before the train’s arrival at the McKnight Road grade crossing. Crossing Gate Operation Crossing gates typically begin to lower within 4 to 5 seconds after the warning lights activate. Although data downloaded from the signal system event recorder for the accident crossing showed that a lowering of the gates was initiated, the information captured by the event recorder does not include the actual position of the gates. Investigators therefore conducted a number of tests to determine whether, in this accident, a failure or delay occurred in the lowering of one or both gates. Investigators examined the circuit diagrams for the gates to determine what could cause both gates to be delayed or prevented from lowering while the lights are flashing. Two possibilities were considered: (1) failure within the gate control circuit, or (2) simultaneous failure of the motor control relay in each gate arm mechanism. Maintenance and inspection records for this crossing’s signals show no indications of a history of failure within the gate control circuit. In addition, the on-scene field testing conducted following the accident revealed no problems with the gate control circuit, and the XRPR relay on that circuit functioned normally in cutting power to the motor control relays that hold the gates in the upright position. Any failure of both gates, therefore, would have required the simultaneous failure of two separate motor control relays that did not have a history of failure and that functioned normally in postaccident tests. Finally, the pattern of breakage evident on the tip of the east (far side) gate is consistent with that gate having been fully down at the time of impact. With a simultaneous failure of both gates to lower properly thus ruled out, investigators examined a failure mode in which the lights activate at the appropriate time but one gate (in this case, the west, or approach side, gate) fails to deploy. According to the circuit diagram, in order for this to happen, a failure within only one of the gate arm mechanisms would be required. According to downloaded signal event recorder data, the GCP 3000 warning signal system computer detected the presence of train 59 at 9:46:59 p.m. Four seconds later, the XRPR crossing control relay de-energized, which in turn de-energized and opened both gate motor control relays. When these relays open, power is removed from the gate hold- clear mechanisms and the gates are released. At that point, if the gates are operating normally, the gate motor activates to control the gravity-assisted descent of the gates.

Analysis 50 Railroad Accident Report Laboratory testing of the west (approach side) gate arm mechanism revealed no sign of improper operation; nevertheless, investigators recognized that some latent or intermittent defect could still exist within the mechanism. The Safety Board therefore conducted laboratory examinations of the mechanical and electromechanical components of the west gate arm mechanism to determine whether such a failure could be detected. Motor Control Relay. If, for any reason, the motor control relay within the gate arm mechanism was not de-energized or if once de-energized, it failed to open, the gate motor would not receive power, nor would the hold-clear mechanism release the gate. The data downloaded from the signal event recorder indicated that the gate motor for both gates did energize. If for any reason the energized motor had then failed to operate, the gates would still have descended by gravity once the hold-clear mechanism released. The fact that the gate motors did energize indicates that the motor control relays functioned as designed. Also, operational tests showed that the motor control relay for the west gate functioned as designed. The electrical test showed that the operating parameters of the damaged relay were still within limits specified for new equipment, and the mechanical teardown found no evidence of foreign material transfer that might have caused the relay to stick when de-energized. Bearings. The main shaft bearings bore Brinell marks or indentations indicating that at some time the bearing components struck one another with considerable force. When the marks on the inner race, which is affixed to the shaft, were lined up with the marks on the outer race, which is affixed to the outer casing, they indicated that the gate was in a fully upright position (in regard to the relative positions of the gate and the shaft) when the marks were made. Thus, if it could be determined conclusively that the Brinell marks occurred as a result of this accident, the orientation of the marks could serve as evidence of the gate position at the time of the collision. The indentations found on the signal mast base clearly show that, during the course of the collision between the train and the truck-tractor semitrailer, a bundle of rebar struck the signal mast. This secondary impact was severe enough to move the entire mast, as well as the concrete foundation to which it was bolted. Additionally, the impact fractured the cast metal base of the pole. Much of the impact energy to the base was most likely absorbed by the impact-induced fracture of the base and pole mounting. Laboratory analysis of both the wooden gate arm and the cast metal counterweight arm fracture surfaces suggest that they may have broken as a result of a vibratory flexural motion that could have been induced by the impact to the base. While such motion could also have loaded the bearing, no clear evidence exists to indicate it could cause the Brinell marks observed on the bearing. The bearing races are fabricated from hardened steel. The pole is fabricated from a ductile alloy of significantly lower strength and hardness than the bearing races. Since the pole material at the bearing shaft interface showed no signs of permanent deformation or damage, it is not possible to conclude that any mechanism existed for transmitting enough impact energy from the pole to the bearing to cause the Brinell marks. Several additional facts also make it impossible to declare positively that the Brinell marks were caused during the accident. First, Brinell marks can be inflicted on a

Analysis 51 Railroad Accident Report bearing during installation if the bearing is dropped or stuck by a hammer or other object, or they may occur while the bearing is being pressed onto the shaft. Second, although the accident crossing had been equipped with crossing gates since 1968, records do not exist that would indicate whether the mechanism had been replaced one or more times before the accident or whether the mechanism that was in place on the day of the accident had received a blow from a previous accident or from another cause at any time before this accident. Third, because the mechanism was lifted, transported, and placed in an outside storage area where it lay for several months after the accident, the possibility that the damage occurred after the accident cannot be entirely discounted. Finally, although the impact to the base was sufficient to cause fracture of the counterweight arm, it is not known if the impact generated sufficient force in the proper direction to cause the brinelling damage to the bearings. Gate Arm Light Bulb Filaments. The filaments of the accident-involved gate arm light bulbs were distorted in a direction parallel with the roadway. Investigators conducted tests on similar bulbs to determine whether the direction of this distortion could offer clues about the position of the gate at the time the filaments were distorted. These test results proved inconclusive as they showed that filament deformation in a given direction could come as a result of the filaments’ being acted upon by forces from several different directions. Driver’s Actions. The Safety Board also considered the driver’s actions as a possible clue to the functioning of the crossing gates. The driver stated that he did not notice the movement of the gates at the crossing (whether they were in the process of moving, or whether they were in an upright or down position) as he approached the tracks. According to the truckdriver, when he first saw the crossing lights flashing, he quickly decided to accelerate, and he focused his attention primarily on moving the truck straight ahead and across the tracks. Computer simulations conducted by the Safety Board as part of this accident investigation provided evidence that disputes the truckdriver’s account. As mentioned earlier in the discussion of the truck speed, two different analysts used different software programs to simulate the accident, generating hundreds of simulations. The simulations were not only used to estimate the truck speed, they were also used in an attempt to determine whether the physical evidence, particularly the tire marks, were more likely created by a truck driving more or less straight through the crossing with a delayed gate or by a truck driving around lowered gates. The analyses indicated that in order for the truck to have made the tire marks found at the scene, it must have been at an angle such that, at the time of impact, the right front tire of the tractor was near its final position and the left front axle of the trailer was to the left of the highway centerline. Every highway vehicle experiences, to some degree, a phenomenon called offtracking, in which the rear wheels follow a shorter radius path than the front wheels when the vehicle is turning at low speeds. As noted earlier, the accident truck was likely moving at a relatively low speed (7 to 14 mph). Offtracking is of particular concern with longer vehicles, because the rear portion of the vehicle can strike roadside objects such as signs unless the driver compensates by swinging the front of the vehicle along a wider

Analysis 52 Railroad Accident Report turning path. The simulations conducted by the Safety Board indicate that, when the offtracking characteristics of the accident truck are considered, the best fit of the observed data (most significantly, the tire marks) occurs when the truck tractor is moving toward the right-hand side of the road to recover from having been fully in the left lane. In other words, the simulations indicate that the data are best matched when the truck is driven as though to avoid lowered or lowering crossing gate arms. To summarize, no repeatable malfunction of any of the gate arm mechanism’s components, whether individually or in combination, was found during testing. Thus, the Safety Board was unable to reproduce any fault that would have caused a failure or a delay in the lowering of either crossing gate. The Safety Board therefore concludes that, based on the signal system tests and physical evidence, including evidence of the truck’s position at the time of impact, both crossing gates likely lowered as designed as the accident truck approached the crossing. Where highway/railroad grade crossing signal systems are equipped with event recorders, it is often possible to put in place a method to detect whether the gate has descended fully. The method of detection is sometimes as simple as an electrical contact made when the gate reaches the horizontal. Such a system may aid signal maintainers and inspectors, enabling them to see clear recorded evidence of signal malfunctions before accidents occur. However, the accident crossing in Bourbonnais was not equipped with a gate position detection system. The Safety Board notes that all modern electronic warning signal systems may be equipped easily with signal event recorders and that almost all the warning systems installed as new or as upgrades by class I railroads are equipped with such devices. These recorders may or may not, however, capture the actual deployed gate position for those systems that are equipped with gates. For example, while all the warning systems installed or upgraded by the CNIC Railroad since 1995 have been equipped with signal event recorders, only after the Bourbonnais accident did the company specify that its newly purchased systems be required to capture gate position (horizontal or other than horizontal). According to CNIC officials, about 60 to 75 of the company’s crossing signal event recorders now record this data. Some other class I railroads, notably the Burlington Northern/Santa Fe, also use event recorders that capture gate position information.299 In the view of the Safety Board, determination of actual crossing gate position is important not only because it facilitates accident reconstruction but also because it can help railroads detect and correct warning system defects or anomalies before they become a hazard to the public. While, as noted above, some railroads already recognize the benefits of gate position information and are installing event recorders that capture such data, other railroads are less aggressive in pursuing this option as they install new or upgraded systems. The FRA, while not requiring that grade crossing warning systems be equipped with signal event recorders, can nonetheless play a role in ensuring that those systems that are in place provide gate position information. The Safety Board believes, 29 The Burlington Northern/Santa Fe Railroad event recorders that capture gate position indicate whether the gate is vertical (between 83 and 90 degrees) or horizontal (between 0 and 5 degrees).

Analysis 53 Railroad Accident Report therefore, that the FRA should, for all railroads that install new or upgraded grade crossing warning systems that include crossing gates and that are equipped with event recorders, require that the information captured by those event recorders include the position of the deployed gates. In the interim, nothing prevents railroads that have not done so from following the lead of other carriers in regard to obtaining gate position information for those crossings equipped with new or upgraded warning systems that have both gates and event recorders. The Safety Board therefore believes that all class I and regional railroads should, for all their new and upgraded grade crossing warning systems that include crossing gates and that are equipped with event recorders, ensure that the information captured by those event recorders includes the position of the deployed gates. Fatigue The truckdriver customarily worked a 5-day work-week, Monday through Friday, delivering two loads of steel daily from the plant at Bourbonnais to Dayton, Ohio. These deliveries were accomplished within the Federal duty-rest requirements in effect at the time of the accident. The driver reported that he was off duty for approximately 52 hours on Friday, Saturday, and Sunday, the weekend before the accident occurred on Monday evening. He reported receiving 2 full nights of sleep at home on both Friday and Saturday night, and about 2 hours, 30 minutes of sleep at home on Sunday evening. He awoke at midnight and reported for duty at 2:00 a.m. on Monday, the day of the accident, and delivered one load of steel to Dayton during the morning. According to the reconstruction of the truckdriver’s 72-hour history, following delivery of his steel shipment to Dayton, he loaded a shipment of forklifts in Canal Winchester, Ohio. He transported the forklifts to Peotone, Illinois, arriving at about 7:00 p.m. At this point, the truckdriver was not in conformity with Federal duty-rest requirements (discussed below). After unloading, the driver returned home. In a revised statement, the truckdriver changed his initial account of the amount of sleep he had received on the day of the accident, reporting that he had slept for a total of 4 hours, 45 minutes, most in the sleeper berth but with a small amount of sleep at home immediately before the accident trip. Therefore, combining the 2 hours, 30 minutes, of rest the driver reported he received on Sunday night before reporting to work with the 4 hours, 45 minutes, he reported receiving on Monday would suggest that he accumulated 7 hours, 15 minutes, of fragmented sleep before the accident. A close examination of the various trip segments on Monday, however, suggests he had even less sleep. Based on Safety Board calculations of trip times and lengths, it is unlikely that the driver could have completed the majority of his trip in the amount of time he reported. The calculations indicate the trip would have taken about 1 hour and 45 minutes longer than the driver reported, thus allowing that much less time to sleep.

Analysis 54 Railroad Accident Report In addition, according to the accounts of the shippers and receivers of his trip loads, it appears that the truckdriver participated in the loading and offloading of his cargo, thus further reducing the time available for sleep. The amount of time needed to complete loading and offloading activities is not known, which prevents an exact determination of the amount of time the driver had for sleep on Monday. But based on all available evidence, the truckdriver accrued only 3 to 5 hours of fragmented sleep in the 38 hours (Sunday and Monday) before the accident. Fragmented sleep, such as that experienced by the driver in this accident, has been associated with driver fatigue and a resulting decrease in performance. Research has shown that sleep accumulated in short time blocks is less refreshing than sleep accumulated in one long time period.30 Safety Board research indicates that the duration of the most recent sleep period, the amount of sleep during the previous 24 hours, and split or fragmented sleep patterns are among the most critical factors leading to fatigue-related accidents.31 As indicated above, the truckdriver’s cumulative sleep total for the 24 hours before the accident was about 3 to 5 hours, well below the average of 6.9 hours slept by truckdrivers involved in fatigue-related accidents examined by the Safety Board. Truckdrivers involved in non-fatigue-related accidents averaged 9.3 hours of sleep within the previous 24 hours. The Bourbonnais accident-involved truckdriver’s most recent sleep period lasted about 1 to 2 hours. In the Safety Board’s study, the fatigue-related-accident truckdrivers had slept an average of 5.5 hours, and the non-fatigue-related-accident truckdrivers had slept an average of 8.0 hours in their most recent sleep periods before their accidents. Research32 has demonstrated how sleep loss is associated with decrements in decision-making, vigilance, reaction time, memory, psychomotor coordination, and information processing (for example, fixation on certain material to the neglect of other information). An operator may react slowly to information, may incorrectly process the importance of the information, may find decision-making difficult, or may make poor decisions. This performance degradation can be a direct result of sleep loss and the associated sleepiness and can play an insidious role in the occurrence of an operational incident or accident. It is likely that the small amount of sleep the truckdriver had obtained resulted in decrements in one or more of the following: his decision-making, vigilance, reaction time, memory, psychomotor coordination, or information processing. These decrements may have caused the truckdriver to miss the onset of the grade crossing signal indication and to preclude his braking in time to avoid stopping on the tracks. Such an event is consistent 30 Dinges, D.F., 1989, “The Nature of Sleepiness: Causes, Contexts, and Consequences,” In: Stunkard, A.J.; Baum, A., Perspectives in Behavioral Medicine: Eating, Sleeping, and Sex, Hillsdale, NJ: Lawrence Erblaum Associates: 147-79, Chapter 9 (p. 147). 31 National Transportation Safety Board, Factors That Affect Fatigue in Heavy Truck Accidents, Highway Safety Study NTSB/SS-95/01 (Washington, D.C.: NTSB, 1995). 32 Rosekind, M., Gregory, K., Miller, D., Co, E., Lebacqz, V. Analysis of Crew Fatigue in AIA Guantanamo Bay Aviation Accident. Fatigue Countermeasures Program, Flight Human Factors Branch, NASA Ames Research Center.

Analysis 55 Railroad Accident Report with the driver’s contention that the grade crossing warning lights did not activate until he was very close to the crossing and may have lead to the truckdriver’s risky actions well after the warning system had actually been activated. Despite the fact that the truckdriver was suffering from fatigue at the time of the accident, investigators could not determine the extent to which fatigue accounted for his performance. Investigators could, however, determine that at least some of the truckdriver’s statements lacked credibility and that the accident did not happen exactly as the truckdriver described it. As noted above, recorded evidence and the statements of the crane operator indicated that the signal lights began flashing more than 20 seconds before the arrival of the train at the crossing. If the signal lights had thus begun to activate just as the truck reached the crossing, as the truckdriver stated, he would have had more than enough time to clear the crossing, even if he had had to go around lowered or lowering gates to do so. The truckdriver said he did not notice the position of the crossing gates. But eyewitnesses stated that the truck crossed the centerline of the roadway as it attempted to navigate the crossing. Also, computer simulations indicated that the truck, when struck, was moving from the left lane back into the right lane. This movement suggests either that one or both gates were down when the truck began to move over the crossing or that the truckdriver was anticipating the lowering of the gates and was maneuvering to avoid them when the collision occurred. Based on all available evidence, the most likely scenario is that the signal lights began flashing as the truck was some distance from the crossing. The possibility exists that the truckdriver may not have noticed the flashing signal lights when they first activated. But the fact that those lights were seen by a crane operator who was as much as 600 yards away from, and at an angle to, the crossing makes it unlikely that they would have not been seen by the truckdriver only a few hundred feet away unless the driver was either sleep-deprived or distracted in some way. But according to witnesses, the truckdriver reduced throttle, which applied the jake brake, and he may have applied the brakes and further slowed, which suggests that he did, indeed, see the lights. At some point, as he continued to approach the crossing, the truckdriver made a judgment that he could clear the crossing before the train arrived. Perhaps he was misled by the normal delay in the lowering of the gates, or he may have assumed that the train was a slow- moving freight train rather than a passenger train.33 Whatever the basis of the truckdriver’s judgment and whether or not it was affected by fatigue, by the time the truck reached the crossing, most of the warning time had elapsed, and the arrival of the train was imminent. Considering the speed he was traveling and the length of his truck, the truckdriver had no chance to avoid a collision once he committed to attempting to cross in front of the train. 33 The truckdriver was probably not aware that the signal system was designed to provide a fixed warning time regardless of the speed of an approaching train.

Analysis 56 Railroad Accident Report The Safety Board therefore concludes that the truckdriver had ample time to safely stop his truck and avoid an accident, but likely as a result of fatigue, he failed to respond appropriately to the signals and instead decided to attempt to cross ahead of the train. Motor Carrier Performance On the day of the accident, the truckdriver exceeded the work hours specified in the Federal Motor Carrier hours-of-service rules.34 Since the truckdriver’s last consecutive 8-hour off-duty period, he had been driving for more than 13 hours (10 hours are allowed) and had been on-duty for almost 20 hours (15 hours are allowed). Furthermore, at the time of the accident, the truckdriver was beginning another trip that would have put his duty/rest cycle even more out of balance and would have aggravated his already fatigued condition. Originally, the Safety Board was led to believe that on the day of the accident, the truckdriver had transported the first load of steel and had returned home empty. According to this scenario, he was off duty at home and returned to work shortly before the accident to pick up his second load of steel of the day. Had this scenario been accurate, the driver would have been just within the hours-of-service rules, having driven for about 10 hours, then having about 8 hours of off-duty time before driving again. However, during the investigation, a back-haul was discovered. This back-haul load resulted in the driver’s exceeding the hours-of-service limitation and led to his fatigued condition. Melco indicated that although it had scheduled the two loads of steel, the company was unaware of the back-haul. However, investigators found that the company (Country Supply) that arranged the load was closely associated with Melco, and loads similar to the accident back-haul load were frequently transported by Melco drivers, including the accident driver. Furthermore, Melco routinely billed Country Supply for the transportation services associated with those loads. Although Melco denied knowledge of the back-haul load, it appears that Melco probably knew about the load and may even have assigned it to the driver. Unfortunately, investigators were unable to determine how the loads on the day of the accident were scheduled. Melco used assorted assignment and scheduling practices that are not uncommon among motor carriers that primarily employ owner-operators. Therefore, although Melco may have assigned all of the loads on the day of the accident, the Safety Board could not determine if the company was involved in scheduling the back- haul load for movement on the morning of March 15. If the accident truckdriver self-scheduled the back-haul load without the knowledge of Melco, he could have done so with some confidence that its effect on his duty/rest schedule would not be noted by Melco, since weaknesses in Melco’s driver oversight program made it unlikely that Melco would scrutinize the driver’s duty status to monitor conformance with hours-of-service rules. Two days after the accident, a DOT 34 Federal Motor Carrier Safety regulations, Part 395.3 Maximum Driving Time.

Analysis 57 Railroad Accident Report compliance review discovered that Melco had not kept duty status records for about half of its drivers, and this lapse was sufficient to result in an unsatisfactory rating for that category. Therefore the Safety Board concludes that Melco failed to provide driver oversight sufficient to detect or prevent driver fatigue as a result of excessive driving or on-duty periods. Flammability of Interior Materials The flammability of the interior materials of the sleeper car, including the floor and wall covering, seat upholstery, and cushion materials, was reviewed. The Safety Board evaluated two types of foam present in the seat headrests for flame spread and smoke generation. The white headrest foam, which is not in widespread use and is being phased out, met the requirements for smoke generation following 1 minute of testing but did not meet them after 4 minutes. The white headrest foam also did not meet the requirements for flame spread. The blue headrest foam, when tested with the Kevlar cloth cover normally attached in order to act as a fire barrier, met the standards for flame spread. The blue foam passed the smoke generation requirements at 1 and 4 minutes, even without the Kevlar cloth cover. During the accident, the front half of the sleeper car was severely damaged by fire. The extensive fire damage was consistent with long exposure to high temperatures. Examination of the wreckage indicated that, following the collision, the front half of the car was in close contact with a fully developed pool fire that occurred when fuel spilled from the second locomotive ignited. The remaining sleeper car half, where it was not collapsed too much to be assessed, showed little fire damage. There was some discoloration of the interior window surfaces, and slight sooting of the interior materials in the areas closer to the impact site in the middle of the car. Close to the impact area, there was evidence of burned interior materials. Because the evidence of fire damage was concentrated around the sections of the car exposed to the external fuel fire and was not spread generally throughout the car, the Safety Board concludes that the flammability and smoke generation properties of the train’s interior materials did not contribute significantly to the spread of fire. Emergency Response The effectiveness of emergency response is affected by the preparations made by local jurisdiction responders and by the railroads involved. Because Amtrak is not able to provide on-site training to every emergency response agency within the territories through which it operates, these agencies often face the prospect of responding to a passenger train emergency without any real knowledge about the particular hazards passenger trains may present. In other words, local emergency responders may not know how to gain access to an overturned locomotive or passenger car, may not know where in cars to search for

Analysis 58 Railroad Accident Report trapped occupants, and may not be aware of the quantities of diesel fuel available to fuel a fire. Before this accident, neither the Bourbonnais Fire Protection District nor other Kankakee County emergency responders had been provided on-site instruction or training in responding to such emergencies. The Braidwood Fire Department officer, who arrived about 50 minutes after the first emergency responder, was familiar with petrochemical fires and recognized almost immediately that a large amount of foam was necessary to combat the blaze. Upon receiving concurrence from the incident commander, he called for heavy foam tanker trucks to come from a local chemical plant. The foam tanker arrived and was set up about 1 hour later, and within a few minutes of this equipment beginning to apply foam, the fire was extinguished. Before the arrival of the Braidwood officer, on the other hand, the incident commander had directed firefighting operations that had proved ineffective at either extinguishing the flames or at keeping the fire away from the sleeper car in which occupants were entrapped. The Safety Board concludes that because of insufficient training in responding to railroad emergencies or inadequate/inappropriate resources, or both, the Bourbonnais Fire Protection District was not prepared to respond effectively to a train accident involving a significant diesel fuel fire. Even though modern locomotives, such as the ones involved in this accident, are designed with improved protection for fuel tanks, the possibility of a fuel leak and fire is present anywhere a major railroad accident occurs. The Safety Board believes that Amtrak, in fulfilling its Federal mandate to help prepare emergency responders to respond to an accident involving Amtrak equipment, should emphasize to those responders the possibility that such an accident could result in large quantities of burning diesel fuel and urge them to be prepared to respond to this specific hazard. The Safety Board further believes that the International Association of Fire Fighters and the International Association of Fire Chiefs should inform their memberships of the circumstances surrounding this accident and of the need for responders to prepare for train accidents that may result in significant diesel fuel fires. Train Evacuation Effort When the first Bourbonnais Fire Protection District personnel arrived at the accident scene, they saw that some 30 to 35 employees of Birmingham Steel had responded to the scene had begun the rescue effort. These steel plant employees had cut a hole in the chain-link fence separating the wreckage site from the steel plant’s property and had brought a number of hand-held fire extinguishers and ladders from the plant to combat the flames. While some of the steel plant employees applied the fire extinguishers to the flames, others entered some of the damaged passenger cars to extricate entrapped passengers. These efforts were continued for an hour or more, when the steel plant employees were relieved by Bourbonnais Fire Protection District personnel, who continued the extrication efforts.

Analysis 59 Railroad Accident Report The Amtrak National Operations Center told emergency responders that the train could be carrying as many as 400 passengers. When Amtrak management arrived on scene, this number was lowered to 196. Several days after the accident, Amtrak identified the number of “confirmed” passengers to be 198. However, it was several more days before a complete list of passenger names was developed by Amtrak, and its accuracy remained in question. It was only later, when investigators were able to compare that list with a list provided by the Illinois State Police, that the correct passenger count of 207 could be determined. The difficulty in determining the number of passengers involved may have put emergency responders at unnecessary risk. As the fire progressed, entry into some of the overturned cars became more hazardous, but rescuers repeatedly risked their own safety, returning to the cars in order to help the trapped occupants. They stopped only when the fire made it impossible for them to help any further. In some cases, rescue workers were able to identify locations where people were trapped. In other cases, however, because of the confusion over the number of passengers actually aboard the train, they may have been searching for unaccounted-for passengers who did not really exist. Amtrak’s passenger train emergency preparedness plan contained no elements addressing the need to provide an accurate count of train occupants to local emergency responders in the event of a passenger train emergency. Nor do the Federal regulations require such a section. As the confusion following this accident shows, however, the lack of a reasonably accurate count can lead to rescue personnel risking their lives needlessly. In September 1994, the Safety Board published a report on its investigation into an Amtrak accident in Mobile, Alabama.35 In this report, the Safety Board highlighted the value of providing emergency responders with an accurate count of train occupants, recommending that Amtrak: R-94-7 Develop and implement procedures to provide adequate passenger and crew lists to local authorities with minimum delay in emergencies. Amtrak responded with a plan to develop a satellite and long-distance messaging system between long-distance trains and corporate offices. One benefit of this proposed new communications system would be improved passenger manifests. Following a 1997 Amtrak accident in Kingman, Arizona,36 Amtrak indicated to the Safety Board that such manifests were unlikely to become possible on unreserved trains, because of the many stops these trains make. The railroad did state, however, that computer systems exist that 35 National Transportation Safety Board, Derailment of Amtrak Train No. 2 on the CSXT Big Bayou Canot Bridge Near Mobile, Alabama, September 22, 1993, Railroad Accident Report NTSB/RAR-94/01 (Washington, D.C.: NTSB, 1994). 36 National Transportation Safety Board, Derailment of Amtrak Train 4, Southwest Chief, on the Burlington Northern Santa Fe Railway near Kingman, Arizona August 9, 1997, Railroad Accident Report NTSB/RAR-98/03 (Washington, D.C.: NTSB, 1998).

Analysis 60 Railroad Accident Report would enable them to provide such a list for reserved trains. As a result of these communications, the Safety Board closed the 1994 recommendation and issued a new recommendation urging Amtrak to: R-98-58 Expedite the development and implementation of a passenger and crew accountability system on reserved trains. Based on Amtrak responses in 2000, in which the railroad stated that it had implemented a system to account for all train occupants, the Safety Board classified this recommendation “ClosedAcceptable Action” in December 2000. Roadway Geometry/Highway Condition The wearing surface of the pavement was in good condition. The 5/8-inch to 1-inch depressed north shoulder indicates that there has been some use of the shoulder by vehicular traffic. This depression may have been caused by either railroad maintenance vehicles parking on the shoulder to service the signal bungalow in the northwest quadrant of the crossing or by large vehicles driving around lowered gates. According to tests conducted by the Safety Board and the Illinois State Police, an exemplar truck, loaded as the accident vehicle, would likely infringe on the shoulder area in the process of maneuvering around lowered gates. After the accident, the Illinois State Police took a tire print from this area; it did not match any tire pattern on any of the accident truck’s tires. Railroad pavement markings, consisting of an X, the letters “RR,” certain transverse lines, and “no passing” double solid yellow centerlines, were required by the MUTCD; none of these were in place. One intent of pavement markings is to inform the motorist that he is approaching a railroad crossing. But the truckdriver, because of his experience on this route, was familiar with the crossing and did not need to rely on pavement markings. Therefore, the Safety Board concludes that the lack of railroad pavement markings probably had no effect on the truckdriver’s driving behavior. As a result of its investigation of a March 14, 1982, accident in Mineola, New York,37 in which an impaired driver crossed the centerline to go around lowered gates and was struck by a Long Island Railroad commuter train, the Safety Board recommended that the Federal Highway Administration (FHWA): 37 National Transportation Safety Board, Long Island Railroad, Commuter Train/ Ford Van Collision, Mineola, New York, March 14, 1982, Railroad/Highway Accident Report NTSB/RHR-82/02 (Washington, D.C.: NTSB, 1982).

Analysis 61 Railroad Accident Report H-82-052 Review the effectiveness of guidelines in the Manual on Uniform Traffic Control Devices (MUTCD) on the use of traffic divisional islands to deter motorists from driving around lowered railroad crossing gates.38 The FHWA responded that the subject would be covered in the Railroad-Highway Grade Crossing Handbook in 1984 (actually published in 1986). The handbook (a new edition is being prepared) states that “traffic divisional islands may be used at crossings on multi-lane roadways to prevent motorists from driving around a lowered gate.” The recommendation was classified “ClosedAcceptable Action” in 1987. The Swift Rail Development Act, passed in 1991, required that regulations be established to require that a train’s horn be sounded on the approach to public highway/rail grade crossings except when supplemental safety measures fully compensate for the absence of audible warning, when there is no significant risk to persons, or when it is not practical (as is the case during certain backing movements). In response to the Swift Act, on January 13, 2000, the FRA published a notice of proposed rulemaking (NPRM) entitled “Use of Locomotive Horns at Highway-Rail Grade Crossings.” In this NPRM, the FRA indicates that the supplemental safety measures that would be considered adequate would include (1) four-quadrant gates, (2) medians or channelization devices at gated crossings, (3) paired one-way streets, (4) temporary crossing closure (for example, crossing closed at night), or (5) the use of photo-enforcement technology. The NPRM also indicated that in addition to the supplemental safety devices, all crossings within a quiet zone had to be equipped with train-activated lights and gates. The period for comments on the NPRM closed May 26, 2000; the FRA has received more than 2,300 comments. To give the public an opportunity to provide oral comments, the FRA also conducted a series of public hearings on the matter in California, the District of Columbia, Florida, Illinois, Indiana, Massachusetts, Ohio, and Oregon. According to the FRA’s Office of Safety, the rule is expected to be completed by spring 2002. Given the reasons detailed above, the Safety Board is pleased to note that the Village of Bourbonnais has installed temporary median barriers in McKnight Road in the vicinity of the grade crossing until such time as the crossing can be closed. Reducing Traffic Violations at Grade Crossings The Safety Board is pleased to note the steps that have been taken in Illinois and nationwide to improve grade crossing safety through better enforcement of traffic laws at grade crossings. For example, not only do new Federal regulations promulgated in 1999 prevent States from granting a provisional, probationary, or other temporary license to a CDL holder whose CDL has been suspended, the new regulations require CDL suspension for a driver convicted of a grade crossing violation. Further, current Illinois State law 38 The 2000 edition of the MUTCD states that channelization may be used between opposing lanes on all approaches when four quadrant gates are used.

Analysis 62 Railroad Accident Report provides that motorists convicted of grade crossing violations may be fined up to $500. In the case of CDL holders, both the fine and the potential loss of income (by CDL suspension) should provide an incentive for CDL holders to exercise greater caution at grade crossings. But while greater penalties for grade crossing violations are welcomed, their deterrent effect can be undermined if motorists perceive that they face little threat of detection or apprehension. To address this problem, some States, localities, and other entities have developed innovative ways of approaching grade crossing enforcement. For example, Operation Lifesaver 39 organizations in several States have conducted programs to place law officers on trains and at stationary locations along the trains’ routes. The officers at the stationary locations stop and ticket those motorists identified by on-board officers as having violated traffic control devices at crossings. While programs such as this can increase law enforcement awareness of grade crossing violations, in some States they are conducted only sporadically. As noted above, motorists who encounter what is, at best, limited and intermittent enforcement of traffic laws at grade crossings may conclude that it is possible to violate those traffic laws with some impunity. To increase the likelihood that grade crossing violations will not go undetected, some States, municipalities, and railroads have turned to the use of photo enforcement at grade crossings. In use throughout the world for more than 40 years,40 photo enforcement technology such as that used for identifying and citing those who run red lights has recently been adapted for use at grade crossings. In 1995, for example, the Los Angeles Metropolitan Transportation Authority (MTA) began a photo enforcement program that has been credited with reducing by almost 50 percent the number of grade crossing violations detected at 17 gated crossings along the Metro Blue Line route.41 Encouraged by the program’s success, the MTA is planning to expand its use of photo enforcement by installing six more crossing video systems during the first half of 2002. A grade crossing photo enforcement pilot program has also recently been established in Illinois. The Illinois General Assembly in 1996 required the Illinois Commerce Commission to conduct a study of the effectiveness of photo enforcement at grade crossings. According to the commission, it selected three grade crossings in DuPage County, Illinois, for the test. Because of difficulties in establishing contracts, as well as construction problems, the three sites were completed at different times. Fully functional in January 2000, photo enforcement at the grade crossing in the city of Wood Dale achieved a 47-percent decrease in the number of violations between January and September 2000. This crossing, which had formerly experienced three to four collisions per year had only one collision in the pilot program’s first 13 months of operation. Photo 39 Operation Lifesaver is a not-for-profit organization that provides information about grade crossing safety to motor vehicle operators, as well as to law enforcement agencies, through safety education programs. 40 http://www.photocop.com is a non-commercial web site providing research and technical information about photo enforcement. 41 Metropolitan Transportation Authority, New Signs, Cameras Reducing Accidents, Illegal Crossings on Metro Blue Line, MTA News http://www.mta.net/press/stakeholders/scoop_stories/leftturn_trains.htm.

Analysis 63 Railroad Accident Report enforcement at the grade crossing in the city of Naperville was functional in July 2000, and the crossing has seen a 51-percent reduction in the number of violations. According to the FRA, the State of North Carolina has established, with Federal assistance, a program to eliminate grade crossing hazards as part of an attempt to develop a high-speed rail corridor within its borders.42 Known as the Sealed Corridor Initiative, the program calls for the improvement or closure of every crossing along the proposed corridor. The plans include installation of four-quadrant gates, longer gate arms, and median barriers as well as video enforcement of grade crossing traffic laws. The testing of the video enforcement project has recently begun. In the Safety Board’s 1998 grade crossing safety study,43 the Safety Board noted the sporadic nature of traffic law enforcement at passive crossings (those without train- activated warning devices). In order to promote better law enforcement at passive crossings, the Safety Board issued the following safety recommendation to the Secretary of Transportation: H-98-29 Provide Federal highway safety incentive grants to States to advance innovative pilot programs designed to increase enforcement of passive grade crossing traffic laws. After the DOT indicated that it had made inquiries to State and local law enforcement for suggestions regarding enforcement programs, the Safety Board classified Safety Recommendation H-98-29 “OpenAcceptable Response.” Whereas this recommendation was directed to enforcement at passive grade crossings, this accident, as well as subsequent violations recorded at the McKnight Road and St. George Road grade crossings, indicates that grade crossings equipped with train- activated warning devices could also benefit from innovative enforcement programs such as the photo enforcement programs employed in several locations. The Safety Board therefore believes that the DOT should provide Federal highway safety incentive grants to States to advance innovative pilot programs designed to increase enforcement of grade crossing traffic laws at both active and passive crossings. This recommendation replaces Safety Recommendation H-98-29, which has been reclassified “ClosedSuperseded.” 42 http://www.fra.dot.gov/o/hsgt/states/NC2.htm on January 16, 2002. 43 National Transportation Safety Board, Safety at Passive Grade Crossings, Volumes I and II, NTSB Safety Study Nos. NTSB/SS-98/02 (Vol. I: Analysis) and NTSB/SS-98/03 (Vol. II: Case Summaries) (Washington, D.C.: NTSB, 1998).

64 Railroad Accident Report Conclusions Findings 1. The following factors did not cause or contribute to the accident: the physical condition or actions of the engineer of Amtrak train 59; the mechanical condition of the train and the condition of the tracks; railroad operating procedures and policies; the mechanical condition of the truck-tractor semitrailer; the equipment making up Amtrak train 59; weather; alcohol, drugs, or prescription medications; and the location of traffic control signs on the approach to the grade crossing. 2. The accident-involved truck-tractor semitrailer was probably traveling between 7 and 14 mph at the time of the collision. 3. The grade crossing signal lights began flashing at least 26 seconds before the train’s arrival at the McKnight Road grade crossing. 4. Based on the signal system tests and physical evidence, including evidence of the truck’s position at the time of impact, both crossing gates likely lowered as designed as the accident truck approached the crossing. 5. The truckdriver had ample time to safely stop his truck and avoid an accident, but likely as a result of fatigue, he failed to respond appropriately to the signals and instead decided to attempt to cross ahead of the train. 6. Melco Transfer, Inc., failed to provide driver oversight sufficient to detect or prevent driver fatigue as a result of excessive driving or on-duty periods. 7. The flammability and smoke generation properties of the train’s interior materials did not contribute significantly to the spread of fire. 8. Because of insufficient training in responding to railroad emergencies or inadequate/inappropriate resources, or both, the Bourbonnais Fire Protection District was not prepared to respond effectively to a passenger train accident involving a significant diesel fuel fire. 9. The lack of railroad pavement markings probably had no effect on the truckdriver’s driving behavior.

Conclusions 65 Railroad Accident Report Probable Cause The National Transportation Safety Board determines that the probable cause of the collision between Amtrak train 59 and a truck tractor-semitrailer combination vehicle at the McKnight Road grade crossing in Bourbonnais, Illinois, was the truckdriver’s inappropriate response to the grade crossing warning devices and his judgment, likely impaired by fatigue, that he could cross the tracks before the arrival of the train. Contributing to the accident was Melco Tranfer, Inc.’s failure to provide driver oversight sufficient to detect or prevent driver fatigue as a result of excessive driving or on-duty periods.

66 Railroad Accident Report Recommendations As a result of its investigation of the March 15, 1999, grade crossing accident in Bourbonnais, Illinois, the National Transportation Safety Board makes the following safety recommendations: New Recommendations To the U.S. Department of Transportation: Provide Federal highway safety incentive grants to States to advance innovative pilot programs designed to increase enforcement of grade crossing traffic laws at both active and passive crossings. (H-02-1) To the Federal Railroad Administration: For all railroads that install new or upgraded grade crossing warning systems that include crossing gates and that are equipped with event recorders, require that the information captured by those event recorders include the position of the deployed gates. (R-02-1) To All Class I Railroads: To All Regional Railroads: For all your new and upgraded grade crossing warning systems that include crossing gates and that are equipped with event recorders, ensure that the information captured by those event recorders includes the position of the deployed gates. (R-02-2) To the National Railroad Passenger Corporation: In fulfilling your Federal mandate to help prepare emergency responders to respond to an accident involving Amtrak equipment, emphasize to those responders the possibility that such an accident could result in large quantities of burning diesel fuel and urge them to be prepared to respond to this specific hazard. (R-02-3)

Recommendations 67 Railroad Accident Report To the International Association of Fire Fighters: To the International Association of Fire Chiefs: Inform your membership of the circumstances surrounding the emergency response to the March 15, 1999, grade crossing accident in Bourbonnais, Illinois, and of the need for responders to prepare for train accidents that may result in significant diesel fuel fires. (R-02-4) Recommendations Reclassified in This Report To the U.S. Department of Transportation: H-98-29 Provide Federal highway safety incentive grants to States to advance innovative pilot programs designed to increase enforcement of passive grade crossing traffic laws. Safety Recommendation H-98-29, previously classified “OpenAcceptable Response” is reclassified “ClosedSuperseded” in the “Reducing Traffic Violations at Grade Crossings” section of this report. BY THE NATIONAL TRANSPORTATION SAFETY BOARD MARION C. BLAKEY Chairman CAROL J. CARMODY Vice Chairman JOHN A. HAMMERSCHMIDT Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: February 5, 2002

this page intentionally left blank

69 Railroad Accident Report Appendix A Investigation The National Transportation Safety Board was notified at 11:52 p.m., eastern standard time, on March 15, 1999, of a collision and derailment involving an Amtrak passenger train and a truck tractor-semitrailer combination vehicle in Bourbonnais, Illinois. The investigator-in-charge, Board Member John Goglia, and other members of the Safety Board investigative team were dispatched from Washington, D.C., headquarters, and from the Chicago, Illinois; Atlanta, Georgia; and Los Angeles, California, field offices. Upon arriving at the scene, investigative groups were established to study railroad operations, motor carrier operations, track, highway, signals, railroad mechanical, highway vehicle, survival factors, railroad human performance, highway human performance, locomotive event recorders, and hazardous materials issues. A separate group was established to coordinate the many witness interviews. The Safety Board was assisted in the investigation by the Federal Railroad Administration, the Illinois Commerce Commission, the National Passenger Railroad Corporation, the Canadian National/Illinois Central Railroad, the Brotherhood of Locomotive Engineers, the United Transportation Union, the Bourbonnais Fire Protection District, the Illinois State Police, the Village of Bourbonnais Police Department, Melco Transfer, Inc., and Alstom Signaling, Inc. Hearings The Safety Board held a public hearing, chaired by Member George Black, in Chicago, Illinois, on September 13-15, 1999. Parties to the hearing included the Federal Railroad Administration, the Federal Highway Administration, the National Railroad Passenger Corporation, the Canadian National/Illinois Central Railroad, the Illinois Commerce Commission, the Brotherhood of Locomotive Engineers, the United Transportation Union, and Melco Transfer, Inc.

FD07263 ｜ 2002_美国_RAR0202.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2002 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 RAILROAD ACCIDENT REPORT PB2002-916302 NTSB/RAR-02/02 Derailment of CSX Transportation Coal Train V986-26 at Bloomington, Maryland, January 30, 2000 7445

THE CORRECTIONS BELOW ARE INCLUDED IN THIS VERSION OF THE PUBLISHED REPORT RAILROAD ACCIDENT REPORT NTSB/RAR-02/02 (PB2002-916302)

DERAILMENT OF CSX TRANSPORTATION COAL TRAIN V986-26 AT BLOOMINGTON, MARYLAND January 30, 2000

• Page 24 has been updated with the correct junction name. (12 Aug 2002) The name originally printed as Virginia Central Junction.

• Page 20 has been updated to correct the data in Table 2 under the column heading Coefficient of Friction for Car Type, CSXT 392663, Step 13. (21 May 2003) The data originally printed as 03263.

Railroad Accident Report Derailment of CSX Transportation Coal Train V986-26 at Bloomington, Maryland, January 30, 2000 NTSB/RAR-02/02 PB2002-916302 National Transportation Safety Board Notation 7445 490 L’Enfant Plaza, S.W. Adopted March 5, 2002 Washington, D.C. 20594

National Transportation Safety Board. 2002. Derailment of CSX Transportation Coal Train V986-26 at Bloomington, Maryland, January 30, 2000. Railroad Accident Report NTSB/RAR-02/02. Washington, DC. Abstract: About 7:00 a.m. on January 30, 2000, eastbound loaded CSX Transportation coal train V986-26 lost effective braking while descending a section of track known as “17-mile grade” from Altamont to Bloomington, Maryland, and derailed 76 of its 80 “bathtub” high-side gondola cars when the train failed to negotiate curves at excessive speed. The derailed cars destroyed a nearby occupied residence, killing a 15- year-old boy and seriously injuring his mother. Three other occupants of the residence escaped with little or no injury. Track and equipment damages were estimated to be in excess of $3.2 million. There was no resulting fire or hazardous materials release. The safety issues addressed in the report include the determination and designation of maximum authorized train speeds with sufficient safety margins to ensure that a train can be stopped by the air brake system alone; locomotive engineer support and training; and engineer knowledge of the condition of the dynamic braking system before and during use. As a result of its investigation of this accident, the Safety Board makes safety recommendations to CSX Transportation and all class I railroads. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2002-916302 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Railroad Accident Report Contents Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iv Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Train Makeup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Train Movement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Descent of 17-Mile Grade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Damages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Personnel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Engineer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Conductor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Trainman Trainee . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Train Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Train Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Track Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Signal Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Operations Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Toxicological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Track and Signal Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Accident Site Inspection of Cars . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 End-of-Train Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Locomotive Tests and Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Multiple-Unit Cable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Event Recorders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Calculation of Braking Horsepower . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Load Cell Brake Shoe Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Dynamometer Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Engineer Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Determination of Maximum Authorized Speeds and Braking Capability . . . . . . . . . . 23 CSXT Postaccident Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Weather . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Fatigue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Toxicology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Track and Signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Event Recorder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Air Brake System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Dynamic Braking and Train Speed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Contents iv Railroad Accident Report Tread Brakes/Air Brakes and Stopping Ability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 CSXT Management Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Engineer’s Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Engineer’s Support and Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Use of End-of-Train Emergency Switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Emergency Radio Use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Appendixes A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .39 B: How Freight Train Air Brakes Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

v Railroad Accident Report Executive Summary About 7:00 a.m. on January 30, 2000, eastbound loaded CSX Transportation (CSXT) coal train V986-26 lost effective braking while descending a section of track known as “17-mile grade” from Altamont to Bloomington, Maryland, and derailed 76 of its 80 “bathtub” high-side gondola cars when the train failed to negotiate curves at excessive speed. The derailed cars destroyed a nearby occupied residence, killing a 15- year-old boy and seriously injuring his mother. Three other occupants of the residence escaped with little or no injury. Track and equipment damages were estimated to be in excess of $3.2 million. There was no resulting fire or hazardous materials release. The National Transportation Safety Board determines that the probable cause of the January 30, 2000, derailment of CSX Transportation train V986-26 near Bloomington, Maryland, was the railroad’s practice of including dynamic braking in determining maximum authorized speed without providing the engineer with real-time information on the status of the dynamic braking system. The safety issues addressed in the report include: • The determination and designation of maximum authorized train speeds with sufficient safety margins to ensure that a train can be stopped by the air brake system alone. • Locomotive engineer support and training. • Engineer knowledge of the condition of the dynamic braking system before and during use. As a result of its investigation of this accident, the Safety Board makes safety recommendations to CSX Transportation and all class I railroads.

this page intentionally left blank

1 Railroad Accident Report Factual Information Accident Synopsis About 7:00 a.m. on January 30, 2000, eastbound loaded CSX Transportation (CSXT) coal train V986-26 lost effective braking while descending a section of track known as “17-mile grade”1 from Altamont to Bloomington, Maryland, (figure 1) and derailed 76 of its 80 “bathtub”2 high-side gondola cars when the train failed to negotiate curves at excessive speed. The derailed cars destroyed a nearby occupied residence, killing a 15-year-old boy and seriously injuring his mother. Three other occupants of the residence escaped with little or no injury. Track and equipment damages were estimated to be in excess of $3.2 million. There was no resulting fire or hazardous materials release. 1 Grade is defined as the change in elevation along the track. It is expressed in percentage representing the change in vertical elevation, in feet, over a distance of 100 feet. For example, a change in elevation of 1 foot over a distance of 100 feet would represent at 1-percent grade. Mountain, heavy, or steep grade for a train of 4,000 trailing tons or less is a grade of 2 percent or more for a distance of 2 or more miles. For a train with a trailing tonnage of more than 4,000 tons, steep grade is an average of 1 percent or more grade for 3 or more miles. 2 Unlike hopper cars, these cars do not have bottom outlets and must be unloaded in a rotary dump cradle. Figure 1. Accident location. Pennsylvania Virginia West Virginia Ohio MD Bloomington

Factual Information 2 Railroad Accident Report Accident Narrative3 Train Makeup CSXT train V986-26 originated at the CSXT Grafton Yard in Grafton, West Virginia, and was destined for the Potomac Electric Power Company’s Bennings power plant in Washington, D.C. The 80 loaded coal cars of the accident train originated at the Sentinel (coal) Mine, which is about 13 miles from Grafton on the CSXT Cowen Subdivision. On January 28, 2000, a CSXT train crew put together the two previously assembled blocks of 40 loaded coal cars that would become the accident train using a two- locomotive consist. After the initial terminal air brake tests and equipment inspection, the train departed the mine. At that time, the train’s brake pipe4 air pressure was set for 90 pounds per square inch (psi), and according to the crew, the end-of-train device (EOT)5 was showing a train line pressure of 88 1/2 psi at the rear of the train. (See appendix B for more detailed information on the operation of freight train air brakes.) According to the mine train crew, the movement from the mine to Grafton Yard was routine and without incident. When the train reached Grafton Yard, it was moved to the East Yard No. 3 track. The locomotives were removed, and the train line was connected to an 80-psi yard air supply to maintain brake pipe pressure. About 11:30 p.m. on January 29, a yard crew at Grafton Yard, under the direction of the dispatcher, assembled the three-locomotive consist of the accident train,6 with a former Conrail locomotive as the lead unit. (See figure 2.) Once the locomotive units were coupled together on the eastbound track, the yard crewmembers connected the locomotives’ air hoses and multiple-unit cables,7 and performed an air test. They then coupled the locomotive consist to the 80 loaded coal cars on No. 3 track that would make up train V986-26. According to the CSXT Locomotive and Train Air Brake Test Certificate signed by the yard crew engineer, a locomotive brake test was completed at 12:01 a.m., January 30. A successful set-and-release train brake test was also performed. 3 The following narrative is based on witness interviews as corroborated by CSXT records, official documents, and train event recorder data. 4 Commonly called a “train line,” the brake pipe is the pipe, hose, connections, angle cocks, cut-out cocks, fittings, etc., connecting the locomotive and all cars from one end of the train to the other for the passage of air to charge and control the brakes. 5 An EOT transmits to the lead unit (head-end locomotive) the brake pipe pressure at the rear of the train. Brake pipe pressure can also be seen on a digital readout on the flashing rear-end device itself. 6 The number of locomotive units assigned to eastbound coal trains had recently been increased from two to three to preclude delays due to insufficient power. 7 The multiple-unit cable electronically connects coupled individual locomotive units, enabling them to be controlled from one cab as one locomotive.

Factual Information 3 Railroad Accident Report After the locomotives were attached to the accident train, a utility employee8 removed the yard air. The yard crewmembers were instructed to move the accident train down track No. 3 to the scale house, where they secured the train and were relieved. The accident train crewmembers (an engineer, a conductor, and a trainman trainee) arrived at Grafton about 2 hours later, at 2:00 a.m. on January 30. After receiving their orders and conducting a job briefing, the accident train crewmembers went to the train. The utility employee helped the accident engineer test the air brakes, as required by the Federal Railroad Administration (FRA). The train line pressure was set for 90 psi, and according to both the engineer and the utility employee, the EOT indicated a pressure of 81 psi at the rear of the train.9 The engineer and the utility employee also successfully tested the EOT emergency brake application feature.10 The crew then checked that the locomotive hand brakes were off and that the control console of each trailing locomotive unit was set up in the proper configuration. About 2:30 a.m., the train, upon receiving the signal from the dispatcher, departed Grafton Yard. Figure 2. Accident locomotive consist. 8 The utility employee performs several jobs in the yard, combining functions of a brakeman, a switchman, and a carman. 9 That the flashing rear-end device showed a brake pipe pressure of 81 pounds was later verified by the event recorder, which recorded both the head-end and rear-end train line pressures. 10 This was a two-way EOT, which gives the engineer the capability to remotely initiate an emergency brake application (by immediately releasing all air pressure from the train line) from the rear end of the train, either to get a quicker application or because a train line blockage is preventing the propagation of an application from the locomotive.

Factual Information 4 Railroad Accident Report The utility employee said that he observed the last 30 to 35 cars of the train as it departed and that he noted no problems. He also said that he saw no snow or ice around the brake shoes or trucks. Train Movement When the train reached Newburg at milepost (MP) 267.2, it stopped so a helper11 could be added. The engineer said that up to that point, he had not needed to use either the air brakes or the dynamic brakes12 to control the train. When the helper arrived and was coupled onto the rear of the coal train, the helper flagman (brakeman) disconnected the train line from the coal train EOT and connected it to the helper.13 The helper engineer told the train engineer that there were 82 pounds of pressure and asked him to do a set-and-release brake test. After successful completion of the test, the train proceeded east with a clear signal. From then on, except at Blaser (MP 258.9), until the helper was uncoupled at Terra Alta, the train engineer did not communicate with the helper engineer except to call signals. When the train reached the top of the hill at Blaser, the helper engineer radioed the train crew that the air on the rear of the train was adequate to go down the hill. The train proceeded down the hill at the authorized speed of 25 mph; however, the helper engineer thought something was unusual: I think we used 17 pounds of air14 coming down the first hill. Which was kind of [unusual]…. Generally, 10 to 11 [pounds of] air will hold a train off there…. But [the coal train engineer] controlled the train at the speed limit…. The helper engineer said later that he did not say anything to the train engineer about the heavier air brake application, even though he thought it was unusual, because the train was under control and not exceeding the authorized speed. The train reached the bottom of the grade at Rowlesburg and began the uphill climb to Terra Alta. The train reached the top of the grade at Terra Alta without difficulty, where it stopped to cut off the helper. 11 The helper was a two-unit locomotive placed on the rear of the train to help push the coal train up the grade to Altamont. 12 Dynamic braking is a method of train braking in which the locomotive’s traction motors are converted to electric generators driven by kinetic energy from the moving train. The generated electricity flows into a resistor grid on the locomotive and is dissipated as heat. This electrical “load” on the traction motor/generator acts to slow the motor shaft rotation, resulting in a braking action being applied to the train wheels. Dynamic braking on the locomotives is completely independent of the air braking system on the cars themselves. 13 This type of two-way EOT can remain in the coupler when another car or locomotive is coupled to it. 14 Meaning that the train line pressure was reduced by 17 psi. Brake application is modulated by the amount of air pressure reduction. In an emergency brake application, the air pressure is quickly reduced to zero.

Factual Information 5 Railroad Accident Report As the train draped the crest of the grade at Terra Alta, the helper was uncoupled. The helper brakeman reconnected the flashing EOT to the train line, but the EOT would not register train line pressure. The helper brakeman replaced the EOT with a spare unit carried aboard the helper, and he and the train engineer were then able to establish telemetry and successfully performed an air test and an EOT emergency feature test. About 5:43 a.m., the train continued east, and the helper returned to Rowlesburg. The portion of railroad from Terra Alta to Altamont was undulating over 18.6 miles, and the maximum authorized speed for coal trains was 30 mph.15 The eastbound route had a brief down grade, from Terra Alta to Snowy Creek, during which the engineer maintained a speed of 28 to 29 mph by using dynamic braking and a short and limited application of the air brakes.16 The engineer then went to full throttle (throttle control in the 8th notch) and ascended the grade to Edgewood, east of the Maryland State line. Then he descended the shallow down grade to Skipnish Fill, while he again made a short, 1- minute, minimum 8-pound application of the air brakes, supplemented by dynamic braking. (The engineer was unaware that the lead locomotive was the only unit on which dynamic braking was actually being applied because of a defective multiple-unit cable connecting the lead locomotive with the first trailing unit.) After that, the grade dropped off rather sharply down into the Youghcogheny River Valley through Macking’s Hollow, just west of Oakland, Maryland. The engineer used a brief minimum brake application of 10 pounds for about a minute and a half while continuously using heavy dynamic braking. The railroad was relatively level through Oakland and then gently ascended to Mountain Lake Park, where the grade increased and the railroad climbed up through Deer Park, Maryland, about 2.8 miles from the grade at Altamont. When the train reached Oakland, the engineer came out of dynamic braking and increased the throttle, eventually accelerating to 40 mph in order to build enough momentum to ascend to Altamont. He maintained maximum throttle (notch 8) on the climb to Altamont, but the speed slowly dropped to 15 mph as the lead locomotive unit crossed the summit, about 6:22 a.m. About a minute later, the speed dropped to 13 mph, and the engineer made a minimum brake application while in throttle notch 7. He proceeded to drag the train over the crest of the Altamont summit17 while progressively reducing the throttle as more of the train crested and began the descent. During this time, the train’s speed dropped to 9 mph and then climbed to 13 mph. Descent of 17-Mile Grade As it began its descent at Altamont, down 17-mile grade, the train had been running for more than 4 hours and had traveled about 58 miles. Until the train had reached Newburg, where the helper was added, the engineer had not used either the air brakes or 15 All braking and speed information in this section is taken from locomotive event recorder data downloaded after the accident. 16 The engineer made a 9-psi reduction of the brake pipe for about a minute over about 1/2 mile between MPs 239.5 and 239. 17 The summit of the grade at Altamont is 2,629 feet above sea level and is crossed at that point by Maryland Route 135.

Factual Information 6 Railroad Accident Report the dynamic brakes. Between Newburg and Altamont (about 25 miles), the engineer made four applications of the air brakes, totaling 43 minutes and 18 miles. One of the four applications was the 17-pound reduction at Blaser that was noted by the helper engineer. The train started down 17-mile grade (an average grade of 2.4 percent18) at 13 mph in throttle notch 7 with a 6-pound reduction19 of the train line. The maximum authorized speed from Altamont to Swanton Flats was 30 mph. Over the next 3 minutes, as more of the train crested the summit and began to descend, the engineer increased the train line reduction to 10 psi, which increased the brake application. During this time, he also went from pulling (throttle) to dynamic braking, which he increased to the near maximum according to the event recorder on the lead locomotive unit. For the next 7 minutes, he maintained heavy dynamic braking (which was affecting only the lead locomotive because of the defective cable) and continued to increase air braking by making incremental 1- pound reductions in train line pressure about every 30 seconds until he had a 17-pound reduction. About 10 minutes down the grade from Altamont, near “Swanton Flats” (Swanton Road MP 219.4), the engineer deactivated dynamic braking and began to apply traction power while still maintaining a 17-pound reduction in train line pressure. The maximum authorized speed from Swanton Flats to Bloomington was 25 mph. The engineer then powered against the train brakes for about the next 2 miles (5 minutes) while keeping the speed between 21 and 24 mph. When asked later if the reason he powered against the brakes was that he was afraid of stalling out at Swanton Flats, the engineer stated, “Yes, sir. A lot of times, your trains will hang up there if you don’t keep your speed up.” The engineer outlined the consequences of stalling out at Swanton Flats: You stop and then the brakeman goes back and sets up all the brakes. And then you recharge your train and then put the air on and he’ll knock them off and then you can continue down the hill. [This takes] I’d say a good two and a half hours somewhere. And in that point, probably longer with the ice, the way the weather was climbing up and down. 18 Gravity acts on each ton of train weight with a force of about 20 pounds for each percent of grade. 19 According to the engineer, he considered the reduction a “minimum” or preliminary application of the brakes.

Factual Information 7 Railroad Accident Report According to CSXT Train Handling Rules20: When necessary to apply power descending long heavy grades, trains must not be pulled for a distance greater than 2 miles if the brake pipe reduction is 18 pounds [psi] or greater. According to FRA inspectors who have ridden trains down 17-mile grade and to CSXT operating officers and CSXT engineers who regularly operate trains through the accident area, it is possible to control a loaded coal train headed by three modern locomotive units with a 12-pound or less brake pipe reduction and light throttle or dynamic brake modulation. The accident engineer stated several times that he attributed his use of more air brake than usual to the wet snow and icy rail. About 16 minutes down 17-mile grade, near MP 218, the engineer went from power to heavy dynamic braking with the 17-pound reduction still applied. The train was moving at 24 mph. Several minutes after reaching full or near-full dynamic braking (on the lead unit only), the train’s speed reached 28 mph, and the engineer increased the train line reduction to 18 pounds. Over the next 2 minutes, he steadily increased the train line reduction to 26 pounds, or “full service,” in response to the train’s steadily increasing speed. The train failed to slow, and about 30 seconds later, while moving at 34 mph at MP 214.34, the engineer put the train brakes in “emergency,”21 which eliminated any effect from the dynamic braking. The train briefly slowed to 30 mph and then began to accelerate. Despite the emergency application of the air brakes, the train’s speed steadily increased over the next 6 minutes to 59 mph. When the engineer placed the train in emergency, he used the automatic brake valve handle. He did not use the switch in the cab that would have activated an emergency application from the two-way EOT on the rear of the train. He said that he noted the EOT was indicating a train line pressure of 0 psi about a minute and a half after he had made the emergency application and that he therefore felt no need to activate the switch. He said that he was taught to activate the switch only if the emergency application did not apply on the rear. The conductor said that he noted on his display screen that the train line had depleted to 0 psi and that he, therefore, knew that the emergency brake application had propagated all the way to the end of the train. 20 Effective January 1, 1998, and revised July 1, 1999, Rule 3.3.7, “Speed Control on Descending Grade,” paragraph C: “Use of Power on Heavy Descending Grades.” 21 Emergency braking increases the brake shoe pressure on the wheel by about 25 percent over that of full service.

Factual Information 8 Railroad Accident Report When it became apparent that the train was uncontrollable, the engineer attempted to radio the dispatcher on the locomotive radio but was unable to do so. According to the engineer: I could not contact the dispatcher. I tried the emergency button, the code 9 and applied on channel 14, but [this was] a Conrail radio, and evidently they’re not compatible with ours [CSXT]. The conductor said: We tried to contact the dispatcher with the engine radio, but the engine radio is a Conrail radio, and it will not contact our dispatchers, the equipment is not compatible. Radios are locked-in and not changeable by crews. The trainman trainee was in the second locomotive unit cab. He said: The first suspicion I had that anything was amiss was that the brake shoes were burning and there was acrid smoke coming into the…cabin of the second locomotive. I opened the window, and it was even worse. I shut it quickly. Five minutes later, the engineer came on the radio, and said, ‘Go to channel 14 and get the dispatcher on the radio.’ He said there was a button that I should press, number

1. Well, the second radio is different from what he had, and I didn’t know how to

operate it, so I went to channel 14, but I was still on channel 8. I broadcast the emergency, but I was unable to get the dispatcher. During postaccident interviews, the trainman trainee was asked if he had been trained in making an emergency radio transmission. He said: Yes, but getting the dispatcher on the radio here is something different. You have to press certain buttons and I wasn’t still surehe gave me some instructions over the radio, but the second radio was different from his, and it had no key pad, so I did not know how to operate the second radio. The trainman trainee stated that he had seen as many as five different styles of radios on various locomotives but that the instructions he had been given on their use were generic and were not specific to any particular type of radio. Near Bond, MP 212.6, the trainman trainee inadvertently contacted the operator at West Keyser. The operator responded and said that the train was “lit up,” or cleared for continued movement. The conductor told the operator that the train was going through Big Curve at 50 mph and was in “real trouble.” The conductor told the engineer that he did not believe the train would get to the bottom of the hill at all. The conductor said that he and the engineer discussed jumping but “figured we were going to land in a ditch someplace with the engine on top of us. I figured our chance of survival was about zero.” The train ultimately reached a speed of 59 mph. The train broke apart and derailed at curves in three separate segments, starting from the rear end. At MP 210.6, the first group of 20 cars separated, and 17 of the 20 cars derailed. At MP 209.8, another 18 cars separated and derailed. Finally, at MP 208.2, the remaining 42 cars separated, and 41 of

Factual Information 9 Railroad Accident Report the 42 derailed in a general pileup. (See figure 3.) Some of the 41 derailed cars struck a nearby occupied residence, destroying the house and killing a 15-year-old boy and seriously injuring his mother. (See figure 4.) Three other occupants of the house escaped with minor or no injuries. Some of the 41 cars also broke a gas pipeline inside a transfer building near the track; as a result, about 101 customers of Columbia Gas of Maryland temporarily lost natural gas service. Figure 3. Pileup of derailed coal cars. Figure 4. Destroyed residence where one fatal and one serious injury occurred.

Factual Information 10 Railroad Accident Report The three locomotive units finally came to rest more than 2 miles down the track, at MP 206.5, just west of Piedmont Road Crossing, where the crew was subsequently picked up and taken to Cumberland for toxicology testing and interviews. Damages Damages to railroad equipment totaled about $1.8 million (67 of the 76 cars that derailed had to be scrapped). Other damages included: • Lading of coal: $182,753 • Track and signal: $275,000 • Private property: $288,963 • Clean up: $14,297 Total damages were in excess of $3.2 million. Injuries Table 1. Injuries. Injury Scalea CSXT Operating Crew Residents Total Fatal 0 1 1 Serious 0 1 1 Minor 0 2 2 None 3 1 4 Total 3 5 8 a49 Code of Federal Regulations 830.2 defines fatal injury as “any injury which results in death within 30 days of the accident” and serious injury as “an injury which: (1) requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; (2) results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages, nerve, or tendon damage; (4) involves any internal organ; or (5) involves second or third-degree burns, or any burn affecting more than 5 percent of the body surface.”

Factual Information 11 Railroad Accident Report Personnel Information Engineer The Baltimore & Ohio Railroad, a CSXT predecessor, had hired the engineer in

1. He had started in the maintenance-of-way department working on track and then

moved to the mechanical department, repairing cars and locomotives. He changed jobs again to work in train service as a brakeman and finally went to engine service, becoming an engineer in 1976. According to CSXT records, the engineer had neither medical restrictions nor disciplinary actions. His personal record file showed he had taken or received the following required examinations, classes, tests, and certifications22: Last medical examination 5-03-99 Driver’s License (WV) 6-29-99 Rules Class 1-27-00 Scored 94 out of 100 FRA Locomotive Engineer Certification23 Knowledge

5-04-99 Scored 98 out of 100 Performance 3-21-99 Scored 90 out of 100 Certified 12-31-99 Skill Performance Evaluations by a road foreman or supervisor 1-17-00 Scored 95 out of 100 6-27-98 Scored 95 out of 100 5-12-98 Scored 95 out of 100 5-11-98 Scored 90 out of 100 3-05-98 Scored 90 out of 100 9-17-97 Scored 90 out of 100 6-18-97 Scored 95 out of 100 6-13-96 Scored 95 out of 100 22 A more complete description of the evaluations and examinations can be found later in this report in the “Evaluations” portion the “Engineer Training” section. 23 CSXT locomotive engineers are tested for FRA certification every 3 years according to 49 CFR Part

1. The FRA locomotive engineer certification program began in January 1992.

Factual Information 12 Railroad Accident Report The engineer was considered to be one of the most senior and experienced engineers in the Grafton area. He said that he had taken trains from Grafton to Cumberland “thousands of times” since becoming an engineer in 1976. Before the accident, he had been in yard service for approximately 4 years. His yard service involved switching cars within the yard at Grafton, taking empty coal trains up to coal mines around Grafton, and returning with loaded coal trains down grade to Grafton. He had returned to road service on January 9 and had made a total of 20 trips, 12 westbound and 8 eastbound, between Grafton and Cumberland before the accident. Of the eight eastbound trips, all but one were with loaded coal trains. The engineer made a trip on January 29, the day before the accident. According to CSXT computer records, he was relieved at 11:00 a.m. and off at 12:15 p.m.24 He said he went home and ate and was asleep by about 2:30 p.m. At 9:30 p.m., about 7 hours later, he said, he was called to report at 11:30 p.m. for the accident train.25 He said he reported to the Cumberland Yard office about 11:30 p.m. He and the crew were then sent by taxi to Grafton, where they arrived about 2:00 a.m. on January 30. He said he felt well rested when he came on duty. Conductor The conductor stated that he had been off for 11 hours and 30 minutes before reporting for the accident train. He was not a qualified engineer. Trainman Trainee The trainman trainee had been on the railroad for about a month before the accident. He had spent most of the time in a classroom in Atlanta, Georgia, taking part of his CSXT initial training. He had had no previous railroad experience. At the time of the accident, he was sitting in the second locomotive unit cab because the engineer smoked and he did not like the cigarette smoke. Train Information Train Equipment The locomotive for the accident train consisted of three locomotive units; CSXT 806 (an ex-Conrail unit) was lead, BNSF26 9481 trailed next, and CSXT 8666 was last. General Motors Electromotive Division manufactured all the locomotive units, which were high-horsepower six-axle locomotive units with high-adhesion trucks and extended range dynamic braking capability. 24 Eastbound loaded coal train V986-28. On-duty time was 11:30 p.m. on January 29. 25 The engineer was off 11 hours and 15 minutes between the time he finished and 11:30 p.m., the time he was to report. 26 Burlington Northern Santa Fe Railway.

Factual Information 13 Railroad Accident Report The first unit, CSXT 806, was an SD80MAC; BNSF 9481 was an SD70MAC; and CSXT 8666 was an SD50. On these units, maximum dynamic braking is achieved when the locomotive is traveling between 4 and 24 mph. The maximum dynamic braking effort is 96,000 pounds for an SD80MAC, 81,000 pounds for an SD70MAC, and 60,000 pounds for an SD50. The accident train had 80 coal cars, all of which were high-side “bathtub” gondola cars designed for unit coal train service. The cars were relatively uniform in appearance. Each car was 45 feet long (48 feet, 8 inches long over the couplers) and had two two-axle trucks and 36-inch wheels. The cars were used between coalmines and power plants. The cars had been inspected and repaired as necessary at CSXT facilities at either Curtis Bay or Brunswick, Maryland. According to the CSXT consist list, the train was 4,145 feet long (the length of the combined cars was 3,920 feet). The trailing tonnage (the cars only) was 10,569 tons, and the tons per operative brake27 was 132. Track Information The railroad from Grafton to Cumberland, Maryland, which traverses the accident area, was built about 150 years ago as part of the Baltimore and Ohio Railroad.28 The general east-west railroad line location and grade have remained unchanged. The railroad is now part of CSXT Allegheny Division (formerly the Baltimore Division), Mountain Subdivision, and consists of two mainline tracks: No. 1 (westbound)29 and No. 2 (eastbound), with their attendant sidings and industrial spurs. Most of the rail is continuous welded rail with some jointed rail, which varies in size from 122 to 140 pounds,30 depending on location. The rail was manufactured from 1951 through 1998, and the track was last surfaced during the 1980s, when crossties were replaced. The maximum authorized speed varies from 25 to 45 mph, depending on the location of the track and the type of train. The site of the accident, 17-mile grade, is the railroad between Altamont (MP 223.4) and Bloomington (MP 208.6) and has an average 2.4-percent grade. The grade has 10 rail lubricators.31 27 Tons per operative brake is the total trailing tonnage divided by the number of freight car brake control valves, which usually corresponds to one per car, as in this case. 28 The Baltimore and Ohio Railroad reached Wheeling, West Virginia, over this railroad on December 24, 1852. 29 The No. 1 main track is the northernmost track. 30 Rail sizes are standardized by weight per 3-foot length by the American Railway Engineering Association (AREA), a component of the Association of American Railroads. 31 Rail lubricators are fixed devices, usually located near railroad track curves, that lubricate the side of the railhead to minimize rail and wheel wear.

Factual Information 14 Railroad Accident Report Signal Information Train movement on the two mainline tracks is governed by visual indication of automatic block, color-position wayside signals set for movement in the above indicated direction (No. 1 track westbound, No, 2 track eastbound) for each track only. Train movements in the opposite direction of the set signals are made under some form of train order authority from the dispatcher. Operations Information Train movements between Grafton and Cumberland were governed by the following: wayside block signal indication; CSXT Allegheny Division Timetable No. 1, effective January 1, 2000, for the Mountain Subdivision; and CSXT Allegheny Division Western District General Bulletins. According to the timetable in effect at the time of the accident, for eastbound loaded coal trains, the maximum authorized speed between Altamont and Swanton was 30 mph; between Swanton and Bloomington (MP 208.6), the maximum authorized speed was 25 mph. Meteorological Information The CSXT utility employee who worked on the accident train in Grafton stated that the temperature was warming and that the precipitation had changed from snow to sleet and then rain. By the time the train had left Grafton, he said, the temperature had warmed to the mid- to high 30s and “everything was thawing out.” The train conductor said that some freezing rain was falling in Grafton when the crew was releasing the hand brakes. He said that the grab irons were slippery and that the crew took extra care. He said that during the trip, it was snowing with a little bit of snow on the cap of the rail. He also said that there was some blowing snow. The engineer said: The ground was covered, and it was snowing and raining and sleeting…. It was raining when we left Grafton, and [as we traveled] further east…it turned to snow and ice. The rails were covered with wet snow and ice. We were clearing the rail as we went. When asked what the temperature was at the time, he said, “approximately in the 20s.” Investigators asked the helper brakeman whether any ice or snow had built up on the trucks or brake shoes of the cars when the helper locomotive was attached. He said that

Factual Information 15 Railroad Accident Report it had been snowing but that he had not noticed any ice or snow on the running gear. He said that the snow had been 3 or 4 inches deep but that it had not been on or above the rails. The National Weather Service described the weather at the time of the accident as follows: Morgantown 0653 EST. Sky overcast; winds 170 degrees at 5 knots; visibility 10 miles; temperature 36° F; dew point 36° F; snow ended 0630 EST. 0706 EST. Sky overcast; winds 150 degrees at 5 knots; visibility 10 miles; temperature 36° F; dew point 36° F. Martinsburg 0650 EST. Sky overcast; winds calm; visibility 2 miles; light snow; temperature 41° F; dew point 21° F; 4 inches of snow on the ground. 0750 EST. Sky overcast; winds 020 degrees at 4 knots; visibility 4 miles; mist; temperature 23° F; dew point 21° F. Snow ended 0740 EST. Petersburg 0650 EST. Sky overcast; winds calm; visibility 10 miles; temperature 27° F; dew point 27° F. 0750 EST. Sky overcast; winds calm; visibility 10 miles; temperature 23° F; dew point 23° F. Toxicological Information The engineer and conductor were taken to Memorial Hospital in Cumberland about 2 hours after the derailment, where they gave blood and urine specimens for the toxicological testing required by the FRA.32 The results of the tests were negative for drugs and alcohol. 32 49 CFR 219.201.

Factual Information 16 Railroad Accident Report Tests and Research Track and Signal Tests Postaccident track inspections and a review of the maintenance-of-way records revealed no track anomalies. The 10 rail lubricators in the accident area were inspected and found to function as designed with no discharge of excess lubricant noted. Postaccident tests and a review of the records indicated that the signal and train control systems functioned as designed. Accident Site Inspection of Cars Safety Board investigators examined the derailed and wrecked coal cars on the day of the accident. Because so many of the cars had been completely destroyed, a brake function test could not be performed; however, almost all of the brake shoes and wheels showed signs of heavy braking. Wheel treads had bluing, indicating enough heat had been generated to change the micro-structure of the steel. Brake shoe surfaces were burned and blackened from the oxidation and melting of the composites that make up the shoes. The severity and consistency of the damage to the brake shoes indicated that the emergency brake application had fully propagated through the train to the last car. That the application had fully propagated was later substantiated by the event recorder data from the EOT. End-of-Train Test The flashing EOT telemetry device on the end coupler of the last car in the train survived the accident because the last car did not derail. On February 2, 2000, the communications maintainer at the CSXT Cumberland radio shop tested the flashing rear- end device. All communication and pneumatic functions performed as designed. Battery voltage was found to be 13 volts, the proper voltage. Locomotive Tests and Inspections The locomotive consist for train V986-26 survived the accident intact. Safety Board investigators found nothing in the maintenance and service records for the locomotive units that indicated a condition that would have caused or contributed to the accident. Investigators measured and recorded brake shoe thickness and brake cylinder piston travel. They compared the recorded air brake pressure readings of the equalizing reservoir, brake pipe, brake cylinder, and main reservoir of each locomotive unit to specifications. Other than what had been affected by the excessive wear caused by the heavy braking during the accident, everything was within specifications and standards. On February 1, 2000, the Cumberland locomotive shop tested the air brakes of the locomotive consist. The brake pipe leaked 2 pounds in 3 minutes, which was within acceptable limits. The main reservoir leaked 4 pounds in 3 minutes, which was unacceptable. A leak was found in the main reservoir. The leak was behind the clamp in

Factual Information 17 Railroad Accident Report front of the No. 2 main reservoir cylinder on the lead locomotive unit, CSXT 806. Investigators determined that such a leak would not affect the application of the train or locomotive air brakes but would lower the pressure of the main reservoir enough to cause the air compressors to activate more frequently. Postaccident testing of the engineer’s radio and subsequent investigation revealed that the radio worked as designed. Multiple-Unit Cable Mechanical personnel from the Cumberland locomotive shop tested the dynamic braking system about 1:30 p.m. on January 31 at Westernport, Maryland. The testing was under the auspices of FRA inspectors. The No. 24 pin socket of the multiple-unit cable between the first and second locomotive units was defective. The defect prevented the dynamic brake excitation voltage of the lead unit from reaching the two trailing units. Thus, only the lead unit produced dynamic braking. Testers replaced the defective multiple-unit cable and performed both a static and running test of the dynamic brake system of the locomotive consist. The system then worked properly. Event Recorders CSXT personnel downloaded the data from the event recorders of all three locomotive units. They gave floppy diskettes containing the data files to Safety Board investigators at the accident scene. The Safety Board’s laboratory in Washington, D.C., examined the diskettes. Event recorder mileposts and times were based on evidence gathered at the accident site. Locomotives CSXT 806 (the lead) and BNSF 9481 had Rockwell solid-state event recorders. Locomotive CSXT 8666 had a Quantum Engineering, Inc., event recorder. The data from all three locomotive matched in all significant parameters. Calculation of Braking Horsepower The air-brake system is a powered braking system that uses the power of compressed air to move a series of rods and levers on each locomotive and car to force a brake shoe against each wheel tread to slow or stop the rotation of the wheel by friction. Thus the tread brakes, also called the “friction brakes,” may be considered a subcomponent of the overall air-brake system. Since the retarding or braking force is generated by friction, a great deal of heat is created when the brakes are applied. The energy and resultant heat is commonly expressed as braking horsepower (bhp). The more energy and effort that is needed to stop a train, the greater the braking horsepower, and the greater the heat. High braking horsepower involving tread brakes is synonymous with the creation of high heat and temperatures. Modern composition brake shoes are designed to withstand temperatures up to about 500° F but rapidly deteriorate at higher temperatures. After the accident, theoretical calculations were performed to determine if the accident train speed may have exceeded the capacity of the tread-braked air-brake system

Factual Information 18 Railroad Accident Report to stop the train, and if so, when. The calculations and method used were developed by David G. Blaine33 for use by air brake and brake shoe manufacturers.34 According to the above reference, the maximum safe braking horsepower for safe practical operation is 30 bhp for a 36-inch wheel.35 The calculated bhp per wheel for the accident train traveling at various speeds down a 2.4 percent grade was as follows: Speed Braking Horsepower (bhp) (in miles per hour) per Wheel 5 9.69 10 19.12 20 33.45 30 48.75 In order for the accident train on 17-mile grade to maintain 30 bhp or less, the accident train would have had to travel no faster than 15 mph. Load Cell Brake Shoe Test In order to validate the theoretical bhp calculations, it was necessary to perform some type of actual braking tests, either with an identical train or by using a dynamometer. For safety reasons, arrangements were made with Wabtec (formerly Westinghouse Air Brake) to conduct dynamometer tests. As a prerequisite for accurate dynamometer testing, actual brake shoe force against the wheel must be used. Actual brake shoe forces are measured on a static car using a load-cell brake shoe device, sometimes called a “golden shoe” or “gym shoe.” The car brake shoes are replaced with brake shoes that are embedded with pressure-sensitive transducers.36 When the brakes are applied, the pressure of the shoe against the wheel changes the conductivity of the electrical circuit through the shoe, which is then converted to a force reading and recorded. Because all but four coal cars were destroyed or severely damaged in the derailment, three exemplar cars, one each of the three major car types involved in the accident, 37 were tested under the direction of the Safety Board at the CSXT car shop in Cumberland, Maryland, on August 8 and 9, 2000. All parties to the investigation 33 See American Society of Mechanical Engineers (ASME) publication 69-WA/RR-6, “Determining Practical Tonnage Limits and Speeds in Grade Operations,” by David G. Blaine as presented to the ASME conference in November 1969. 34 Other referenced braking documents were “Calculated Tonnage Per Operative Brake in Grade Service,” for the Air Brake Association Annual Meeting, September 12, 1961; and “Braking Duty in North American Freight Train Service and Effects on Brake Equipment, Brake Shoes and Wheels,” by D.G. Blaine, F.J. Grejda, and J.C. Kahr, January 25, 1978. 35 All the cars in the accident train had 36-inch wheels. 36 A transducer is a device that converts one form of energy into another. 37 Although four types of cars were used in the accident train consist, only three types were tested since only five cars of the fourth type were in the train.

Factual Information 19 Railroad Accident Report participated in the testing. Wabtec technicians from the company’s facility in Wilmerding, Pennsylvania, were provided, along with the device to assist in the tests. Twenty-one consecutive air brake applications38 or “steps” were made using a cart- mounted control valve at the same pressures and in the same sequence as those made by the accident engineer and recorded by the accident train’s event recorders. After each application, the brake rigging was tapped with hammers to simulate the movement and vibration of the moving accident train, and then raw force readings were taken for each of the eight brake shoe locations on each of the three cars. There were 168 readings for each car, for a total of 672 separate recorded raw force measurements. The Wabtec technicians then converted these raw force numbers into actual force readings, and a single application reading for each car was developed by averaging the readings from the eight shoe locations for each air brake change for each car. These readings were later used on the dynamometer machine. Dynamometer Tests The Association of American Railroads (AAR) sets performance specifications for high-friction composition-type brake shoes such as those involved in the accident and for the manner in which such brake shoes are tested for acceptability. Specifications and procedures can be found in the AAR Manual of Standards and Recommended Practices, Specification M-926-99. All railroad brake shoe manufacturers are required to test their brake shoes periodically to ensure that the shoes meet the AAR’s specifications. To ensure compliance, the AAR periodically reviews brake shoe tests. Consequently, the brake shoe manufacturers have dynamometer machines for testing brake shoes. The dynamometer consists of a large electrical motor that turns a shaft on which fixed and movable inertial discs are attached to provide momentum. At the end of the shaft is a modified39 railroad car wheel. When the wheel is spun, the test brake shoe is applied to the wheel tread as it would be during the actual braking of a railroad car or locomotive. Mounted sensors on the dynamometer are attached to a computer that calculates velocity, net shoe force, average wheel temperature, retarding force, coefficient of friction, and bhp. On August 22, 2000, representatives of parties to the accident gathered at the Railroad Friction Products Corporation plant at Maxton (Laurinburg), North Carolina, where a dynamometer machine tested brake shoes under the accident conditions. Speeds and application times were taken from the event recorder data. The shoe forces used were those previously measured and recorded at Cumberland for each of the three major coal car types involved in the accident. The difference between the ambient temperature of January, when the accident took place, and that of August was not considered significant because of the magnitude of the temperatures that develop at the shoe-wheel interface. Each of the new brake shoes used for the simulation was broken in or slightly worn before 38 Almost all of these applications were 1-pound incremental brake pipe reductions. 39 The dynamometer railroad car wheel has a slightly modified tread profile to allow a more accurate measurement of the temperature, pressure, and coefficient of friction.

Factual Information 20 Railroad Accident Report being used, following the practice in brake shoe testing that the AAR recommends in order to provide the most realistic response. Shoe forces, velocity (train speed), and application times were preprogrammed into the dynamometer control computer for each of the three coal car types. The computer then drove the dynamometer and applied the brake shoe to simulate the forces, speeds, and timing of the accident. This procedure was followed for each type of car. The computer then recorded the resulting wheel temperatures, retarding forces, coefficients of friction, and horsepower values. (See table 2.) Based on these values, for two of the three car types tested, the tests showed a loss of retardation and braking ability under operating and braking conditions that existed between steps 11 and 12 in table 2. For the other car type, loss of braking efficiency occurred under the conditions existing between steps 12 and 13. These steps correspond to the braking actions the accident engineer took when the train was between MP 220.12 (step 11) and MP 216.46 (step 12), or MP 216.34 (step 13). These locations match the area at Swanton Flats where the engineer powered against the train air brakes (17-psi reduction of the train line) for several miles while traveling 23 to 28 mph. Other Information Engineer Training Classroom Training. CSXT began its engineer recertification program in 1992. In 2000, the program involved 2 1/2 days of classroom presentations and testing. The FRA requires an engineer to be recertified every 3 years. CSXT requires the engineer to take the Table 2. Braking Efficiency. Car Type Step Milepost MPH Temp F Force lbs. Coefficient of Friction BHP CSXT 11 220.12 23.8 431 1013 0.434 64 392663 12 216.46 27.8 598 669 0.259 50 13 216.34 27.9 606 703 0.326 52 CSXT 11 220.12 23.9 329 829 0.433 53 385995 12 216.46 27.9 557 611 0.294 45 13 216.34 27.9 565 655 0.277 49 NYC 11 220.12 23.8 335 821 0.445 52 503250 12 216.46 27.8 536 566 0.310 42 13 216.34 27.8 542 602 0.286 45

Factual Information 21 Railroad Accident Report recertification training and testing sometime during the third year. If the engineer successfully completes the training, CSXT issues the certification card on the last day of that year. Recertification classes were held in Atlanta, Georgia, and in Cumberland, where the accident engineer was recertified. Before he took the class, CSXT had mailed him a workbook. He was required to fill out the workbook (by answering between 250 and 300 questions) before reporting to class. A completed workbook was a condition of class attendance and was checked by the instructors for completeness and correctness. The workbook questions focused on FRA-required subject matter. The classroom instruction focused on updating the engineers on air brake methods, new locomotives and equipment, hazardous materials, and changes in train handling rules. Each engineer took a knowledge test, which included a customized part devoted to the unique physical characteristics of the portion of the railroad on which the engineer operated. The accident engineer took the classroom training in May 1999 and scored 98 out of 100 on the written examination. Evaluations. Each engineer’s performance is evaluated at least once a year by railroad operating officials, usually the road foreman. The CSXT Locomotive Engineer Evaluation Report is the form used in the evaluation. When the evaluation is done in the same year that the engineer is to be recertified, the evaluation also serves as the recertification performance test, since the criteria and standards are the same. The accident engineer’s last recertification performance evaluation was on March 21, 1999. He scored 90 out of 100. The evaluation was done on the Thomas Subdivision at BAH-28 while he was in switching service. He lost 10 points because, according to the form, he “didn’t make standing and running brake test on initial movement [and] didn’t test handbrake.” The accident engineer was evaluated on January 17, 2000, about 2 weeks before the accident, when a road foreman of engines evaluated him on an eastbound loaded coal train40 and gave him a score of 95 out of 100 points. According to the form, 6 safety rules, 17 operating rules, and crew resource management were discussed. The discussion included efficiency tests and the downloading of event recorders. The form shows that the road foreman rode with the accident engineer for 7 hours, from Grafton to Keyser, which should have included the accident area. However, when the engineer was asked whether a road foreman had ever ridden with him from Altamont down to Bloomington on 17-mile grade before the accident, 41 he replied, “No.” He indicated that no road foreman who had evaluated him had ever made a complete trip. He said that the road foremen rode between Keyser and Cumberland, or between Grafton and Rowlesburg, on either side of the accident area, but not through the accident area. CSXT presented evidence that the engineer had made a trip down 17-mile grade on January 17, 2000, accompanied by a road foreman and another qualified engineer, but that the qualified engineer was operating the train, with the accident engineer observing. 40 Train U822-15 was similar to the accident train; it had 82 cars and 10,470 trailing tons. 41 For purposes other than an efficiency test.

Factual Information 22 Railroad Accident Report As a result of the Safety Board investigation of the runaway and subsequent derailment of a Southern Pacific Transportation Company train in San Bernardino, California, in 1989,42 the Safety Board issued the following recommendation to the FRA regarding engineer qualification and supervisory oversight: R-90-22 Promulgate regulations regarding the qualification of engineers to require that supervisors ride with an engineer in both directions on mountain grade territory before qualifying the engineer over the entire territory and that the ride be performed on a train that is comparable in size and trailing tonnage to those typically most difficult to operate on that territory. The FRA issued regulations (49 Code of Federal Regulations [CFR] Part 240 Subpart B, and section 240.127) that fulfilled the recommendation. The recommendation was classified “ClosedAcceptable Action” on January 21, 1992. As a result of this recommendation, all railroads, including CSXT, now include such requirements in their operating and engineer qualification rules. Pilot Request. According to CSXT Rule 520: Engineers must be fully familiar with the physical characteristics of the territory over which they are called to operate. An engineer must not accept a call to operate over a territory that the engineer has not been over in the previous 12 months. Because the engineer had been in yard service for 4 years before taking this road assignment, he requested a pilot43 from the road foreman upon his return to road service on January 9, 2000. The engineer said: I talked to the road foreman, general road foreman, and he told me that I could have a pilot for two round trips. I got one, one trip out of Cumberland [westbound]. We brought a train out and taxied back to Cumberland, and when I asked for one on the second call I was told [by the crew caller] that [he] and the lead caller would decide if I needed one.44 If so, there would be one there, and when I reported to work, there was none. 42 National Transportation Safety Board, Derailment of Southern Pacific Transportation Company Freight Train on May 12, 1989, and Subsequent Rupture of Calnev Petroleum Pipeline on May 25, 1989, San Bernardino, California, Railroad Accident Report NTSB/RAR-90/02 (Washington, D.C.: NTSB, 1989). 43 A pilot is a qualified employee assigned to a train when the engineer or conductor is not acquainted with the rules or the portion of a railroad over which the train is to be moved. 44 Crew callers are not railroad officials or supervisors and do not have the authority to make such determinations. The CSXT superintendent stated that the crew caller’s response to the engineer’s request was a serious breach of policy and procedure and said that CSXT had taken steps to prevent similar incidents.

Factual Information 23 Railroad Accident Report The engineer said he was aware that the road foreman who normally made arrangements for a pilot was in Richmond, Virginia, at the time and therefore was unavailable. Consequently the engineer never had a pilot for an eastbound trip (which included descending 17-mile grade). Two-Way EOT Training. When asked whether he was trained to activate the two- way EOT emergency switch after an emergency application with the brake handle, the engineer testified that the EOT emergency switch was to be used only if the EOT was not showing 0 psi at the rear of the train after the emergency application was made. According to the CSXT manager of engineer training, at the time the accident engineer took his recertification training, two-way EOTs were being introduced. He said the procedure to activate an EOT emergency brake application along with a brake handle emergency was taught orally but that instructional materials had not yet been updated to document this new training. He said he believed that the accident engineer had received this new instruction during recertification training, but he could not document the training. After the accident, CSXT expedited the updating of instructional materials and tests to reflect the EOT activation procedure when making a brake handle emergency application. In addition, all new EOTs purchased by CSXT have a feature that automatically and simultaneously initiates an emergency application at the rear of the train when an emergency application of the brakes is made by the automatic brake handle in the locomotive cab. Determination of Maximum Authorized Speeds and Braking Capability Railroads determine maximum authorized speeds for various rail segments based on a number of factors, such as tons per operative brake for control and stopping ability, descending grade, signal spacing, and track structure. Any one factor may be the decisive factor in determining the maximum authorized speed. The lowest speed associated with any one factor will usually become the maximum authorized speed. For the past decade, most railroads, including CSXT, have also used a computerized train dynamics analyzer machine to help determine maximum authorized speeds and appropriate train handling procedures. The use of the train dynamics analyzer has grown as locomotive and braking technology have advanced. According to those familiar with the capabilities of train dynamics analyzers, the machines cannot accurately replicate the complex phenomenon of heat fade that occurs between the brake shoes and wheel tread under severe braking conditions. According to the CSXT manager of accident prevention, the maximum authorized train speed for coal trains down 17-mile grade had been 25 mph for at least the past 20 years, the period for which timetable documentation was available. The CSXT central region vice president told Safety Board investigators that CSXT included the supplemental braking effects of dynamic braking when the railroad determined maximum authorized speeds for various track segments. Because dynamic braking may fail suddenly

Factual Information 24 Railroad Accident Report and without warning, it is not considered by the FRA to be sufficiently reliable to be used in determining maximum authorized speeds. The FRA does not specifically set or directly monitor railroad maximum authorized speeds, although it does regulate train braking, which is a factor in setting maximum authorized speeds.45 Because the air brake system is the only train braking system that can both be operated from the locomotive and reliably stop a train,46 that system is considered the train’s primary braking system. This concept was not codified until after the accident in the revised power brake regulations, Brake System Safety Standards for Freight and Other Non-Passenger Trains and Equipment, at 49 CFR Part 232, which were issued on January 17, 2001, and made effective in May 2001. Part 232 regulation series 100 and 200 will not become effective until April 2004. One of these regulations, Part 232.103(a), states that: A train’s primary brake system shall be capable of stopping the train with a service application from its maximum operating speed within the signal spacing existing on the track over which the train is operating. Also, 49 CFR 232.109(j) states: The railroad’s operating rules shall be based on the premise that the friction brakes are sufficient by themselves, without the aid of the dynamic brakes, to stop the train safely under all operating conditions. CSXT Postaccident Actions On February 2, 2000, the CSXT general manager for the Allegheny Division issued Western District General Bulletin No. 207, SUBJECT: Mountain Subdivision Timetable Special Instruction Modifications, which was effective immediately. For eastbound trains between Altamont and West Virginia Central Junction (MP 207.8), the maximum authorized speed for all trains was lowered from 25 to 20 mph. Engineers were instructed: “If train speed cannot be maintained at or below the maximum authorized speed of 20 mph, the train must be stopped immediately with an emergency brake application.” Locomotives for all trains originating in Grafton were required to have a running dynamic brake test before being attached to the train. Engineers of run-through trains47 were required to test the dynamic brakes before passing Westerman (MP 274). Engineers of trains originating east of Westerman were required to make a running dynamic brake test at the first available location before Mountain Lake Park (MP 229.8). Detailed instructions were also given on how to perform the dynamic brake testing on one or more locomotive units. 45 The FRA also indirectly controls maximum authorized speeds through track regulations, 49 CFR Part 213, “Track Safety Standards,” which set maximum train speeds for different classes and conditions of track. 46 Handbrakes can stop a train but currently cannot be operated from the locomotive cab. Dynamic brakes can slow a train but cannot reliably stop a train under all operating conditions. 47 A run-through train does not originate in Grafton but stops there only for a crew change.

25 Railroad Accident Report Analysis Exclusions Weather Investigators considered whether the weather might have played a role in the accident. Snow and ice could have accumulated between the brake shoes and wheels on the coal cars and made the tread braking less effective, thus increasing the chance of creating a runaway. Postaccident examination of the running gear of the cars showed no signs of any precipitation accumulation. The shallowness of the snow below the top of the rail and its water content, as described by train and yard personnel and later verified at the accident scene by investigators, did not support any scenario involving snow and ice accumulation on the brake shoes or wheels. The fact that the train brakes had been applied much longer than necessary to clean any snow and ice from the brake shoes before the descent of the train down 17-mile grade also did not support the idea of a runaway caused by moisture accumulation. Finally, the weather reports from the surrounding area recorded temperatures slightly above or below freezing, again suggesting it was unlikely that there had been an accumulation of blowing snow about the trucks and brake shoes of the freight cars or locomotive. Consequently, the Safety Board concludes that the weather did not cause or contribute to the accident. Fatigue Investigators reviewed the work/rest cycle records of the engineer and conductor, their 72-hour histories before the accident, and the train handling data recorded by the event recorder.48 All parties to the investigation agreed that the crewmembers were qualified to perform their duties according to CSXT procedures and accepted practice. Nothing suggested that the train crewmen were fatigued or asleep. The crewmembers said that they were rested in accordance with the Federal Hours of Service Act, and no postaccident evidence or witness suggested anything to the contrary. The engineer’s work schedule, his statement that he felt well rested, and the train handling data from the event recorder all suggested that fatigue was not an element in this accident. Therefore, the Safety Board concludes that crewmember fatigue was not a factor in the accident. Toxicology The engineer and conductor were tested after the accident, and no alcohol or drugs were found. Therefore, the Safety Board concludes that neither alcohol nor drug use caused or contributed to the accident. 48 The event recorder, by documenting each throttle and brake manipulation, provides some indication of the operator’s level of alertness and skill.

Analysis 26 Railroad Accident Report Track and Signals The postaccident track inspections and a review of the maintenance-of-way records revealed no contributory track anomalies. The 10 rail lubricators in the accident area were inspected and found to function as designed, with no excessive lubricant found that would have affected train braking. Nothing was found to suggest that either the track conditions or the signal and train control systems caused or contributed to the accident. The Safety Board concludes that neither the signal and train control systems nor the track conditions were factors in the accident. Event Recorder Even though CSXT downloaded the three locomotive unit event recorders without Safety Board or FRA supervision or permission, there was no evidence that the event recorder data had been altered or tampered with. Air Brake System Postaccident testing of the train’s air brake system was not possible because so many cars were destroyed in the accident; however, the air brake test performed on the coal cars before they left the mine, the preaccident initial terminal air brake test, and the set-and-release tests done when the helper locomotive was attached and when it was detached suggest that the air brake system functioned as designed. The engineer stated that the air brakes functioned “normally” and indicated that he had had no air brake problems before the accident. The brake pipe pressure that was recorded on the event recorder from both the front and rear of the train show that the air brake system had responded to the engineer and had functioned as designed. Postaccident examination of the coal car wheels and brake shoes, particularly those at the end of the train, showed that the brakes had been applied heavily and for a relatively long time. Many wheels showed discoloration caused by high heat, including bluing on the tread and rim and red coloration on the wheel plate. The brake shoes were burnt, glazed, and cracked and in various stages of degradation caused by the high heat. The physical evidence on the wheels and brake shoes also showed that the applications had propagated through the entire train without any train line blockage. The conductor said that the EOT display in the locomotive cab showed 0 psi brake pipe pressure after the engineer made the emergency brake application, also indicating that the application had propagated to the end of the train without blockage. Investigators concluded that the air brakes had functioned as designed and that the brake applications had applied throughout the train. Therefore, the Safety Board concludes that the train’s air braking system did not cause or contribute to the accident.

Analysis 27 Railroad Accident Report Dynamic Braking and Train Speed To a large extent, train speeds and train handling are determined empirically within the limitations of the track structure and signal or train control systems. As with the maximum authorized speed through the accident area, most speed limits have not changed over a long period, particularly speed limits for common trains like coal trains, even though the weight of trains has steadily increased over time. CSXT has been able to maintain relatively high speeds despite increasing train weight because of the emphasis on and continued improvement of locomotive dynamic braking. Dynamic braking on the two trailing locomotive units, while available, could not be activated because of the defective multiple-unit cable between the first and second locomotive units. Because he did not have the benefit of full dynamic braking, the engineer had to increase the air brake application beyond what normally would have been expected in order to control speed. By so doing, he unwittingly overheated the tread-brake system. Further, the maximum authorized speed for the accident grade had been established based on the assumed availability and use of dynamic braking. Judging from the CSXT’s experience of successfully negotiating 17-mile grade at the maximum authorized speed, the combination of dynamic and air braking was, in fact, adequate to hold a train at or under the established maximum authorized speed as the train progressed down the grade. The Safety Board concludes that if all the available dynamic braking could have been activated on the accident train, the derailment probably would not have occurred. Unfortunately, problems can occur when, as in this accident, the dynamic braking system functions only partially or suddenly and unexpectedly fails when the train is moving too fast to be stopped by the air brakes alone. Calculations and dynamometer testing confirmed that CSXT eastbound loaded coal trains on 17-mile grade could not be controlled or stopped at the maximum authorized speed without the use of significant dynamic braking. The Safety Board concludes that by using the effects of dynamic braking in its speed calculations, CSXT established a maximum authorized speed over and down 17-mile grade that was too high to ensure that heavily loaded trains could be stopped using air brakes alone. The lead locomotive unit had no device for checking the real-time condition of the dynamic brakes on the trailing locomotive units (or the signal continuity through the multiple-unit cable), nor was such a device required at the time of the accident. The condition of the dynamic brakes on trailing units can be determined by observing the ampere gage in the cab of each of the trailing units, but those units normally do not have crewmembers aboard. In this accident, an inexperienced trainman trainee was on board the second unit, but only because of his aversion to cigarette smoke. And no one would have been able to check the gage in the third unit because CSXT rules, for safety reasons, generally prohibit crewmembers from moving between locomotive units while the train is in motion. In short, even though CSXT had made the availability of dynamic brakes critical by using their effects in calculating the maximum authorized speed, the company had no requirement that the dynamic braking system be tested before or during use to

Analysis 28 Railroad Accident Report determine how well it was functioning. After the accident, CSXT instituted a running dynamic brake test procedure for its Mountain Subdivision. As a result of the previously mentioned Safety Board investigation of the runaway and subsequent derailment of a Southern Pacific Transportation Company train in San Bernardino, California, in 1989, the Safety Board issued the following recommendation to the FRA regarding dynamic braking: R-90-23 Study, in conjunction with Association of American Railroads, the feasibility of developing a positive method to indicate to the operating engineer in the cab of the controlling locomotive unit the condition of the dynamic brakes on all units in the train. The Safety Board classified this recommendation “ClosedUnacceptable Action/Superseded” after its investigation of a runaway Union Pacific train at Kelso, California.49 After that accident, the Safety Board issued the following safety recommendation to the FRA: R-98-6 Require railroads to ensure that all locomotives with dynamic braking be equipped with a device in the cab of the controlling locomotive unit to indicate to the operating engineer the real-time condition of the dynamic brakes on each trailing unit. This recommendation was classified “OpenAcceptable Response” on January 11, 2000. The FRA has included in the new power brake regulations (49 CFR 232.109) the following dynamic braking requirements: (a) A locomotive engineer shall be informed in writing of the operational status of the dynamic brakes on all locomotive units in the consist at the initial terminal or point of origin for a train and at other locations where a locomotive engineer first takes charge of a train. (g) All locomotives equipped with dynamic brakes and ordered on or after August 1, 2002, or placed in service for the first time on or after April 1, 2004, shall be designed to: (1) Test the electrical integrity of the dynamic brake at rest; and (2) Display the available total train dynamic brake retarding force at vari- ous speed increments in the cab of the controlling (lead) locomotive. 49 National Transportation Safety Board, Derailment of Union Pacific Railroad Unit Freight Train 6205 West Near Kelso, California, January 12, 1997, Railroad Accident Report NTSB/RAR-98-01 (Washington, D.C.: NTSB, 1998).

Analysis 29 Railroad Accident Report (h) All rebuilt locomotives equipped with dynamic brakes and placed in service on or after April 1, 2004, shall be designed to: (1) Test the electrical integrity of the dynamic brake at rest; and (2) Display either the train deceleration rate or the available total train dynamic brake retarding force at various speed increments in the cab of the controlling (lead) locomotive. While the new regulation does not require a dynamic braking display for each trailing locomotive unit, as recommended by the Safety Board, a total real-time dynamic braking effort display as described above may be as useful and acceptable. The Safety Board is also pleased to note that the accelerometer will be used in conjunction with the FRA regulation that will require a train descending a grade of 1 percent or greater to be immediately stopped if it exceeds the maximum authorized speed by more than 5 mph. Therefore, the Board has reclassified Safety Recommendation R-98-6 “ClosedAcceptable Alternate Action.” Tread Brakes/Air Brakes and Stopping Ability High-friction composition-type brake shoes such as those involved in the Bloomington accident significantly degrade when the average wheel temperature exceeds 500° F. Considerable “heat” or brake fade also occurs around these higher temperatures, which results in a noticeable drop in the coefficient of friction and braking ability. At the time of the accident, the maximum authorized speed from Swanton (MP 219.4) to Bloomington (MP 206.2) was 25 mph. CSXT lowered the maximum authorized speed to 20 mph after the accident in an attempt to create a safe speed. CSXT Rule 34-D requires that, on descending grades of 1 percent or more, a train must be stopped using an emergency brake application if the train’s speed reaches 5 mph more than the maximum speed permitted for that train. Thus, even under the reduced postaccident maximum speed of 20 mph, the engineer could still attain 25 mph before attempting to stop the train. For the accident train, at 20 mph, the recognized safe bhp of 30 would have been exceeded by more than 10 percent, and at 25 mph, the bhp would have been exceeded by more than 62 percent. According to commonly accepted air brake industry standards, a train with cars that have 36-inch diameter wheels, such as the accident train, should not exceed an average bhp of 30. The accident train had such a bhp, but only when it was traveling about 15 mph. At 20 mph, its bhp was 49.54; and at 30 mph, its bhp was 64.40. The large disparity in bhp between the recommended 30 and the actual number the accident train had at its maximum authorized speed translates into significant increases in the heat generated at the interface between the brake shoe and wheel tread. The increases in heat, in turn, degrade the brake shoes and cause heat fade and the loss of molecular adhesion, resulting in a catastrophic loss of retardation and braking powera runaway train.

Analysis 30 Railroad Accident Report Actual brake shoe force measurements were taken for each brake application on identical coal cars on August 8, 2000. Using these shoe forces, the bhp calculations were then substantiated by dynamometer tests performed on August 22, 2000. These test results also indicated that the heat from the applied accident train brakes had reached the critical point about the time the train began to pass through Swanton Flats, MP 219.4, only about 3.6 miles into 17-mile grade. By that time, the temperature of the brake shoes/wheels exceeded the thermal limit of the brake shoes and resulted in a loss of braking power. The dynamometer tests validated the theoretical calculations. The calculations and dynamometer tests showed that the maximum authorized speed of 25 mph was too high and that, in fact, any speed above 15 mph was too high to allow the train to be brought to a stop by the air brakes alone. Because the air brake system is the only braking system capable of bringing a train to a stop, it is incumbent upon railroads to set maximum speeds that ensure that trains can be stopped without the use of supplemental braking.50 At the time of the accident, there was no regulation requiring a train to have the capability to stop by use of the air brake system alone. According to FRA officials, the agency believed this was understood by the railroads, but it was not. CSXT management had included the effect of dynamic braking in determining maximum authorized speeds. Including in the maximum speed calculation the effects of dynamic brakes, which cannot be relied upon to stop the train, resulted in speeds that violated the spirit of the “primary brake” and prevented the engineer from stopping the accident train with the air brakes alone.51 The maximum authorized speed down 17-mile grade should probably have been no greater than 15 mph to ensure safe operation in the event of either partial or full dynamic brake failure or an unintended release of the air brake. CSXT does actively update its train handling practices as train equipment improves. To a large extent, it does the updating by using computer simulators, such as a train dynamics analyzer. The analyzer is used to match methods of train handling with current and proposed maximum authorized speeds; however, no software is yet capable of replicating the loss of braking caused by heat fade. (Such software is under development.) Since a train dynamics analyzer cannot replicate heat fade, a simulator may indicate that a train can be stopped when, in reality, it may be unstoppable. Running an actual train on steep grades and applying the brakes until heat fade occurs is dangerous and expensive and is therefore not practical. The most available current methods of determining the maximum authorized speed are by calculation or by using dynamometers; however, most railroads use neither. As already noted, the Safety Board has previously investigated runaway train accidents at San Bernardino and Kelso, California, involving the Southern Pacific and the Union Pacific Railroads. There have been similar incidents on the BNSF Railway on Cajon Pass. All these accidents and incidents involved, as does the Bloomington accident, the dependence on and sudden loss of dynamic braking. The Safety Board is concerned 50 Unlike automobiles, a train can attain speeds, particularly when traveling downgrade, that exceed the capacity of the brakes to bring it to a stop. 51 At the time of this report, the FRA had not cited CSXT for any rule violation regarding the maximum authorized speed in this accident.

Analysis 31 Railroad Accident Report that maximum authorized speeds enabling a train to stop by the air brake system alone are not, and have not been, audited or re-evaluated by the major carriers as frequently as necessary over time as trains have become heavier and braking systems have changed. Therefore, the Safety Board believes that the class I railroads should calculate steep-grade maximum authorized speeds to ensure that trains can be stopped by use of the air brake system alone. The Safety Board also believes all class I railroads should establish procedures to revise maximum authorized speeds as necessary. CSXT Management Oversight Given the circumstances at the time of the accident, including the maximum authorized speed and the absence of a method to warn the engineer that he did not have access to full dynamic braking, the engineer’s actions did not cause or contribute to the accident. Without the added retardation afforded by full dynamic braking and given the magnitude of the difference in energy52 between what was developed during the investigation as a maximum safe speed of 15 mph and the maximum authorized speed of 25, it is doubtful whether the engineer could have stopped the train regardless of what he did. According to the dynamometer tests, the “point of no return” was around Swanton Flats, MP 219.4, only 3.6 miles down 17-mile grade, a point long before an engineer would normally be concerned about controlling or stopping the train. In fact, the engineer was concerned about stalling rather than stopping the train. Consequently, he powered against the brakes. The event recorder showed that the train’s speed from MP 223 to MP 217.22 never exceeded the maximum authorized 25 mph; and yet, as confirmed by the dynamometer tests, the train became uncontrollable. The difference in energy is even greater at 30 mph, which was still within the allowable +5 mph margin of the operating rules at the time. Therefore, the Safety Board concludes that no matter what actions the engineer took, he probably could not have prevented a runaway because of the speed at which he was authorized to operate and the condition of the dynamic brakes. Engineer’s Actions While the engineer’s actions do not appear to have directly caused or contributed to the accident, some of his actions, or some of his failures to act, reflect upon the efficacy of his supervision, training, and support. The engineer had more than 29 years of railroad experience at the time of the accident. He was well regarded by railroad management and coworkers as a “senior” engineer. He had been in engine service since 1976 and had made numerous runs along the Grafton to Cumberland route. He had come back to road service on January 9, 2000, a few weeks before the accident. He had just had his last rules class and test 3 days before the accident. He had completed 2 days of recertification53 training (49 CFR Part 240) at the CSXT Training Center, Cumberland, Maryland, on May 4, 1999, which consisted of 52 Energy as measured in bhp. 53 Recertification is not the same as requalification.

Analysis 32 Railroad Accident Report classroom presentations and tests. And yet, in this accident, the engineer’s train handling was not optimal. Situational Awareness. According to FRA inspectors, CSXT operating officers, and CSXT engineers with knowledge of and experience with 17-mile grade, it is possible to control a loaded coal train headed by three modern locomotive units with a 12-pound or less brake pipe reduction and light throttle or dynamic brake modulation. Earlier in the trip, the helper engineer had noted that the train engineer had used more air brake than was normal or routine. The accident engineer stated several times that he attributed his use of more air brake than usual to the wet snow and icy rail; however, his need to power against a 17-pound reduction with up to a 6th notch of throttle belies this contention. The engineer said he was afraid that the train would stall at Swanton Flats if he did not power against the brakes. Thus, he should have realized that the brakes were effective and not affected at that time by snow or ice. An engineer who was fully situationally aware and who understood the grade and the newer locomotives would likely have been aware that something was wrong long before the point where the train could not be controlled with customary train handling. Powering Against the Brakes. As mentioned earlier, CSXT rules state, “When necessary to apply power descending long heavy grades, trains must not be pulled54 for a distance greater than 2 miles if the brake pipe reduction is 18 pounds [psi] or greater.” According to the event recorder, the engineer had steadily increased the air brake application for more than 10 minutes, until he had a 17-pound reduction of the brake pipe55 at MP 220.12 (Swanton) at a speed of 24 mph. He maintained the 17-pound reduction for the next 9 minutes at a speed of 24 mph. It is significant that he powered against this 17-pound reduction through Swanton for about 5 minutes and 2 miles, at one point reaching the 6th notch on the throttle. He further reduced the brake pipe to 18 pounds at MP 216.46 at a speed of 28 mph. Thus the engineer had been operating at the limit or just short of the 18-pound limit, and the brakes had probably already reached the thermal point of no return at the speed the train was moving. He continued to make progressive 1-pound reductions for about the next 4 minutes as the speed of the train increased to 34 mph, when he finally placed the brakes in emergency. Had the engineer gone into emergency shortly after reaching the 18-pound reduction, as required by rule, he probably would not have been able to stop, since the train’s brakes were probably already beyond the critical thermal limit. The actions of the engineer, and the effects of those actions, point out a problem with the CSXT “18-pound” rule. As written, the rule is inadequate to ensure that an 54 In order for the train to be pulled regardless of whether the train brakes are applied, the locomotives must be in the power mode. 55 The brake pipe pressure is 90 psi minus the total reduction. In this case a 17-pound reduction will result in a brake pipe pressure of 73 psi.

Analysis 33 Railroad Accident Report engineer does not, as the accident engineer did, power against his brakes at a speed that is likely to cause excessive heat generation and loss of control. All the calculations for bhp are based on the factor of speed or velocitythe greater the speed, the greater the bhp and heat energy generated by the friction brakes. The CSXT rule does not include a critical limit for speed. The Safety Board concludes that, because the CSXT rule regarding powering against the brakes does not address train speed, it is inadequate to ensure that an engineer does not exceed the bhp and heat energy limitations of the tread brake system and thereby create conditions that can lead to a runaway train. Therefore, the Safety Board believes that CSXT should modify CSXT Rule 3.3.7, Speed Control on Descending Grade, Paragraph C, “Use of Power on Heavy Descending Grades,” to impose a speed limit in addition to the maximum distance and brake pipe reduction currently imposed to prevent excessive heat generation, heat fade, and loss of braking ability. Engineer’s Support and Training The Safety Board examined the management and supervisory support the engineer received as well as and engineer’s actions during the accident. The Safety Board also examined the effect that the CSXT locomotive engineer training and the recertification program might have had on those actions. Since the engineer had become an engineer in 1976, his most recent training was considered. The engineer said that he had transferred from a yard to a road assignment only a few weeks before the derailment. Consequently, the general road foreman told the engineer that he could have a pilot for two roundtrips. For the engineer’s first trip on the assignment, a pilot was provided for the westbound leg, from Cumberland to Grafton (uphill, in the opposite direction of the accident train). Because the crew returned to Cumberland by taxi, the engineer did not make an eastbound trip (which would have taken him down 17-mile grade) with the pilot. The engineer said that when he was called for his second trip, he asked that a pilot accompany him on the return to Cumberland. But, he said, a crew caller told him that the crew caller and the lead crew caller would decide whether the engineer needed a pilot and, if so, would provide one. No pilot was provided. Additionally, according to the engineer and to CSXT records, no supervisor had ridden with the engineer while he operated a train down 17-mile grade to monitor his performance or to provide specific train handling instruction and guidance, even though this area was a critical train handling portion of the railroad. And while the engineer had made one trip down the grade as an observer and had operated a train on eight trips down 17-mile grade in the weeks preceding the accident (most of them with loaded coal trains), neither he nor his supervisors could know for certain whether his train handling technique was appropriate or whether it offered some safety margin in case of an unforeseen event.

Analysis 34 Railroad Accident Report Use of End-of-Train Emergency Switch After the engineer placed the train brakes in emergency with the automatic brake handle, he did not confirm that the emergency application had propagated to the end of the train until a minute and a half later when he saw the head-end display showing 0 psi pressure for the train’s EOT. Had he activated the EOT emergency brake application switch immediately after initiating the emergency application, he would have ensured that the emergency application had reached the end of the train. Immediately throwing the EOT switch not only propagates the brake application more rapidly because the release of air pressure comes from both ends of the train rather than just the head end, but it also ensures full propagation even if a kink or other obstruction is blocking the train line. Thus, the prudent action would have been to immediately flip the EOT emergency brake switch. The needless time taken to confirm that the emergency propagation was complete could, under some circumstances, have been critical. In this case, because the engineer had already exceeded the thermal limit of the brakes by the time he placed the brakes in emergency, his failure to immediately initiate an EOT emergency application became moot. The engineer said he had been trained to use the two-way EOT emergency switch only if the EOT was not showing 0 psi after an emergency brake application. Since using the switch causes no damage to any equipment on the train while offering the advantages of a quicker and more thorough response, the Safety Board fails to see the benefit in restricting its use to what is, in effect, a backup system. CSXT agrees and has an automatic two-way emergency EOT switch on all new locomotives. In addition, CSXT offers instruction in the use of the switch in its engineer classes and, in its operating rules, requires immediate use of the switch in an emergency. Emergency Radio Use During the runaway, the train crew was unable to contact the dispatcher but was able to contact the railroad operator at West Keyser, Virginia, as the train passed Bond at MP 212.6. The engineer attributed his inability to contact the dispatcher to the fact that the radio on the ex-Conrail lead locomotive was different from the radios found on the CSXT locomotives that he more commonly operated. Postaccident testing of the engineer’s radio and subsequent investigation revealed that the radio worked as designed. U.S. railroads use five basic styles of locomotive radios, each of which is compatible with the others, regardless of railroad. Except for superficial details such as dials, touch pads, and channel display, all railroad radios are similar; that is, they use the same frequencies or channels. Timetable instructions list the particular channels for emergency use and/or for calls to the dispatcher. Had the engineer properly set the channel for the dispatcher and then pushed the correct keypad numbereither “9” for emergency or “5” for the dispatcherhe would have reached the dispatcher. The Safety Board concludes that CSXT failed to train and oversee the engineer sufficiently and effectively, as evidenced by (1) management’s failure to provide the engineer with a pilot when requested, (2) management’s failure to fully evaluate the

Analysis 35 Railroad Accident Report engineer over the critical portion of the railroad where the accident took place, (3) the engineer’s failure to use the EOT emergency brake switch, (4) the engineer’s imprudent use of power during brake application, and (5) the engineer’s reported inability to use the radio to contact the dispatcher. Therefore, the Safety Board believes that CSXT management should systematically ensure that engineers are provided with pilots, as appropriate, and that locomotive engineers are fully evaluated over the whole of their territories, particularly in critical areas of train handling such as steep grades. The Safety Board also believes that CSXT should revise its locomotive engineer training and requalification programs as necessary to ensure that they address (1) the emergency use of the two-way EOT emergency switch, (2) the proper use of power during a brake application to prevent heat fade and loss of braking, and (3) the use of all styles of locomotive radios, especially their use during emergency situations to call the dispatcher.

36 Railroad Accident Report Conclusions Findings 1. There was no evidence that the following factors were causal or contributory to the accident: the weather; crewmember fatigue, or alcohol or drug use of any kind. 2. Neither the signal and train control systems nor the track conditions were factors in the accident. 3. The train’s air braking system did not cause or contribute to the accident. 4. By using the effects of dynamic braking in its speed calculations, CSX Transportation established a maximum authorized speed over and down 17-mile grade that was too high to ensure that heavily loaded trains could be stopped using air brakes alone. 5. No matter what actions the engineer took, he probably could not have prevented a runaway because of the speed at which he was authorized to operate and the condition of the dynamic brakes. 6. If all the available dynamic braking could have been activated on the accident train, the derailment probably would not have occurred. 7. Because the CSX Transportation rule regarding powering against the brakes does not address train speed, it is inadequate to ensure that an engineer does not exceed the braking horsepower and heat energy limitations of the tread brake system and thereby create conditions that can lead to a runaway train. 8. CSX Transportation management failed to train and oversee the engineer sufficiently and effectively, as evidenced by (1) management’s failure to provide the engineer with a pilot when requested, (2) management’s failure to fully evaluate the engineer over the critical portion of the railroad where the accident took place, (3) the engineer’s failure to use the end-of-train emergency brake switch, (4) the engineer’s imprudent use of power during brake application, and (5) the engineer’s reported inability to use the radio to contact the dispatcher. Probable Cause The National Transportation Safety Board determines that the probable cause of the January 30, 2000, derailment of CSX Transportation train V986-26 near Bloomington, Maryland, was the railroad’s practice of including dynamic braking in determining maximum authorized speed without providing the engineer with real-time information on the status of the dynamic braking system.

37 Railroad Accident Report Recommendations As a result of its investigation of the January 30, 2000, derailment of CSXT train V986-26 near Bloomington, Maryland, the National Transportation Safety Board makes the following safety recommendations: To CSX Transportation, Inc.: Systematically ensure that engineers are provided with pilots as appropriate and that locomotive engineers are fully evaluated over the whole of their territories, particularly in critical areas of train handling such as steep grades. (R-02-8) Revise your locomotive engineer training and requalification programs as necessary to ensure that they address (1) the emergency use of the two-way end-of-train emergency switch, (2) the proper use of power during a brake application to prevent heat fade and loss of braking, and (3) the use of all styles of locomotive radios, especially their use during emergency situations to call the dispatcher. (R-02-9) Modify CSX Transportation Rule 3.3.7, Speed Control on Descending Grade, Paragraph C, “Use of Power on Heavy Descending Grades,” to impose a speed limit in addition to the maximum distance and brake pipe reduction currently imposed to prevent excessive heat generation, heat fade, and loss of braking ability. (R-0-10) To all class I railroads: Calculate and document steep-grade maximum authorized speeds to ensure that trains can be stopped by use of the air brake system alone. (R-02-11) Establish procedures to revise steep-grade maximum authorized speeds as necessary. (R-02-12)

38 Railroad Accident Report BY THE NATIONAL TRANSPORTATION SAFETY BOARD MARION C. BLAKEY Chairman CAROL J. CARMODY Vice Chairman JOHN A. HAMMERSCHMIDT Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: March 5, 2002 Recommendations

39 Railroad Accident Report Appendix A Investigation The National Transportation Safety Board Communications Center was notified of the derailment at Bloomington, Maryland, about 8 a.m. on January 30, 2000, and two Safety Board investigators were launched to Bloomington, arriving on scene about 11:00 a.m. No Board Member went to the scene. No public hearing was held on this accident. Testimony was taken in Grafton, West Virginia, immediately after the accident on February 1, 2000. Follow-up testimony was taken in Jacksonville, Florida, at CSXT headquarters on November 8, 2000, and in Cumberland, Maryland, on November 28, 2000. Load-cell brake shoe measurements were performed at the CSXT car shop in Cumberland, Maryland, on August 8 and 9, 2000. On August 22, 2000, representatives of parties to the accident gathered at the Railroad Friction Products Corporation plant at Maxton (Laurinburg), North Carolina, where a dynamometer machine tested brake shoes under the accident conditions.

this page intentionally left blank

41 Railroad Accident Report Appendix B How Freight Train Air Brakes Work The air brake system on a train is designed to slow or stop a train through the use of compressed air. The compressed air is used to push a piston within a cylinder. Usually, through a series of rods and levers, the piston’s movement forces brake shoes against car or locomotive wheels or discs to slow their rotation through friction. The air is compressed by an air compressor in the locomotive and stored for use in the main reservoirs (large tanks) on the locomotive. (See diagram that follows.) The compressed air and the brakes are controlled by the engineer using an automatic brake-valve handle on a locomotive control stand. The automatic brake valve controls the train’s brakes (including the locomotive’s brakes) and has three functions: (1) to apply the brakes, (2) to release the brakes, and (3) to charge or recharge the air brake system. Another valve handle, called the independent brake valve, is used by the engineer to independently control only the locomotive’s brakes. Figure 1. Brake Diagram

Appendix B 42 Railroad Accident Report Each railroad car has one or more brake-cylinder pistons, a reservoir (storage tank), associated piping, and a control valve. The control valves on cars are designed to respond to changes in air pressure in the train line. The train line is the physical connection of the locomotive and the cars’ air brake systems through metal pipes and connecting flexible air hoses at the ends of each railroad vehicle. The air pressure within the train line is called the brake pipe. When brake pipe pressure (in the train line) is reduced by the engineer, each car’s control valve senses the drop and applies the brakes by sending some air stored in the car’s reservoir to its brake cylinder(s). The amount of air sent to the air brake cylinder is proportional to the drop in brake pipe pressure. Up to a point, the larger the drop in brake pipe pressure, the more air the control valve sends from the reservoir to the brake cylinder and the greater the amount of braking force created. To release the brakes, the engineer lets more air into the train line from the locomotive main reservoirs, increasing the brake pipe pressure. Each car’s control valve senses this increase in air pressure and exhausts air from the brake cylinder, releasing the brakes. A return spring within the brake cylinder pushes the piston back into the cylinder, and the brake shoe backs away from the wheel or disc. At the same time, the car’s control valve takes some air from the train line to replenish any air that the car’s braking system has used from its reservoir to charge or recharge its system. The brake-pipe pressure is determined by the engineer, who turns a knob that sets the regulating or feed valve. The regulating valve reduces the pressurized air from the main reservoir to a determined amount for delivery to the equalizing reservoir, which then dictates brake pipe pressure. The equalizing reservoir is a small reference volume used to control the much larger brake pipe or train line volume. The equalizing reservoir allows the engineer to make immediate predetermined changes to the brake-pipe pressure without having to wait for the changes to take place in the train and stabilize. Since the train line connections through and between cars are not perfect, some of the compressed air leaks out of the system. In order to prevent the car control valves from sensing a drop in air pressure from leakage and inadvertently applying the brakes, the automatic brake valve in the engineer’s locomotive control stand has a maintaining feature. The maintaining feature automatically sends just the right amount of air into the brake pipe, regardless of whether the brakes are applied or released, to make up for any train line system leakage. Since the maintaining feature is located in the locomotive, there is usually a constant flow of air toward the rear of the train. Train line leakage progressively draws off air from the brake pipe as it travels toward the rear of the train, dropping air pressure. This gradual drop in brake pipe pressure is called gradient, and represents the difference in brake pipe pressure between the front of the train and the rear of the train.

FD07264 ｜ 2002_美国_RAR0203.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2002 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594 RAILROAD ACCIDENT REPORT PB2002-916303 NTSB/RAR-02/03 DERAILMENT OF UNION PACIFIC RAILROAD TRAIN QFPLI-26 AT EUNICE, LOUISIANA, MAY 27, 2000 7450

this page intentionally left blank

Railroad Accident Report Derailment of Union Pacific Railroad Train QFPLI-26 at Eunice, Louisiana, May 27, 2000 NTSB/RAR-02/03 PB2002-916303 National Transportation Safety Board Notation 7450 490 L’Enfant Plaza, S.W. Adopted April 2, 2002 Washington, D.C. 20594

National Transportation Safety Board. 2002. Derailment of Union Pacific Railroad Train QFPLI-26 at Eunice, Louisiana, May 27, 2000 . Railroad Accident Report NTSB/RAR-02/03. Washington, DC. Abstract: On Saturday, May 27, 2000, about 11:48 a.m., central daylight time, 33 of the 113 cars making up eastbound Union Pacific Railroad train QFPLI-26 derailed near Eunice, Louisiana. Of the derailed cars, 15 contained hazardous materials and 2 contained hazardous materials residue. The derailment resulted in a release of hazardous materials with explosions and fire. About 3,500 people were evacuated from the surrounding area, which included some of the business area of Eunice. No one was injured during the derailment of the train or the subsequent release of hazardous materials. Total damages exceeded $35 million. The major safety issues identified in this investigation are track conditions on the Union Pacific’s Beaumont Subdivision and the effectiveness of the Union Pacific’s track inspection activities, including management oversight. As a result of the investigation, the National Transportation Safety Board makes safety recommendations to the Federal Railroad Administration, the Union Pacific Railroad, and the Association of American Railroads. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2002-916303 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Railroad Accident Report Contents Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Track and Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Hazardous Material Tank Cars . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Train and Operations Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Personnel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Engineer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Conductor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Site Description and Track Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Location of Derailment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Speed Restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Signal System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Postaccident Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 UP Inspection of Beaumont Subdivision Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Hy-Rail Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Walking Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Other Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Oversight of Track Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 FRA Inspection of Beaumont Subdivision Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Joint Bars . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Rail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Bond Wires . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Beaumont Subdivision Track Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Jointed Rail in Mainline Tracks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Rail Joints as a Cause of Derailments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Mechanical Suitability of Joint Bars . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 UP Track Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Frequency of Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Contents iv Railroad Accident Report Adequacy of Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Inspection Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Walking Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Oversight of Track Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 UP Management Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 FRA Track Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 AAR Recommended Practices for Key Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Environmental Remediation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Appendixes A: Investigation and Public Hearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .41

v Railroad Accident Report Executive Summary On Saturday, May 27, 2000, about 11:48 a.m., central daylight time, 33 of the 113 cars making up eastbound Union Pacific Railroad train QFPLI-26 derailed near Eunice, Louisiana. Of the derailed cars, 15 contained hazardous materials and 2 contained hazardous materials residue. The derailment resulted in a release of hazardous materials with explosions and fire. About 3,500 people were evacuated from the surrounding area, which included some of the business area of Eunice. No one was injured during the derailment of the train or the subsequent release of hazardous materials. Total damages exceeded $35 million. The National Transportation Safety Board determines that the probable cause of the May 27, 2000, derailment of Union Pacific train QFPLI-26 was the failure of a set of joint bars that had remained in service with undetected and uncorrected defects because of the Union Pacific Railroad’s ineffective track inspection procedures and inadequate management oversight. The major safety issues identified in this investigation are track conditions on the Union Pacific’s Beaumont Subdivision and the effectiveness of the Union Pacific’s track inspection activities, including management oversight. As a result of the investigation, the National Transportation Safety Board makes safety recommendations to the Federal Railroad Administration, the Union Pacific Railroad, and the Association of American Railroads.

this page intentionally left blank

1 Railroad Accident Report Factual Information Accident Synopsis On Saturday, May 27, 2000, about 11:48 a.m.,1 33 of the 113 cars making up eastbound Union Pacific Railroad (UP) train QFPLI-26 derailed near Eunice, Louisiana. Of the derailed cars, 15 contained hazardous materials and 2 contained hazardous materials residue. The derailment resulted in a release of hazardous materials with explosions and fire. (See figure 1.) About 3,500 people were evacuated from the surrounding area, which included some of the business area of Eunice. No one was injured during the derailment of the train or the subsequent release of hazardous materials. Total damages exceeded $35 million. Accident Narrative At 6:00 a.m. central daylight time on May 27, 2000, a two-person train crew consisting of an engineer and conductor went on duty at Beaumont, Texas, to take UP freight train QFPLI-26 to Livonia, Louisiana. (See figure 2.) Train QFPLI-26 was a run- through train,2 and the crew received the train directly from the inbound crew. The train 1 All times referenced in this report are central daylight time. Figure 1. Looking west at accident scene.

Factual Information 2 Railroad Accident Report was made up of 3 locomotives, 87 loads, and 26 empties, and it departed Beaumont without the locomotives or cars being changed. According to the train consist,3 56 cars required hazardous material placards. Of these, 40 cars were loaded, and 16 contained residue.4 The train carried several types of hazardous materials, including numerous liquids and flammable gases. According to the train-dispatching records, the train arrived at Beaumont at 6:02 a.m. and departed at 8:17 a.m. During the next 3 1/2 hours, the train traveled about 109 miles. The engineer and conductor told Safety Board investigators that during this time, the trip was without 2 Train QFPLI is a regularly scheduled freight train that originates in Freeport, Texas. On the day of the accident, train QFPLI-26 stopped at Beaumont only to change crews. (See the “Train and Operations” section of this report for more information.) 3 A train consist is an organized list of the train cars, indicating the location of all of the cars and other equipment. A consist also provides hazardous materials information. 4 Residue is the hazardous material that remains in a tank car that has been unloaded but has not been cleaned or purged. In tallies of loads and empties, a residue car is counted as an empty. Figure 2. The Union Pacific’s Beaumont Subdivision Galveston Angleton Freeport Bay city Wadsworth ArcolaAlvin Algoa La Port Baytown Spring Cleveland Conroe Lafayette Lake CharlesIowa Junction Alexandria Livonia Baton Rouge Port Allen Lettsworth Kinder Orange Port Author Beaumont Silsbee De Quincy Eunice Opelousas Navasota Texas Louisiana New Iberia KCS CNIC NS CSX Rosenberg HOUSTON Dayton Dobbins Eagle Lake Sealy New Orleans Mississippi Louisiana UP UP UP BNSF BNSF UP Lufkin UP UP BNSF Morgan City 0 50 100 Scale in Miles G U L F o f M E X I C O UP UP Tenaha UP BNSF BNSF/UP Not all Railroads are Shown UP's Beaumont Subdivsion Other UP Lines and Other Railroads

Factual Information 3 Railroad Accident Report incident. The engineer said that he had had no difficulties with brakes or slack action5 and that the train was a “good handling train.” The engineer said that between milepost (MP) 556.75 and MP 557.0, he slowed the train from 40 to 25 mph to comply with a temporary speed restriction that had been imposed because of track conditions. He said that after the rear car was beyond the temporary speed restriction, he accelerated the train back to the designated track speed of 40 mph. According to engineer statements and event recorder data, the wayside signals were displaying a clear signal,6 the locomotive throttle was in the eighth notch, and the train was moving about 40 mph7 as it approached Bridge 567.9, a nine-span precast concrete bridge. (See figure 3.) 5 Slack in a train can be expressed as the difference between the length of the train when it is compressed and when it is stretched. Train slack can be affected by the free movement between couplers and the amount of play in the draft gear. Excessive train slack will affect train handling and can sometimes be of concern. 6 A clear signal indicates that a train may proceed at track speed. Trains receiving a clear signal will not be diverging at the next signal location and will not have a signal more restrictive than approach at the next signal. 7 According to the lead locomotive event recorder data, the speed varied between 39 and 41 mph. The event recorder on the second locomotive indicated a constant speed of 40 mph. Figure 3. Location of the derailment. 190 190 13 91 757 13 29 To Beaumont

Direction of Travel Derailment occurred on Bridge 567.9 To Livonia Bayou Des Cannes

Factual Information 4 Railroad Accident Report The engineer stated that as his train approached the bridge, he saw a section of misaligned or broken rail about 50 feet in front of the locomotive. The defect was in the south rail, which was the rail under the engineer’s side of the cab. The conductor, who was sitting on the opposite side of the locomotive, said he did not see the misalignment in the rail but he heard the engineer say they were about to pass over a broken rail, and he felt the engine pitch toward the south side. Both crewmembers reported the sound of a “thud” as the locomotive passed over the spot where the engineer had seen the misalignment. As the train passed over the defect, the train derailed and separated, which placed the train brakes in emergency.8 The engineer said that he felt an increase in the train’s rolling resistance, and then he saw the cars derailing and piling up behind him, instantly producing fire and smoke. The engineer said that he immediately contacted the UP train dispatcher in Spring, Texas, on the locomotive radio. According to the transcript of the call, the engineer told the dispatcher that the train had derailed and that there was a fire. The engineer asked for urgent emergency assistance and said he believed the train had passed over a broken rail. With the train in emergency braking, the lead locomotive stopped at MP 568.1, and after a brief moment of discussion, the crew decided to uncouple the three locomotive units from the train. After the conductor separated the last locomotive from the first car of the train, the engineer moved the locomotives eastward to a grade crossing at MP 568.75 and waited for emergency crews to arrive. Postaccident investigation revealed that all three locomotives and the first nine cars passed over the location of the reported track defect without derailing. The rear truck of the 10th car derailed, and the train separated behind this car. Of the 33 cars that derailed, 17 were hazardous materials cars. Two contained a residue of thiapentanal; one each contained acrylic acid, dichloropropane, dicyclopentadiene, molten phenol, and pentanes; two each contained toluene diisocyanate, methyl chloride, and hexanes; and four carried a corrosive liquid. Five additional hazardous materials cars did not derail but were exposed to the heat of the fire. The five included three cars loaded with styrene monomer and two thiapentanal residue cars. The derailed freight cars that carried no hazardous freight included covered hoppers carrying plastic pellets and other cars carrying feed, dyes, and glycol. Emergency Response The St. Landry Parish 911 Center received the first call at 11:48 a.m. The call came from someone at the Eunice Country Club with a cellular telephone. The caller stated that a train had derailed, that a tank car was on fire, and that there was a cloud of black smoke. 8 Train brakes are applied in response to reductions in trainline air pressure. Normally, the locomotive engineer initiates a reduction of trainline air pressure, but a broken or disconnected trainline (such as occurs when a train separates) results in an instantaneous loss of air pressure that causes an application of the emergency brakes.

Factual Information 5 Railroad Accident Report The 911 operator transferred the caller to the Eunice Police Department and remained on the line while the caller told the police the location of the fire. The caller informed the Eunice Police Department that the fire was in the area of the railroad tracks behind the country club. The police dispatcher told the caller that the Eunice Fire Department had been dispatched. The UP’s Risk Management Communications Center received the initial notification at approximately 11:49 a.m. and notified the local police, fire, and emergency medical services within 2 minutes. The UP Police Department was notified and began to respond within 10 minutes of the initial notification. Within 30 minutes, the UP’s environmental and hazardous material personnel had begun to respond. The St. Landry Parish 911 operator called the Louisiana State Police and the Louisiana State Police Hazardous Materials Unit. The 911 operator also contacted the sheriff’s offices of St. Landry Parish and Evangeline Parish.9 By 11:55 a.m., the Eunice police and fire departments had arrived on scene and had begun to evacuate the immediate area. About 12:15 p.m., the Eunice police and members of the St. Landry Parish Sheriff’s Office expanded the evacuation to include all people within a 1 mile radius of the derailment. The Louisiana State Police established a command post at Eunice High School at 2:11 p.m. The command post was subsequently relocated at 4:15 p.m. to a Louisiana State University campus in Eunice. The emergency response organizations that responded to the incident included the Louisiana State Police Troop I, the Louisiana State Police Hazardous Materials Unit, the Eunice Police Department, the Eunice Fire Department, the St. Landry Parish Sheriff’s Office, the Evangeline Parish Sheriff’s Department, the Acadia Parish Sheriff’s Department, the Acadia Ambulance Service, the Basile Police Department, the Mamou Police Department, the UP Police Department, and the U.S. Coast Guard. At 8:00 a.m. on Sunday, May 28, a St. Landry Parish official declared a state of emergency and extended the evacuation area to 2 miles east of the derailment. The boundaries of the evacuated area varied over time. At its largest, the evacuation area was 2 miles to the east, 1 mile to the north, 1/2 mile to the south, and 2 1/2 miles to the west. At 9:50 a.m., the Eunice police reported that the evacuation had been completed. At 5:30 a.m. on Monday, May 29, the command post was moved from the Louisiana State University campus to Eunice Junior High School. That afternoon, Evangeline Parish evacuated residents who resided 2 1/2 miles west of the derailment. During the following days, law enforcement officers escorted residents of the evacuated area to their homes so they could get food and medicine and could care for their animals. UP police told Safety Board investigators that 22 UP officers were in the Eunice area to assist the local police where necessary, including patrolling the evacuated areas at night. 9 The boundary between St Landry Parish and Evangeline Parish is about 0.4 mile west of the location of the derailment.

Factual Information 6 Railroad Accident Report At 4:00 p.m., on June 1, the evacuation area was reduced to 1/2 mile. The majority of the residents returned to their homes, and businesses were reopened. At 6:00 p.m. on June 2, the Louisiana State Police released the accident site to the Louisiana Department of Environmental Quality. UP officials told Safety Board investigators that the railroad provided assistance to residents who were affected by the evacuation. Investigators observed UP representatives processing requests for assistance by local citizens. Such assistance included compensation for hotels, meals, clothes, and other expenses. Injuries No one was injured during the derailment of the train. Safety Board investigators visited local hospitals and asked hospital staff members to identify anyone who had been treated for ailments related to the fire or release of hazardous materials. The investigators found no indication that anyone had gone to the facilities with complaints related to the derailment. UP officials told the investigators that they did not have any evidence that anyone had received medical treatment for injuries sustained as a result of the evacuation or the release of hazardous materials. Damage Track and Structures The UP determined track damage to be $988,617. The derailment destroyed about 1,200 feet of the main track. Much of the damaged track material, track ballast, and sub ballast was contaminated by the hazardous materials and was removed from the site. The derailment destroyed most of the bridge, which accounted for $877,177 in structure damages. Three private fiber optic cables ran along the UP right-of-way. One cable was partially severed in the derailment. All three cables were rerouted around the derailment site in preparation for the ground excavation that was anticipated during the hazardous materials mitigation and wreck-clearing operations. Equipment The UP estimated that the monetary damage to the railroad equipment exceeded $1.87 million. Lading damage was estimated to be in excess of $2 million. The cost of wreckage clearing was about $700,000.

Factual Information 7 Railroad Accident Report Hazardous Material Tank Cars All of the hazardous materials involved in this accident were being transported in tank cars. The derailment and the resultant fire and explosions destroyed all of the cars that were in the general pileup. The derailment involved five pressure tank cars (four class DOT 105J and one class DOT 114J). All of the pressure cars survived the derailment without being breached; three of those failed in the resulting fire. Of the 12 non-pressure tank cars, 7 were breached during the derailment.10 In general, pressure tank cars are designed to provide greater damage protection through use of increased wall thickness and head shields. They are used to transport flammable gases and other materials determined by the U.S. Department of Transportation (DOT) to present the greatest hazards if released during transportation. Pressure tank cars are also required to have a thermal protection and a pressure relief system that will allow the car to survive a pool fire for 100 minutes, which allows time for emergency responders to evacuate the area. Witnesses stated that in this accident, the first of two major explosions occurred 1 hour and 43 minutes after the derailment and fire. The two explosions likely involved the two tank cars filled with methyl chloride (a flammable gas). Both of these cars were found torn in half, and portions of the cars were found to have been thrown from 50 to 700 feet from their original resting positions. (See figure 4.) 10 Hazardous materials in pressure tank cars: methyl chloride (2 cars); pentanes; and toluene diisocyanate (2 cars). Hazardous materials in non-pressure tank cars: acrylic acid; 1, 2 dichloropropane; molten phenol; dicyclopentadiene; hexanes (2 cars); corrosive liquid, NOS (4 cars); and 4, thiapentanal residue (2 cars).

Factual Information 8 Railroad Accident Report Figure 1. Figure 4. Wreckage Figure4. Dye CCBX 7086 4 Thiapentanal 1/2 Methyl Chloride Tank Car "A" Direction of Travel 1/2 Methyl Chloride Tank Car "A" in Woods The point of derailment NoScale TrackandBridgeDamageNot Shown Covered Hoppers UTL X 641252 Dicyclopentadiene CCBX 7112 GA TX 73584 Feed TILX 220020 Feed 1/2 Methyl Chloride Car "B" CCBX 7097 4 Thiapentanal SHPX 202922 Cor. Liq NOS ACFX 95520 Cor. Liq. NOS Dye Dye TLCX 77017 Cor. Liq. NOS TLCX 77050 Cor. Liq. NOS HMAX 26822 1/2 PSPX 33722 Pentanes DONX 84374 Toluene Diisocyanate PROX 76473 Molten Phenol DOWX Plastic 66453 Pellets ACFX 94164 1, 2 Dichloropropane DOWX 84375 Toluene Diisocyanate DOWX Plastic 20889 Pellets DBCX Acrylic 468 Acid 1/2 Methyl Chloride Car "B" 1/2 PSPX 33722 Pentanes 1/2 Methyl Chloride Car "B" GATX 67199 Glycol DCBX Plastic 324 Pellets DCBX Plastic 328 Pellets DCBX Plastic 322 Pellets DCBX Plastic 357 Pellets PSPX 23547 Hexanes PSPX 23503 Hexanes

Factual Information 9 Railroad Accident Report Non-pressure tank cars are intended to carry materials considered by the DOT to present a lesser hazard if released in transportation. These cars generally do not have the same wall thickness as the pressure tank cars, and most are not required to have thermal protection or head shields. The non-pressure tank cars on train QFPLI-26 carried flammable liquids, corrosives, and a poisonous solid (molten phenol). Several of these cars released their contents after being crushed and/or punctured during the derailment. Environment Damage to the tank cars caused by the derailment and by the subsequent fire resulted in the release of most of their contents. The tank cars released about 43,700 gallons of flammable gas, 944,150 pounds of corrosive liquids, and 167,685 gallons of miscellaneous flammable liquids and poisons. To eliminate the risks posed by damaged cars that were still loaded with hazardous materials, one car of acrylic acid and two cars of toluene diisocyanate were explosively breached by emergency responders. Most, if not all, of the released product from these three cars was burned. Some hazardous material was recovered during the cleanup. About 7,500 gallons of corrosive liquid were recovered from one tank car, and some phenol was recovered from pits near the derailment site. During the excavation of the site, the Louisiana Department of Environmental Quality directed that the UP remove contaminated soil, burned trees, and water. Records provided by the Louisiana Department of Environmental Quality11 list 71,140 tons of contaminated soil, 1,593 tons of contaminated and burned trees, and 1.68 million gallons of contaminated water that were removed from the site. These materials were sorted according to their chemical contamination and sent to suitable facilities for disposal as hazardous waste. The testing and monitoring of the site will continue under the direction of the Louisiana Department of Environmental Quality. The UP estimated the cost of the environmental damage and cleanup at more than $26 million. Train and Operations Information The derailment occurred on the Beaumont Subdivision, a component of the UP’s Southern Region. The Beaumont Subdivision is one of the 30 subdivisions listed in the UP’s Houston Area Timetable. This trackage was formerly owned and operated by the Missouri Pacific, with the ownership of the right-of-way being absorbed by the UP on December 22, 1983, when the UP and the Missouri Pacific merged. The Beaumont Subdivision extends westward from Gulf Coast Junction, near Houston, Texas, (MP 378.0) to Livonia, Louisiana, (MP 621.0) a distance of 243 miles. It is primarily a single-track railroad and has 20 passing sidings for the meeting and passing of trains. Train operation is controlled by centralized traffic control (CTC)12 and is under 11 These figures were given to the Safety Board totaling the amount of materials recovered as of December 2001. 12 Centralized traffic control is a block signal system that uses wayside signal indications to authorize train movements. The train dispatcher has the ability to control trains by displaying controlled signals and lining track switches from a centralized, remote location.

Factual Information 10 Railroad Accident Report the direction of the UP train dispatcher in Spring, Texas. All engines on the accident train were equipped with standard radios for communication with the train dispatcher. Because it is more efficient to “fleet” trains that operate in the same direction on the mostly single-track subdivision, trains that operate on the Beaumont Subdivision are generally eastbound trains. Although there are no limitations or restrictions to the operation of a westbound train on the subdivision, this type of “one-way” operation avoids the process of trains that are of opposing directions having to wait for one another in sidings. Westbound UP trains between Livonia and Beaumont generally operate over a joint UP/Burlington Northern Santa Fe Subdivision, which parallels the UP’s Beaumont Subdivision to the south. Twelve freight trains pass through Eunice on an average day. In addition, two local freights pass through town each day, placing and pulling cars at local industries. No regularly scheduled passenger trains operate on the Beaumont Subdivision. In 1998, the annual gross tonnage on the Beaumont Subdivision was about 18.29 million gross tons. In 1999, the Beaumont Subdivision handled a gross tonnage of about 22.13 million gross tons, or 21 percent more than in 1998. The UP operates a train with the symbol “QFPLI” each day of the week except Monday. The train originates at the UP yard in Freeport, Texas, and terminates at the UP facility in Livonia. Because of the various chemical-related industries that are located along the Gulf Coast of Texas and Louisiana, a QFPLI usually carries hazardous materials. The UP provides all train crews with a consist that provides hazardous materials information and emergency response information for the materials being transported in the various cars of the train. The consist for QFPLI-26 identified the train as a “key” train, which requires special handling considerations because of the hazardous materials transported. The consist information for each hazardous materials car included the commodity, the car identification, emergency contact information, and the location of the car in the train. Investigators found that the placement of cars carrying hazardous materials conformed to the UP’s hazardous materials instructions. The UP also requires that a key train have an operable end-of-train telemetry device.13 According to the UP special instructions and the UP’s “Instructions for Handling Hazardous Materials,” a key train must not exceed 50 mph. The exact order and identification of the cars that were listed in the computer-generated consist was verified by an AEI14 reader in Beaumont. The Association of American Railroads (AAR), in AAR Circular No. OT-55-B, Recommended Railroad Operating Practices for Transportation of Hazardous Materials, 13 An end-of-train telemetry device, or EOT, transmits to the lead unit (head-end locomotive) the brake pipe pressure at the rear of the train and other pertinent information. Brake pipe pressure can also be displayed on a digital readout on the flashing rear-end device itself. 14 AEI is an abbreviation for “automatic equipment identification.” This is a system of car identification by wayside scanners that records the identification of the cars of a passing train. Such information can be used to update the exact order and identification of the equipment in a train. It is commonly used to generate an accurate train consist.

Factual Information 11 Railroad Accident Report defines and recommends limits on key trains and key routes. The AAR defines “key train” as follows: Any train with five tank car loads of Poison Inhalation Hazard PIH or 20 car loads or intermodal portable tank loads of a combination of PIH (Hazard zone A or B), flammable gas, Class 1.1 or 1.2 explosives (Class A), and environmentally sensitive chemicals.[15] UP train QFPLI-26 did not meet the AAR definition of a key train but, as noted above, the train did meet the UP’s definition and was handled accordingly. The AAR defines “key route” as follows: Any track with a combination of 10,000 car loads or intermodal portable tank loads of hazardous materials, or a combination of 4,000 car loadings of PIH (Hazard zone A or B), flammable gas, Class 1.1 or 1.2 explosives (Class A), and environmentally sensitive chemicals, over a period of one year. UP stated that the route from Freeport, Texas, to Livonia, Louisiana, was a key route. The train consist indicated that the train was 6,708 feet in length and had a gross weight of 11,999 tons. Three locomotive units were on the head-end of the train. The lead locomotive was the UP 3909, an EMD (manufactured by the Electromotive Division of General Motors) SD40-2 that is rated at 3,000 horsepower. The two following units were manufactured by General Electric and owned by the Norfolk Southern Railway. Each of them is rated at 4,000 horsepower. The middle unit was NS 8766, a GE C40-8, and the last unit was NS 8738, a GE C40-9. The trailing unit was isolated,16 and the diesel engine was shut down at the time of the derailment. The train had an operating two-way end-of-train telemetry17 device. Operating crews of the trains on the Beaumont Subdivision were governed by the General Code of Operating Rules, Fourth Edition, effective April 2, 2000; the UP air brake and train handling rules; and the safety rules. Other instructions and references included the UP “System Timetable,” the “Houston Timetable No. 1,” the UP’s system special instructions, and the UP’s “Instructions for Handling Hazardous Materials.” Train crews were also governed by the applicable general orders and the instructions from the train dispatcher. 15 AAR Circular OT-55 was modified to revision C on October 20, 2000, and to revision D on August 23, 2001. Revision D incorporates the transportation of spent nuclear fuel and high -level radioactive waste and updates the list (provided with the circular) of poison inhalation hazard materials and environmentally sensitive chemicals that are subject to OT-55. 16 An isolated locomotive is set up so that it may be moved in a train but will not produce tractive effort. An isolated locomotive will not provide dynamic braking, but all aspects of the pneumatic braking systems (automatic, independent, and actuating) will function in unity with the other locomotive(s). The diesel engine of an isolated locomotive may or may not be operating. 17 A two-way end-of-train device is capable of initiating an emergency brake application at the rear of the train upon receiving a signal from the head end.

Factual Information 12 Railroad Accident Report Automated train records note the passage of trains by certain locations. These records indicate that QFPLI-26 passed the timetable station of Hub, MP 544.4, at 11:03 a.m., about 45 minutes before the derailment. Using the recorded times for two other trains as they passed Hub, investigators added 45 minutes to the “Hub times” to approximate the times that the two preceding trains had passed through the Eunice area. (Both trains, according to the train dispatching records, were eastbound, as is the usual practice.) One train was an intermodal train, IHONO-26, with 26 cars, that passed through Eunice about 2:10 a.m.; the other train was a miscellaneous freight train, QDYLIX-26, with 103 cars, that passed through Eunice about 4:22 a.m. According to UP officials, neither train reported a track defect or rough ride when it passed over the point at which the accident train subsequently derailed. Personnel Information UP crew dispatching records indicate that the conductor had been off duty for at least 8 hours and that the engineer had been off duty for at least 10 hours before reporting for duty at 6:00 a.m. on the day of the accident. Both men had had the required amount of time off duty before beginning their tours of duty and were in compliance with the Federal hours-of-service law. After the accident, both crewmembers were toxicologically tested as required under 49 Code of Federal Regulations (CFR) Part 219, Subpart C, “Post-Accident Toxicological Testing.” The results for both employees were negative. Engineer The 53-year-old engineer began his railroad career as a brakeman with the Missouri Pacific Railroad in Dequincy, Louisiana, on June 30, 1978. He attended the Missouri Pacific’s school for locomotive engineers in Little Rock, Arkansas, in 1980 and was promoted to locomotive engineer in March 1981. He has worked as an engineer since then and came to the UP following its merger with the Missouri Pacific. Under 49 CFR Part 240, all locomotive engineers must be certified. Records indicate that the engineer had most recently attended a safety and operating rules class and successfully passed an examination on the General Code of Operating Rules on November 11, 1998. His last physical exam was on June 3, 1999. His most recent check-ride before the accident was on May 6, 2000. He had most recently attended training in a locomotive simulator on May 19, 1999. During the 2 years before the accident, he attended six UP training classes, five of which were safety-related. Conductor The 28-year-old conductor began his railroad career with the UP in August 1997 and became a conductor on November 24, 1997. Records indicate that he had most recently passed an examination on the General Code of Operating Rules on January 12,

Factual Information 13 Railroad Accident Report

1. Training records indicate that he had attended numerous training classes and had

passed an examination on hazardous materials on August 20, 1997. His last physical exam was a preemployment exam on July 15, 1997. Site Description and Track Information Location of Derailment The derailment occurred in St. Landry Parish, about 2 miles west of the downtown section of Eunice, and about 0.4 mile east of the St. Landry Parish and Evangeline Parish line. The cars derailed in an area that was generally flat and marked by a mixture of farm fields and woods. To the north of the derailment was a section of deciduous woods. To the south of the derailment area was the wooded property of the Eunice County Club, including a golf course, swimming pool, and Lake Eunice. A driving range that was several acres in size was to the southeast, adjacent to the country club. The pileup of cars was centered around a bridge over a tributary that emptied into Bayou Des Cannes. The track in this area had an approximate compass direction of east-west, which matched the east-west direction that was specified in the timetable. Milepost numbers increased from west to east. The bridge, which had nine spans and was made of precast concrete, was 189 feet long and had a maximum height of about 12 feet above the waterway. The eastern end of the bridge was at MP 567.9. The alignment of the track was tangent for several miles west of the bridge and remained tangent over the bridge. At MP 568.0, the track began a 1-degree curve to the right. The grade of the right- of-way in the Eunice area was undulating, and track gradients were 0.4 percent or less. The track was level at the point of the derailment. The track was on an earthen fill about 12 feet above the ditch line at the east end of the bridge. The track at the accident location was jointed track supported with granite ballast that was approximately 18 inches deep under the crossties. The 115-pound rail was manufactured in 39-foot lengths and joined together with two 36-inch joint bars (one on each side of the rail joint) that had 3 bolts per rail end. The manufacturer’s stamping identified the rail as 115 RE CC CF&I, rolled in January 1951. The double-shoulder tie plates were 8 inches wide and 13 inches long. Six-inch chisel-cut track spikes secured the rail and tie plates to the crossties. The spiking pattern varied between 2 to 4 spikes per tie plate. When two spikes per tie plate were used, one spike was on the field side18 and one spike was in the gage side19 in the rail holding position. When four spikes per tie plate were used, there was an additional spike in the gage-side rail holding position and one additional spike on the field-side plate holding position. Wooden crossties were installed with an average spacing of 19.5 inches, yielding 24 crossties per rail length. Every third or fourth tie was box anchored.20 18 The field side of a rail or rail joint is the side toward the outside of the track. 19 The gage side of a rail or rail joint is the side toward the center of the track.

Factual Information 14 Railroad Accident Report Three fiber optic cables were located on the UP’s right-of-way in the area of the derailment. Two cables were on the south side of the track, and one cable was on the north side of the track. No other utilities were on the UP right-of-way. Speed Restrictions The maximum speed (for non-key trains) on the majority of the Beaumont Subdivision was 60 mph; however, a maximum timetable speed of 50 mph was specified between MP 544.8 and MP 588.5, approximately corresponding to the 44-mile segment21 of the subdivision that used jointed rail. (The balance of the subdivision used continuous welded rail, or CWR. See the “Jointed Rail in Main Tracks” section of this report for more information on CWR versus jointed rail.) To supplement and update timetable instructions, the railroad issues general orders that contain specific instructions to operating crews. Such instructions cover a wide range of operating considerations, including train speed, track speed, and the required speed of equipment in various situations. A general order for the Beaumont Subdivision specified a maximum allowable train speed of 40 mph between MP 544.8 and MP 589.0,22 which corresponded with the jointed rail portion of the subdivision and included the accident area. Because the track had a maximum allowable operating speed of 40 mph for freight trains, the track was required to meet the Federal Railroad Administration’s (FRA’s) requirements for class 3 track.23 Signal System The signal system in use on the Beaumont Subdivision displayed wayside signal indications to the operating crews of trains. The signal system components pass an electric current through the rails to determine whether the track is clear of trains or occupied by railroad equipment. Because of the electrical current carried in the rails, the signal system also detects continuity of the rails and rail joints. A disruption in the electrical circuit could be associated with a break in the rail or a break in a bond wire at a rail joint.24 A wayside signal can display a clear indication only if the two consecutive blocks in advance of the signal are clear of trains and have no loss of rail continuity. The engineer and conductor of the accident train said that they had observed a clear indication at the last signal before the derailment and that previous signal aspects had also displayed a clear indication. Safety Board investigators examined the signal system for information that 20 The term box anchored indicates that rail anchors are applied on both sides of the tie, resulting in a rectangular box pattern. 21 The actual location of this jointed rail was between MP 544.3 and MP 588.5. 22 UP officials informed Safety Board investigators that this speed restriction is reissued annually in the spring to coincide with the change to daylight savings time. This particular general order was effective May 10, 2000. 23 The track safety standards, contained in the CFR, allow for increased train speed as the track meets increasing standards of construction, maintenance, and inspections. Freight trains can operate at a maximum speed of 10 mph on class 1 track, 25 mph on class 2 track, and 40 mph on class 3 track. Succeeding higher classes of track allow for higher train speeds. 24 A bond wire bridges the rail joint to provide electrical continuity from one rail section to the next.

Factual Information 15 Railroad Accident Report could be used to determine whether the signal system had detected a loss of continuity of the rails before the arrival of the accident train. No loss of continuity was detected. Except for a section of automatic block signals and yard limits, train movements on the greater part of the Beaumont Subdivision are governed by the signal indications of the CTC system. The CTC system controls train movements through the use of three- aspect color light signals, displayed singularly or in combination, along the track wayside. The wayside signals are controlled by Electro Code 2 and Electro Code 4 electronic coded track circuits. Signals are arranged for train movement in either direction. On the Beaumont Subdivision, the signal system is operated with the help of a computer-aided dispatching (CAD) system to assist the train dispatcher. Postaccident Inspection Equipment Two days after the derailment, the 69 rear cars of the accident train were moved from the accident site to Basile, Louisiana, where they were given a mechanical inspection and an initial terminal air brake test. Investigators found that there was no air brake leakage. They did discover two mechanical defects: one worn composition brake shoe and a car with air brakes that released on the rear of the car.25 They also noted that the seven east cars were covered in soot from the fire. The head nine cars were moved from the accident site about 1/2 mile eastward, where they were given a roll-by inspection, a mechanical inspection, and an initial terminal air brake test. The roll-by inspection was performed as the cars were pulled from the wreckage; there was no evidence of any component dragging, binding, or fouling. No air brake train line leakage was noted during the air test. In the general pileup area, investigators observed wheels, axles, and other car parts that exhibited visible evidence of having been deformed by the heat of the fire. Heat and explosive forces had visibly damaged the tank car shells. Safety Board investigators examined the several derailed cars at the east end of the derailment; those cars had departed the roadbed to the south and had escaped the direct effects of the explosions and fire. No preaccident defects were identified on these cars. Signals During an inspection from MP 569 to a signal control point near MP 572, investigators found all signal units and signal bungalows to be locked and secured. Investigators found no indication that any of the signal equipment had been vandalized or tampered with. Testing indicated no grounds or short circuits on any of the equipment, and no obstructions were identified that would hinder a train crewmember’s ability to see the 25 The brakes did apply on the car; however, after a time, the truck-mounted brake on the rear of the car released.

Factual Information 16 Railroad Accident Report wayside signals. The investigators looked at the track connections and insulated joints and found three broken bond wires. At the control point, track circuits were verified, and investigators used track shunts to simulate train movements as a method of testing the system. Switch and signal locking tests were also performed. All electric lock locations were tested and verified. Signal indications were found to correspond with one other. The UP signal maintenance, inspection, and test records indicate the equipment was in working condition and listed no exceptions that would prevent the signal equipment from operating properly. Investigators reviewed the records of the most recent testing of the signal equipment in the vicinity of the accident. Postaccident data was also obtained from the CAD computer log at the control center in Spring. The records and data revealed some anomalies with the signal system, but none that would have had a bearing on the derailment. Wayside defect detectors were located approximately every 10 to 15 miles along the Beaumont Subdivision. The last two defect detectors that the train passed before the derailment were at MP 546.7 and MP 558.8. The detectors were designed to detect overheated journals and dragging equipment and had radios that enabled them to transmit information about the trains that passed. Each defect detector had an event recorder. Safety Board investigators examined the downloaded data from the detector stations and noted that neither detector had recorded any defect when train QFPLI-26 traveled over it. Track Investigators examined the accident site and found that a major portion of the track structure was totally destroyed by the pileup of the cars and the resulting fire and explosions. The bridge was severely damaged, and only the western end remained standing. Trees near the roadbed showed evidence of blast and fire damage. The engineer stated that he had seen a misalignment in the south rail just before passing over it, but he said he was not sure if the misalignment was at a rail joint or if it was due to a broken rail. After the derailment, the recovered sections of rail were arranged in a linear fashion; the relative order was determined by matching ends of the rails and joint bars. Some of the rails had been bent and twisted by the extreme heat, and postaccident overstress fractures were found. Investigators could find no evidence of a preaccident rail failure. In jointed rail territory, the individual rails are joined to one another by joint bars. (See figure 5.) The Beaumont Subdivision used a common form of rail joint that consists of two joint bars plus six track bolts, nuts, and spring washers. Two joint bars, one on each side of the rail ends, are considered to be a pair. Oval-shouldered track bolts, typically 1 inch in diameter, are arranged in an alternating pattern through holes in the joint bars and rail. When the bars are matched up to form a rail joint, one on the gage side and one on the field side of the rail, the bolts are tightened and the joint bars are drawn toward each other, squeezing them toward the side of the rail. In addition to joining the rail ends together, the joint bars act as a beam that distributes over several adjacent ties the downward vertical load that is imposed on the rail joint by the weight of the train.

Factual Information 17 Railroad Accident Report During the postaccident inspection of the derailment area, portions of two broken joint bars, still bolted to the end of a section of the south rail, were found on the bridge at about the fourth span. Each joint bar portion had a break in the transverse plane at the center of the joint bar, near the end of the rail. Later, portions of another pair of broken joint bars were found. These bars also had remained bolted to a piece of rail and had breaks in the transverse plane at the center of the joint bar. The fractured surfaces of the two pairs of broken joint bar pieces matched one another in both the location of the broken surfaces and the type of fracture. When investigators examined the second pair of broken joint bar pieces and the rail to which the bars were bolted, they discovered that the top corner of the end-face of the rail exhibited visible evidence of having been deformed by impact.26 This rail end-face deformation was consistent with the deformation and appearance that would have been caused if railroad wheels had hammered the blunt end of the receiving rail instead of rolling over the top of it. This type of deformation can occur when a misalignment or gap between the two rails allows the wheels to drop below the surface of the delivering rail and hammer against the end of the receiving rail as they roll over the end corner of the rail. Both broken joint bars and the rail ends to which they were attached were sent to the Safety Board’s Materials Laboratory for further examination. (See the “Tests and Research” section of this report for more information.) On the day after the derailment, Safety Board investigators inspected the track west of the derailment site with a Hy-Rail vehicle.27 A walking inspection was conducted Figure 4. Sketch of a typical joint bar. 26 The word “batter” is sometimes used to describe this type of deformation. In this instance, “deformation” is used to describe marks and indentations that result from wheels passing over the end face of the rail when the rails are separated by a greater distance than is normally expected. Bond Wire 115-Pound Rail in 39-ft Lengths Outside Joint Bar Inside Joint Bar

Track Bolts Figure 5.

Factual Information 18 Railroad Accident Report east of the derailment site. During the walking inspection, joint bars with visible vertical cracks were found. Subsequent inspections during the following days identified additional cracked and broken joint bars on either side of the derailment area. (See table 1.) The investigators noted that the cracks they found in the joint bars were not visible to a track inspector using a Hy-Rail vehicle. An inspector driving such a vehicle across a rail joint could see only the tops of the two joint bars on the driver’s side and the joint bar on the gage side of the track on the passenger side. The joint bar on the field side of the track on the passenger side of the vehicle was not visible. 27 A Hy-Rail vehicle is a maintenance-of-way highway vehicle, in this case a pickup truck, that is equipped with flanged wheels that can be lowered to allow the vehicle to travel along the railroad tracks. Table 1. Track defects noted in the accident area. Joint bar defects found by UP track maintenance crews east of the derailment location Inspection Date Milepost Locations Miles Inspected Number of Cracked Bars Number of Broken Bars 05/28/00 561.25 to 566.0 4.75 54 1 05/29/00 552.0 to 561.25 9.25 65 2 05/30/00 544.49 to 552.0 7.51 97 1 Joint bar defects found by UP track maintenance crews west of the derailment location Inspection Date Milepost Locations Miles Inspected Number of Cracked Bars Number of Broken Bars 05/28/00 570.4 to 571.8 1.4 12 05/29/00 571.8 to 576.25 4.45 35 2 05/30/00 576.25 to 578.5 2.25 21 05/31/00 578.5 to 586.5 8.0 66 3 06/01/00 586.5 to 588.2 1.7 16 1 Joint bar defects found by FRA chief inspector west of the derailment location Inspection Dates Milepost Locations Miles Inspected Number of Cracked Bars Number of Broken Bars 06/06/00 06/07/00 568.0 to 574.76 6.76 27 Total of Inspections and Defects Found Inspection Dates Total Miles Inspected Total Number of Cracked Bars Total Number of Broken Bars Total Number of Defective Bars 05/28/00 Through 06/07/00 46.07 393 10 403

Factual Information 19 Railroad Accident Report The vehicle the track inspector used during his track inspections was a 1996 Chevrolet 1-ton super-cab pickup truck with Fairmont Hy-Rail equipment. Although forward visibility will vary somewhat depending on the seat adjustment and the height of the driver, an inspector in the driver’s seat cannot see a track component that is less than about 28 feet in front of the vehicle. With a newer model of pickup truck (having a shorter hood), the track component is not visible unless it is at least 19.5 feet in front of the operator. With a flat-front inspection vehicle, an operator can see a track component at a distance of about 9.5 feet. On May 28, after the track conditions were initially observed by the track group, the Federal Railroad Administration (FRA) chief inspector inspected the track between MP 573.3 and MP 573.45 for compliance with the Federal track safety standards. He discovered seven track defects, including two cracked joint bars, three locations of defective track ties, and two locations of insufficient bolts. On May 29, the FRA chief inspector reviewed the UP’s track inspection records for the period January 1 to May 26, 2000. They revealed that the track inspector had identified defective switch ties28 at the east end of Lawtell, MP 585.0, on March 11, on April 8, and on April 15, but that the inspector had not taken remedial action as required by 49 CFR 213.233(d).29 Because of the lack of remedial action, the FRA chief inspector reported a violation on his inspection report. On May 31, 2000, Safety Board investigators and FRA personnel did a walking inspection and identified the defective switch ties that the track inspector had previously reported. The chief inspector reported a violation because the ties had still not been repaired. Safety Board investigators and FRA personnel also inspected the track at the east end of an interlocking and siding switch between MP 573.4 and MP 573.7. The FRA chief inspector reported a joint with insufficient track bolts, a tread portion of a frog that was worn beyond allowable limits, and eight loose guard bolts on the north-side guard rail. In addition to the track group’s walking inspections, the UP track maintenance crews conducted a 5-day walking inspection of the joint bars on the 44 miles of jointed rail territory. They discovered 376 defective joint bars, of which 366 were cracked and 10 were broken. After the UP had replaced the defective joint bars, the FRA chief inspector conducted a walking track inspection between MP 568 and MP 574.8. He found an additional 27 cracked joint bars and 42 rail joint locations that lacked effective crossties. 28 Switch ties support switches and turnouts and are longer than standard ties, commonly reaching lengths of more than 16 feet. 29 Title 49 CFR 213.233(d) states, “If the person making the inspection finds a deviation from the requirements of this part, the inspector shall immediately initiate remedial action.”

Factual Information 20 Railroad Accident Report UP Inspection of Beaumont Subdivision Track Routine track inspections are normally conducted by walking the tracks or by riding along the track in a Hy-Rail vehicle. Other inspections, such as those intended to identify internal rail defects or to check track geometry, are performed using specially equipped rail cars. Hy-Rail Inspections Federal regulations (49 CFR Part 213) set the requirements for track geometry and inspections. As noted earlier, in the area of the derailment, trains traveled over the Beaumont Subdivision at 40 mph, a speed that required class 3 track. Federal requirements for inspections of class 3 track stipulate that the track be inspected twice per week with at least one calendar day between inspections.30 The UP’s general practice called for the mainline track on the Beaumont Subdivision to be inspected six times per week. The UP track inspector explained that his inspection territory consisted of about 84 miles of the Beaumont Subdivision, from MP 507 to MP 590.75, which he inspects using a Hy-Rail vehicle. He stated that he tried to inspect the main track four times a week and explained that he normally inspected the main track on Saturdays, Sundays, Mondays, and Tuesdays. He used Wednesdays for yard track inspections. A relief inspector, usually the track foreman, inspected the track on Thursdays and Fridays, the regular track inspector’s off days. The inspector said that he usually traveled from west to east because the majority of train traffic operated in that direction. (An inspection vehicle that proceeds in the same direction as the train traffic generally experiences fewer delays.) When performing an inspection, the inspector observes the track, searching for defective track components or changes in track geometry. The track inspector stated that he did the track inspections at speeds between 20 and 25 mph on CWR track and between 15 and 20 mph on jointed rail. Safety Board investigators examined track inspection records for the jointed rail territory of the Beaumont Subdivision. Investigators discovered that during the week before the derailment, the records itemized three separate instances of broken joint bars. According to the records, each instance involved a rail joint in which both joint bars had broken, as had been the case with the joint bars later found near the derailment. In the first instance, which was on May 20, 1 week before the derailment, the UP track inspector found a pair of broken joint bars at MP 579.1. In the second instance, 4 days before the derailment, the track inspector found a rail joint in which both joint bars had broken at MP 571.1, about 3.1 miles east of the derailment location. In the third instance, 3 days before the derailment, the track inspector discovered a rail joint at which both joint bars were broken at MP 587.1, about 17 miles east of Eunice. According to track inspection records, a total of 128 cracked or broken joint bars had been discovered in the 5 months before the derailment. 30 This requirement is for track that had more that 10 million gross tons of traffic in the preceding year. In 1999, the Beaumont Subdivision carried in excess of 22 million gross tons.

Factual Information 21 Railroad Accident Report The relief inspector inspected the track on Thursday, 2 days before the derailment, and on Friday, the day before the derailment. He did not note any track defects on Thursday. On Friday, he replaced some track bolts at MP 575. He also inspected the switches at Lawtell, MP 585.0, and Powel, MP 573.6. He did not note track defects at either location. Walking Inspections In addition to the Hy-Rail inspections, UP policy required that the subdivision’s track be walked annually and visually inspected for cracks and breaks. The UP manager of track maintenance stated that the annual walking track inspections had been instituted before he was assigned to the Beaumont Subdivision in April 1997. He stated that he let the track inspector determine how and when to do the walking inspections. Inspectors were not required to keep written records of the dates or locations of their walking inspections. The chief engineer stated that in early 2000, he had issued oral instructions that the walking inspections of all track, whether in jointed rail territory or CWR territory, be done twice a year instead of once. He stated that he had instituted the walking inspection program after the UP reported to the FRA that a derailment in California had been caused by a pair of broken joint bars. He was unsure of exactly when he had issued the instructions, and other maintenance-of-way employees interviewed by investigators were also unsure of the exact date of the origin of this instruction. The chief engineer did not require that written records be kept of the dates or locations of the twice-yearly walking inspections. The UP track inspector told the Safety Board that while no written record of the walking inspections was kept, if a cracked or broken joint bar was found during the walking inspection, that finding would be recorded on the track inspection form. The track inspector stated that his most recent walking inspection before the accident was on January 3, 5, and 12, 2000. On those 3 days, the investigators found, the track inspector had inspected 10 miles of track. He stated that during the walking inspection, he had had track workers following behind him to make repairs. The relief inspector stated that he had done his last walking inspection in December 1999. He said he had inspected 7 miles of track, from MP 572 to MP 565, and had found more than 20 cracked joint bars. This 7-mile segment of track included MP 567.9, the location of the derailment. Since the Eunice derailment, the UP has increased the frequency of its walking inspections of jointed track. The chief engineer told investigators that he now requires that jointed rail territory that carries over 10 million gross tons and has class 2 or higher track be inspected on foot four times a year. He also said that the locations of the walking inspections must be recorded on the inspection reports.

Factual Information 22 Railroad Accident Report Other Inspections The line on which the derailment occurred was a key route by both AAR and UP definition. In its Recommended Railroad Operating Practices for Transportation of Hazardous Materials, the AAR states: Main Track on ‘Key Routes’ must be inspected by rail defect detection and track geometry inspection cars or any equivalent level of inspection no less that two times each year; and sidings must be similarly inspected no less than one time each year. The UP chief engineer told investigators that on the Beaumont Subdivision, the rail was inspected for internal defects twice a year. The UP had done the last rail inspection for internal defects on the main track with its DC-9 test car on April 11 and had found five rail defects. According to its summary report of rail detector car results on the Beaumont Subdivision for 1999, the UP, using rail test cars, had conducted internal rail inspections on April 20, July 22, and October 12. According to the UP record of rail service failures,31 one rail failure was found between MP 567 and MP 568. No rail failures were found between MP 568 and MP 569. On February 2, 2000, the UP did a track geometry inspection between MP 556 and MP 584 and did not find any track geometry defects within the area of the derailment. Oversight of Track Inspections The manager of track maintenance had almost 30 years of railroad service and had been promoted to positions of increasing responsibility. He had been the manager of track maintenance of the Livonia Service Unit, which included the Beaumont Subdivision, since April 1997. His territory consisted of about 277 miles of track. He told investigators that he had Hy-Railed over the Beaumont Subdivision about a month before the derailment. He also told investigators that the track inspector was a hard worker and that he did a good job. UP track inspectors on the Beaumont Subdivision are not dedicated exclusively to the inspection of track; they are also expected to make repairs to track defects if they are qualified and equipped to do so. Track inspectors are expected to replace defective joint bars that they find during their inspections. More extensive repairs are performed by maintenance crews. The manager of track maintenance told investigators that he reviewed the records of daily track inspection at the end of each month but that he did not scrutinize the records. He also had conversations with the track inspector when the inspector found larger maintenance problems that he could not solve by himself; in such instances, the manager of track maintenance arranged for other track employees to make the repairs. 31 A service failure is the occurrence of a broken rail or a rail defect being discovered under normal operating conditions or routine track inspections.

Factual Information 23 Railroad Accident Report FRA Inspection of Beaumont Subdivision Track Investigators examined the data gathered by the FRA’s T-10 test car32 as it had traveled over the Beaumont Subdivision on April 10. No track geometry defects were noted for class 3 track within the area of the derailment. This inspection car is not designed to inspect individual track components such as joint bars. The FRA track inspectors had inspected the track on the Beaumont Subdivision on January 26 and 27, 1999, and had done a follow-up inspection on March 16, 1999. These were the last FRA inspections before the accident. The FRA regional administrator had arranged for the January inspection to be sure that the main track complied with FRA regulations because a special train hauling napalm for the military was expected to use the track. Two FRA track inspectors inspected the Beaumont Subdivision independently, one between MP 507 and MP 569, the other between MP 569 and MP 578. Between MP 507 and MP 569, the FRA track inspector reported six locations with defective ties. The inspector also wrote on the inspection report that “ties are weak and marginal in various locations between Kinder and Eunice, LA.” Between MP 569 and MP 578, the track inspector reported three locations with defective ties and five locations with cracked or broken joint bars. A note on the inspection report reads “weak tie condition between milepost 569 and milepost 578.” The ties must support the load that is imposed on the rail and joint bars in the area of the rail joint and transmit this load to the ballast with diminished unit load. Tie spacing, weak ties, or missing ties may place a bending load on the joint bar and rails and require the adjacent ties to distribute the additional load to the ballast. The FRA track inspector who did the March follow-up inspection inspected the track between MP 556 and MP 591. He stated that he did the follow-up to see whether the conditions that he had reported in January had been corrected and to inspect other locations. He stated that the previously reported defects had been repaired but that he found defective tie conditions at 11 other locations. He identified cracked joint bars at two locations. Safety Board investigators also examined the FRA inspection reports for 1997 and

1. The reports noted that the Beaumont Subdivision was FRA class 4 track with an

operating speed of 50 mph. Most of the observed track defects were defective joint bars, improper cross-level elevation (the relative heights of the two rails), and insufficient or loose track bolts. The reports did not note weak tie conditions. The investigators also examined the FRA track inspection reports for 1995 and

1. The FRA track inspector had noted numerous track defects. No problematic defects

were noted in the immediate area of the derailment. Most of the reported track defects were deviations in cross-level, crossties not effectively distributed over a 39-foot segment 32 The T-10 test car utilizes electronic sensing technology to record eight critical track measurements for each linear foot of track. The T-10 can objectively identify problems in track gage, surface, and alignment and can accurately locate problematic conditions that are difficult to detect by visual inspection.

Factual Information 24 Railroad Accident Report of rail, no effective support crossties within the prescribed distance from a joint, missing track bolts, and cracked/broken joint bars. The FRA regional chief inspector stated that depending on what was observed from a Hy-Rail truck, an FRA inspector might decide to return for a follow-up walking inspection. He had done a walking inspection during the 1996 inspections of the Beaumont Subdivision. According to his inspection reports, he had found 36 cracked/broken joint bars. At two locations, he had found rail joints in which both joint bars were cracked. According to the track safety standards in 49 CFR 213.121(c): “If a joint bar is cracked or broken between the middle two bolt holes it shall be replaced.” The track can remain in service, at 10 mph, for a period of 30 days while repairs are made. Tests and Research Joint Bars The broken joint bars that were found at the accident scene were shipped to the Safety Board’s Materials Laboratory for further examination. An overall view of the rail pieces is shown in figure 6. The examination of the rail, joint bars, and bond wires included optical and scanning electron microscopy and energy dispersive x-ray spectroscopy of the fracture surfaces. The microstructures of each joint bar were examined, and a chemical analysis was performed on the joint bar on the field side. Raised characters on each joint bar identified the bars as having been manufactured in 1951 by the Colorado Fuel & Iron Corporation. Although some of the fracture surface was obliterated by postfracture damage, a portion of the remaining fracture surface of each joint bar showed the chevron patterns and radial marks that are typically found in overstress fractures. From these markings, the initiation of the overstress region in each bar could be traced to a relatively smooth, dark region with a curving boundary, which is typical of fatigue. On the field-side joint bar shown in figure 7, the fatigue region was on the upper portion. A portion of the boundary was visible on the east surface, as indicated by the dashed line. Ratchet marks were visible on the west surface, indicating multiple origins at the top of the bar in the area marked by bracket “O.” The depth of the fatigue region was approximately 0.813 inch. On the gage-side joint bar shown in figure 8, the fatigue region was on the lower gage-side corner of the bar. For each mating surface shown in figures 7 and 8, a dashed line indicates the fatigue boundary, and bracket “O” indicates the fatigue origin area. The depth of the fatigue region was approximately 0.308 inch.

Factual Information 25 Railroad Accident Report Figure 5. The accident joint bars. The east and west sections of the joint bars are indicated by “E” and “W.” The location of the bond wires is indicated by “B.” The bond wires are on the field side (outside) of the joint. Figure 6. The field side (outside) joint bar from the accident joint. The area of the fatigue crack boundary is shown as a dashed line. The letter “O” indicates the fatigue origin area. Figure 6. Figure 7.

Factual Information 26 Railroad Accident Report An examination of the surface of the fractured areas of the joint bars revealed that both fractured surfaces displayed evidence of contact damage to the mating fractured surface. In general, the greater damage was on the field side of the west surfaces and on the gage side of the east surfaces, indicating that the separated joint bars had shifted in relation to each other after they had fractured. Investigators chemically analyzed for carbon and phosphorus the field-side joint bar material that had been sampled approximately 2 inches west of the fracture surface. The result was 0.499 percent carbon and 0.014 percent phosphorus. According to the AREA (American Railway Engineers Association) Manual for Railway Engineering, “Specifications for High-Carbon-Steel Joint Bars” (1969), the carbon content must be greater than 0.45 percent, and the phosphorus content in the finished bar must be less than 0.05 percent. The phosphorus and carbon levels of the tested material met those specifications. Safety Board investigators measured the hardness on a cross-section of the accident joint bars.33 The AREA manual requires that the steel used in joint bars have a minimum tensile strength of 85,000 pounds per square inch (psi). The investigators found that the corresponding tensile strengths were 121,000 psi for the joint bar on the gage side and 112,000 psi for the joint bar on the field side. Figure 7. The gage side (inside) joint bar from the accident joint. The area of the fatigue crack boundary is shown as a dashed line. The letter “O” indicates the fatigue origin area. 33 The Wilson Conversion Table was used to convert hardness to the estimated tensile strengths corresponding to the measured hardness values. Figure 8.

Factual Information 27 Railroad Accident Report The pair of broken joint bars found at the derailment exhibited visual indications that the fracture surface of both failed joint bars originated at a previously formed fatigue crack. After the derailment, more than 400 defective joint bars were identified and removed from the Beaumont Subdivision’s 44-mile stretch of jointed track. Two hundred of these defective bars were transported to the UP’s research and development laboratory in Omaha, Nebraska, for examination and testing under the supervision of Safety Board staff. The majority of the defective joint bars had fatigue cracks across the center of the bar, roughly parallel to the rail ends. This type of defect is similar to the fatigue cracks that were found to have existed before the total failure of the pair of broken joint bars that were found at the location of the derailment. The purpose of the Omaha testing was to determine the relative strength of joint bars that were found to have fatigue cracks of various lengths in the center. Investigators also tested the strength of a new, as-manufactured, joint bar and of a nondefective joint bar that had been in service for about 48 years. During testing, these joint bars were mounted in a fixture that was designed to replicate the direction and location of the bending forces that a joint bar is expected to withstand in normal use. In the test, a hydraulic press was used to create bending forces that would exceed those normally found in the field so that the strength of the bar could be measured. In individual testing of a new joint that had never been in service, the bar deformed under a peak load of 120,000 pounds. In individual testing of a nondefective joint bar that was manufactured and had been in service since 1952, the bar deformed under a peak load of 110,000 pounds. Neither bar cracked or broke under testing. In addition to the nondefective joint bars, Safety Board staff selected 17 other joint bars with varying types of fatigue cracks and had them tested in a manner that subjected them to bending forces that could be measured. Three of the defective bars were tested individually, as were the two nondefective bars. These three bars fractured, with little or no deformation, under peak loads of 34,200 pounds, 43,400 pounds, and 16,600 pounds. The remaining 14 defective bars were paired and tested as a unit. Of the 14 paired bars, 8 fractured during testing with little or no deformation. These bars fractured under peak loads ranging from 16,000 to 138,000 pounds, with an average peak load at failure of about 79,375 pounds. Rail As shown in figure 6, the top surface of the end face of the east rail “E” showed damage consistent with receiving rail end deformation, and the gage side of the head was rounded. The web portion of the rail end face was deformed on the gage side, and the corner of the gage side of the base was missing. The top surface at the end face of west rail “W” was rolled over. This type of damage is consistent with trailing rail end deformation. Bond Wires Bond wires are attached to the ends of each rail at a rail joint to connect the rails electrically. With all of the rails “bonded” in this fashion, segments of track make up

Factual Information 28 Railroad Accident Report circuits in the railroad signal system. A break in a rail or a broken bond wire can cause the signal system to detect an interruption in the circuit. The Safety Board laboratory used optical microscopy to examine the separated ends of the wires to determine whether the wires had been broken before, or had been broken by, the derailment. Examination of the wires attached to west rail section revealed that most of the ends were necked adjacent to the fracture surface, which is typical of ductile overstress fracture. For the wires attached to east rail section, examination revealed that the shorter wires also appeared necked. The longer wires appeared to be flattened near the end, consistent with a longitudinal compression of the wire. Other Information Beaumont Subdivision Track Maintenance Recently Completed Maintenance. Larger maintenance projects on the Beaumont Subdivision included the 1998 installation of 20 miles of 133-pound CWR between MP 608.5 and MP 588.5, which is east of Eunice. In mid-1999, 88 carloads of ballast were distributed between MP 544.5 and MP 590.0, which corresponds to the 44- mile portion of jointed track between MP 544.3 and MP 588.5. After the ballast was spread, the track was surfaced. In addition to the surfacing, some of the road crossings were improved. In 2000, before the derailment, the UP installed 116 crossties to break up defective tie clusters and repaired an additional 21 battered rail joints. Planned Maintenance. The UP maintains a long-range plan, called a “5-year plan,” for major capital work in track maintenance. The plan is predominantly concerned with rail and tie replacement. During any particular 5-year period, projects may be accelerated or deferred. Adjustments are made according to changing conditions. The chief engineer explained that the planned projects are usually selected in the spring. He added, “Then, in December, we follow up with another planning conference where we look out the 5 years.” The projects are prioritized according to relative necessity and the changing conditions. The chief engineer told investigators that the 5-year plan, as of May 2000, did not include a tie replacement program for the Beaumont Subdivision. Such a tie project for the subdivision had been discussed, however. The chief engineer informed investigators that after the derailment, an average of 1,200 crossties per mile had been replaced on the Beaumont Subdivision. After the new crossties were installed, the jointed rail was replaced by CWR. Jointed Rail in Mainline Tracks Rail used for mainline railroad tracks can be divided into two types: CWR and jointed rail. For mainline tracks with heavy traffic, CWR is the most common, although a

Factual Information 29 Railroad Accident Report significant number of heavy-use mainlines continue to use jointed rail. Jointed rail was used exclusively before technological advancements made possible the installation and welding of rails into seamless 1/4-mile sections. Most welded rail track also has some joint bars,34 which have the same characteristics and fastening methods as the joint bars found in jointed track. After the accident, the UP replaced the Beaumont Subdivision’s 44 miles of jointed rail with CWR. The UP Senior Director of Derailment Prevention stated that by the end of 1999 (the last year of record before the derailment), the UP had 33,078 miles of mainline track. The track comprised 23,698 miles of CWR and 9,380 miles of jointed rail. As of the end of 2001, the UP had 32,682 miles of mainline track, including 6,688 miles of jointed rail. Other large railroads were surveyed to determine the amount of jointed rail on their mainline tracks at the end of 2001. The Burlington Northern Santa Fe had 29,043 miles of mainline track, which included of 5,026 miles of jointed rail. CSX had 19,043 miles of mainline track, including 4,295 miles of jointed rail. The Norfolk Southern had 21,807 miles of mainline rail, of which 3,114 miles were jointed rail. Rail Joints as a Cause of Derailments The Nation’s railroads reported to the FRA that there were 48 broken joint bar incidents that caused derailments between 1995 and 1999. A search of the FRA database resulted in the information shown in table 2, which lists the number of derailments that are caused by broken joint bars. 34 Joints are commonly found near turnounts and special track work. Insulated joint bars are installed at certain locations to isolate the electric circuits used for railroad signal systems and grade crossing warning devices. Temporary joints are commonly installed during maintenance activities and are welded at a later time. Table 2. Accidents that were reported to the Federal Railroad Administration that were attributed to broken joint bars compared with total train accidents. Year Total No. of Accidents No. of Track-Caused Accidents No. of Accidents Attributable to Broken Joint Bars 1995 2,459 856 6 1996 2,443 905 16 1997 2,397 879 9 1998 2,575 900 8 1999 2,768 995 9 2000 2,983 1,035 12 2001 3,134 1,094 11

30 Railroad Accident Report Analysis General The engineer and conductor were qualified in their operational responsibilities and were familiar with the territory. The event recorders indicate no abnormalities with train handling or other operational considerations. The train was traveling eastward, in good weather, with a proper wayside signal indication and was operating about 40 mph, which was within the specified speed limit for the track. Postaccident testing of the train crewmembers for alcohol and specific drugs was negative. Therefore, the Safety Board concludes that there was no evidence of alcohol or drug use, and weather, train crew qualifications, and the operation of the train were not factors in this accident. The engineer told investigators that he had no difficulties with brakes or slack action and that all equipment had worked normally. The train had passed over wayside defect detectors 21.2 miles and 9.1 miles before the derailment. The detectors were designed to detect overheated journals and dragging equipment and had event recorders, both of which indicated that the train had no defects. An examination of the records that indicated the placement of loaded and empty cars in the train and the maximum car weights revealed nothing that contributed to the severity of the derailment. Investigators examined the locomotives and freight cars that did not derail and did an air brake test. No defects were found that could have caused or contributed to the derailment. A mechanical inspection of the derailed cars that were not involved in the general pileup revealed nothing that could have caused the accident. Explosions and fire damaged most of the derailed equipment in the general pileup, and the damage was so extensive that determining the mechanical condition of the cars before the derailment was not possible. However, because of the number of cars that derailed in advance of the general pileup, any causal mechanical defect would probably have been in the first several cars to derail, and not in the general pileup of destroyed cars. The 10th car, the car that had remained coupled to the head end of the train after the derailment, was thoroughly examined and had no significant defects. The wheels, trucks, and couplers of the 11th, 12th, and 13th cars were also inspected, and no causal defects were identified. The Safety Board therefore concludes that the mechanical condition of the cars in the train did not cause or contribute to the derailment. The engineer and conductor of the accident train informed Safety Board investigators that they observed a clear signal indication at the last signal before the derailment, and that prior signal aspects had also displayed a clear indication. A wayside signal can only display a clear indication if the two consecutive blocks ahead are clear of trains and have no loss of rail continuity. Safety Board investigators examined and tested the signal system and found it to be functioning properly. The Safety Board therefore concludes that the signal system in the accident area did not contribute to the accident.

Analysis 31 Railroad Accident Report The derailment involved 5 pressure tank cars and 12 non-pressure tank cars carrying various hazardous materials. All of the pressure cars survived the derailment without being breached, although three of those failed in the resulting fire. These cars had greater wall thickness than non-pressure cars and were equipped with head shield and thermal protection. Based on the fact that the first explosion was reported to have occurred 103 minutes after the derailment, the three pressure tank cars that failed exceeded the required minimum 100-minute exposure to fire before failing. Of the non-pressure tank cars, seven were breached during the derailment. The level of damage sustained in this accident by both pressure and non-pressure tank cars is consistent with that found in similar accidents involving a derailment at relatively high speed (in this case, about 40 mph). The Accident The engineer of the accident train said that he had seen a track defect in the south rail just before passing over it. The conductor, although he had not seen the defect, stated that he had felt the engine pass over a track abnormality. Both employees heard an unusual sound as the engine passed over the location where the engineer had reported the defect. According to the transcripts of the emergency radio broadcast to the train dispatcher just after the derailment, the engineer had indicated that the train had passed over a broken rail. During wreck-clearing operations, a rail with pieces of two broken joint bars attached to its east end was found on the south side of the bridge. The following day, investigators located a similar rail with broken pieces of joint bars attached. Metallurgists at the site indicated that the two pairs of broken joint bars matched, which was later reaffirmed by a closer examination at the Safety Board’s Materials Laboratory. Investigators were more confident that the broken pair of joint bars had played a role in the derailment after observing that the top corner of the end face of the rail exhibited visible evidence of having been deformed by the impact of wheels moving over the top corner of the rail end. This is significant in that it demonstrates that the separated rail and joint bars had, for a time, remained in place while the wheels of a moving train passed over them. Such damage would not have been present if the joint bars had broken as a result of forces generated during the derailment. Based on the engineer’s statements, on the physical evidence exhibited by the broken joint bars and the damage to the end face of the rail that is consistent with wheel impact, and on the laboratory examination of the joint bars, the Safety Board concludes that the joint bars found at the point of the derailment had broken before the arrival of the accident train, which allowed the rail to become misaligned. The joint bars had most probably failed when the previous freight train had passed through the area. Just as a number of the cars of the earlier train had been able to pass over the misaligned rails without incident, the 3 locomotives and first 10 cars of the accident train passed over the track defect without derailing. Investigators believe that the 11th car was probably the first

Analysis 32 Railroad Accident Report to derail and that it pulled laterally on the trailing end of the 10th car, causing it to also derail. Mechanical Suitability of Joint Bars Many of the joint bars in the 44-mile section of jointed rail territory of the Beaumont Subdivision were removed because of cracks that were detected during inspections following the accident. To determine the mechanical suitability of the joint bars, a series of mechanical tests was conducted to determine whether the steel from which the joint bars were made was substandard or had flaws or defects that may have contributed to the cracking. The results of the tests showed that the material properties were not substandard. During laboratory testing, the strength of a new joint bar was compared with that of a noncracked joint bar that had been in service for some 48 years. The strength of the materials was found to be similar. But testing also showed that even a small crack in the center of the joint bar significantly reduced the bar’s strength. Investigators found no material defects at the origin areas of the fractured surfaces. Chemical composition was within specifications, and hardness results indicated that the approximate tensile strength was also within specifications. The failures in the accident joint bars resulted from metal fatigue. UP Track Inspections Frequency of Inspections Trains were operated at 40 mph in the area of the derailment, and Federal regulations specify that for a speed of 40 mph, the track must meet the track safety standards for class 3 track. Regulations require that for the annual tonnage supported by the Beaumont Subdivision, class 3 track must be inspected twice a week at intervals of at least one calendar day. During its investigation, the Safety Board found that the UP was inspecting the mainline track of the Beaumont Subdivision six times a week. Adequacy of Inspections Observing track from a moving inspection vehicle is the most common method of inspecting track; however, this method is inadequate for detecting defective joint bars. When the track inspector’s vehicle is operated in an eastward direction, as was the case generally for the Beaumont Subdivision, the inspector cannot see any part of the outside joint bar on the south side of the track, nor can he see any part except the tops of the two joint bars on the north rail. Even those joint bars that can be partially seen by the inspector may have small fractures that are extremely difficult, if not impossible, to see from a moving vehicle.

Analysis 33 Railroad Accident Report Investigators found that in the 5 months before the derailment, UP track inspectors had detected and replaced 128 defective joint bars. However, after the derailment, various walking inspections of the entire 44-mile section of jointed rail revealed 403 defective joint bars, indicating that regular track inspections had resulted in a significant number of defective joint bars remaining undetected. As evidenced by the numerous joint bars that were found with fatigue cracks of varying lengths, a joint bar with a fatigue crack can remain in service for some time before failing completely. And although fatigue crack growth rates will vary depending on the type and frequency of forces exerted upon the joint bars, a fatigue crack, once initiated, can be expected to grow until it causes complete failure of the bar. Laboratory examination of the pair of broken joint bars found at the derailment site revealed that the fractures in those bars resulted from fatigue cracks, and while it cannot be determined when the cracks were initiated, they were certainly evident in the bars for some time before the bars failed in this accident. The Safety Board concludes that the UP track inspection procedures in use before the derailment were inadequate in that inspectors identified only a small proportion of the cracked or broken joint bars on the subdivision, with the result that defective joint bars that should have been replaced were allowed to remain in service. Inspection Reports After each inspection, the UP track inspector or the relief inspector completed a daily track inspection report form. Although the completed form itemized the various times and the location of the track inspection, the form did not specify whether any part of the inspection was a walking inspection. The form listed the types and locations of repairs that the inspector had made and the locations of the track deficiencies that he could not correct. The Safety Board considers that the daily track inspection report has value, both as a record of track abnormalities and as a means of allowing supervisors to evaluate track conditions as well as review inspection activities and repairs made by the inspectors. Investigators who reviewed track inspection records made before the derailment and compared them with the results of a walking inspection of the 44-mile section of jointed rail after the derailment found a serious disparity between the condition of the track as listed on the track inspection reports and the actual condition of the track. In addition to the defective joint bars, investigators became aware of defective switch ties that were itemized on track inspection reports 6 weeks before the derailment, on March 11, April 7, and April 15. These switch ties remained in service, notwithstanding the six inspections per week for the 6-week period between April 15 and the derailment on May 27. The FRA chief inspector also located areas of defective crossties and joint bolt defects. After the derailment, a thorough inspection of the jointed rail territory revealed track conditions that did not meet the requirements of class 3 track, and these conditions had likely existed for some time. As noted earlier, the inspection method used by UP track inspectors was inadequate to detect the significant number of cracked or broken joint bars

Analysis 34 Railroad Accident Report in the inspection area, and Federal rules require that such defective bars be replaced if the track is to maintain its class 3 classification and be approved for 40 mph operations. Therefore, the Safety Board concludes that had the track of the Beaumont Subdivision been properly assessed, trains would not have been permitted to operate at a speed of 40 mph until appropriate repairs were made. Walking Inspections Early in 2000, the UP chief engineer issued oral instructions that the number of walking inspections of all joints, whether in jointed rail territory or CWR territory, be increased from once to twice yearly. He said he had made the change primarily to increase the chances of finding defective joint bars. Neither the regular track inspector nor the relief inspector had used the railroad’s track inspection reports to document the times and locations of their walking inspections. The track inspector referred to some of his own written notes and stated that his last walking inspections were in January 2000. With no written notes, the relief inspector relied on his memory and provided the milepost locations of his most recent walking inspections. He stated that his most recent track inspections were in December 1999 and had included the area of the derailment. Safety Board investigators totaled up the miles of track that were itemized by the track inspector and relief inspector and found that a walking inspection had taken place on 17 miles of track during the months of December and January. The manager of track maintenance told investigators that it was up to the inspectors to determine how and when to do the walking inspections and that they were not required to keep records of those inspections. The Safety Board notes that without a written record of the time and location a walking inspection is made, it is difficult or impossible to determine exactly when and where a walking inspection has occurred. As a consequence, track inspectors may inadvertently duplicate walking inspections in some areas while neglecting others completely. Since the derailment, the UP has added to the Union Pacific Engineering Track Maintenance Field Manual the requirement that jointed rail territory that carries more than 10 million gross tons and is class 2 track or higher be subject to quarterly walking inspections. Included in the manual is an explanation of the proper method of inspecting rail joint bars and the requirement that the dates and locations of walking inspections be recorded on the track inspection reports. Also, since the derailment, track inspectors have been required to record the date and locations of their walking inspections on the inspection reports. Oversight of Track Inspections UP Management Oversight Despite inspection methods that were generally inadequate to identify all defective joint bars, enough defects were noted to demonstrate that defective joint bars were a

Analysis 35 Railroad Accident Report frequent and persistent problem on the subdivision. For the 2-month period before the derailment, there were numerous records of defective joint bars and of joint bars with missing or defective bolts. For example, in the week before the derailment, the UP track inspector found three rail joints at which both joint bars had broken, which is the same type of failure that was found at the location of the derailment. The manager of track maintenance told investigators that he reviewed the track inspection reports at the end of each month, but he did not scrutinize them. Had he done so, he may have noted the recurring problems associated with joint bars. The three broken pairs of joint bars that were found and replaced just days before the derailment should have alerted management to the potential for other occurrences of total joint bar failure. This is especially true given that, as noted above, joint bars normally provide evidence, such as cracks, of impending failure before complete failure actually occurs. Managers who reviewed the track reports closely would have been aware that track inspections were not always identifying weakened joint bars in time to prevent future failures and potential risk to trains. The Safety Board therefore concludes that if UP management had thoroughly examined track inspection reports, they may have determined that track inspections were not identifying joint bar defects that could, over time, lead to complete joint bar failure. The Safety Board believes that the UP should change its track inspection programs to ensure that managers are making use of all available information about track condition, including railroad and FRA track inspection reports, to identify trends or problem areas and to monitor the effectiveness of daily track inspections. FRA Track Inspections The FRA track inspector’s duties include monitoring the accuracy of the railroad track inspectors’ reporting of track conditions. The FRA’s records for the 5 years preceding the accident document a history of weak tie conditions and cracked joint bars in the jointed rail section of the Beaumont Subdivision. During a walking inspection in 1996, the FRA discovered 36 broken joint bars and identified areas with weak crossties. FRA inspectors inspected the track in January 1999 and discovered areas with insufficient crossties and defective joint bars. An inspector returned for a follow-up inspection in March 1999 and found that the situation had been corrected; however, he found defective tie conditions at 11 locations and 2 cracked joint bars. Although the FRA did not conduct a regular track inspection on the Beaumont Subdivision in the 13 months before the derailment, it did do a track geometry car inspection 47 days before the derailment. The track geometry car did not detect an unusual amount of poor track surface or alignment. The car did not, and was not designed to, detect track component defectssuch as fatigue cracks in joint bars or defective crosstiesthat did not affect track geometry. The Safety Board notes that hazardous materials can be expected to traverse most mainline rail routes. However, certain lines, like the Beaumont Subdivision, are known to support a high volume of hazardous materials. The FRA had inspected Beaumont

Analysis 36 Railroad Accident Report Subdivision track in 1999 because the military was planning a shipment of napalm. But other, possibly equally hazardous, products are routinely transported over the subdivision, and these materials can constitute a serious risk to the public if they are transported over track that does not comply with the Federal track safety standards. The Safety Board concludes that the frequency and type of track inspections routinely performed by the FRA on the Beaumont Subdivision were inappropriate given the fact that this was a key route that carried large volumes of hazardous materials. Therefore, the Board believes that the FRA should modify its track inspection program to incorporate the volume of hazardous materials shipments made over the tracks in determining the frequency and type of track inspections. AAR Recommended Practices for Key Routes UP officials stated that the route from Freeport, Texas, to Livonia, Louisiana, was designated a key route because of the types and volumes of hazardous materials carried over it. The AAR, in its Circular No. OT-55-B, Recommended Railroad Operating Practices for Transportation of Hazardous Materials, states that mainline track on key routes “must be inspected by rail defect detection and track geometry inspection cars or any equivalent level of inspection no less than two times each year.” As noted earlier, inspections conducted by UP and FRA inspectors using special cars designed to detect internal rail defects or variances in track geometry did not and could not identify cracks or breaks in joint bars that did not affect track geometry. The Safety Board concludes that inspections of jointed rail using rail defect detection or track geometry cars are inadequate to identify the types of joint bar defects that led to this accident. The Safety Board therefore believes that the AAR should revise the guidance in its Circular No. OT-55 to recommend that all key routes be subjected to periodic track inspections that will identify cracks or breaks in joint bars. Emergency Response The Eunice Police and Fire Departments arrived on the scene within about 7 minutes of the accident. The local responders acted quickly, decisively, and effectively in the early stages of the response. After State responders arrived, the local residents were quickly and effectively evacuated. The evacuation area was enlarged as the situation warranted and remained flexible as the circumstances changed. The Louisiana State Police established a command post near the scene less than 2 1/2 hours after the derailment. The emergency response information was exchanged efficiently, and emergency agencies assembled at the scene quickly. The Safety Board notes that the UP’s train consist contained the required hazardous materials information. In interviewing the train crewmembers and the local emergency responders who were first

Analysis 37 Railroad Accident Report to arrive at the scene, investigators detected no fault with the postaccident actions of the train crew or the information that was contained in the train consist. As part of the response, three tank cars were explosively vented, and emergency responders burned the released material. The evacuation zone was reduced as the risk posed by the hazardous chemicals was lessened and a more thorough inspection of the site could be performed. Five days after the derailment, the evacuation area was reduced to 1/2 mile, and the majority of residents returned to their homes. The Louisiana State Police maintained control of the derailment scene until turning it over to the Louisiana Department of Environmental Quality 6 days after the accident. The Board concludes that the emergency responders to the accident responded quickly and handled the accident effectively. Environmental Remediation Most of the hazardous material was not directly recovered. Except for some corrosive liquid and some phenol, most of the hazardous material was consumed by fire or leaked into the soil. Contaminated soil was removed from the site as part of the remediation activities. After being removed from the site, the various contaminated materials were sorted according to their chemical contamination and sent to a facility that could handle it. The testing and monitoring of the site will continue under the direction of the Louisiana Department of Environmental Quality.

38 Railroad Accident Report Conclusions Findings 1. There was no evidence of alcohol or drug use, and weather, train crew qualifications, and the operation of the train were not factors in this accident. 2. The mechanical condition of the cars in the train did not cause or contribute to the derailment. 3. The signal system in the accident area did not contribute to the accident. 4. The emergency responders to the accident responded quickly and handled the accident effectively. 5. The joint bars found at the point of the derailment had broken before the arrival of the accident train, which allowed the rail to become misaligned. 6. The Union Pacific track inspection procedures in use before the derailment were inadequate in that inspectors identified only a small proportion of the cracked or broken joint bars on the subdivision, with the result that defective joint bars that should have been replaced were allowed to remain in service. 7. If Union Pacific management had thoroughly examined track inspection reports, they may have determined that track inspections were not identifying joint bar defects that could, over time, lead to complete joint bar failure. 8. Had the track inspection of the Beaumont Subdivision properly assessed the condition of the track, trains would not have been permitted to operate at a speed of 40 mph until appropriate repairs were made. 9. Inspections of jointed rail using rail defect detection or track geometry cars are inadequate to identify the types of joint bar defects that led to this accident.

1. The frequency and type of track inspections routinely performed by the Federal

Railroad Administration on the Beaumont Subdivision were inappropriate given the fact that this was a key route that carried large volumes of hazardous materials. Probable Cause The National Transportation Safety Board determines that the probable cause of the May 27, 2000, derailment of Union Pacific train QFPLI-26 was the failure of a set of joint bars that had remained in service with undetected and uncorrected defects because of the Union Pacific Railroad’s ineffective track inspection procedures and inadequate management oversight.

39 Railroad Accident Report Recommendations As a result of its investigation of this accident, the National Transportation Safety Board makes the following safety recommendations: To the Federal Railroad Administration: Modify your track inspection program to incorporate the volume of hazardous materials shipments made over the tracks in determining the frequency and type of track inspections. (R-02-13) To the Union Pacific Railroad: Change your track inspection programs to ensure that managers are making use of all available information about track conditions, including railroad and Federal Railroad Administration track inspection reports, to identify trends or problem areas and to monitor the effectiveness of daily track inspections. (R-02-14) To the Association of American Railroads: Revise the guidance in your Circular No. OT-55, Recommended Railroad Operating Practices for Transportation of Hazardous Materials, to recommend that all key routes be subjected to periodic track inspections that will identify cracks or breaks in joint bars. (R-02-15) BY THE NATIONAL TRANSPORTATION SAFETY BOARD MARION C. BLAKEY Chairman CAROL J. CARMODY Vice Chairman JOHN A. HAMMERSCHMIDT Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR. Member Adopted: April 2, 2002

this page intentionally left blank

41 Railroad Accident Report Appendix A Investigation and Public Hearing The National Transportation Safety Board was notified of the Eunice, Louisiana, accident during the afternoon of May 27, 2000. An investigative team was dispatched with members from the Washington, D.C.; Atlanta, Georgia; and Chicago, Illinois; offices. Groups were established to investigate railroad operations, track, mechanical, signal, and hazardous materials issues. Participating in the investigation were representatives of the Federal Railroad Administration, the Union Pacific Railroad, the Eunice Police Department, the Louisiana State Police, and the Louisiana Department of Environmental Quality. No public hearings were held.

this page intentionally left blank

FD07265 ｜ 2003_美国_AAR0301.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2003 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Aircraft Accident Report In-Flight Electrical System Failure and Loss of Control Jet Express Services Raytheon (Beechcraft) Super King Air 200, N81PF Near Strasburg, Colorado January 27, 2001 National Transportation Safety Board Washington, D.C. A A N T I O N L T R A S P O R A T I O N B O A R D S A F E T Y N T E

P L U R IB US UN U M

NTSB/AAR-03/01 PB2003-910401

this page intentionally left blank

Aircraft Accident Report In-Flight Electrical System Failure and Loss of Control Jet Express Services Raytheon (Beechcraft) Super King Air 200, N81PF Near Strasburg, Colorado January 27, 2001 NTSB/AAR-03/01 PB2003-910401 National Transportation Safety Board Notation 7358A 490 L’Enfant Plaza, S.W. Adopted January 15, 2003 Washington, D.C. 20594 E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N

National Transportation Safety Board. 2003. In-Flight Electrical System Failure and Loss of Control, Jet Express Services, Raytheon (Beechcraft) Super King Air 200, N81PF, Near Strasburg, Colorado, January 27, 2001. Aircraft Accident Report NTSB/AAR-03/01. Washington, DC. Abstract: This report explains the accident involving a Jet Express Services Raytheon (Beechcraft) Super King Air 200 airplane, which crashed near Strasburg, Colorado. The safety issue discussed in this report is the lack of oversight for athletic team and other college- and university-sponsored travel. A safety recommendation concerning this issue is addressed to the National Collegiate Athletic Association, the National Association of Intercollegiate Athletics, and the American Council on Education. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2003-910401 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Aircraft Accident Report Contents Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii

1. Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
2. 1

History of Flight. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.2 Injuries to Persons. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.3 Damage to Airplane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.4 Other Damage. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.5 Personnel Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.5.1 The Pilot. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.5.2 The Second Pilot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 1.6 Airplane Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1.6.1 Electrical System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1.6.1.1 Manufacturer Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.6.2 Maintenance Records. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.7 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1.7.1 Meteorological Information for N250FX and N77LX . . . . . . . . . . . . . . . . . . . . . . 13 1.7.2 Additional Pilot Witness Statements Regarding the Weather Conditions. . . . . . . . 14 1.8 Aids to Navigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 1.9 Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 1.10 Airport Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 1.10.1 Air Traffic Control Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 1.11 Flight Recorders. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1.12 Wreckage and Impact Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1.13 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 1.14 Fire. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 1.15 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 1.16 Tests and Research. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 1.16.1 Airplane Performance Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 1.17 Organizational and Management Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 1.17.1 Jet Express Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 1.17.2 North Bay Charter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 1.17.3 Federal Aviation Administration Surveillance . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 1.17.4 Federal Aviation Administration Letter to the Safety Board. . . . . . . . . . . . . . . . . . 21 1.18 Additional Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 1.18.1 Oklahoma State University Travel Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 1.18.1.1 Revised Team Travel Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 1.18.2 Spatial Disorientation Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

1. Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
2. 1

General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 2.2 Accident Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 2.3 Breakup Sequence. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Contents iv Aircraft Accident Report 2.4 Loss of A.C. Electrical Power . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 2.5 Oklahoma State University’s Team Travel Policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

1. Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
2. 1

Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 3.2 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

1. Recommendation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
2. Appendixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

A: Investigation and Hearing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 B: Oklahoma State University’s Revised Team Travel Policy . . . . . . . . . . . . . . . . . . 40

v Aircraft Accident Report Figures

1. Radar data for the last 2 minutes of the accident flight. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2. Schematic of the King Air 200 a.c. electrical system. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

vi Aircraft Accident Report Abbreviations a.c. alternating current AC advisory circular AIRMET airmen’s meteorological information ARTCC air route traffic control center ASOS automated surface observing system ASR-9 airport surveillance radar-9 ATC air traffic control ATCT air traffic control tower ATIS automatic terminal information service AWOS automated weather observing system BJC Jefferson County Airport C Celsius CFR Code of Federal Regulations d.c. direct current FAA Federal Aviation Administration FAR Federal Aviation Regulation Hg mercury HSI horizontal situation indicator Hz Hertz IFR instrument flight rules ILS instrument landing system IMC instrument meteorological conditions nm nautical mile NWS National Weather Service

Abbreviations vii Aircraft Accident Report OSU Oklahoma State University PennDOT Pennsylvania Department of Transportation PIC pilot-in-command PWA Wiley Post Airport RMI radio magnetic indicator SIGMET significant meteorological information S/N serial number SWO Stillwater Regional Airport TRACON terminal radar approach control VFR visual flight rules WSR-88D Weather Surveillance Radar 1988 Doppler

viii Aircraft Accident Report Executive Summary On January 27, 2001, about 1737 mountain standard time, a Raytheon (Beechcraft) Super King Air 200, N81PF, owned by North Bay Charter, LLC, and operated by Jet Express Services, crashed into rolling terrain near Strasburg, Colorado. The flight was operating on an instrument flight rules flight plan under 14 Code of Federal Regulations Part 91. The flight departed about 1718 from Jefferson County Airport, Broomfield, Colorado, with two pilots and eight passengers aboard. N81PF was one of three airplanes transporting members of the Oklahoma State University basketball team and associated team personnel to Stillwater Regional Airport, Stillwater, Oklahoma, after a game at the University of Colorado at Boulder that afternoon. All 10 occupants aboard N81PF were killed, and the airplane was destroyed by impact forces and a postcrash fire. Instrument meteorological conditions prevailed at the time of the accident. The National Transportation Safety Board determines that the probable cause of this accident was the pilot’s spatial disorientation resulting from his failure to maintain positive manual control of the airplane with the available flight instrumentation. Contributing to the cause of the accident was the loss of a.c. electrical power during instrument meteorological conditions. The safety issue discussed in this report is the lack of oversight for athletic team and other college- and university-sponsored travel. A safety recommendation concerning this issue is addressed to the National Collegiate Athletic Association, the National Association of Intercollegiate Athletics, and the American Council on Education.

1 Aircraft Accident Report 1. Factual Information 1.1 History of Flight On January 27, 2001, about 1737 mountain standard time,1 a Raytheon (Beechcraft) Super King Air 200,2 N81PF, owned by North Bay Charter, LLC, and operated by Jet Express Services, crashed into rolling terrain near Strasburg, Colorado. The flight was operating on an instrument flight rules (IFR) flight plan under 14 Code of Federal Regulations (CFR) Part 91. The flight departed about 1718 from Jefferson County Airport (BJC), Broomfield, Colorado, with two pilots and eight passengers aboard. The pilot who occupied the left seat in the cockpit was solely responsible for the flight.3 The pilot who occupied the right seat in the cockpit, referred to in this report as the “second pilot,” was not a required flight crewmember. N81PF was one of three airplanes4 transporting members of the Oklahoma State University (OSU) basketball team and associated team personnel to Stillwater Regional Airport (SWO), Stillwater, Oklahoma, after a game at the University of Colorado at Boulder that afternoon. All 10 occupants aboard N81PF were killed, and the airplane was destroyed by impact forces and a postcrash fire. Instrument meteorological conditions (IMC) prevailed at the time of the accident. On the day before the accident, the pilots departed Wiley Post Airport (PWA), near Oklahoma City, Oklahoma, for a positioning flight to SWO.5 At SWO, members of the OSU basketball team and associated team personnel boarded the airplane, which then continued to BJC. According to ATC records, N81PF made its first radio contact with the Kansas City ARTCC about 1449 (1549 central standard time) and its last radio contact with the Denver Terminal Radar Approach Control (TRACON) about 1652. Records from Stevens Aviation, a fixed-base operator at BJC, indicated that the airplane landed at 1700 and was placed in a hangar overnight. ATC records indicated that the pilot contacted the Denver Automated Flight Service Station about 1100 on the day of the accident to obtain a weather briefing and file IFR flight plans for the return trips to SWO and PWA. The weather briefing included a 1 Unless otherwise indicated, all times are mountain standard time, based on a 24-hour clock. The times contained in this report are approximations based on air traffic control (ATC) radar data and transcript information. 2 Raytheon Aircraft Company acquired Beech Aircraft Corporation in February 1980. 3 King Air operations under 14 CFR Part 91 require only one pilot. 4 The other two airplanes were a Learjet 60, N250FX, and a Cessna Citation 650, N77LX. These flights were operating under 14 CFR Part 91. 5 Precise departure and arrival information could not be determined. According to ATC information, the pilot maintained radio contact with the Kansas City Air Route Traffic Control Center (ARTCC) between 1357 and 1407 (1457 and 1507 central standard time). The distance between the two airports is about 47 nautical miles (nm), and the entire flight was estimated to have taken no more than 25 minutes.

Factual Information 2 Aircraft Accident Report general synopsis of the weather situation for the proposed flights, AIRMET [airmen’s meteorological information]6 flight advisories for occasional moderate icing and occasional moderate turbulence, forecast airport conditions, winds and temperatures aloft, and notices to airmen in effect. A Stevens Aviation ramp worker at BJC stated that the airplane was pulled outside from its overnight hangar between 1115 and 1130 on the day of the accident. The ramp worker also stated that the pilots arrived at the airport sometime after 1300. The pilot requested that the airplane be returned to a hangar until after the passengers boarded. According to the ramp worker, the airplane was subsequently returned to another hangar.7 The pilots left the airport to attend at least the first half of the basketball game, which began at 1400. According to ATC records, the pilot contacted BJC ground control about 1631 to obtain an IFR clearance to SWO, and the ground controller issued the clearance as filed. The Stevens Aviation ramp worker indicated that the passengers arrived at BJC at 1700. After the passengers boarded the airplane, it was towed from the hangar.8 About 1712, the pilot contacted ground control to request taxi instructions, indicating that he had received automatic terminal information service (ATIS) information Quebec.9 Because ATIS information Romeo10 was current at the time, the ground controller issued the new weather information along with the taxi clearance to runway 29R. About 1717:15, the pilot of N81PF reported that the airplane was ready to depart from runway 29R. The ground controller instructed the pilot to hold short of the runway while awaiting an IFR release. The ground controller then contacted the Denver TRACON for an IFR release, which was issued about 1717:38. The BJC local controller cleared N81PF for takeoff about 1717:49 and instructed the airplane to turn right to a 040º heading. About 1719:47, the local controller instructed the pilot to contact the Denver TRACON. 6 An AIRMET is an in-flight weather advisory issued by the National Weather Service (NWS) Aviation Weather Center in Kansas City, Missouri. An AIRMET advisory indicates weather that may be hazardous to single-engine and other light aircraft and visual flight rules (VFR) pilots. Operators of large aircraft may also be concerned with the information included in an AIRMET. 7 The ramp worker indicated that the airplane was refueled with 260 gallons of Jet A fuel before returning to the hangar. Each King Air 200 main fuel tank has a 191-gallon capacity, and each auxiliary fuel tank has a 40-gallon capacity. Fuel samples from the refueling truck and the accident airplane’s right wing fuel tank were analyzed, and both samples were found to conform to specifications. 8 The Stevens Aviation ramp worker indicated that the airplane was dry when it was towed from the hangar and that the temperature in the hangar was about 60º to 65º. The ramp worker also indicated that the airplane was airborne about 5 to 7 minutes after it had been towed from the hangar. Further, the ramp worker stated that the airplane was loaded with “small overnight bags and a few duffel bags.” 9 ATIS information Quebec was issued at 1545 and stated that the wind was calm, visibility was 1 mile in light snow, sky condition was an indefinite ceiling of 200 feet, temperature was -3º Celsius (C), dew point was -5º C, altimeter setting was 29.99 inches of mercury (Hg), and the instrument landing system (ILS) runway 29R approach was in use. 10 ATIS information Romeo was issued at 1652 and stated that the wind was variable at 3 knots, visibility was 1 mile in light snow, sky condition was an indefinite ceiling of 200 feet, temperature was -4º C, dew point was -5º C, altimeter setting was 30.00 inches of Hg, and the ILS runway 29R approach was in use.

Factual Information 3 Aircraft Accident Report About 1719:55, the pilot contacted the Denver Departure Radar Four position and reported that he was climbing through 6,500 feet11 to 8,000 feet. Afterward, the departure controller issued a clearance for the airplane to climb to 12,000 feet and then instructed the pilot to fly the airplane on a 060º heading. About 1722:09, the controller instructed the pilot to proceed to the EPKEE intersection, join the Garden City transition, and climb to 23,000 feet. The pilot acknowledged these instructions. About 1724:07, the departure controller instructed the pilot to fly the airplane on a 110º heading, and the pilot acknowledged this instruction. About 1725:53, the controller instructed the pilot to contact the Satellite Radar Two controller. The pilot contacted the Satellite Radar Two controller about 1726:06, reporting out of 16,300 feet and climbing to 23,000 feet. The controller asked the pilot whether he was flying directly to the EPKEE intersection, and the pilot responded that he had been proceeding to the intersection but had been assigned a heading of 110º. About 1726:20, the controller cleared the airplane to proceed directly to the EPKEE intersection. About 1726:27, the pilot stated that he was going directly to the EPKEE intersection and that he needed to make about a 3º left turn. The controller did not receive any further transmissions from the pilot. Mode C information from the airplane’s transponder12 indicated that the airplane reached its cruising altitude of 23,000 feet about 1732:35. According to ATC radar data, the airplane’s climb through this altitude was normal, and its airspeeds had been steady. The last mode C transponder return occurred about 1735:44, when the airplane was at an altitude of 23,200 feet. Radar data indicated that the airplane started to deviate from its heading and to turn to the right by about 1736:26 (about 42 seconds after mode C information was lost). Mode A information from the transponder remained available until about 1737:12.13 Within the next 5 to 8 seconds (sometime between 1737:17 and 1737:20), the airplane impacted rolling terrain at an elevation of 5,223 feet. The accident occurred at 39º 44.822 minutes north latitude and 104º 15.037 minutes west longitude after official sunset but before the end of evening civil twilight.14 Figure 1 shows the airplane’s flight track, according to ATC radar data, for the last 2 minutes of the accident flight. 11 All altitudes in this report are mean sea level. 12 A transponder transmits an airplane’s identification and altitude information in response to interrogation signals received from ground-based radar equipment. Mode C information, if available, provides the airplane’s altitude in 100-foot increments. 13 Mode A information provides the airplane’s four-digit beacon (identification) code. Ground-based radar equipment observes this information and calculates the airplane’s direction (azimuth) and distance from the radar antenna. During the final minute of the flight, two beacon returns were transmitted but were not received because of the airplane’s orientation (that is, the airplane’s antenna was not in the line of sight of the ground-based radar equipment). 14 On the day of the accident, official sunset for the Denver, Colorado, area occurred at 1716, and evening civil twilight for the area ended at 1744. (Title 14 CFR Part 1.1 states that night begins after the end of evening civil twilight.) At the time of the accident, the sun was -4.7º below the horizon, and the moon was 36º above the horizon with 16 percent illumination.

Factual Information 4 Aircraft Accident Report Note: Airport surveillance radar-9 (ASR-9) primary data are reflected radio signals. ASR-9 primary data returns were received until about 1737:26, about 14 seconds after the last mode A (beacon data) return. The distances shown are relative to the ASR-9 radar site at Denver International Airport. Figure 1. Radar data for the last 2 minutes of the accident flight. 1.2 Injuries to Persons Table 1. Injury chart. Injuries Flight Crew Cabin Crew Passengers Other Total Fatal 2 0 8 0 10 Serious 0 0 0 0 0 Minor 0 0 0 0 0 None 0 0 0 0 0 Total 2 0 8 0 10

Factual Information 5 Aircraft Accident Report 1.3 Damage to Airplane The airplane was destroyed by impact forces and a postcrash fire. 1.4 Other Damage No other damage was reported. 1.5 Personnel Information 1.5.1 The Pilot The pilot, age 55, held a Federal Aviation Administration (FAA) airline transport pilot certificate. He also held an FAA second-class medical certificate dated January 25, 2001, with a limitation that required lenses to correct for near and distant vision. The pilot received his private pilot’s license in December 1969 and his commercial pilot’s license in January 1971. He received a Cessna 500 type rating in March 1989 and a Learjet type rating in July 1994. (A type rating is not required for the King Air 200.) He was also a certified flight instructor. According to the pilot’s logbook, he had accumulated 5,117 hours total flying time, including 3,650 hours as a multiengine pilot-in-command (PIC) and 2,520 hours in King Air airplanes (767 hours of which were as a King Air 200 PIC). He had flown approximately 51, 13, and 0.415 hours in the 90 days, 30 days, and 24 hours, respectively, before the accident. According to documents from SIMCOM Training Center of Scottsdale, Arizona, the pilot’s last recurrent ground and simulator training occurred on April 20 and 21, 2000. He satisfactorily completed a recurrent training course on the King Air 200 with King Air C90B differences. He also satisfactorily completed an instrument proficiency check, as required by Federal Aviation Regulation (FAR) 61.57, “Recent Flight Experience: Pilot in Command,” and met biennial flight review requirements by completing a pilot proficiency program, in accordance with FAA Advisory Circular (AC) 61.91, “Pilot Proficiency Award Program.”16 In addition, a search of the National Driver Register database indicated no record of driver’s license suspension or revocation. The pilot’s family described his health as “good” and indicated that he did not smoke and that he consumed alcoholic beverages “socially in moderation.” The pilot’s family also indicated that no changes in his health or in his personal, professional, or 15 This figure reflects the estimated duration of the accident flight. The flight from SWO to BJC on the day before the accident is not included in this figure because the airplane had landed at 1700. 16 SIMCOM documents also indicated that, from January 28 to 30, 1999, the pilot completed ground and simulator training for the King Air 200 and differences training for the King Air C90B. In addition, the pilot’s logbook indicated that, from July 21 to 23, 1997, he completed King Air 200 training at Flight Safety International in Wichita, Kansas.

Factual Information 6 Aircraft Accident Report financial situation had occurred in the year before the accident. In addition, the pilot’s family indicated that he did not suffer from any sleep disorders. According to the pilot’s family, on January 24, 2001, he awoke about 0630 central standard time and went to work. (He was a partner in an accounting firm in Oklahoma City.) Afterward, he went to PWA and then home, where he spent the rest of the evening. He went to sleep about 2300 central standard time. On January 25, 2001, the pilot awoke about 0630 central standard time, went to work in the morning, received his FAA medical examination in the afternoon, went back to work, stopped by PWA, arrived home between 1800 and 1900 central standard time, and went to sleep about 2300 central standard time. On January 26, 2001, the pilot awoke about 0630 central standard time and went to work. He left work about 1200 central standard time to go to PWA to prepare for the flights to SWO and BJC. Records from a hotel in Boulder indicated that the pilot checked in, along with the second pilot, about 1730 on January 26th. 1.5.2 The Second Pilot The second pilot, age 30, held an FAA first-class medical certificate dated January 27, 2000, with no limitations. The second pilot received his private pilot’s license in June 1996, his IFR rating in February 1997, and his commercial pilot’s license in May 1997. He was also a certified flight instructor. According to the second pilot’s logbook, he had accumulated 1,828 hours total flying time, including 1,218 hours as a multiengine pilot. He had flown approximately 87, 17, and 0.4 hours in the 90 days, 30 days, and 24 hours, respectively, before the accident. The second pilot’s logbook also indicated that he completed an instrument proficiency check on May 14, 1999, as required by FAR 61.57, and that he completed a flight review on October 7, 1999, in accordance with FAR 61.56, “Flight Review.” The second pilot’s logbook further indicated that he had flown the accident airplane four times in the 90 days before the accident, logging 10.4 hours as PIC. A search of the National Driver Register database indicated no record of driver’s license suspension or revocation. A pilot who knew the second pilot since May 2000 and flew with him a few times each week stated that the second pilot wanted to work for an airline and was logging flight time as fast as he could. The pilot indicated that the second pilot flew with the accident pilot once or twice per month. The second pilot had not received any formal training on King Air airplanes. The second pilot was not married and had no children. The pilot who knew the second pilot stated that he did not seem to have any personal or financial problems. On January 24, 2001, the second pilot flew with that pilot to various destinations in Texas, accumulating about 6 hours of flight time in a King Air C90B. The second pilot’s activities on January 25, 2001, and on the morning of January 26, 2001, are unknown.

Factual Information 7 Aircraft Accident Report 1.6 Airplane Information The accident airplane, serial number (S/N) BB-158, was manufactured in 1976. The airplane was equipped with a Sperry three-axis autopilot. The airplane was also equipped with Pratt & Whitney Canada PT6A-41 turbopropeller engines and Hartzell model HC-B3TN-3C three-bladed, constant-speed propellers. The time since new for the No. 1 (left) engine, S/N PC-E 80339, was about 8,517 hours; the time since new for the No. 2 (right) engine, S/N PC-E 80292, was about 8,283 hours; and the time since overhaul for both engines was about 2,551 hours. The time since new and the time since overhaul for the No. 1 (left) propeller, S/N BUA-21161, were estimated to be 8,261 and 476 hours, respectively. The time since new and the time since overhaul for the No. 2 (right) propeller, S/N BU-6844, were estimated to be 8,737 and 1,244 hours, respectively. (All of the engine and propeller times are based on the airplane’s total flying time, which was last recorded during airplane maintenance that was performed on December 8, 2000. The maintenance work order indicated that the airplane had accumulated about 8,737 hours.)17 The accident airplane’s last weight and balance were calculated on October 18,

1. The airplane’s empty weight was about 8,048 pounds, and its center of gravity

location was 185.48 inches aft of datum. On the basis of these and other calculations provided by Raytheon, at takeoff the airplane was calculated to be within its center of gravity limits but about 314 pounds overweight. (A weight and balance form for the accident flight was not recovered.) 1.6.1 Electrical System The airplane had a 28-volt d.c. electrical system. The system uses one 34-ampere-hour, air-cooled, 20-cell, nickel-cadmium battery and two interconnected 230-ampere generators (left and right) to supply d.c. electrical power to the airplane. The battery routes power to its main bus through the battery relay. The generators route power to their main buses, including the No. 1 (left) and No. 2 (right) avionics buses, which power the communications radios. A powered battery bus would operate certain essential equipment, including ambient cockpit and instrument panel lighting, in an emergency. The bus system includes four sub-buses that are dual-fed (that is, they receive power from either generator’s main bus). All electrical loads are divided among the sub-buses, and loads with duplicate functions are connected to different sub-buses. Among the loads connected to the sub-buses are the No. 1 (left) and No. 2 (right) 600-volt static inverters, each of which converts d.c. power to a.c. power. Each inverter provides 400-Hertz (Hz),18 115 volts a.c. to the avionics equipment and 400-Hz, 26 volts a.c. to the engine instrument panel, but only one inverter can be engaged at a time. The inverter select switch, located on a panel below the instrument panel and to the left of the control wheel on the pilot’s (left) side of the cockpit, activates the selected inverter through the 17 The last maintenance work order for the airplane, dated January 23, 2001, did not list the total flying time. 18 Hz is unit of frequency equal to one cycle per second.

Factual Information 8 Aircraft Accident Report inverter select relay and the avionics inverter select relay. If the selected inverter is inoperative, an inverter annunciator light will illuminate in the cockpit. The other inverter can then be selected, by moving the inverter select switch, to provide a.c. power to the airplane. Avionics equipment powered by a.c. electricity includes the pilot-side altimeter (26 volts a.c.), the radio magnetic indicators (RMI, 115 volts a.c.), and the air data computer (115 volts a.c.). The air data computer produces electrical output signals for air data displays, the pilot-side attitude indicator, the autopilot, and mode C altitude information from the transponder.19 Postaccident examination and testing of a King Air 200 airplane that was similarly equipped to N81PF revealed that, if the airplane’s a.c. electrical power were lost, flags would appear on most of the instruments on the pilot’s (left) side of the cockpit, including the altimeter,20 attitude indicator, horizontal situation indicator (HSI), radio altimeter, RMI, and altitude preselect. Also, a flag would appear on the RMI and HSI on the copilot’s (right) side of the cockpit if the airplane’s a.c. electrical power were lost. Further, the examination and testing determined that, if a.c. power were lost, the working instruments on the pilot’s side of the cockpit would be limited to an airspeed indicator and a turn and slip indicator. The copilot’s side of the cockpit would display working airspeed and turn and slip indicators but would also display a working altimeter and attitude indicator. The two pilot-side instruments and the four copilot-side instruments would function because they would receive inputs from the pitot static or vacuum systems. The airplane’s electrical system also includes an a.c. volt/frequency meter. The meter displays the frequency of the airplane’s a.c. power in Hz and shows the a.c. voltage when the “push for volts” button is depressed. The meter’s crossarm assembly has three short arms and one long arm with a needle attached. The needle arm’s normal reading indicates 400 Hz/115 volts. The needle arm would be in the 380-Hz/100-volt position (the lowest reading on the meter) if the airplane had no a.c. power.21 Figure 2 shows a schematic of the King Air 200 a.c. electrical system. The figure shows that the inverter select relay, the avionics inverter select relays, and the inverter select switch are located between the inverters and the volt/frequency meter. 19 Mode A identifying information from the transponder is powered by d.c. electricity. 20 According to the manufacturer of the airplane’s air data computer, the altimeter flag would also appear if the air data computer became invalid. 21 According to the Beechcraft Super King Air 200 Pilot’s Operating Handbook, the inverter annunciator light appears when the volt/frequency meter is at the 380-Hz/100-volt position.

Factual Information 9 Aircraft Accident Report Source: Beechcraft Super King Air 200 Pilot’s Operating Handbook. Figure 2. Schematic of the King Air 200 a.c. electrical system. 1.6.1.1 Manufacturer Information The Beechcraft Super King Air 200 Pilot’s Operating Handbook, Section III, “Emergency Procedures,” dated October 1978, indicates that the following actions should be taken for an electrical system failure: CIRCUIT BREAKER TRIPPED [22]

1. Nonessential circuit – DO NOT RESET IN FLIGHT
2. Essential circuit:

a. Circuit Breaker – PUSH TO RESET b. If Circuit Breaker trips again – DO NOT RESET INVERTER INOPERATIVE – Select the other inverter 22 The circuit breaker panel assembly is located on the right side of the cockpit at knee level.

Factual Information 10 Aircraft Accident Report 1.6.2 Maintenance Records A review of the maintenance records for the accident airplane indicated that the airplane was maintained from 1976 to September 2000 using either an FAA- or a manufacturer-approved continuous inspection program. One of these programs was administered by the Pennsylvania Department of Transportation (PennDOT), which purchased the airplane in 1989. Specifically, in 1994, PennDOT’s Bureau of Aviation submitted a request to the FAA for an Approved Aircraft Continuous Inspection Program for the King Air 200. The program consisted of one primary and three interim inspections conducted by an appropriately rated repair station or a qualified certificated mechanic. The time between primary inspections was not to exceed 600 hours, and each of the interim inspections was to be performed at 150-hour intervals. The FAA approved PennDOT’s request on June 22, 1994, and the inspection program was first used on N81PF on April 23, 1996, when a second interim inspection was performed. At the time of the inspection, the airplane had accumulated about 7,491 hours of total flying time. PennDOT designed its own discrepancy sheets to track the discrepancies found during inspections and to show the corrective action taken in response. These discrepancy sheets were required to be a part of the airplane’s permanent maintenance records. On August 18, 1999, PennDOT sold N81PF; at that time, the airplane had accumulated about 8,547 hours total flying time. On September 30, 1999, the airplane was sold to North Bay Charter, its owner at the time of the accident. North Bay Charter leased the airplane to Navajo Aviation of Concord, California, which operated the airplane under 14 CFR Part 135. Navajo Aviation had received permission from the FAA and PennDOT to continue using PennDOT’s inspection program for the remaining two interim inspections in the four-inspection cycle. Navajo Aviation noted discrepancies on its own discrepancy sheets but did not include all of the sheets in the airplane’s permanent maintenance records. (The Safety Board requested, and Navajo Aviation provided, copies of those discrepancy forms that were not included in the records.) According to the owner of North Bay Charter, the airplane was removed from Navajo Aviation’s Part 135 operating certificate on September 16, 2000; after that date, the accident pilot managed the airplane from PWA.23 The most recent primary inspection of N81PF was performed by PennDOT on February 12, 1999, when the airplane had accumulated about 8,361 hours total flying time. The most recent first interim inspection was performed by PennDOT on July 23, 1999, when the airplane had accumulated about 8,510 hours total flying time. The most recent second interim inspection was performed by Navajo Aviation on June 28, 2000, when the airplane had accumulated about 8,659 hours total flying time. The airplane had not reached the interval for its next third interim inspection, so the most recent one was performed by PennDOT on August 14, 1998, when the airplane had accumulated about 8,213 hours total flying time. 23 See sections 1.17.1 and 1.17.2 for more information.

Factual Information 11 Aircraft Accident Report A review of the maintenance records through June 28, 2000 (when the last second interim inspection was performed), revealed no uncorrected maintenance discrepancies. After September 16, 2000 (when the airplane was removed from Navajo’s certificate), the airplane underwent various maintenance repairs at different maintenance facilities. According to the owner of the airplane, no major maintenance had been performed after the airplane had been moved back to PWA. The maintenance records noted a discrepancy on October 23, 1990, involving both inverters. Specifically, the pilot at that time reported that both inverters were inoperative in flight and that a.c. power was restored after 5 to 8 minutes. The cause of the problem was found to be a failed relay rather than inoperative inverters. The failed relay was replaced, and no further discrepancies regarding the inverters were reported. The maintenance records also showed that the No. 1 inverter was replaced in May 1996 with an overhauled inverter and that the No. 2 inverter was replaced in October 1994 with a new inverter. The maintenance records did not indicate any discrepancies regarding either of these inverters. A review of FAA Service Difficulty Reports for the King Air 200 electrical system found that 89 reports had been submitted between January 28, 1986, and December 1,

1. Eight of these reports involved inverters, but none of the reports involved a dual

inverter failure. 1.7 Meteorological Information Air traffic control tower (ATCT) personnel certified by the NWS under the Supplemental Aviation Weather Reporting System make weather observations at BJC. The weather conditions reported at 1658 and 1745 were as follows: wind variable at 4 knots, visibility 1 mile in light snow, sky obscured with vertical visibility 200 feet, temperature -4º C, dew point -5º C, and altimeter setting 30.00 inches of Hg. The closest airport to the accident site is Front Range Airport in Denver, located about 14 miles west of the site, but the airport’s weather observations are only transmitted locally and are not archived. The closest official weather reporting facilities to the accident site are Denver International Airport, located about 20 miles west-northwest of the site; Centennial Airport in Denver, located about 24 miles west-southwest of the site; and Buckley Air Force Base in Aurora, located 23 miles west of the site. Denver International Airport has an automated surface observing system (ASOS) that is maintained by the NWS and augmented by NWS certified weather observers.24 At 1715, the ASOS indicated that visibility was 1 1/2 miles in light snow and mist and that the sky condition was ceiling overcast at 1,500 feet. At 1742, the ASOS indicated that 24 The ASOS continuously measures wind, visibility, precipitation and obstructions to vision, cloud height, sky cover, dew point, and altimeter setting. The certified weather observers can provide observations for any other operationally significant information and override the automated mode if it malfunctions or provides unrepresentative values.

Factual Information 12 Aircraft Accident Report visibility was 1 1/2 miles in light snow and mist and that the sky condition was scattered clouds at 600 feet and ceiling overcast at 1,300 feet. Centennial Airport is equipped with an automated weather observing system (AWOS) that is augmented by NWS certified weather observers.25 At 1653, the AWOS reported that the visibility was 1 mile in light snow and mist and that the sky condition was ceiling broken at 600 feet and overcast at 1,500 feet. At 1753, the AWOS reported that visibility was 1 mile in light snow and mist and that the sky condition was ceiling broken at 800 feet, second broken layer of clouds at 4,200 feet, and overcast at 6,000 feet. Weather observers at Buckley Air Force Base reported, at 1656 and 1755, that visibility was 1 mile in light snow and mist and that the sky condition was ceiling broken at 600 feet and overcast at 1,100 feet.26 The closest Weather Surveillance Radar 1988 Doppler (WSR-88D) is located at Front Range Airport. The WSR-88D is a 10-centimeter S-band wavelength radar that provides a three-dimensional volume scan of the atmosphere at varying degrees of elevation. Before and after the accident, the WSR-88D was displaying the five lowest elevation angles (0.4º, 1.5º, 2.5º, 3.5º, and 4.5º) every 10 minutes. The 4.5º elevation scan that covered the period from 1728:56 to 1738:37 indicated very light weather echoes under the accident airplane’s flight track. The WSR-88D also produces a vertical azimuth display wind profile. The wind profile is based on the detection of echoes within 20 miles of the radar site. The profile between 1709 and 1728 detected echoes to 28,000 feet. At 1738, the profile detected the wind at 22,000 feet from 180º at 35 knots, the wind at 24,000 feet from 180º at 40 knots, and droplets up to 26,000 feet. Geostationary Operational Environmental Satellite number 10 (referred to as “GOES-10”) infrared satellite imagery at 1730 depicted a large cloud shield over the accident area. The sounding data from these images indicated that the cloud tops were about 27,000 feet. Three NWS AIRMETs were current during the time of the accident flight for eastern Colorado, including the area of the accident site.27 All three were issued at 1345 and were valid until 2000. One of the AIRMETs warned of occasional moderate rime to mixed icing in clouds and in precipitation below 22,000 feet. Another AIRMET warned of occasional moderate turbulence below 18,000 feet associated with moderate southerly to 25 The AWOS is another system that measures, collects, and disseminates weather information. According to the FAA’s Web site, the basic difference between ASOS and AWOS is that ASOS generally comprises a standard suite of weather sensors that have all been procured from one contractor, whereas AWOS is a suite of weather sensors of many different configurations that were either procured by the FAA or purchased by individuals, groups, or airports that are required to meet FAA standards to be able to report weather parameters. 26 All three of these weather reporting facilities reported similar information concerning the wind (generally from the northeast with windspeeds under 5 knots), temperature and dew point (about -4º C), and altimeter setting (near 29.99 inches of Hg). 27 No other NWS in-flight weather advisory category—SIGMET [significant meteorological information], Convective SIGMET, Severe Weather Forecast Alert, and Center Weather Advisory—was current at the time of the accident.

Factual Information 13 Aircraft Accident Report southeasterly flow. The last AIRMET warned of occasional widespread ceilings below 1,000 feet and visibility below 3 miles in precipitation and mist. The Safety Board contacted two aviation research meteorologists from the National Center for Atmospheric Research in Boulder regarding the potential icing environment about the time of the accident. These meteorologists (who are well-known experts and leaders in the field of icing research) use an icing diagnostic program, known as the Integrated Icing Diagnostic Algorithm, which incorporates multiple sources of weather information to determine the threat of airframe icing and supercooled large droplets. Analysis of the program’s output28 for 1700 on the day of the accident indicated a fairly low threat for potential icing and no threat for potential supercooled large droplets over eastern Colorado, including the area of the accident site. In addition, no pilot reports indicated any in-flight icing over Colorado surrounding the time of the accident. 1.7.1 Meteorological Information for N250FX and N77LX The Learjet 60 (N250FX) was kept overnight at Centennial Airport from January 26 to 27, 2001. The pilot indicated that the airplane was deiced before departing for BJC about 1718 on January 27th. The pilot stated that the airplane climbed to an altitude of 7,200 feet. The pilot also stated that he flew in IMC with the anti-ice on and that the airplane did not accumulate any ice on its unprotected areas. He further stated that visibility was 1 mile and that snowfall was “moderate” during the approach. The airplane landed at BJC about 1726. The pilot indicated that the runway and taxiway had a thin layer of snow. After he parked the airplane, the pilot noticed snow beginning to accumulate on the upper wing surfaces. The airplane was subsequently deiced. The passengers boarded the airplane for the return trip to SWO, and the airplane departed from BJC at 1808. The pilot stated that he entered clouds at about 300 feet and that, during the climb to 9,000 feet, he encountered “continuous light to moderate chop.” The pilot further indicated that he encountered “continuous moderate chop” from 17,000 to 26,000 feet and that the flight was smooth between 26,000 and 33,000 feet, with the cloud tops at 33,000 feet. In addition, the pilot stated that, from 14,000 to 22,000 feet, the windshield accumulated ice even with the full bleed air windshield heat on. The airplane landed at SWO at 1919. The Cessna Citation 650 (N77LX) was kept in a hangar overnight at BJC from January 26 to 27, 2001. The pilot stated that the airplane was in a hangar when the passengers boarded it for the return trip to SWO and that the airplane was warm with no accumulation of snow on the wings. He also stated that, during the departure, visibility was 1/2 mile in light snow and that, during the climb, the airplane did not accumulate any ice buildup on the center post of the windshield and there was “very occasional light 28 At the time of this analysis, the Integrated Icing Diagnostic Algorithm was an experimental product for research purposes only. The product is now used by the NWS in its operations and is available on the Internet.

Factual Information 14 Aircraft Accident Report chop.” In addition, he indicated that the cloud tops were at 29,000 feet and that the cruising altitude was 37,000 feet. 1.7.2 Additional Pilot Witness Statements Regarding the Weather Conditions A Piper Cheyenne 3A pilot indicated that he was traveling from Albuquerque, New Mexico, to BJC and had landed about 10 minutes before the accident airplane departed. During the arrival into BJC, the Cheyenne pilot indicated that the airplane encountered moderate snow but did not encounter any ice or turbulence. He stated that the clouds were at 200 feet with 1-mile visibility. He also stated that the conditions at BJC were “not that bad.” Two pilots operating King Air airplanes landed at Front Range Airport (the closest airport to the accident site) between 1650 and 1750 on the day of the accident. One pilot indicated that he flew from Steamboat Springs, Colorado, at a cruising altitude of 17,000 feet and did not encounter any turbulence or icing en route or on approach to the airport. He reported that the sky condition was ceiling overcast at 400 feet and that visibility was obscured at about 1 mile in snow and mist. The second pilot was traveling from Grand Junction to Front Range with a stop at Centennial Airport. He indicated that no icing occurred en route to Centennial but that frost began to form on the airplane’s wings after landing. After the airplane was deiced, it departed for Front Range Airport. The pilot stated that the airplane experienced light to moderate turbulence from 17,000 feet to the surface but did not accumulate any icing. Further, the pilot stated that the sky condition was overcast at 400 feet and that visibility was about 1 mile in snow and mist. 1.8 Aids to Navigation No navigational aid problems were reported. 1.9 Communications No communications problems were reported between the pilot and any of the air traffic controllers that handled the flight. 1.10 Airport Information 1.10.1 Air Traffic Control Information The Denver TRACON is located at Denver International Airport. Three controllers at the TRACON handled N81PF on the day of the accident.

Factual Information 15 Aircraft Accident Report The first controller, who handled N81PF at the Departure Radar Four position, had been a U.S. Air Force tower controller from 1976 to 1986. He began working for the FAA in December 1986, was assigned to the Denver ATCT in March 1987, and transferred to the Denver TRACON in October 1990. He became fully certified at the Denver TRACON in February 1995. The second controller, who also handled N81PF at the Departure Radar Four position, began working for the FAA in July 1986 and was assigned to the Standiford, Kentucky, ATCT in November 1986. He transferred to the Covington, Kentucky, ATCT in March 1990 and the Denver TRACON in September 1998. He became fully certified at the Denver TRACON in June 1999. The third controller, who handled N81PF at the Satellite Radar Two position, began working for the FAA in July 1982 at the ATCT and TRACON at Bradley International Airport, Windsor Locks, Connecticut. He transferred to the Denver TRACON in January 1992, returned to the Bradley TRACON in September 1996, and transferred back to the Denver TRACON in September 1998. The controller became fully certified at the Denver TRACON in December 1998. The first Departure Radar Four controller indicated that, after departing from BJC, the airplane turned to the assigned heading, and its climb appeared “normal.” After the controller cleared the airplane to proceed directly to the EPKEE intersection, the second Departure Radar Four controller arrived to take over the position. According to the first controller, during the position relief briefing, both controllers noticed that the airplane was not turning directly to the EPKEE intersection but was still flying on a 060º heading. The second controller indicated that he issued instructions for the airplane to fly on a 110º heading because he thought that the pilot had not followed the clearance to proceed directly to the EPKEE intersection. The first controller also indicated that the pilot appeared to have a slow response to the clearance to proceed directly to the EPKEE intersection. The second Departure Radar Four controller reported that the airplane turned to the newly assigned heading in a timely manner and that everything appeared “normal.” This controller also reported that he continued to watch the radar target until the airplane left his airspace and that he saw nothing unusual during this time. The Satellite Radar Two controller indicated that, when he cleared the pilot to proceed directly to the EPKEE intersection, the airplane appeared to be tracking the course well. The controller also indicated that radar contact with the airplane was lost when the airplane was about 10 miles southwest of Byers, Colorado.29 The controller stated that the airplane was at an altitude of 23,000 feet at the time. Further, he stated that, before the airplane’s radar target disappeared, the airplane seemed to be “doing fine” and did not appear to have any problems with its mode C altitude information. 29 Byers, Colorado, is located about 3 miles southeast of the accident site.

Factual Information 16 Aircraft Accident Report About 1738:05 and 1738:17, the Satellite Radar Two controller attempted to contact the airplane. About 1738:28, the controller contacted the Denver ARTCC East Departure Controller to see if he had radar contact with the airplane, and he indicated that radar contact with the airplane had been lost. The Satellite Radar Two controller tried continually to contact the airplane and looked at the Departure Four Right radar display (which uses a different radar site than the one used at the Satellite Radar Two position) to try to locate the airplane. About 1739:40, the Satellite Radar Two controller asked the pilot of United Airlines flight 1270, who was on frequency, to attempt to contact the airplane; the pilot tried but reported that he received no response. About 1742:00, the TRACON was informed by the county sheriff’s office that an airplane accident had occurred near Strasburg. About 1747:40, the controller asked the pilot of Northwest Airlines flight 800, who was on frequency, to determine if that airplane was receiving a signal from an emergency locator transmitter, but the pilot responded that no signal was being received. 1.11 Flight Recorders The accident airplane was not equipped with a cockpit voice recorder or a flight data recorder. Title 14 CFR Part 91 did not require the airplane to be so equipped. 1.12 Wreckage and Impact Information The accident airplane’s wreckage was located about 42 miles east of BJC. All of the major pieces of the airplane’s structure were recovered and examined. The wreckage was spread across snow-covered rolling terrain over a distance of 2,800 feet. The airplane’s first impact point made a 20- by 30-foot impression in the ground. The wreckage path was oriented along a 135º magnetic heading. The main wreckage site was at a ground elevation of about 5,200 feet and was located about 1/2 nm southeast of the location of the last mode A transponder return. All structural pieces found before the main wreckage area exhibited no evidence of fire damage. The first debris items found along the wreckage path were small, lightweight pieces from the right horizontal stabilizer rear spar enclosure panel, which were located about 2,700 feet northwest of the main wreckage. Several sections of the right horizontal stabilizer upper and lower skins were found next along the wreckage path. The first large piece of wreckage found was the left horizontal stabilizer, which was located about 1,500 feet northwest of the main wreckage. An 11-foot section of the right outboard wing was found about 1,100 feet northwest of the main wreckage. The main wreckage, which consisted of the cockpit, forward fuselage, nose landing gear, left inboard wing and flap, and fuselage belly, was located 125 feet southeast of the first impact point. These structures came to rest in an inverted position and exhibited fire damage. The fuselage belly showed no impact damage, but the cockpit and fuselage crown area showed severe impact damage.

Factual Information 17 Aircraft Accident Report The left horizontal stabilizer main spar lower cap was bent aft and downward. The front spar upper and lower caps were fractured and bent downward. The right horizontal stabilizer fractured into numerous small pieces, and the upper and lower skins exhibited saw-tooth tear features and screw curls at various locations. No evidence of preexisting corrosion or fatigue cracks was found. The right wing fractured outboard of the engine. The upper skin surface was displaced downward over the ribs and stringers, and the sheet metal frame and skin at the fracture location were bent downward. The main spar upper cap was fractured and bent up 60º. The main spar lower cap was bent upward at the fracture location, and the fracture surface exhibited no evidence of fatigue or corrosion. The rear spar upper cap had fractured at the inboard aileron hinge, and the upper skin between the fracture location and the inboard aileron hinge was bent downward. The rear spar lower cap was fractured outboard of the inboard edge of the aileron and was bent upward 30º. No evidence of preexisting corrosion or fatigue cracks was found. The left wing also fractured outboard of the engine. The upper and lower caps of the main and rear spars remained attached to the left wing outboard section, but deformation on these caps could not be determined because of fire damage. The two engines, two propeller hubs, and six propeller blades were all recovered from the crash site. The engines showed no indication of an in-flight fire, uncontainment, case rupture, or preimpact failure. The engines’ rotors had blade and vane breakage and bending that were consistent with rotation at the time of impact. The propeller hubs had separated from the engines, and one propeller blade had separated from each hub. On April 18, 2001, the propellers were examined at the manufacturer’s facility in Piqua, Ohio. The examination revealed witness marks on the propeller pistons’ rear spring retainer cans and the blades’ butts that were consistent with the blades being in the normal operating range at the time of impact. The pilot-side altimeter was crushed, but the faceplate was legible. No needle was present, and the flag position could not initially be determined. Removal of the faceplate revealed that the altitude reading was 23,220 feet and that the flag was in the visible position. The copilot-side altimeter was not recovered. The pilot-side attitude indicator was damaged by impact forces and fire. Disassembly of the unit showed witness marks that were consistent with a wings-level and an approximately 10º nose-down position. The copilot-side attitude indicator was not recovered. Both RMIs were damaged by impact forces and fire, all face glass was missing, and flag positions could not be determined. One RMI still had its needles, but they were bent; the other RMI was missing its needles. Both RMI compass cards showed a heading of 115º. Both HSIs were damaged by impact forces and fire, the faceplate on each was illegible, and the needles were missing. The air data computer case was fractured, and most of the internal components were missing. The radio altimeter casing had partially folded over the faceplate, and the needle was missing. Only one airspeed indicator and one turn and slip indicator were recovered. Their data plates were damaged, so no determination could be made as to whether the indicators were on the pilot’s or copilot’s side of the cockpit. The mounting plate on the airspeed indicator was intact, but most of the face glass and the needle were missing. The case for

Factual Information 18 Aircraft Accident Report the turn and slip indicator was fractured, all of the face glass was missing, and no needle was present. The a.c. volt/frequency meter was discovered at the accident site almost 3 months after the accident, after snow had melted. The meter was found loose on the ground, and its faceplate mechanism had separated from the unit case. The needle arm was displaced to the right. The meter face showed two witness marks aligned with the 380-Hz/100-volt position. The No. 1 and No. 2 inverters were found broken, and their internal components and wiring were destroyed. The internal fuses for both inverters were broken but not melted or burned. The inverter select switch, inverter select relay, and avionics inverter select relay were not recovered from the wreckage. The circuit breaker panel had broken away from the airplane and showed impact and postcrash fire damage. Almost all of the circuit breakers were found in the open position. One emergency oxygen mask and hose assembly was recovered. The bag included in the assembly showed several cuts, rips, and holes in a repeating pattern. The bag was not inflated, and the hose was still attached to the assembly. 1.13 Medical and Pathological Information Tissue specimens from the pilot and second pilot were sent to the FAA’s Civil Aerospace Medical Institute in Oklahoma City, Oklahoma, for toxicological analysis. The specimens tested negative for major drugs of abuse and for prescription and over-the-counter medications. The pilot’s specimens tested positive for ethanol, but the analysis indicated that the detected ethanol might have been the result of postmortem ethanol formation rather than ethanol ingestion. The second pilot’s specimens also tested positive for ethanol, but the analysis indicated that the detected ethanol was the result of postmortem ethanol formation. 1.14 Fire A fuel-fed fire erupted after the airplane impacted the ground. 1.15 Survival Aspects Autopsy results indicated that the cause of death for all of the airplane occupants was multiple massive blunt traumatic injuries.

Factual Information 19 Aircraft Accident Report 1.16 Tests and Research 1.16.1 Airplane Performance Study The Safety Board conducted an airplane performance study to develop the time history of the airplane’s motion and to calculate various performance parameters. To perform the study, several sources of information were used, including the ATC transcript, ASR radar data from the Denver TRACON, National Track Analysis Program radar data from the Denver ARTCC, aerodynamic data from the airplane’s manufacturer, and weather data. Radar data showed that, after its departure from BJC, the airplane executed a right turn to the northeast while climbing through 7,600 feet. The airplane continued its climb to the northeast until about 1724:07, when the airplane was at an altitude of 13,500 feet and the departure controller directed the pilot to turn to the right on a southeast heading. About 1732:50, the airplane was at an altitude of 23,100 feet and was maintaining its heading to the southeast. Because mode C transponder information was not transmitted after about 1735:44, the airplane’s altitude time history had to be estimated after this time. As a result, calculations of the airplane’s performance parameters are approximations. Several seconds after the last mode C transponder return, the airplane banked slightly in the right-wing-down direction. Calculated performance parameters showed that, by 1736:15, the airplane’s airspeed was about 200 knots, its bank was 30º right wing down, and its pitch was 15º airplane nose down. Radar data indicated that, by 1736:26, the airplane started to deviate from its heading and make a right turn to the south. During the next 30 seconds, the airplane’s bank angle continued to increase in the right-wing-down direction, and its pitch angle remained near 20º airplane nose down. About 1736:45, the airplane had turned to the north and was continuing its turn to the right. At that point, the airplane’s altitude was about 17,200 feet, and its airspeed had accelerated to about 250 knots. The airplane’s right bank, nose-down pitch, and airspeed continued to increase as the airplane completed a 360º rotation in heading by 1737:02. During the time that the airplane was executing the 360º turn, its descent rate was increasing constantly to more than 15,000 feet per minute. By 1737:10, the airplane entered a steep dive; at that point, the airplane was descending through 10,000 feet with its pitch angle exceeding 80º airplane nose down and its bank angle exceeding 100º right wing down. Calculated performance parameters showed that, about the time of the last mode A transponder return (1737:12), the airplane rolled to the left toward wings level, its descent rate began to be arrested, and its nose-down pitch decreased. During the next 5 seconds, the airplane’s airspeed increased rapidly to more than 350 knots as the descent rate was reduced. The calculated performance parameters also showed that, by 1737:15, the airplane was on a 130º heading at an altitude of 6,200 feet.

Factual Information 20 Aircraft Accident Report 1.17 Organizational and Management Information 1.17.1 Jet Express Services The pilot was the sole proprietor of Jet Express Services, an aircraft management company located at PWA. The pilot managed two airplanes, including the accident airplane. He arranged lease agreements for the two airplanes and charged fees for his management services. Among Jet Express Services’ clients and users of the accident airplane were the Oklahoma Department of Public Safety and the Oklahoma Gas and Electric Company. According to OSU’s Vice President of Business and External Relations, the accident pilot flew for the university’s Athletic Department. OSU records indicated that, between July 1, 2000, and January 25, 2001 (the day before the flight from SWO to BJC), the pilot flew three roundtrips for OSU athletic events. On October 14, 2000, the pilot flew to Birmingham, Alabama, for a men’s golf event, returning 2 days later. On November 26, 2000, the pilot flew to Denton, Texas, for a men’s basketball event, returning the next day. On January 16, 2001, the pilot flew to Waco, Texas, for a men’s basketball event, returning the next day. 1.17.2 North Bay Charter North Bay Charter, LLC, was chartered in Nevada. The owner of the company was also the owner of the accident airplane. As stated in section 1.6.2, the owner leased the airplane to Navajo Aviation of California. According to the owner of North Bay Charter, business for the airplane was slow, so he placed the airplane in Oklahoma with the accident pilot for 3 months. (During this time, the airplane continued to operate under Navajo’s Part 135 certificate.) Afterward, the airplane was returned to California. The General Manager of Navajo Aviation indicated that the airplane was not being chartered for many flights and that, according to his records, its last company charter flight occurred on August 10, 2000. The General Manager also indicated that, when the owner terminated his relationship with Navajo Aviation, the airplane was immediately removed from Navajo’s Part 135 certificate. The airplane was sent back to Oklahoma and was again managed by the accident pilot. The owner dry leased30 the airplane per hour and paid the pilot a flat monthly fee to oversee the airplane. The owner also paid monthly hangar fees and maintenance bills for the airplane. The owner of the accident airplane indicated that the airplane had been used for OSU travel a few times since he had acquired the airplane. 30 AC 91-37A, “Truth in Leasing,” states that a dry lease is the “leasing of an aircraft without the crew.”

Factual Information 21 Aircraft Accident Report 1.17.3 Federal Aviation Administration Surveillance On March 24, 1998, an FAA air safety inspector administered a Part 135 check ride to the pilot in a King Air 200. The purpose of the check ride was to add the pilot to the Part 135 certificate held by Million Air in Oklahoma City. (The air safety inspector was also the principal operations inspector for Million Air.) The inspector indicated that one part of the check ride involved a simulated engine failure as the airplane climbed through 400 feet altitude with the autopilot engaged. According to FAA records, the airplane drifted off its heading by 30º and lost 100 feet of altitude before the air safety inspector intervened and told the pilot to manually fly the airplane. The air safety inspector said that the pilot thought that the autopilot would fly the airplane with the engine failure. The pilot failed the check ride. He received training and satisfactorily completed the check ride on the next day. In a postaccident interview, the air safety inspector31 indicated that the pilot “had a tendency to lock in on a problem and not fly the airplane.” Also, the inspector stated that the pilot and N81PF were subsequently removed from the Million Air Part 135 certificate because the pilot had apparently flown the airplane for OSU without Million Air’s knowledge. On September 11, 1997, the pilot was providing proficiency training in a King Air 200 to FAA safety inspectors from the Airman Testing Standards Branch and was involved in a landing in which the nose gear actuator failed and was unable to lock down. The pilot landed the airplane on its two main landing gear wheels and on its nose. No one aboard the airplane was injured, and the airplane received only minor damage to its propellers. The FAA sent the pilot a letter of commendation, dated September 22, 1997, complimenting him for the manner in which he handled the emergency. 1.17.4 Federal Aviation Administration Letter to the Safety Board In a January 25, 2002, letter to the Safety Board, the FAA recognized that North Bay Charter owned the accident airplane. However, the FAA stated that, for the accident flight, the airplane was being operated by Jet Express Services, which also provided the PIC. The FAA indicated that the pilot was required to operate the accident airplane pursuant to 14 CFR Part 135 because he had the primary responsibility for providing the airplane and the pilot services and was receiving compensation for both. The FAA added that the compensation was “direct and indirect.” 31 The air safety inspector is now the Director of Operations for Sierra Aviation doing business as Million Air Oklahoma City Aircraft Charter.

Factual Information 22 Aircraft Accident Report The FAA also stated the following: In Part 91 operations, the owner or operator bears the responsibility for the operation of the aircraft. The owner may exercise his responsibility by individually operating the aircraft or through the use of a flight department, through use of the services of a management company, or by hiring pilots. In Part 135 operations, the air carrier or commercial operator has the responsibility for operational control. In either case, of course, the pilot-in-command is primarily responsible for the safe operation of the flight. Further, the FAA indicated that it determined that the Learjet and the Cessna Citation were fractionally owned and were being operated pursuant to 14 CFR Part 91. The FAA noted that a portion of the cost of these flights was also donated. The FAA stated that, “the fact that the cost of a given flight may be donated, whether in whole or in part, does not itself determine whether the flight is one required to be operated pursuant to Part 91 or Part 135. That determination depends upon an examination of the specific facts of each situation.” 1.18 Additional Information 1.18.1 Oklahoma State University Travel Information OSU’s air transportation team travel policy in effect at the time of the accident was detailed in OSU policy and procedures document 3-0155, “Transportation Services Flight Department,” dated April 2000. The document indicated that the university’s Transportation Services Flight Department was to provide transportation for university and state employees, student athletes, and others traveling on official university or state business. The Flight Department Manager was responsible for administering OSU’s air transportation policies at that time. The policy and procedures document indicated that the Flight Department operated a six-seat Cessna 421B32 and had access to other multiengine aircraft through the University of Oklahoma and the State of Oklahoma.33 These airplanes could be operated during day or night and in VFR or IFR conditions. According to the Manager of the Flight Department, who is also the OSU Chief Pilot, all of the airplanes operated under 14 CFR Part 91. The document indicated that these airplanes were to be flown only by pilots from the OSU Flight Department or qualified pilots hired by the Flight Department Manager. The pilots were required to have a commercial pilot’s license; certification for single-engine, multiengine, and instrument flying; and 2,500 hours as PIC, at least 500 of which were to have been in a multiengine airplane. 32 OSU’s Vice President of Business and External Relations stated that the Cessna 421B was too small to be used for athletic events. 33 The Manager of the Flight Department indicated that the University of Oklahoma operated a Turbo Commander 690 and that the State of Oklahoma operated a King Air 350.

Factual Information 23 Aircraft Accident Report According to the policy and procedures document, the basic requirement for arranging transportation services was approval by the Flight Department Manager. The document also indicated that, for out-of-state transportation, prior approval from the appropriate OSU vice president was necessary. In addition, the document indicated that the judgment of a pilot would always prevail regarding whether flight conditions were safe for takeoff or continuation of a flight. Further, if the weather or the length of a trip were such that the pilot felt a copilot was necessary for the safe completion of the flight, the pilot would have the authority to dispatch a copilot for that purpose. The policy and procedures document also stated that flights to be chartered for the university had to be contracted through the Flight Department. (Football team and commercial airline travel were exempt from this requirement.) The document explained that charter trips included any trips for which money, goods, or services were exchanged for air service. The Flight Department Manager was responsible for ensuring that all charter companies providing services to OSU were properly certified under FAA regulations (14 CFR Part 135). The proper certification was to be updated annually and kept on file within the department. OSU indicated that, from July 1, 1999, to January 31, 2001, 62 charter flights had been arranged through the Flight Department, 50 of which were for athletic events. (An additional four charter flights were used for football team travel, but these flights were not contracted through the Flight Department.) According to the OSU Flight Department Manager, four Part 135 operators were on file with the Flight Department at the time of the accident, none of which were Jet Express Services. According to OSU’s Vice President of Business and External Relations, several alumni donate airplanes for the Athletic Department to use to transport players to games and events. The OSU policy and procedures document indicated that all airplanes donated for OSU use had to be certified and approved through the Flight Department. Information regarding the airplane’s inspection records and insurance policy, the pilot’s FAA certificate number and medical certificate, and the pilot’s biennial flight review record were to be updated annually and kept on file within the department. OSU indicated that its Flight Department did not have any records on file regarding the accident pilot, second pilot, or airplane. Donated flights did not require coordination with the Flight Department, and the only charges that the university incurred for such flights were for the pilots’ hotel rooms, meals, and telephone use. According to the OSU Flight Department Manager, most donated flights were aboard personal airplanes being operated under 14 CFR Part 91. OSU indicated that 18 flights had been donated during the 2000 to 2001 basketball season. OSU’s Vice President of Business and External Relations stated that the flights that were used to transport OSU basketball players and associated personnel between SWO and BJC on January 26 and 27, 2001, were donated. The basketball staff coordinated these flights directly with the donors. The chairman of an Oklahoma City oil company, who was an OSU alumnus and a friend of the pilot, donated the use of N81PF.34 In a postaccident interview, another friend of the pilot said that the donor paid for the

Factual Information 24 Aircraft Accident Report airplane’s rental fee, fuel, and associated expenses. This friend also said that the pilot did not bill OSU for his services because he enjoyed being with the basketball team players and coach and that he mostly flew for OSU as a single pilot because the athletic department staff wanted to use all of the available seats in the airplane. 1.18.1.1 Revised Team Travel Policy On April 22, 2002, OSU issued a revised team travel policy “to provide a framework for safe and efficient athletic team travel”35 and “to assign responsibility and accountability for enforcement.” The policy states that the OSU Director of Intercollegiate Athletics is responsible for the overall administration of the revised policy and that a member of the athletic department staff is responsible for compliance, oversight, and recordkeeping. The director or a designee is to provide a copy of the policy to every coach, provide training to every coach, and maintain a signed statement from each coach indicating that he/she has read and understands the policy. According to the policy, the OSU Director of Intercollegiate Athletics or a designee is also responsible for verifying that the mode of transportation recommended for use for athletic travel complies with the policy. Coaches are responsible for developing their season travel plans, including recommended transportation mode, and gaining written approval from the appropriate associate athletic director in advance of the season or subsequent schedule change. In addition, the policy indicates that any coach or athletic department staff member who knowingly violates the policy will be suspended until the director or a designee investigates the violation and that violations may result in disciplinary action or termination. Section 6.01, “Types of Vehicles Used for Team Travel and Requirements for Operation,” Subheading E, “Air Transportation,” states that commercial air carriers, charter, time-share, and other aircraft may be used for athletic team travel. Section 6.01, subheadings A through D, address automobiles/minivans, 12- and 15-passenger vans,36 buses, and mini-buses (20 to 30 passengers), respectively. OSU’s revised team travel policy appears in appendix B. 1.18.2 Spatial Disorientation Information Spatial disorientation occurs when a pilot has inadequate visual information or fails to attend to or properly interpret available information regarding the airplane’s pitch 34 An OSU alumnus from Houston, Texas, donated the use of the Learjet. A friend of the coach from Little Rock, Arkansas, donated the use of the Cessna Citation. 35 The policy applies to baseball, basketball (women’s and men’s), equestrian, football, golf (women’s and men’s), soccer, softball, tennis (women’s and men’s), track (women’s and men’s indoor, outdoor, and cross country), and wrestling teams, as well as mascots, spirit squad members, student trainers, and student managers. 36 OSU’s revised team travel policy states that 12-passenger vans are to carry no more than 8 passengers and equipment and that 15-passenger vans are to carry no more than 10 passengers and equipment.

Factual Information 25 Aircraft Accident Report and bank. Instead, a disoriented pilot relies on cues that are often misleading. The most hazardous illusions that lead to spatial disorientation result from ambiguous information received from motion sensing organs located in each inner ear. The sensory organs of the inner ear detect angular accelerations in the pitch, yaw, and roll axes and gravity and linear accelerations. During flight, the inner ear organs may be stimulated by motion of the aircraft alone or along with head and body movement. Spatial disorientation can occur in a banked airplane when it rolls very slowly at a rate that is not detected by the motion sensing organs of the inner ear. The threshold for the detection of roll rate (roll to bank) by humans is about 2º per second.37 Spatial disorientation can also occur in a banked airplane when a constant-rate turn is maintained and stimulation of the inner ear organs ceases. A disoriented pilot who falsely perceives a constant-rate turn as a descent may respond with elevator pitch-up controls, which will tighten the turn. As the turn tightens and the airplane’s bank continues to increase, the airplane will lose altitude from the resulting loss of vertical lift. A disoriented pilot who still perceives a wings-level flight attitude may respond to the loss of altitude with increased pitch-up controls, resulting in a steep spiral dive (commonly referred to as a “graveyard spiral”).38 According to the FAA Aeronautical Information Manual, paragraph 8-1-5, spatial disorientation can only be prevented by visual reference to reliable fixed points on the ground or to flight instruments. FAA AC 60-4A, “Pilot’s Spatial Disorientation,” states that tests conducted with qualified instrument pilots showed that it could take as long as 35 seconds to establish full control solely by reference to flight instruments when a loss of visual reference occurs. 37 A.J. Benson, “Spatial Disorientation—Common Illusions,” eds. J. Ernsting, A.N. Nichols, and D.J. Rainford, Aviation Medicine, 3rd Ed. (Oxford, United Kingdom: Butterworth-Heinemann, 1999). 38 The FAA Aeronautical Information Manual, Paragraph 8-1-5, “Illusions in Flight,” describes a graveyard spiral as follows: “An observed loss of altitude during a coordinated constant-rate turn that has ceased stimulating the motion sensing system can create the illusion of being in a descent with the wings level. The disoriented pilot will pull back on the controls, tightening the spiral and increasing the loss of altitude.”

26 Aircraft Accident Report 2. Analysis 2.1 General The pilot was properly certificated and qualified under Federal regulations. No evidence indicates any preexisting medical or behavioral conditions that might have adversely affected the pilot’s performance during the accident flight. The pilot filed an instrument flight rules (IFR) flight plan under 14 Code of Federal Regulations (CFR) Part 91 for the accident flight; as a result, he was the only person responsible for the airplane. In its January 25, 2002, letter to the Safety Board, the FAA determined that the pilot should have been operating the airplane under 14 CFR Part 135 because he had the primary responsibility for providing the airplane and the pilot services and was receiving compensation for both. The Board defers to the Federal Aviation Administration’s (FAA) judgment that the flight should have been operated under 14 CFR Part 135. The second pilot was properly certificated and qualified under Federal regulations. The second pilot was not a required flight crewmember because the airplane was certified for single-pilot operation under 14 CFR Part 91. Even if the flight had been operated under 14 CFR Part 135, the second pilot would still not have been a required crewmember; the airplane was certified for single-pilot operation under Part 135 in IFR conditions because a three-axis autopilot was installed and operating.39 (The use of the autopilot is discussed later in this analysis.) Because the flight was conducted with two qualified pilots and an operational autopilot and thus exceeded Part 135 requirements, the circumstances of this accident would not have been any different if the pilot had operated the flight under Part 135 rather than Part 91. The accident airplane was properly certified, equipped, and maintained in accordance with Federal regulations. The recovered components showed no evidence of any preexisting structural, engine, or system failures. (The in-flight electrical system failure is addressed later.) Snow was falling at Jefferson County Airport (BJC) in Colorado when the accident airplane departed for Stillwater Regional Airport (SWO) in Oklahoma, and instrument meteorological conditions (IMC) prevailed from the surface to altitudes above those of the accident airplane. However, icing was not a factor in this accident. No pilot reports surrounding the time of the accident indicated any in-flight icing over Colorado, and none of the pilot witnesses indicated any in-flight icing along or near the accident airplane’s route of flight. Also, radar data for the accident airplane indicated no degradation of airplane performance (airspeed or altitude) consistent with ice accretion. 39 This certification information is found in the Beechcraft Super King Air 200 Pilot’s Operating Handbook, Section II, “Limitations,” dated February 1979.

Analysis 27 Aircraft Accident Report No evidence of a cabin pressurization problem was found. Also, the repeating cuts, rips, and holes on the bag included in the recovered oxygen mask and hose assembly were consistent with a bag that remained folded and unused. This accident was not survivable for any of the airplane occupants because they were subjected to impact forces that exceeded the limits of human tolerance. This analysis discusses the accident sequence, including the role of spatial disorientation. The analysis also describes the airplane breakup sequence and provides possible explanations for the loss of mode C altitude transponder information aboard the airplane. In addition, the analysis compares Oklahoma State University’s (OSU) revised team travel policy with the one that was in place at the time of the accident. 2.2 Accident Sequence Radar data indicated that the flight from BJC to SWO was routine until the airplane was at an altitude of 23,200 feet. At that point, the airplane stopped transmitting mode C altitude transponder information, which is generated from electrical output signals from the airplane’s a.c.-powered air data computer. The airplane continued to transmit mode A identifying transponder information, which is generated from d.c. electrical power, until the time of impact. Thus, a total power loss aboard the airplane did not occur, but a partial or complete loss of a.c. power had occurred. It was possible that the a.c. electrical malfunction involved a failure of the air data computer only. However, the pilot-side altimeter indicated that the altitude reading was 23,220 feet, which was consistent with the last reported altitude (23,200 feet) before the airplane stopped transmitting mode C information. Also, both radio magnetic indicator (RMI) compass cards showed a heading of 115º, which was consistent with the airplane’s heading when mode C information was lost. (The pilot was flying the airplane on a 110º heading and indicated that he was going to be making a turn of about 3º.) In addition, witness marks on the volt/frequency meter showed that it was at the 380-Hertz/100-volt position (the lowest reading) at the time of impact,40 indicating that no a.c. power was available. The Safety Board concludes that the physical evidence recovered from the wreckage site and the recorded radar data indicate that a complete loss of a.c. electrical power occurred aboard the airplane. Further, a.c. power was not restored any time after it was lost; if a.c. power had been restored, the altimeter would have shown an altitude lower than 23,220 feet. The complete loss of a.c. electrical power would have rendered most of the pilot’s flight instruments inoperative. The only instruments that would have been available to the pilot were those that were operated by the pitot static or vacuum systems. Specifically, on 40 The position of the three short arms of the meter’s crossarm assembly supported this reading, but the one long arm—the needle arm—was displaced clockwise. The witness marks were likely made by the needle arm during the initial impact; the needle arm was then likely displaced during the subsequent impact, resulting in a false position.

Analysis 28 Aircraft Accident Report the left side of the cockpit, the airspeed indicator and the turn and slip indicator would have been operational; on the right side of the cockpit, the airspeed indicator, turn and slip indicator, altimeter, and attitude indicator would have been operational. Despite the loss of the airplane’s primary flight instruments, the pilot made no radio transmissions to the controller after mode C information was lost.41 (Between 1 minute 33 seconds and 1 minute 36 seconds elapsed between the time of the last mode C return and airplane impact.) The airplane’s air data computer also produces electrical output signals for the autopilot. Thus, the complete loss of a.c. power would have caused the autopilot to cease operating if it were being used. The Safety Board was unable to determine from the available evidence whether the pilot was flying the airplane with the autopilot engaged or whether he was manually flying the airplane. Ambient cockpit and instrument panel lighting are powered by d.c. electrical power. Thus, the pilot would have been able to see within the cockpit to attempt to diagnose the electrical problem. The flashing red master warning light and the autopilot disconnect annunciator light would have signaled the loss of the autopilot if it were engaged. Also, as demonstrated by postaccident examination and testing of a King Air 200 airplane that was similarly equipped to N81PF, instrument flags would have appeared on the pilot’s altimeter, attitude indicator, horizontal situation indicator (HSI), radio altimeter, RMI, and altitude preselect. Examination of the pilot’s altimeter verified that the instrument flag would have been visible to him.42 In addition, the inverter annunciator light would have illuminated. The Safety Board concludes that the pilot would have had salient cues to identify the a.c. electrical power failure. The pilot’s experience and recent training should have prepared him to complete all prescribed checklist actions for diagnosing and resolving an electrical system failure. Further, it is possible that the second pilot would have been able to provide some assistance to the pilot. The postaccident examination and testing of a King Air 200 airplane showed that instrument flags would have appeared on the HSI and RMI on the second pilot’s (right) side of the cockpit.43 However, because the second pilot had not received any formal King Air training, he would have had limited experience with the airplane’s systems and emergency procedures. The Beechcraft Super King Air 200 Pilot’s Operating Handbook indicates that, if one inverter is inoperative, the other should be selected using the inverter select switch. 41 The communications radios were powered by the No. 1 and No. 2 d.c. avionics buses and were thus operational. 42 The Safety Board could not determine whether the flags on the attitude indicator, HSI, radio altimeter, and RMI would have been visible to the pilot because the attitude indicator faceplate was illegible and the needles on the other instruments were missing. The altitude preselect flag appeared in the retracted position, indicating that it would not have been visible to the pilot. The flag would not be visible to the pilot if the autopilot was not in use, but, if the autopilot were in use, impact forces might have forced the flag into the retracted position. 43 The Safety Board could not determine whether the flags on the HSI and RMI would have been visible to the second pilot because the needles on both instruments were missing.

Analysis 29 Aircraft Accident Report This switch is located away from other switches on a panel below the instrument panel and to the left of the pilot-side control wheel. However, the Safety Board was unable to determine from the available evidence whether the pilot attempted to restore a.c. power using the inverter select switch. The Beechcraft Super King Air 200 Pilot’s Operating Handbook also indicates that, in the event of an electrical system failure, nonessential circuit breakers are not to be reset in flight, but essential circuit breakers are to be reset.44 However, there was insufficient evidence to determine whether either pilot attempted to troubleshoot the electrical problem by examining the circuit breaker panel, which was located on the right side of the cockpit at knee level. Despite the loss of a.c. electrical power, the pilot could have safely flown and landed the airplane from the left seat by referencing the available (non-a.c.-powered) flight instruments on the right side of the cockpit (the altimeter and the airspeed, attitude, and turn and slip indicators). Also, the pilot could have asked the second pilot to fly the airplane because the available flight instruments would be more easily viewed from the right seat. The Safety Board could not determine from the available evidence what actions the pilot took (or did not take) and the extent to which the pilot might have coordinated with the second pilot. Nevertheless, the Safety Board concludes that the pilot did not appropriately manage the workload associated with troubleshooting the loss of a.c. electrical power with the need to establish and maintain positive control of the airplane.45 Because mode C data were unavailable after about 1735:44, the Safety Board’s airplane performance study for this accident was used to estimate the airplane’s altitude and descent rate after this point. According to air traffic control (ATC) radar data, the airplane began to turn to the right about 1736:26. The calculated bank angle during this turn, estimated to be less than 15º initially, increased to more than 80º over the next 30 seconds. Also, airplane performance calculations showed that the airplane entered into a descent shortly after starting the turn to the right. The estimated descent rate increased constantly to more than 15,000 feet per minute as the airplane completed a 360º turn. The Safety Board concludes that the airplane’s estimated flightpath in the final 2 minutes of flight was consistent with a graveyard spiral resulting from pilot spatial disorientation.46 The pilot probably did not sense the right descending turn at first because the airplane’s bank was entered gradually. As the airplane’s bank angle and descent rate began increasing, the pilot’s spatial disorientation most likely persisted, and he was not able to successfully use the available instruments to regain positive control of the airplane. Any head movements that the pilot made while attempting to diagnose the electrical system malfunction (for example, looking down and to the right at the circuit breaker panel)47 might have exacerbated his spatial disorientation because the motion sensing organs of the 44 Because all of the circuit breakers were found open, most likely because of impact forces, the Safety Board could not determine the positions of the circuit breakers at the time of the accident. 45 In a postaccident interview, the air safety inspector who conducted the pilot’s March 1998 Part 135 check ride indicated that the pilot tended to “lock in on a problem and not fly the airplane.” This observation is consistent with the circumstances of this accident.

Analysis 30 Aircraft Accident Report inner ear could have been stimulated by these head movements in addition to the motion of the airplane. Radar data, ground scars, and wreckage distribution indicated that the airplane impacted terrain at an angle that was less steep than the descent. The Safety Board concludes that the airplane’s angle at the time of impact indicated that the pilot attempted to arrest the descent in the final portion of the flight, possibly in response to obtaining visual references of the ground after emerging from the lowest layer of clouds.48 The pilot input and the airplane reaction required to arrest the descent rate with the available altitude would have placed a large aerodynamic loading on the airplane. The aerodynamic loading caused the airplane to break apart in flight at a low altitude (within several hundred feet of the ground) and crash into terrain. The ATC primary radar data returns about 1737:16, 1737:21, and 1737:26 (see figure 1) and the scattered debris found at the accident site were also consistent with an in-flight breakup at a low altitude. The cockpit and fuselage crown area showed severe impact damage, but the fuselage belly was not damaged. The airplane was found in an inverted position 125 feet from its initial impact point with the ground. Thus, the airplane initially impacted the ground nose first and then bounced 125 feet to an inverted position. 2.3 Breakup Sequence On the basis of the wreckage distribution,49 the Safety Board determined that the tail structure sections departed the airplane first and that the outboard section of the right wing departed the airplane after the tail sections. The pilot likely initiated a severe pull-up maneuver by pulling back on the control column; this action loaded the tail in the downward direction and the wing in the upward direction. The Safety Board concludes that the in-flight breakup occurred because the aerodynamic loading during the pilot’s 46 The Safety Board is not making any recommendations in this report regarding spatial disorientation because the FAA has already published many resources to acquaint pilots with the hazards of spatial disorientation. These resources include Advisory Circular (AC) 60-4A, “Pilot’s Spatial Disorientation”; Aeronautical Information Manual Paragraph 8-1-5, “Illusions in Flight”; Airplane Flying Handbook (FAA-H-8083-3) Chapter 9, “Flight by Reference to Instruments”; Instrument Flying Handbook (FAA-H-8083-15) Chapter 1, “Human Factors”; AC 00-6A, “Aviation Weather”; AC 61-23C, “Pilot’s Handbook of Aeronautical Knowledge”; and Medical Facts for Pilots (FAA-P-8740-41). In addition, the FAA has recently attempted to discover why the malfunctioning of attitude instruments in general aviation airplanes can result in loss of control in partial panel situations. See, for example, D.B. Beringer and J.D. Ball, “When gauges fail and clouds are tall, we miss the horizon most of all: General Aviation pilot responses to the loss of attitude information in IMC,” Proceedings of the 45th Annual Meeting of the Human Factors and Ergonomics Society (Santa Monica, CA: Human Factors and Ergonomics Society, 2001), Vol. 45, 21-25. 47 Research has demonstrated that visual distraction and head movements can often lead to spatial disorientation. See Benson, “Spatial Disorientation—Common Illusions,” 1999. 48 The closest official weather reporting facilities to the accident site—Denver International Airport, Centennial Airport, and Buckley Air Force Base—all reported that the lowest layer of clouds about the time of the accident was 600 feet. 49 See section 1.12 for more information.

Analysis 31 Aircraft Accident Report pull-up maneuver was great enough to overload the horizontal stabilizer downward and the right outboard wing section was sufficiently loaded upward to sustain a permanent bend in the spar. As soon as the horizontal stabilizer fractured and departed the airplane, the right outboard wing loaded downward and separated from the airplane in a downward direction. 2.4 Loss of A.C. Electrical Power Four possibilities exist to explain the loss of a.c. power aboard the accident airplane. First, the selected inverter could have failed, and the pilot might not have switched to the other inverter. However, the pilot should have been familiar with this switch because it is always used to supply a.c. power after engine start and to terminate a.c. power before engine shutdown. Second, a dual inverter failure could have occurred. However, it is extremely unlikely that both inverters would have failed because of the inverters’ history of reliability aboard King Air 200 airplanes. Only eight FAA Service Difficulty Reports regarding King Air 200 inverters were submitted during a period of almost 15 years, and none of the eight reports involved a dual inverter failure. The Safety Board notes that, in October 1990, both inverters aboard the accident airplane were reported as inoperative for several minutes, but the cause of the problem was found to be a failed relay (which was then replaced) and not the failure of both inverters. Also, the maintenance records for the accident airplane did not indicate a systemic problem with either inverter. In addition, the internal fuses from both inverters were found broken but not melted or burned, which indicated that the inverters had not shorted. Third, the King Air 200 electrical system schematic indicates that, if at least one of the inverters is operational, no a.c. power is present at the volt/frequency meter, and d.c. power is available to the inverters, then one of three components—the inverter selector switch, the inverter select relay, or the avionics inverter select relay—could produce an a.c. power electrical system failure (see figure 2). Thus, all three components are potential sources of single-point failures in the electrical system. None of these items was recovered from the wreckage. Fourth, wiring failures, shorts, or opens are possible reasons for the loss of a.c. power. The Safety Board cannot make a definitive determination regarding what caused the a.c. electrical system to fail. However, the Safety Board concludes that the a.c. electrical failure was a contributing factor to this accident but was not a causal factor because non-a.c.-powered instrumentation remained available for the duration of the flight for the pilot to use to safely fly and land the airplane.50 50 The Safety Board is not making any recommendations in this report regarding the a.c. electrical failure aboard the airplane because the FAA already requires pilots to be trained to fly and land airplanes using standby flight instruments.

Analysis 32 Aircraft Accident Report 2.5 Oklahoma State University’s Team Travel Policies OSU’s former air transportation policy was not causal to the accident. In fact, the policy was not likely different from those in place at other universities of the same size as OSU. However, even though the university’s athletic department knew the accident pilot, the Flight Department had no records on file regarding him, the second pilot, or the accident airplane, as required. Also, because the accident flight was a donated flight, it was not coordinated with the Flight Department Manager, as were charter flights and flights involving university airplanes. Thus, the Safety Board concludes that OSU did not provide any significant oversight for the accident flight. The Safety Board investigated another accident involving a university athletic team in which no significant oversight occurred. On October 2, 1970, a Martin 404, N464M, was transporting members of the Wichita State University football team from Wichita, Kansas, to Logan, Utah. After a refueling stop in Denver, the flight crew deviated from the flight plan and proceeded via a “scenic” route with mountains on both sides of the flightpath. Subsequently, the airplane crashed into the base of a mountain 8 miles west of Silver Plume, Colorado. The captain, flight attendant, and 28 passengers were killed; the first officer and 10 passengers were injured; and the airplane was destroyed by impact forces and a postcrash fire. The Safety Board found that none of the parties involved with the flight (the owner of the airplane, the company that provided the pilots and other services, or the lessee) accepted responsibility concerning who was the operator of the flight and was thus responsible for its safe conduct.51 The Board indicated that, if the parties denied after the accident that they were responsible for the safe conduct of the flight, it was likely that they would not have acknowledged such responsibility at the time of the flight. The Board also indicated that numerous deficiencies, unsafe practices, and deviations from regulations occurred during the flight and that the management required for a safe operation appears to have been absent, which was a “significant” factor in this accident.52 The Safety Board is concerned that colleges and universities may not be providing adequate oversight for athletic team travel. OSU’s revised team travel policy, issued on April 22, 2002, is a comprehensive travel management system that promotes safe university-sponsored team travel and provides the necessary oversight to ensure that transportation services are carried out in accordance with the provisions of the revised policy. For example, in addition to the oversight provided by the university’s athletic director, athletic staff, and coaches, OSU will retain an aviation consultant with “expertise 51 The Jack Richards Aircraft Company, Inc., which owned the airplane, and Golden Eagle Aviation, Inc., which provided the pilots and other services, contended that Wichita State University was the operator. Wichita State’s position was that it had merely chartered air service and thus was not the operator. The FAA’s position was that Golden Eagle Aviation was the operator. The Safety Board indicated that, for purposes of the report, it was not necessary to determine which party was the official operator of the flight but that this issue needed to be fully resolved separate from the report. 52 For more information, see National Transportation Safety Board, Martin 404, N464M, 8 Statute Miles West of Silver Plume, Colorado, October 2, 1970, Aircraft Accident Report NTSB/AAR-71-04 (Washington, DC: NTSB, 1971).

Analysis 33 Aircraft Accident Report in operations, safety and certification.” Among other things, the aviation consultant will evaluate the certifications and safety records of charter air carriers, time-share aircraft, and other aircraft and will have the final authority for approving a firm or an aircraft for the purposes of the policy. Also, OSU’s revised team travel policy provides a greater margin of safety for air transportation compared with the university’s former air transportation policy, as demonstrated by the following examples: • OSU’s former air transportation policy indicated that, if the weather or the length of a trip were such that the pilot thought a copilot was necessary for the safe completion of the flight, the pilot would have the authority to dispatch a copilot for that purpose. As a result, some donated flights and possibly some charter flights were allowed to operate with one pilot (depending on whether the airplane was certified for single-pilot operation). In fact, a friend of the accident pilot stated, in a postaccident interview, that the pilot often flew for OSU as a single pilot because the athletic staff wanted to use all of the seats. The revised team travel policy, however, requires two pilots for all OSU air travel involving student athletes. • The only mention in the former air transportation policy regarding pilot requirements are those for the OSU Flight Department’s Cessna 421B and the other multiengine aircraft to which OSU had access. The former policy indicated that these airplanes were to be flown only by pilots from the OSU Flight Department or by qualified pilots hired by the Flight Department Manager. The pilots were required to have a commercial pilot’s license; certification for single-engine, multiengine, and instrument flying; and a minimum of 2,500 hours as pilot-in-command, at least 500 of which were to have been in a multiengine airplane. The revised team travel policy requires captains and copilots to meet multiple requirements, some of which are more stringent than those required by the FAA.53 • The former air transportation policy indicated that university airplanes could be operated during day or night and in visual flight rules or IFR conditions. The former policy also indicated that the judgment of a pilot would always prevail regarding whether flight conditions were safe for takeoff or continuation of a flight. The revised team travel policy indicates that all flights are to be operated on an IFR flight plan and that aircraft may not depart into forecast hazardous weather conditions, including severe icing, thunderstorms, 53 According to the policy, a captain is required to be employed as a full-time pilot and have an airline transport pilot rating with a current first-class medical certificate; a type rating in the airplane to be used for team travel; training in the airplane type within the past 12 months; at least 2,000 hours total flying time, including 200 hours in the airplane type to be used and 20 hours in the past 90 days in the airplane type to be used; and three instrument approaches and three night landings in the past 90 days. The policy also requires a copilot to have multiengine and instrument ratings and a current second-class medical certificate; training in the airplane type within the past 12 months; at least 1,500 hours total flying time, including 100 hours in the airplane type to be used and 10 hours in the past 90 days in the airplane type to be used; and three instrument approaches and three night landings in the past 90 days.

Analysis 34 Aircraft Accident Report or severe turbulence or windshear. Also, the revised policy indicates that passengers cannot enter the cockpit or distract the pilots when an aircraft is below 10,000 feet on takeoff or landing operations and that aircraft used for team travel cannot be piloted by a team member. • No specific restrictions on athletic team travel were provided in the former air transportation policy. The revised team travel policy indicates that other aircraft, including donated aircraft, are an acceptable means of travel for coaches and professional athletic department staff but that student athletes and teams are generally not permitted to travel on such aircraft.54 (Students are allowed to travel on commercial, charter, and time-share aircraft.) Coaches, professional athletic department staff, and student athletes traveling under special circumstances can decline travel on other aircraft, in which case accommodating transportation (within the framework of the policy) will be provided. Unlike the former policy, specific requirements must now be met for other aircraft, including that the aircraft are powered by two or more turbine engines and are certified for flight into known icing conditions. • The former air transportation policy did not mention any provisions regarding airplane maintenance. The revised team travel policy indicates that inspection and maintenance must be performed by an appropriately rated FAA-certified repair station, the manufacturer, or a manufacturer-authorized service center. The revised policy further indicates that maintenance personnel must be appropriately rated and must have been trained within the previous 5 years to maintain the aircraft type to be used. On June 18, 2002, OSU’s Vice President of Business and External Relations, along with two colleagues, presented the university’s revised team travel policy to the National Association of Collegiate Athletic Directors at a convention in Dallas, Texas. The Safety Board notes that this presentation was a positive initial step to inform college and university athletic directors and senior athletic administrators of OSU’s comprehensive team travel policy. However, athletic directors and senior athletic administrators who are not members of the association, as well as senior administrators outside of athletic departments, also need to be made aware of OSU’s revised policy. The adoption of a comprehensive team travel policy, such as the one developed by OSU, would ensure the necessary oversight for athletic team and other school-sponsored travel and would provide an extra margin of safety for students, faculty, and staff. The Safety Board recognizes that not all colleges and universities have athletic programs the size of the OSU program and that some schools do not even have an athletic program. However, the guidance outlined in OSU’s revised team travel policy can be adapted to smaller-scale athletic programs and to club and academic travel, especially because the policy addresses specific requirements for travel by automobiles and minivans, 12- and 15-passenger vans, buses, and mini-buses.55 (As stated earlier, OSU’s 54 The revised team travel policy indicates that, “in special circumstances, if three or fewer athletes are needed for official business of the department, such student athletes may accompany a coach on other aircraft if written parental/guardian consent has been received for any athlete less than 21 years of age.”

Analysis 35 Aircraft Accident Report policy indicates that 15-passenger vans can transport no more than 10 passengers and equipment. According to the Board’s October 2002 safety report, research from the National Highway Traffic Safety Administration indicated that, in 2001, 15-passenger vans with 10 or more occupants were three times more likely to be involved in a rollover accident than those vans with fewer than 10 occupants.56 The Board is concerned that 15-passenger vans carrying 10 occupants and athletic equipment may not have the same margin of safety from rollovers as vans carrying fewer than 10 occupants and no equipment because the weight and position of the equipment would cause the van’s center of gravity to move rearward and upward.) The Safety Board also recognizes that not all colleges and universities have budgets to support the specific requirements described in the revised OSU team travel policy. However, the Safety Board concludes that colleges and universities would benefit from reviewing a model policy based on OSU’s postaccident team travel policy and then implementing a travel policy that is commensurate with the institution’s travel needs. Therefore, the Safety Board believes that the National Collegiate Athletic Association, the National Association of Intercollegiate Athletics, and the American Council on Education should review OSU’s postaccident team travel policy and develop, either independently or jointly, a model policy for member institutions to use in creating a travel policy or strengthening an existing travel policy. 55 OSU is not the only university to develop a written driving policy after an accident. On February 10, 2000, a 1999 Ford E-350 XLT 15-passenger van was transporting a track coach, an athletic trainer, and eight student athletes from Prairie View A&M University, near Hempstead, Texas, to a men’s indoor track meet at the University of Arkansas at Pine Bluff. When the van was on Texas State Highway 43 near Karnack, Texas (a two-lane highway), the van driver (a student athlete) tried to pass a Jeep Cherokee but then decided to reverse this passing action. The van subsequently went out of control and rolled over. Four of the van occupants were killed, and six were seriously injured. The Safety Board determined that a contributing factor to this accident was Prairie View’s lack of oversight regarding the transportation of student athletes. At the time of the accident, Prairie View’s only written driving policy was a provision in its Athletic Policies & Procedures manual requiring that designated speed laws be obeyed when official vehicles were used for team functions. In June 2001, the Texas legislature passed a bill requiring that, by August 2002, all public institutions of higher education have a travel policy addressing fatigue, use of seatbelts, passenger capacity, and qualifications and training of drivers who operate a particular mode of transportation. In December 2001, Prairie View adopted a vehicle safety policy that conforms to the State requirements. 56 For more information, see National Transportation Safety Board, Evaluating the Rollover Propensity of 15-Passenger Vans, Safety Report NTSB/SR-02-03 (Washington, DC: NTSB, 2002).

36 Aircraft Accident Report 3. Conclusions 3.1 Findings 1. The pilot was properly certificated and qualified under Federal regulations. No evidence indicates any preexisting medical or behavioral conditions that might have adversely affected the pilot’s performance during the accident flight. 2. The second pilot was properly certificated and qualified under Federal regulations. The second pilot was not a required flight crewmember because the airplane was certified for single-pilot operation under 14 Code of Federal Regulations (CFR) Part

1. Even if the flight had been operated under 14 CFR Part 135, the second pilot

would still not have been a required crewmember; the airplane was certified for single-pilot operation under Part 135 in instrument flight rules conditions because a three-axis autopilot was installed and operating. Because the flight was conducted with two qualified pilots and an operational autopilot and thus exceeded Part 135 requirements, the circumstances of this accident would not have been any different if the pilot had operated the flight under Part 135 rather than Part 91. 3. The accident airplane was properly certified, equipped, and maintained in accordance with Federal regulations. The recovered components showed no evidence of any preexisting structural, engine, or system failures. 4. Icing was not a factor in this accident. 5. No evidence of a cabin pressurization problem was found. 6. This accident was not survivable for any of the airplane occupants because they were subjected to impact forces that exceeded the limits of human tolerance. 7. The physical evidence recovered from the wreckage site and the recorded radar data indicate that a complete loss of a.c. electrical power occurred aboard the airplane. 8. The pilot would have had salient cues to identify the a.c. electrical power failure. 9. The pilot did not appropriately manage the workload associated with troubleshooting the loss of a.c. electrical power with the need to establish and maintain positive control of the airplane.

1. The airplane’s estimated flightpath in the final 2 minutes of flight was consistent with

a graveyard spiral resulting from pilot spatial disorientation.

Conclusions 37 Aircraft Accident Report

1. The airplane’s angle at the time of impact indicated that the pilot attempted to arrest

the descent in the final portion of the flight, possibly in response to obtaining visual references of the ground after emerging from the lowest layer of clouds.

1. The in-flight breakup occurred because the aerodynamic loading during the pilot’s

pull-up maneuver was great enough to overload the horizontal stabilizer downward and the right outboard wing section was sufficiently loaded upward to sustain a permanent bend in the spar.

1. The a.c. electrical failure was a contributing factor to this accident but was not a

causal factor because non-a.c.-powered instrumentation remained available for the duration of the flight for the pilot to use to safely fly and land the airplane.

1. Oklahoma State University did not provide any significant oversight for the accident

flight.

1. Colleges and universities would benefit from reviewing a model policy based on

Oklahoma State University’s postaccident team travel policy and then implementing a travel policy that is commensurate with the institution’s travel needs. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the pilot’s spatial disorientation resulting from his failure to maintain positive manual control of the airplane with the available flight instrumentation. Contributing to the cause of the accident was the loss of a.c. electrical power during instrument meteorological conditions.

38 Aircraft Accident Report 4. Recommendation As a result of the investigation of this accident, the National Transportation Safety Board makes the following recommendation to the National Collegiate Athletic Association, the National Association of Intercollegiate Athletics, and the American Council on Education: Review Oklahoma State University’s postaccident team travel policy and develop, either independently or jointly, a model policy for member institutions to use in creating a travel policy or strengthening an existing travel policy. (A-03-01) BY THE NATIONAL TRANSPORTATION SAFETY BOARD CAROL J. CARMODY Acting Chairman JOHN J. GOGLIA Member JOHN A. HAMMERSCHMIDT Member GEORGE W. BLACK, JR. Member Adopted: January 15, 2003

39 Aircraft Accident Report

1. Appendixes

Appendix A Investigation and Hearing Investigation The National Transportation Safety Board was initially notified of this accident on January 27, 2001, about 2030 eastern standard time (1830 mountain standard time). A go-team was assembled and departed at 0500 eastern standard time on January 28, 2001, from Ronald Reagan National Airport in Washington, D.C., for Denver, Colorado. The team arrived on scene about 1040 eastern standard time (0840 mountain standard time). Accompanying the team to Strasburg was Board Member John Hammerschmidt. The following investigative teams were formed: Aircraft Operations, Human Performance, Aircraft Structures, Aircraft Systems, Powerplants, Maintenance Records, Air Traffic Control, Meteorology, and Aircraft Performance. Parties to the investigation were the Federal Aviation Administration, Oklahoma State University, Raytheon Aircraft Company, and Pratt & Whitney Canada Aircraft Services, Inc. Public Hearing No public hearing was held for this accident.

40 Aircraft Accident Report Appendix B Oklahoma State University’s Revised Team Travel Policy TASK FORCE REPORT OSU TEAM TRAVEL POLICY

1. 01 Purpose

A. To provide a framework for safe and efficient athletic team travel for the Oklahoma State University Department of Intercollegiate Athletics.

B. To assign responsibility and accountability for enforcement.

1. 01 Applicability

For purposes of this policy, athletic teams are defined as:

Baseball Basketball, Women’s and Men’s Equestrian Football Golf, Women’s and Men’s Soccer Softball Tennis, Women’s and Men’s Track (Indoor, Outdoor, Cross Country), Women’s and Men’s Wrestling Mascots, Spirit Squad, Student Trainers, and/or Student Mangers traveling as a part of a team listed above or any other such team as may be subsequently added to the OSU Intercollegiate Athletics Program

1. 01 Responsibility for administration

A. The OSU Director of Intercollegiate Athletics shall be responsible for overall administration of this policy and shall assign a member of the athletics staff to be responsible for compliance, oversight and necessary recordkeeping. The OSU Director of Intercollegiate Athletics or his/her designee shall provide a copy of this policy to every coach; provide training to every coach; and maintain on file in the Athletic Department a signed certificate by each coach stating the coach has read and understands this policy.

B. The OSU Director of Intercollegiate Athletics or his/her designee shall have the responsibility to verify the type of vehicle recommended for use for athletic travel is in compliance with this policy. Coaches are responsible for developing their season travel plans, to include recommended vehicle types, and gaining written approval from the appropriate associate athletic director in advance of the season or subsequent schedule change. Coaches will consider the type of travel necessary to comply with the institutional policy on missed classes. Post-season travel shall be handled according to NCAA guidelines and approved by the OSU Director of Intercollegiate Athletics or his/her designee.

Appendix B 41 Aircraft Accident Report C. When aircraft are used under this policy, the captain (pilot in command) shall make the final decision whether to fly. However, in no case will the pilot fly if weather conditions do not meet the standards of his/her certification. The respective head coach may always overrule the pilot if he/she concludes that it is inappropriate to fly.

D. The OSU Director of Intercollegiate Athletics or his/her designee shall review and recommend revision, as deemed appropriate to this policy annually, in accordance with institutional guidelines on policy revisions.

1. 01 Accountability

Any coach or athletic staff member knowingly violating this policy will be suspended with or without pay until the OSU Director of Intercollegiate Athletics or his/her designee investigates the violation. Violations may result in disciplinary action or termination.

1. 01 Supplemental Insurance

OSU will procure and maintain in effect accidental death benefits that will guarantee an amount up to $1 million, but not less than $250,000 for travel connected to athletic competition and practice [in accordance with NCAA Bylaw 16.4.1-(b) or as amended]. Coverage per person will be in addition to any other coverages for student athletes, coaches, mascots, spirit squad, student trainers, student managers, and Athletic Department members while on authorized Athletic Department business.

1. 01 Types of Vehicles Used for Team Travel and Requirements for Operation

General Requirement: Coaches, assistant coaches, student trainers, student managers, mascots and members of the spirit squad may drive vehicles used for team travel, if the specific requirements for the vehicle are met. Student athletes may not drive other athletes as a part of team travel.

The following types of vehicles shall be approved for athletic team travel under the conditions noted:

A. Automobiles/Minivans (Specific Requirements)

Drivers must be at least 21 years of age, have a valid and approved driver’s license and be rested.

A qualified, paid driver must be used if traveling farther than 350 miles one way, or if the trip is expected to extend later than 2:00 a.m., or overnight.

B. Twelve and Fifteen Passenger Vans (Specific Requirements)

Drivers are required to obtain a certification from an Emergency Vehicle Operator’s Course in the type of vehicle they will be driving.

Drivers must be at least 21 years of age, have a valid and approved driver’s license and be rested.

Appendix B 42 Aircraft Accident Report 3. For safety reasons, drivers must have a Class C(P) Commercial Driver’s License whether or not required by law.

Drivers must submit to a health check as required by the license or, upon hiring, must pass a medical exam and pass an annual exam thereafter.

A qualified, paid driver must be used if traveling farther than 350 miles one way or if the trip is expected to extend later than 2:00 a.m., or overnight.

Only vans with a 155 inch wheelbase equipped with “E” rated radial tires, or equivalent, properly inflated will be allowed to transport teams greater than 100 miles from a point of departure. In cases when it is necessary to lease vans from a commercial vendor or when vans are provided as a courtesy, team travel is authorized even if the van does not meet the 155 inch/”E” criteria, but travel will be limited to 100 miles one way.

Twelve passenger vans shall be loaded with no more than eight passengers and equipment. Fifteen passenger vans shall be loaded with no more than ten passengers and equipment.

C. Buses (Specific Requirements)

When more than 20 passengers are part of the land travel party, a bus or mini-bus shall be used.

Buses may be used to transport to away venues, transport to hotels from airports, and transport from hotels to playing venues.

Approved buses for team transport are motor coach common carriers or institution leased, owned or operated over-the-road bus transports.

Drivers of buses must have a valid and approved Class B(P) Commercial Driver’s License.

Drivers must submit to a health check as required by the license or, upon hiring, must pass a medical exam and pass an annual exam thereafter.

D. Mini-buses (defined as 20 – 30 passenger transports) (Specific Requirements)

When more than 20 passengers are part of the land travel party, a bus or mini-bus shall be used.

Acceptable mini-buses shall be institution owned or commercially owned.

Driver must have a valid and approved Class B(P) Commercial Drivers License to operate a mini-bus for purposes of this policy.

Appendix B 43 Aircraft Accident Report

1. Drivers must submit to a health check as required by the license or, upon hiring, must

pass a medical exam and pass an annual exam thereafter.

E. Air Transportation

Commercial air carriers, charter, time-share and other aircraft may be used for the purposes stated and are subject to the provisions below:

• Commercial Airlines

Commercial airlines are an acceptable means of travel for athletic teams. Tickets must be procured under the travel guidelines established by the State of Oklahoma.

• Use of Aviation Consultant

All air travel, except the use of commercial air carriers, shall be subject to the review of the institution’s aviation consultant.

The University will, through competitive proposals, retain an aviation consultant. Such individual or firm must have expertise in operations, safety and certification for the purpose of evaluating the certifications and safety records, of charter air carriers, time-share and other aircraft and assure pilot certifications are in keeping with this policy. The aviation consultant will evaluate and assure insurance coverage consistent with this policy.

Prior to flying, the institutional aviation consultant must assure that charter companies, time-share companies, other aircraft and all pilots flying other aircraft meet the requirements of this policy. The aviation consultant shall maintain a qualified list of time-share and other aircraft for possible use.

The institutional aviation consultant shall have final approving authority for approving a firm/aircraft for purposes of this policy.

• General Requirements for Charter, Time-Share, and Other Aircraft

a) Insurance

Aircraft owners/operators shall furnish proof of insurance in advance. Liability insurance should be at least $25 million for light turboprop aircraft, $50 million for light jet aircraft, and a minimum of $3 million per seat for Commercial airlines. Given the volatility in the insurance market, it may not always be possible to achieve these minimum coverages in the marketplace. If it becomes necessary to establish limits in keeping with current industry standards, it shall be the responsibility of the University’s aviation consultant to recommend acceptable limits.

Appendix B 44 Aircraft Accident Report b) Pilots

Two pilots will be required for all OSU travel involving student athletes. Pilots for small aircraft (maximum gross weight of 12,500 lbs or less), whether charter, time-share or other shall have, as a minimum:

b(1) Captain

• Airline Transport Pilot (ATP) rating with current first class medical. • Type rating in aircraft to be used for team travel. • Training in the aircraft type to be used at Flight Safety International, Simuflite Training International, or equivalent aircraft manufacturer’s training within the past 12 months. • Be employed as a full-time pilot. • 2000 hours total flying time. • 200 hours total flying time in the aircraft type to be used. • 20 hours flying time in the past 90 days in the aircraft type to be used. • Three instrument approaches and three night landings in the previous 90 days.

b(2) Copilot

• Commercial Pilot Certificate with current second class medical with multi-engine and instrument ratings. • Training in the aircraft type to be used at Flight Safety International, Simuflite Training International, or equivalent aircraft manufacturer’s training within the past 12 months. • 1500 hours total flying time. • 100 hours total flying time in the aircraft type to be used. • 10 hours flying time in the past 90 days in the aircraft type to be used. • Three instrument approaches and three night landings in the previous 90 days.

c) Maintenance

c(1) Inspection and maintenance must be performed by an appropriately rated FAA certified repair station, the manufacturer or a manufacturer authorized service center (no Aircraft and Powerplant Mechanic signoffs).

c(2) Maintenance personnel (or at least the person signing the log books) must be appropriately rated and be trained to maintain the aircraft type to be used by either Flight Safety International or Simuflite Training International within the previous five years.

c(3) Charter aircraft used according to this policy must be maintained under the appropriate FAA operations specifications.

Appendix B 45 Aircraft Accident Report d) Operation

d(1) On all light turboprop and light jet aircraft, weight and balance computations using average passenger weights are prohibited. A weight and balance form must be completed for each flight using actual weight figures for passengers (no quick weight and balance using normal passenger weights).

d(2) No over-weight or out of center of gravity operation shall be allowed.

d(3) No aircraft may depart into forecast hazardous weather conditions, such as severe icing, thunderstorms or severe turbulence or wind shear.

d(4) No circling instrument approaches shall be authorized with ceilings less than 1,000 feet and at least three miles visibility.

d(5) All flights shall be conducted on an instrument flight plan.

d(6) No passengers may enter the cockpit or distract pilots when the aircraft is below 10,000 feet on takeoff or landing operations.

d(7) Aircraft should be hangered whenever possible during inclement weather.

d(8) No aircraft used for team transportation may be piloted by a team member.

d(9) All flight operations must be conducted in accordance with all relevant FAA regulations or insurance requirements, whichever is more strict.

Charter Services (Specific Requirements) a) All charter services procured shall be subject to the involvement of the OSU Purchasing Department.

b) Every charter company used must have and demonstrate evidence of a current air carrier certificate under FAA Part 135 or 121.

c) The OSU institutional aviation consultant shall assure the OSU Director of Intercollegiate Athletics or his/her designee that written verification has been received for all charter flights from the FAA Flight Standards District Office (FSDO) that an Air Carrier Operating Certificate has been filed and is being maintained in good standing.

Time-share aircraft is authorized if an individual sport budget is sufficient to pay any applicable and operational costs and if any of the conditions below apply: a) Time is available to the Athletic Department in the time-share pool, either owned by the University, corporate or an individual ownership.

Appendix B 46 Aircraft Accident Report b) Such use will facilitate travel and keep student athletes from missing excessive class time.

c) It will facilitate the recruiting image or funding efforts of the department.

d) Commercial or charter services cannot otherwise accommodate the necessary schedule.

Other Aircraft (Specific Requirements) Other aircraft are an acceptable means of travel for coaches and professional athletic department staff, based on personal election, provided all requirements in Section 6.01 E 3 “General Requirements for Charter, Time-Share and Other Aircraft” have been met and the following specific requirements are met. Student athletes and teams shall not be permitted to travel on such other aircraft, except that in special circumstances if three or fewer athletes are needed for official business of the department, such student athletes may accompany a coach on other aircraft if written parental/guardian consent has been received for any athlete less than 21 years of age. Coaches, professional athletic department staff or student athletes may decline to travel on such other aircraft, in which case accommodating transportation (within the framework of this policy) will be provided.

a) Other Aircraft

a(1) The aircraft are powered by two or more turbine engines.

a(2) The aircraft are certified for flight into known icing conditions.

a(3) The aircraft otherwise meets all FAA and insurance requirements of OSU’s travel policy (whichever are most strict).

b) Other Aircraft Approval

The institutional aviation consultant must approve in writing the use of aircraft prior to travel (See Section 6.01 E 2).

c) Other Aircraft Documentation

Before any aircraft is approved for use, the owner/operator shall provide and the institutional aviation consultant shall evaluate and approve in writing the compliance of the following:

c(1) Proof of insurance with required minimums.

c(2) Documentation showing the maintenance plan under which the aircraft operates complies with the requirements of this policy.

Appendix B 47 Aircraft Accident Report c(3) Pilot experience and training documents showing qualifications meeting or ex the requirements of this policy.

c(4) Documents showing the aircraft payload capabilities for use in trip planning.

this page intentionally left blank

FD07266 ｜ 2003_美国_AAR0302.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2003 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Loss of Pitch Control on Takeoff Emery Worldwide Airlines, Flight 17 McDonnell Douglas DC-8-71F, N8079U Rancho Cordova, California February 16, 2000 Aircraft Accident Report NTSB/AAR-03/02 PB2003-910402 Notation 7299A National Transportation Safety Board Washington, D.C.

this page intentionally left blank

Aircraft Accident Report Loss of Pitch Control on Takeoff Emery Worldwide Airlines, Flight 17 McDonnell Douglas DC-8-71F, N8079U Rancho Cordova, California February 16, 2000 NTSB/AAR-03/02 PB2003-910402 National Transportation Safety Board Notation 7299A 490 L’Enfant Plaza, S.W. Adopted August 5, 2003 Washington, D.C. 20594 E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N

National Transportation Safety Board. 2003. Loss of Pitch Control on Takeoff, Emery Worldwide Airlines, Flight 17, McDonnell Douglas DC-8-71F, N8079U, Rancho Cordova, California, February 16, 2000. Aircraft Accident Report NTSB/AAR-03/02. Washington, D.C. Abstract: This report explains the accident involving Emery Worldwide Airlines flight 17, a McDonnell Douglas DC-8-71F, which crashed in an automobile salvage yard shortly after takeoff, while attempting to return to Sacramento Mather Airport, Rancho Cordova, California, for an emergency landing. Safety issues discussed in this report include DC-8 elevator position indicator installation and usage, adequacy of DC-8 maintenance work cards (required inspection items), and DC-8 elevator control tab design. Safety recommendations are addressed to the Federal Aviation Administration. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2003-910402 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Aircraft Accident Report Contents Figures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii

1. Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
2. 1

History of Flight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.2 Injuries to Persons. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1.3 Damage to Aircraft . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.4 Other Damage. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.5 Personnel Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.5.1 The Captain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.5.2 The First Officer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.5.3 The Flight Engineer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.6 Airplane Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.6.1 Cargo Load Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.6.2 DC-8 Longitudinal Flight Control System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1.6.3 Maintenance Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 1.7 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 1.8 Aids to Navigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 1.9 Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 1.10 Airport Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 1.11 Flight Recorders. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 1.11.1 Cockpit Voice Recorder. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 1.11.2 Flight Data Recorder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 1.12 Wreckage Recovery and Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 1.12.1 Longitudinal Flight Control Surfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 1.13 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 1.13.1 Flight Crew Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 1.13.2 Cargo Handlers—Postaccident Drug and Alcohol Testing . . . . . . . . . . . . . . . . . . . 41 1.14 Fire/Explosion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 1.15 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 1.16 Tests and Research. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 1.16.1 DC-8 Elevator Flight Control Tests. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 1.16.2 Airplane Performance Studies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 1.17 Operational and Management Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 1.17.1 Emery Worldwide Airlines, Inc. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 1.17.2 Tennessee Technical Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 1.17.3 FAA Oversight of Emery Worldwide Airlines’ Certificate. . . . . . . . . . . . . . . . . . . 59 1.18 Additional Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 1.18.1 Design and Certification of DC-8 Elevator System. . . . . . . . . . . . . . . . . . . . . . . . . 62 1.18.2 Party Submissions Regarding Contact/Possible Contact with the Bolt . . . . . . . . . . 63

Contents iv Aircraft Accident Report

1. Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
2. 1

General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 2.2 The Accident Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 2.2.1 Disconnection of the Right Elevator Control Tab . . . . . . . . . . . . . . . . . . . . . . . . . . 66 2.3 Role of Aircraft Maintenance in the Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 2.4 Preflight Inspection and Flight Control/EPI Checks . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 2.4.1 Preflight Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 2.4.2 Elevator Checks/Use of the EPI Gauge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 2.5 Elevator Design Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 2.5.1 Elevator Geared Tab Crank Arm Fractures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 2.6 Emery’s DC-8 Maintenance Documents and Guidance. . . . . . . . . . . . . . . . . . . . . . . . . 73 2.6.1 Required Inspection Items . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 2.6.2 Emery’s B-2 Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 2.6.3 DC-8 MM Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 2.7 FDR-Related Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 2.8 Drug and Alcohol Testing of Ground Personnel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

1. Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
2. 1

Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 3.2 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

1. Recommendations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
2. Appendixes

A: Investigation and Hearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 B: Cockpit Voice Recorder Transcript . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

v Aircraft Accident Report Figures

1. The airplane’s ground track, with selected CVR comments, during the accident flight. . . . . . . . . . . . 7
2. A diagram of the elevator control tab installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
3. A photograph of an EPI gauge similar to the gauge installed on the accident airplane . . . . . . . . . . . 14
4. EPI installation on the lower left side of the first officer’s instrument panel

(shown by the yellow arrow), similar to that on the accident airplane . . . . . . . . . . . . . . . . . . . . . . . . 15

1. Photograph showing the elevator damper’s location on the right elevator of a DC-8 . . . . . . . . . . . . 24
2. Elevator, pitch, and control column plots recorded by the accident airplane’s FDR

during ground operations before the accident flight. The first 20 seconds of data were recorded while the gust lock was engaged . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

1. Pitch attitude, control column position, and (corrected) elevator position FDR

data from the accident flight. About the first 20 seconds of data were recorded while the gust lock was engaged. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

1. Pitch attitude, control column position, and (corrected) elevator position FDR

data for the previous takeoff from RNO. About the first 1 minute 20 seconds of data were recorded while the gust lock was engaged . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

1. A photograph of the accident airplane’s right elevator control tab crank

fitting. Note damage on forward face of control tab crank fitting lugs . . . . . . . . . . . . . . . . . . . . . . . 40

1. Photograph of the test airplane’s right elevator control tab pushrod contacting

the crank fitting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

1. Photograph of the test airplane’s disconnected right elevator control tab

pushrod centered between the lugs of the crank fitting with the control tab rotated 3º to 4º in the TEU direction after the attachment bolt was removed . . . . . . . . . . . . . . . . 45

1. The control column position required for the left elevator control tab to

reach its TEU physical stop (for the recorded elevator position) and the actual recorded control column position for the accident flight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

1. Plots of the control column and corrected elevator position recorded

by the accident FDR during the accident takeoff roll and the previous takeoff roll (from RNO) . . . 50

vi Aircraft Accident Report Abbreviations AC advisory circular AD airworthiness directive ALPA Air Line Pilots Association AND airplane nose down ANU airplane nose up AOM aircraft operating manual ASB alert service bulletin ASOS automated surface observation system ATC air traffic control ATP airline transport pilot c.g. center of gravity CAR Civil Aviation Regulations CFR Code of Federal Regulations CVR cockpit voice recorder DAY James M. Cox Dayton International Airport DFR digital flight recorder EPI elevator position indicator FAA Federal Aviation Administration FAR Federal Aviation Regulations FCD fleet campaign directive FDR flight data recorder FOB flight operations bulletin FSB field service bulletins FSDO flight standards district office GPWS ground proximity warning system

Abbreviations vii Aircraft Accident Report HBAW flight standards handbook bulletin for airworthiness IFR instrument flight rules IPC Illustrated Parts Catalog MAC mean aerodynamic chord MEL minimum equipment list MHR Sacramento Mather Airport MM maintenance manual MPPM maintenance policies and procedures manual msl mean sea level NASIP National Aviation Safety Inspection Program OHM overhaul manual P/N part number PMI principal maintenance inspector POI principal operations inspector PTC pitch trim compensator RASIP Regional Aviation Safety Inspection Program RNO Reno/Tahoe International Airport S/N serial number SB service bulletin SDR service difficulty reports STC supplemental type certificate TED trailing edge down TEU trailing edge up TRACON terminal radar approach control TTS Tennessee Technical Services ULD unit loading device

viii Aircraft Accident Report Executive Summary On February 16, 2000, about 1951 Pacific standard time, Emery Worldwide Airlines, Inc., (Emery) flight 17, a McDonnell Douglas DC-8-71F (DC-8), N8079U, crashed in an automobile salvage yard shortly after takeoff, while attempting to return to Sacramento Mather Airport (MHR), Rancho Cordova, California, for an emergency landing. Emery flight 17 was operating under the provisions of 14 Code of Federal Regulations (CFR) Part 121 as a scheduled cargo flight from MHR to James M. Cox Dayton International Airport (DAY), Dayton, Ohio. The flight departed MHR about 1949, with two pilots and a flight engineer on board. The three flight crewmembers were killed, and the airplane was destroyed. Night visual meteorological conditions prevailed for the flight, which operated on an instrument flight rules flight plan. The National Transportation Safety Board determined that the probable cause of the accident was a loss of pitch control resulting from the disconnection of the right elevator control tab. The disconnection was caused by the failure to properly secure and inspect the attachment bolt. The safety issues discussed in this report include DC-8 elevator position indicator installation and usage, adequacy of DC-8 maintenance work cards (required inspection items), and DC-8 elevator control tab design. Safety recommendations are addressed to the Federal Aviation Administration.

1 Aircraft Accident Report 1. Factual Information 1.1 History of Flight On February 16, 2000, about 1951 Pacific standard time,1 Emery Worldwide Airlines, Inc., (Emery) flight 17, a McDonnell Douglas2 DC-8-71F (DC-8), N8079U, crashed in an automobile salvage yard shortly after takeoff, while attempting to return to Sacramento Mather Airport (MHR), Rancho Cordova, California, for an emergency landing. Emery flight 17 was operating under the provisions of 14 Code of Federal Regulations (CFR) Part 121 as a scheduled cargo flight from MHR to James M. Cox Dayton International Airport (DAY), Dayton, Ohio. The flight departed MHR about 1949, with two pilots and a flight engineer on board. The three flight crewmembers were killed, and the airplane was destroyed. Night visual meteorological conditions prevailed for the flight, which operated on an instrument flight rules (IFR) flight plan. On the day of the accident, Emery had operated the accident airplane on two cargo-carrying flight segments before the accident flight. The first was flight 18 from DAY to Reno/Tahoe International Airport (RNO), Reno, Nevada, which arrived at RNO about 1642, and the second flight segment was the first leg of flight 17, from RNO to MHR. Emery flight 17 departed RNO for MHR about 1755. The accident captain was aboard the airplane for both previous flight segments. He rode the jumpseat as he commuted from DAY to RNO to begin his duty day in RNO and was the flying captain from RNO to MHR.3 According to postaccident interviews and company records, the airplane arrived at MHR about 1815 and reached the MHR cargo ramp about 1832. Records indicated that cargo-handling personnel unloaded the inbound cargo from the main and belly cargo compartments then loaded the outbound cargo, finishing about 1930. Postaccident interviews indicated that while cargo-handling personnel were working, the accident flight engineer conducted a preflight inspection of the exterior of the accident airplane.4 Additionally, during this time, mechanics from Emery and a contract maintenance company performed routine maintenance inspections and service items (such as servicing the engines with oil, checking the tires and brakes, and refueling).5 Although 1 Unless otherwise indicated, all times are Pacific standard time, based on a 24-hour clock. 2 Douglas Aircraft Company and McDonnell Aircraft Company merged in April 1967 and formed the McDonnell Douglas Company. The Boeing Company and McDonnell Douglas merged in August 1997 and operate under the Boeing name. Subsequent references to Boeing as the manufacturer reflect this merger. 3 The captain and flight engineer who flew from DAY to RNO were replaced by the accident captain and flight engineer for the flight from RNO to MHR. The first officer who flew to RNO continued on the accident airplane to MHR, where he was replaced by the accident first officer. 4 For detailed information regarding Emery’s DC-8 preflight inspection procedures, see section 1.17.1.2.1.

Factual Information 2 Aircraft Accident Report the investigation revealed that minor maintenance discrepancies existed (for example, an inoperative fuel valve indication and a malfunctioning navigation light), neither the flight engineer nor the mechanics reported observing any significant airplane anomalies during the preflight inspections. Further, the cockpit voice recorder (CVR) did not record any discussion of airplane anomalies while the airplane was on the ground at MHR.6 According to CVR information and postaccident interviews, the loading supervisor gave the final load planning information to the accident flight crew after the outbound cargo was loaded. According to Emery’s procedures, the pilots were to review this information and use it to calculate the airplane’s weight and center of gravity (c.g.)7 for the accident flight. Postaccident interviews indicated that the cargo loading supervisor received a copy of the signed load planning sheet and the completed weight and balance form from the pilots just before the airplane’s doors were closed for departure; there were no anomalies or irregularities with the paperwork or procedures. Postaccident interviews with the cargo loading supervisor, load planner, and cargo loaders who worked on the accident airplane indicated that the unloading/loading process on the night of the accident was routine and that the airplane’s load was lighter than usual.8 According to the CVR, about 1927:25, the first officer (the flying pilot for the accident flight) performed the takeoff briefing, stating, in part, “[w]e’re cleared up to [3,000 feet]. …Standard Emery procedures if there’s a problem, we’ll come back here and land on [runway 22L].” The captain responded, “Sounds good.” About 1932:32, the CVR recorded the flight engineer confirming that the airplane’s cargo doors were closed and, about 1932:36, the flight crew began the prestart checklist. About 1939:19, the flight engineer advised ground personnel “we have four good [engine starts], you can go ahead and pull the [auxiliary] air and power.” According to the CVR transcript, the flight crew began the after start/before taxi checklist about 1940:00 and, about 1940:39, advised local airport traffic that Emery flight 17 was taxiing from the southwest cargo area to runway 22L.9 As the pilots taxied the airplane toward the runway, the captain called for 15º of flaps and a flight control check. The CVR subsequently recorded the first officer stating, “ailerons 5 It was dark at the time these tasks and inspections were conducted; however, ground personnel set up light stands along the left side of the airplane, illuminating that portion of the airplane for cargo loading/unloading and inspection operations. Ground personnel reported that there was no significant direct light on the right side of the airplane. (National Transportation Safety Board investigators noted similar lighting conditions during their observation of loading operations on February 21, 2000.) 6 The CVR recorded the last 33 minutes and 24 seconds of cockpit communications before the accident. See appendix B for an excerpted portion of the CVR transcript. 7 The position of the c.g. is directly related to the stability of the airplane (that is, the tendency of the aircraft to return to a trimmed equilibrium) and the pitch control input required to maintain a given flight condition. 8 For additional information regarding the cargo loading on the accident airplane, see section 1.6.1. Also, see the Operational Factors/Human Performance Group Chairman’s Factual Report, dated April 13, 2001, and Attachments 1 (interview summaries), 7, and 8 in the public docket for this accident. 9 Because there is no air traffic control (ATC) facility at MHR, pilots typically broadcast their intentions to other area traffic on a common radio frequency.

Factual Information 3 Aircraft Accident Report left…center…right…center” and the captain stating, “ready on the rudders?…left rudder…center…right rudder…center.” About 1942:27, the captain stated, “elevator forward…coming back,” and the first officer responded, “EPI [elevator position indicator]10 checks.” According to the CVR, about 1942:31, the flight crew began the taxi checklist. About 1942:43, the flight engineer stated, “controls, EPI;” the first officer responded, “checked;” and the flight engineer repeated, “checked.” Flight data recorder (FDR) data indicate that, during the elevator control check, the accident airplane’s control column moved from 10.8º forward of its vertical position to 17.3º forward of vertical. During this time, the FDR recorded the elevator surfaces moving from 16.6º trailing edge up (TEU) to 2.8º TEU. No trailing edge down (TED) deflection was recorded during this elevator check. About 1943:23, the flight engineer indicated that the taxi checklist was complete. According to the CVR, about 1946:58, the first officer contacted Sacramento terminal radar approach control (TRACON), advising the air traffic controllers that Emery flight 17 was number one for takeoff and requesting the flight’s IFR release for the flight to DAY.11 About 1947:14, the controllers at Sacramento TRACON stated, “Emery [17…], Sacramento…you’re released for departure, report airborne.” The first officer responded, “…we’ll call you in the air.” Between 1947:28 and 1948:10, the pilots performed the before takeoff checklist, during which they advised the local airport traffic that they would be taking off on runway 22L with a left downwind departure. About 1948:15, the CVR recorded a sound similar to increasing engine rpm. About 1948:44, the captain stated “airspeed’s alive” and the first officer responded “alive here.” According to FDR data, as the airplane accelerated through about 60 knots, the control column was moving forward from about 13.7º forward of vertical while the elevator was about 6.4º TEU.12 About 1948:50, the captain stated “eighty knots” and the first officer responded, “eighty knots…elevator checks.” FDR data indicate that, during this elevator check (which occurred between 1948:48 and 1948:53), the control column and elevator positions moved from about 14.4º forward of vertical and 5.4º TEU, respectively, to about 19.0º forward of vertical and 2.2º TEU then returned to their previous values.13 Also during this time, the airplane’s pitch attitude moved from about 0.2º airplane nose up (ANU) to 0.6º airplane nose down (AND), then back to 0.2º ANU. 10 Emery’s before takeoff checklist procedures included an EPI/elevator check. For additional information regarding the EPI, see sections 1.6.2.1, 1.16.1.2, and 1.17.1.2.2. 11 Because there is no on-airport ATC facility at MHR to provide pilots with instrument clearances, pilots departing from MHR on IFR flight plans contact Sacramento TRACON for an IFR release before they depart. 12 FDR data showed that, during the previous takeoff (at RNO), as the airplane accelerated through about 60 knots, the control column position was steady at 13.4º forward of vertical while the elevator remained fairly steady above neutral, about 6.0º to 6.4º TEU. 13 FDR data showed that, during the previous takeoff (at RNO), as the pilots performed the 80-knot elevator check, the elevator moved below neutral to about 7.8º TED when the control column position moved forward slightly less than it did during the accident flight.

Factual Information 4 Aircraft Accident Report As the takeoff roll continued, the CVR recorded the captain stating, “V one”14 about 1949:02 and “rotate” about 1949:06. Information from the FDR confirmed that the airplane pitched from 0.2º ANU about 1949:02 to 5.3º ANU at 1949:08; the pitch continued to increase despite the forward movement of the control column. FDR data indicated that, during this time, the control column position moved forward (from 14.5º forward of vertical to 17.4º forward of vertical), and the elevators’ TEU deflection increased from about 5.5º to 8.6º TEU.15 About 1949:08, the CVR began to record a sound similar to the airplane’s stabilizer trim-in-motion alert,16 which continued to sound as the captain stated, “…watch the tail,” about 1949:09. (This sound was recorded by the CVR intermittently until 1949:14.) Between 1949:08 and 1949:15, the airplane’s pitch rate increased to about 2º per second. By 1949:12, the airplane’s pitch had increased to 11.7º ANU, while the control column and elevators had moved to 15.7º forward of vertical and 15.3º TEU, respectively. About 1949:13, the CVR recorded the captain stating, “V two”17 then “positive rate,” 1 second later; FDR data show the airplane’s altitude was increasing at this time. By 1949:15, the airplane’s pitch had increased to 18.3º ANU and the control column position was at 16.2º forward of vertical. About 1949:16, the first officer stated, “I got it,” the captain asked, “you got it,” and the first officer responded, “yep.” FDR data indicated that, almost immediately after the accident airplane lifted off the runway (beginning about 1949:12), it entered a left turn that steepened to about 35º within about 10 seconds. Between 1949:12 and 1949:15, the control column position moved forward from 15.7º to 16.2º forward of vertical and the elevator deflection decreased, moving from about 15.7º TEU to 9.0º TEU. About 1949:19, the CVR recorded the first officer stating, “we’re going back…c.g.’s waay [sic] out of limits.” About 1949:25, about 6 seconds after the first officer announced that they would return to the airport, the flight engineer asked, “do you want to pull the power back.” Two seconds later, the CVR recorded a sound similar to decreasing engine rpm, followed by a sound similar to the airplane’s stick shaker. About 1949:30, the first officer stated, “oh [expletive],” and the captain stated, “push forward.” About 1949:36, the CVR recorded the captain advising Sacramento TRACON that the flight had an emergency. During this 14 V1 is the takeoff decision speed, which was 126 knots for the accident flight. Rotation speed for the accident flight was 146 knots. 15 In contrast, the FDR data from the accident airplane’s previous departure (from RNO) indicated that when the pilots moved the control column aft (from 14.4º forward of vertical to about 7.8º forward of vertical), the elevator moved from about 5.1º TED to about 7.8º TEU, and the airplane’s pitch began to increase during the takeoff. 16 CVR information indicates that the pilots began adding nose-down stabilizer trim about 4 seconds before the airplane lifted off the runway at 1949:11 and that the stabilizer reached full nose-down trim about 3 seconds after liftoff. There was no evidence that the pilots changed the trim setting during the remainder of the accident flight. Physical evidence was consistent with full nose-down trim at impact. According to the manufacturer, a cable motion sensor connected to the stabilizer detects horizontal stabilizer motion and commands the stabilizer warning horn to sound for 1/2 second when it detects 1º of continuous stabilizer movement; it then sounds repeatedly for every additional 1/2 degree of continuous stabilizer travel. 17 V2 is the takeoff safety speed, which was 158 knots for the accident flight.

Factual Information 5 Aircraft Accident Report time (between 1949:30 and 1949:40), the FDR recorded the following: the airplane’s altitude increased to 1,037 feet mean sea level (msl) then began to decrease; the airplane’s left bank decreased from more than 30º to about 13º, then increased to 25º, then decreased to about 12º; the control column position varied between about 17º forward of vertical and 19.5º forward of vertical;18 and the elevator surface deflections decreased from about 12º TEU to about 5º TEU then increased to about 7.5º to 8.5º TEU. About 1949:40, the CVR recorded the first officer stating, “you steer, I’m pushing” while Sacramento TRACON asked the pilots of Emery flight 17 to repeat their radio message. About 1949:44, the captain again advised the TRACON controllers that the flight had an emergency. Also about 1949:44, the flight engineer stated, “we’re sinking…we’re going down, guys.” Two seconds later, the CVR recorded a sound similar to increased engine rpm, followed almost immediately by the ground proximity warning system’s (GPWS) “whoop, whoop, pull up” audible alert and the first officer’s call for “power.” According to FDR data, at this time the airplane was descending through 679 feet msl in a steepening left bank of about 11º. The recorded control column position was about 14º forward of vertical and the elevator surface deflection was about 10º TEU. FDR data showed that the airplane continued to descend until about 1949:50, when it reached about 601 feet msl and began to climb again. About 1949:52, as the airplane climbed through 625 feet msl, the GPWS audible alert ceased and the captain stated, “all right, all right…all right.” About 1949:54, as the airplane climbed through 673 feet msl, the first officer stated, “push” and the flight engineer stated, “okay, so…we’re going back up.” As the airplane’s altitude was increasing (after 1940:50), its left bank also increased, reaching about 45º between 1949:55 and 1949:56, then began to decrease. About 1949:57, the CVR recorded the flight engineer stating, “there you go,” then the captain stating, “roll out,” followed by an unidentified crewmember saying, “roll out,” and the sound of a strained exhale. About 1950:04, the FDR data indicated that the airplane was in a left bank of about 33º, at an altitude of 901 feet msl. About this time, the CVR recorded the captain advising Sacramento TRACON that, “Emery [17 has an] extreme c.g. problem.” FDR data indicated that the airplane continued to climb and its bank continued to decrease during the next 6 to 7 seconds. About 1950:10, as the airplane was rolling out of its left bank on a heading of about 02219 at 947 feet msl, the CVR recorded the sound of another strained exhale. About 1950:11, the flight engineer stated, “anything I can do, guys,” and the captain stated, “roll out to the right.” About 1950:12, the CVR recorded the first officer stating, “okay…push.” 18 This control column position (19.5º forward of vertical) was the most forward control column position recorded by the FDR during the accident flight. For additional information on the recorded control column position, see section 1.11.2.4. 19 All headings presented in this report are in degrees relative to the Earth’s magnetic north pole.

Factual Information 6 Aircraft Accident Report For the next 4 seconds, the airplane continued to fly on a north-northeasterly heading, approximately parallel to the departure runway at an altitude of about 1,000 feet msl. About 1950:16, the CVR recorded a crewmember stating, “push forward” then the first officer saying, “awww.” During the next 10 seconds, the airplane banked right to an east-northeasterly heading then climbed, reaching 1,087 feet msl (the maximum altitude obtained for the accident flight) about 1950:18, before it began to descend again. About 1950:26, as the airplane’s right bank and altitude were decreasing, the flight engineer asked, “you got the trim maxed?” About 1950:28, the first officer stated, “power;” the flight engineer asked, “more;” and, about 1950:29, the first officer said, “yeah.” From 1950:29 to about 1950:35, as the airplane’s right bank decreased, the GPWS audible alert sounded again. About 1950:32, as the GPWS alert continued to sound, the first officer stated, “we’re gonna have to land fast.” Between 1950:33 and 1950:34, the airplane transitioned from a right bank into a left bank. About 1950:37, the first officer stated, “what I’m trying to do is make the airplane’s pitch match the elevator. That’s why I’m putting it in a bank.” According to FDR data, as the first officer spoke, the airplane continued a left turn back toward the airport; the airplane’s left bank steepened to about 30º, and its heading shifted from about 071 through about 047. About 1950:45, the captain replied, “all right…left turn” and, about 1950:46, the first officer added, “so we’re gonna have to land it in…a turn.” As the airplane turned through a heading of about 035, the captain stated, “bring it around.” About 1950:48, the CVR recorded a sound similar to the airplane’s stick shaker activating; about 1 second later, the captain repeated, “bring it around.” The CVR transcript indicated that “grunt” and “rustling” sounds were recorded about 1950:51, as the airplane descended through 774 feet and turned through a heading of about 016. About 1950:54, the first officer asked, “you got the airport.” About 1950:56, as the airplane turned through a northerly heading, the captain again stated, “bring it around.” At 1951:00, the first officer requested more power; 2 seconds later, the CVR recorded the GPWS audible alert again briefly. According to FDR data, about 1951:03, the accident airplane was at an altitude of 430 feet msl in about a 24º left bank, passing through a heading of about 325. Two seconds later, the airplane was at 423 feet msl in about a 28º left bank, passing through a heading of about 312. At 1951:07, the FDR recorded the airplane at 224 feet msl, in a left turn through a heading of about 308. Also, at 1951:07, the CVR recorded the first officer stating, “power…aww [expletive].” One second later, at 1951:08, the CVR recorded a sound similar to impact. The accident airplane’s FDR stopped recording about 1951:08, and the CVR stopped recording about 1951:09; the cessations were consistent with an impact-related loss of electrical power. The airplane impacted the ground in a left-wing-low, slightly nose-up attitude in an automobile salvage yard, about 1 mile east of the departure runway. Figure 1 shows the airplane’s ground track, with selected CVR comments, during the accident flight. (For additional information regarding CVR comments, see the CVR transcript in appendix B).

Factual Information 7 Aircraft Accident Report Note: C1=recorded on the captain’s CVR channel, C2=recorded on the first officer’s CVR channel, C=recorded on the cockpit area microphone channel. Figure 1. The airplane’s ground track, with selected CVR comments, during the accident flight. 1.2 Injuries to Persons Table 1. Injury chart Injuries Flight Crew Cabin Crew Passengers Other Total Fatal 3 0 0 0 3 Serious 0 0 0 0 0 Minor 0 0 0 0 0 None 0 0 0 0 0 Total 3 0 0 0 3

Factual Information 8 Aircraft Accident Report 1.3 Damage to Aircraft The airplane was destroyed by impact forces and postcrash fire. 1.4 Other Damage The accident airplane’s left wing tip contacted a concrete and steel support column for an overhang attached to a two-story building, located adjacent to the southeast edge of the salvage yard. The airplane subsequently impacted the vehicles and pavement in the salvage yard; many vehicles in the salvage yard were damaged or destroyed by impact and postimpact fire. 1.5 Personnel Information The National Transportation Safety Board reviewed the flight crew’s flight- and duty-time limits and rest records and found no evidence that they were not within the limits established by Federal regulations. According to Emery records, the accident flight crewmembers flew together on two previous trip sequences in February 2000—one that began on February 4 and another that began on February 8. 1.5.1 The Captain The captain, age 43, was hired by Emery on October 19, 1994. He held an airline transport pilot (ATP) certificate with multiengine land and instrument ratings. He had type ratings in five airplane types, including the DC-8 (issued August 5, 1998). The captain’s most recent DC-8 proficiency check was completed on June 30, 1999, and his most recent recurrent training was completed on February 11, 2000. His most recent Federal Aviation Administration (FAA) first-class airman medical certificate was issued on February 15, 2000, and contained the limitation that he “must wear corrective lenses for near and distant vision.” According to Emery records, at the time of the accident, the captain had flown about 13,329 total flight hours, including 2,128 hours as a DC-8 captain. According to company records and postaccident interviews, the captain left his home in New York about 1430 on February 15 to commute to MHR, where his duty period was scheduled to begin the next day. Interviews indicated that the captain likely traveled from Albany, New York, to DAY by jumpseat then rode on the jumpseat of Emery flight 18, which was scheduled to fly to MHR, then to RNO, and return to DAY. However, the flight from DAY to MHR was delayed while maintenance personnel completed work on one of the cockpit windows, and the trip sequence was subsequently modified to land at RNO first, then MHR. The captain’s flight duty began with the flight from RNO to MHR.

Factual Information 9 Aircraft Accident Report The first officer who was the flying pilot for the flight from DAY to RNO (on which the captain rode jumpseat) and was the non-flying pilot while the accident captain flew the flight from RNO to MHR indicated that he had not flown with the accident captain before. He indicated that the accident captain smoothly hand-flew the airplane to their cruising altitude of 14,000 feet msl, then (again hand-flying) made a normal descent and a “nice” landing at MHR. The first officer stated that he did not note any problems with the airplane during the flight from RNO to MHR, nor did the accident captain indicate to the first officer that there were any problems with the airplane. 1.5.2 The First Officer The first officer, age 35, was hired by Emery on September 15, 1996. He held an ATP certificate with multiengine land and instrument ratings. His most recent DC-8 recurrent training and proficiency checks were completed on October 27 and 29, 1999, respectively. The first officer’s most recent FAA first-class airman medical certificate was issued on June 24, 1999, with no restrictions or limitations. According to Emery records, at the time of the accident, the first officer had flown about 4,511 total flight hours, including 2,080 hours as a DC-8 first officer. The first officer lived in Placerville, California, about 33 miles northeast of MHR, where he joined the accident captain and flight engineer for the accident flight. According to Emery records, the first officer’s duty day began with the accident flight. 1.5.3 The Flight Engineer The flight engineer, age 38, was hired by Emery on September 15, 1998. He held an ATP certificate with multiengine land rating and a flight engineer rating for turbojet-powered airplanes. The flight engineer’s most recent DC-8 recurrent training and proficiency checks were completed on September 2, 1999. His most recent FAA first-class airman medical certificate was issued on June 22, 1999, with no restrictions or limitations. According to Emery records, at the time of the accident, the flight engineer had accumulated about 9,775 total flight hours, including 675 hours as a DC-8 flight engineer. The flight engineer lived in Sparks, Nevada, a suburb of Reno, where he joined the accident captain for the flight from RNO to MHR. According to Emery records, the flight engineer’s duty day began with the flight from RNO to MHR. 1.6 Airplane Information The DC-8 was originally certificated in 1959, under Civil Aviation Regulations (CAR) Part 4b.20 The accident airplane, N8079U, serial number (S/N) 45947, was issued a standard airworthiness certificate as a DC-8-61, on March 21, 1968. In July 1983, the 20 For additional information regarding the DC-8’s certification under CAR 4b, see section 1.18.1.

Factual Information 10 Aircraft Accident Report accident airplane was altered (different engines and nacelles were installed) and the airworthiness certificate was amended accordingly to indicate an airplane model DC-8-71. The accident airplane was converted to a freighter in April 1993, and the airworthiness certificate was amended to indicate an airplane model DC-8-71F. The documentation for the freighter conversion included several FAA Form 8110-3s, “Statement of Compliance with the Federal Aviation Regulations.” Emery purchased the airplane from Aero USA, Inc., on March 27, 1994. The airplane was added to Emery’s operating certificate on March 31, 1994. According to Emery records, the accident airplane had 84,447 total hours of operation and 33,395 flight cycles21 at the time of the accident. The accident airplane was equipped with four CFM International (CFMI)22 CFM56-2-C1 engines. According to Emery’s dispatch documents for the accident flight, the airplane’s takeoff weight was calculated to be 279,231 pounds,23 including 63,764 pounds of cargo and 66,700 pounds of fuel. The dispatch documents indicated that the airplane’s takeoff c.g. was calculated to be 28.9 percent of the mean aerodynamic chord (MAC) and that the aft c.g. limit was 33.6 percent MAC for the DC-8-71F airplane. Dispatch documents indicated that the takeoff flap setting was 15º, and the takeoff horizontal stabilizer trim setting was 1.6 units ANU. 1.6.1 Cargo Load Information Postaccident interviews with the cargo-handling personnel who worked on the accident airplane revealed that the airplane arrived at MHR about 1815. The MHR cargo-handling personnel indicated that they removed the cargo that was on the main cargo compartment when the airplane arrived, then loaded 4 pallets and 14 containers of cargo into the main cargo compartment positions. They also loaded 3 cases of mail and several pieces of long freight to the existing 1,784 pounds of cargo in the belly cargo compartments. According to Emery records, the weight of the cargo that was loaded in the accident airplane at MHR was as follows: 59,290 pounds in the main cargo compartment and 2,690 pounds in the belly cargo compartments. The cargo-handling personnel told investigators that there were no problems during the unloading or loading, and several cargo handlers commented that the operation went “smooth” that night. Additionally, the cargo-handling personnel, including the load planner, reported that the airplane’s load was lighter than usual—the load planner estimated that a typical load would involve about 75,000 pounds of cargo. He further stated that his usual load planning goal was to obtain a c.g. of about 23 percent MAC; the 21 A flight cycle is one complete takeoff and landing sequence. 22 CFMI is a company jointly owned by General Electric Aircraft Engines of the United States and Societe Nationale d’Etude et de Construction de Moteurs d’Aviation of France. 23 According to the manufacturer’s airplane flight manual, the maximum certificated takeoff gross weight for the accident airplane was 328,000 pounds.

Factual Information 11 Aircraft Accident Report accident airplane’s c.g. was slightly aft of this (though still forward of its aft c.g. limit of 33.6 percent MAC) because two of the forward-loaded cargo containers were light. 1.6.2 DC-8 Longitudinal Flight Control System The DC-8’s elevator flight control system is “tab-driven”—that is, the control columns are mechanically linked to the elevator control tabs, and deflection of the control tabs in flight results in deflection of the elevators, which results in changes in the airplane’s pitch attitude. This system includes two linked sets of components (one on the left side and one on the right side), each of which include control columns, cables and linkages, a horizontal stabilizer, and an elevator surface with a control tab and a geared tab. Pitch trim is provided by the adjustable horizontal stabilizer. The elevator surfaces are hinged to the rear spar of the horizontal stabilizer and are connected to each other by drive rods and a torque tube so that they operate in unison. According to chapter 27 of the DC-8 maintenance manual (MM), when the DC-8 elevator surfaces are properly installed and rigged, they have a maximum TEU deflection of 27.0º ± 0.5º and a maximum TED deflection of 16.5º ± 0.5º from their neutral position, which is in line (or faired) with the horizontal stabilizer. Each elevator control tab is hinged to the inboard trailing edge of the associated elevator surface, then connected by a mechanical linkage (including a crank fitting, pushrod, and bellcrank assembly) at the inboard edge of the tab to the flight control system on that side of the airplane. Figure 2 is a diagram of the elevator control tab installation. The elevator control tabs are in their neutral position when they are in line with the elevator surfaces and should have a maximum TEU deflection of 8.5º ± 0.5º and a maximum TED deflection of 26.5º ± 0.5º from that neutral position. The elevator geared tabs are hinged to the middle of the trailing edge of each elevator, immediately outboard of the elevator control tabs. Two longitudinally aligned pushrods, attached to the inboard and outboard ends of the elevator geared tabs, connect the geared tabs to the horizontal stabilizers’ rear spar. The geared tabs are in their neutral position when they are in line with the elevator surfaces in their neutral position and are designed (or rigged) to deflect about 4.75º TEU and 26.75º TED from that position. As the elevators’ positions change in relation to the horizontal stabilizer, linkages move the elevator geared tabs in the opposite direction, providing an aerodynamic boost to assist the control tabs in moving the elevators. (This reduces the amount of control force required from the pilots.)

Factual Information 12 Aircraft Accident Report Figure 2. A diagram of the elevator control tab installation. Dampers are installed in each elevator leading edge at the inboard hinge location and provide an opposing force proportional to the rate of elevator movement to prevent elevator flutter. For additional information regarding the elevator dampers on the accident airplane, see section 1.6.3.1.2. The airplane is also equipped with an elevator load-feel and centering device, which increases the forces felt by the pilots at the control columns above those resulting from the aerodynamic forces acting on the control tabs and helps return the columns to their neutral position when control column force is removed. The control columns are rigged to travel between 23.75º forward and 6.50º aft of a vertical reference position24 and are connected by cables to the left and right elevator control tab drive linkages. The control column’s rigged neutral position is 13.5º forward of the control column’s vertical reference position. 24 The vertical reference position is perpendicular to the cockpit floor. Physical stops prevent control column movement beyond 23.75º forward and 6.50º aft of vertical.

Factual Information 13 Aircraft Accident Report During normal operation in flight, the elevator flight controls work as follows: when a pilot moves the control column forward (commanding an AND movement), the left and right elevator control tabs deflect in a TEU direction and the resultant aerodynamic forces drive the elevator surfaces in the opposite (that is, TED) direction causing the airplane to pitch nose down. When a pilot moves the control column aft (commanding an ANU movement), the left and right elevator control tabs deflect in a TED direction and the resultant aerodynamic forces drive the elevator surfaces in the opposite (TEU) direction causing the airplane to pitch nose up. When the airplane is on the ground with the gust lock engaged,25 the centering device positions the control columns about 15º forward of vertical, the elevators are locked in their neutral position, the elevator geared tabs are in line with the elevator surfaces, and the control tabs are deflected slightly above neutral (about 2º TEU). When the gust lock is disengaged (assuming no pilot input), the elevators rotate in a TEU direction because of their leading-edge-heavy balance condition; depending on the wind conditions, the elevators might rotate to their maximum TEU position. Because of the mechanical linkages between the flight control cables and the control tabs, the control tabs rotate to their maximum TEU position. The elevator geared tabs deflect toward their maximum TED position. 1.6.2.1 DC-8 Elevator Position Indicator Information The DC-8 EPI is a 1-inch diameter circular cockpit gauge with a pointer needle and index markings for UP, DN (down), and NEUT (neutral) positions to indicate the position of the elevators. When the EPI is properly calibrated, the up index mark should correspond to the maximum TEU elevator surface position of 27º and the down index mark should correspond to the maximum TED elevator surface position of 16.5º TED. A narrow white band adjacent to the NEUT index mark indicates an elevator surface position between 0º and 5º TEU. Figure 3 is a photograph of an EPI gauge similar to that on the accident airplane. 25 The gust lock holds the elevator surfaces in a fixed, faired position to prevent damage from gusty winds, etc. The lever for the elevator (and rudder) control surface gust lock is located on the right side of the pilot’s center control pedestal. To engage the gust lock, the lever is moved to its aft (down), latched position.

Factual Information 14 Aircraft Accident Report Figure 3. A photograph of an EPI gauge similar to the gauge installed on the accident airplane. The EPI on the accident airplane was located on the lower left side of the first officer’s instrument panel. (Figure 4 shows an EPI installation similar to that on the accident airplane.) The EPI gauge was installed in 1979 by the then-operator of the accident airplane, United Airlines, in compliance with Airworthiness Directive (AD) 78-01-15, which required DC-8 operators to install an EPI system in accordance with Douglas Service Bulletin (SB) 27-254, dated March 5, 1975. The FAA issued AD 78-01-15 as a result of a series of accidents and incidents involving DC-8 jammed or restricted elevator surfaces that began in 1970. (For additional information regarding these instances of jammed/restricted DC-8 elevators, see section 1.6.2.2) AD 78-01-15 specified that operators install the EPI gauge on the first officer’s instrument panel such that full forward movement of the control column and wheel would not obstruct the first officer’s view of the gauge. The AD did not comment regarding visibility of the gauge from the captain’s seat. As a result, DC-8 operators installed the EPI where they found room for it and where the first officer could see it on an airplane’s existing instrument panel. Because Emery purchased its DC-8s from several other operators and EPI placement was not standardized, EPI gauges in Emery’s fleet were installed in several different locations; according to Emery personnel, however, they were generally installed on the lower portion of the first officer’s instrument panel.

Factual Information 15 Aircraft Accident Report Figure 4. EPI installation on the lower left side of the first officer’s instrument panel (shown by the yellow arrow), similar to that on the accident airplane. Further, AD 78-01-15 did not include any guidance for DC-8 operators regarding incorporation of EPI checks into the operator’s processes and procedures, such as manuals, checklists, cockpit procedures, and training. The Safety Board’s survey of the elevator check procedures used by seven DC-8 operators26 and those recommended by Boeing revealed a variety of practices regarding EPI usage. Of the seven DC-8 operators, only two (Emery and Arrow Air) specifically referenced use of the EPI during the 80-knot elevator check. Emery’s 80-knot check procedure calls for “full forward elevator pressure then release slightly forward of neutral…confirm nose DN response…[first officer] looks for EPI to respond to yoke movement.” Arrow Air’s 80-knot check procedure calls for “full forward yoke and note and feel airplane response, nose strut compression, EPI partial DN.” In a flight operations bulletin (FOB) issued on June 4, 2001, Boeing recommended EPI use during the preflight and taxi elevator checks; however, regarding the 80-knot check, Boeing stated “pitch response may be useful as a check for weight distribution, but [the 80-knot check] is not a valid substitute for a properly conducted flight control check.”27 26 The seven DC-8 operators were Emery, Air Transport International, Arrow Air, United Air Lines, Airborne Express, DHL, and United Parcel Service. 27 For additional information regarding Boeing’s FOB, see section 1.17.1.3.

Factual Information 16 Aircraft Accident Report 1.6.2.2 History of the DC-8 EPI Requirement On September 8, 1970, a Trans International Airlines Corp., DC-8-63, N4863T, crashed on takeoff at John F. Kennedy International Airport, Jamaica, New York. The Safety Board determined that the probable cause of the accident was a loss of pitch control caused by the entrapment of a pointed (asphalt-covered) object between the leading edge of the right elevator and the trailing edge of the horizontal stabilizer, which the flight crew did not detect in time to reject the takeoff.28 As a result of its initial findings during this investigation, on October 28, 1970, the Board issued Safety Recommendation A-70-54 to the FAA, in which the Board expressed its concern that “an elevator jammed by a foreign object would not be detected by the crew” and could result in an accident. Safety Recommendation A-70-54 recommended the following to the FAA: A. All DC-8 operators be advised of the hazardous condition that can be created by foreign object jamming of the aircraft’s elevators. B. Until adequate procedures are developed for positive check of elevator position, all DC-8 operators be advised that takeoff should be aborted whenever premature or unacceptable rotation of the aircraft occurs during takeoff. C. The DC-8 flight control system be evaluated by the FAA in the interest of developing a standard procedure for checking the system from the cockpit. The procedure should provide for positive detection of a jammed elevator. D. Consideration be given for a requirement to install an elevator position indicator in the cockpit of all DC-8 aircraft. The FAA responded to Safety Recommendation A-70-54 in a letter dated November 20, 1970, stating that “additional time is needed to complete the engineering evaluation” and that the FAA would advise the Safety Board of any further action when the evaluation was completed. The FAA’s November 1970 letter further stated that the FAA needed clarification on some sections of A-70-54. The FAA addressed some of these issues in a letter to the Safety Board dated March 8, 1971, which stated: Following our request for the above clarification, NTSB and FAA representatives met on [December 18, 1970] to discuss the intent of the NTSB recommendation….NTSB personnel fully concurred with FAA representatives that the decisions to abort should be left to the judgment of the pilot. 28 For additional information regarding this accident, see National Transportation Safety Board, Trans International Airlines Corp., Ferry Flight 863, Douglas DC-8-63F, N4863T, John F. Kennedy International Airport, New York, September 8, 1970. Aircraft Accident Report NTSB/AAR-71/12 (Washington, DC: 1971).

Factual Information 17 Aircraft Accident Report Douglas has developed check procedures involving control yoke movement to check for elevator movement and jamming prior to takeoff. FAA issued an operations alert on [December 1, 1970] outlining this check procedure and requested all principal inspectors to bring this to the attention of all operators utilizing DC-8 aircraft. This pre-takeoff check made by the pilot in accordance with the operations alert will provide adequate assurance to the pilot that there is proper elevator control for the flight. Compliance with the operations alert, we believe, will be consonant with your first three recommendations made in your [October 28, 1970] letter. In regard to your fourth recommendation for the installation of an elevator position indicator in the cockpit, we believe that due to the design of the aircraft’s elevator controls, the usefulness and value of such a position indicator would not justify the large cost and complexities of this installation. The information provided by the elevator position indicator during the pre-takeoff check specified in the operations alert would, at best, only duplicate the information the pilot obtains by moving the control yoke between full forward and full aft. On February 18, 1972, the Safety Board classified Safety Recommendation A-70-54 “Closed—Acceptable Action.” 29 As previously mentioned, on March 5, 1975, Douglas issued SB 27-254, titled “Flight Controls—Elevator and Tabs—Install Position Indicator,” which recommended that operators install an EPI and associated transmitters and circuitry in their DC-8s to help flight crews detect restricted elevator movement. Douglas indicated that the SB was released because of two instances of insufficient or abnormal elevator travel that were discovered by flight crews during preflight checks. SB 27-254 instructed DC-8 operators to install the EPI on the first officer’s instrument panel, in a location selected by the operator, such that the first officer’s view of the indicator was not obstructed by the full-forward position of the control column. The FAA subsequently issued AD 78-01-15 (effective June 1, 1978), which required DC-8 operators to install an EPI system within 18 months, unless already accomplished in accordance with Douglas SB 27-254. 1.6.3 Maintenance Information Emery’s continuous airworthiness maintenance program for its DC-8 fleet included the following major inspections and intervals:30 29 Although Safety Recommendation A-70-54 contained four distinct subparts, only one recommendation number was assigned. Therefore, the classification “Closed—Acceptable Action” applied to all four parts of Safety Recommendation A-70-54. 30 Emery’s continuous airworthiness maintenance program for its DC-8 fleet also included transit, terminating, and service inspections. For additional information regarding transit, terminating, and service inspections, see the Maintenance Group Chairman’s Factual Report, dated October 27, 2000, in the docket for this accident.

Factual Information 18 Aircraft Accident Report • B Inspections. B inspections were conducted as a series of four segmented inspections (B-1, B-2, B-3, and B-4), accomplished at 136-hour intervals at Emery maintenance stations, unless a C inspection was accomplished. The B inspections were accomplished by Emery maintenance personnel and by contract maintenance personnel under supervision of Emery personnel, whereas heavier maintenance inspections were accomplished for Emery by FAA-approved repair/overhaul facilities. B inspections included inspections of the wings; main landing gear assemblies, wheel wells, doors, and wing root; the nose section, nose landing gear, nose landing gear wheel well area and tunnel; turbo compressor compartment; external center fuselage; aft fuselage and empennage area; cabin area; time-limited components; main aircraft battery; and main cargo door. Additionally, during a B inspection, the airplane was thoroughly cleaned, flight controls were lubricated, the engines were run, and pressurization was checked. For additional information regarding the accident airplane’s most recent B inspections, see section 1.6.3.2. • C Inspections. C inspections were accomplished at 24-month intervals by FAA-approved repair/overhaul vendors that were contracted to conduct maintenance on Emery airplanes. Emery defined a C inspection as “a high level check to insure [sic] the integrity and airworthiness of airframe, fluid quantities, security of components, operational checks of specified components, filter changes, lubrication, overhaul of specific components, systems checks and the accomplishment of principle structural elements per the structural inspection document, or supplemental structural inspection document.” (The accident airplane’s most recent C inspection was completed as part of the most recent D inspection.) • D Inspections. D inspections were accomplished at 12-year intervals; Emery defined a D inspection as “a high level check to include all of the same checks described in the [B and] C check[s], to include overhaul of the aircraft.” For additional information regarding the accident airplane’s most recent D inspection, see section 1.6.3.1. Emery maintenance records indicated that, from November 17, 1999 (the completion date of the accident airplane’s most recent D inspection), to the accident date the company had complied with all applicable FAA ADs and accomplished all scheduled maintenance items on the accident airplane in accordance with the provisions of its continuous airworthiness maintenance program. 1.6.3.1 Accident Airplane’s Most Recent D Inspection Tennessee Technical Services (TTS),31 in Smyrna, Tennessee, performed the accident airplane’s most recent D inspection between August 27 and November 17, 1999, at an airplane total time of 84,050 hours (33,180 cycles). Emery provided TTS with workscope information and guidance. In general, Emery specified that the inspection include fleet campaign directives (FCD) and other special inspections, applicable ADs, 31 For additional information regarding TTS, see section 1.17.2.

Factual Information 19 Aircraft Accident Report components that were due to be changed or recertified, powerplant tasks, and supplemental type certificate (STC) modifications to expand the parameters of the FDR. Emery provided TTS with the following work cards for the inspection: • D inspection work cards for DC-8-50/-60 series airplanes from Emery’s Inspection Program Manual—Volume III, revision 17, dated November 15, 1995. • C inspection work cards for DC-8-50/-60 series airplanes from Emery’s Inspection Program Manual—Volume II, revision 19, dated October 18, 1996. • C supplemental inspection work cards for DC-8-70 series airplanes from Emery’s Inspection Program Manual—Volume II, revisions 16 and 19, dated January 15, 1995, and October 18, 1996, respectively. Emery also provided an amendment to the workscope information, dated September 14, 1999, which stated that the accident airplane’s primary flight controls would be removed and replaced with overhauled units during the D inspection work. 1.6.3.1.1 Removal/Replacement of the Right Elevator Examination of the documentation for the D inspection confirmed that the airplane’s existing elevators and their associated (control and geared) tabs were replaced with overhauled assemblies. At Emery’s request, TTS sent the removed elevator, control tab, and geared tab surfaces and their associated hardware to Willis Aeronautical Services (Willis), in Tempe, Arizona, in exchange for overhauled components.32 (The accident airplane’s right elevator, control, and geared tabs were removed in accordance with work card 3103D, titled “Remove R/H Elevator and Tabs.” This work card instructed maintenance personnel to remove the right elevator, control tab, and geared tab and to bag and attach all loose parts, including hardware, to their respective subassemblies.) Willis then provided TTS (through Emery) with a replacement elevator, control tab, and geared tab surfaces (with no associated hardware), which had been overhauled by Complete Controls, Inc. (CCI), in Tucson, Arizona. According to the attached work orders and documentation, CCI inspected and overhauled the elevator, control tab, and geared tab surfaces in accordance with the DC-8 overhaul manual. Records indicate that TTS received the replacement overhauled elevator geared tab on August 20, 1999, and the replacement overhauled elevator and elevator control tab on September 9, 1999. According to testimony presented at the public hearing for this accident, TTS’ standard receiving inspection procedure consisted of a general visual inspection (to identify shipping damage, etc.) and confirmation that the necessary documentation was with the part.33 TTS representatives indicated that the components were inspected in accordance with TTS’ standard receiving inspection procedure and that no anomalous condition was noted during this inspection. 32 According to public hearing testimony, Emery arranged for TTS to receive replacement parts, which typically were used/overhauled components that Emery obtained through brokers. Willis Aeronautical Services was one such airplane parts broker.

Factual Information 20 Aircraft Accident Report A review of the work cards provided by Emery to TTS for this job revealed that the overhauled control and geared tabs were installed on the overhauled elevator in accordance with instructions on work card 3502D, titled “Install Right Elevator Tabs.” This work card stated the following: NOTE: Use applicable DC-8 M/M [Maintenance Manual], Chapter 27, when performing this card. 1. Inspection OK to install serviceable elevator control and gear tab to elevator. 2. Lube all tab hinge bearings prior to tab installation…. 3. Install overhauled elevator control tab to elevator. 4. Install overhauled elevator gear tab to elevator. 5. Inspector verify control and geared tab installation and security. The Safety Board’s review of the completed work card indicated that the required signatures and stamps were present. All five steps were signed off by a mechanic; the first and third steps involved in the installation of the elevator tabs were signed off by a mechanic and stamped by an inspector; and the final step, an inspection verifying the proper installation and security of the elevator control and geared tabs, was stamped by two inspectors. There was no indication of the date of completion of the individual steps, nor did the card call for such an indication; however, the date listed on the completed work card was October 14, 1999. When TTS received the overhauled elevator components from CCI, the hardware required for installation of the elevator control and geared tabs was not included. TTS personnel indicated that, as a result, they used hardware from TTS stock in accordance with the DC-8 MM chapter 27 guidance (referenced on work card 3502D).34 Chapter 27 of the DC-8 MM, section 3, subpart D of 27-32-06, titled “Tab, Elevator Control— Removal/Installation,” contained instructions to “connect [the control] tab pushrod to the tab crank [fitting] and secure.” However, this section of the Emery DC-8 MM did not contain a list of (or other guidance specifically detailing) the required hardware for the proper installation and security of the control tab crank fitting/pushrod attachment or detailed steps regarding the inspection of this attachment. Likewise, the Douglas Master DC-8 MM did not contain this information. An index associated with an illustration in Emery’s DC-8 MM, chapter 27-32-06, referenced a figure from Emery’s DC-8 Illustrated Parts Catalog (IPC),35 chapter 27-30-01. This IPC figure then referenced another IPC 33 The TTS “Repair Station Inspection Procedures Manual” included the following description of TTS’ procedures for receiving overhauled components, “…[a]ny repaired or overhauled components received from an FAA certificated repair station require a receiving inspection for shipping damage, traceability of life limits, if applicable, and traceability of overhaul record and or maintenance release tag before being returned to service. Repaired or overhauled components that are received from other than an FAA certificated repair station may not be used on an airplane and must be returned to the vendor.” 34 Work card 3502D did not identify the specific hardware required for this installation. 35 Although the Emery and Douglas DC-8 IPCs are not FAA-approved items individually, they were included on a list of reference documents that was approved by the FAA as part of Emery’s continuous airworthiness maintenance program.

Factual Information 21 Aircraft Accident Report figure, which identified the drilled-shank alloy steel bolt, washer, and castellated nut required for this installation by part number but did not identify the cotter pin required to secure the bolt in this installation. On May 8, 2002, Boeing issued temporary revisions 27-207, 27-208, 27-561, and 27-562 to the Master DC-8 MM. These temporary revisions instructed DC-8 operators to connect the control tab pushrod to the tab crank fitting by installing a bolt, washer, and nut and tightening and securing with a cotter pin. These temporary revisions also included an illustration depicting the hardware to be installed when connecting the elevator control tab pushrod to the tab crank fitting. In a June 17, 2002, letter to the Safety Board, Boeing stated that it did not plan to issue a similar revision to the DC-8 IPC because the IPC “was not intended to be used for installation and assembly…the IPC does, however, relate the specific part to the appropriate installation drawing, which is what the mechanic should be using to assemble and/or install components on an airplane.” Emery did not list Boeing’s DC-8 installation drawings in its DC-8 maintenance policy and procedures manual as a reference document, and TTS personnel stated that Emery did not provide them with Boeing’s DC-8 installation drawings. In an August 19, 2002, letter to the Safety Board, the FAA stated “if the air carrier chooses to incorporate the manufacturer’s IPC and/or the manufacturer’s drawings in its program, then the carrier must define the use of the information with regard to its own aircraft.” In a subsequent letter to the Safety Board, dated January 21, 2003, the FAA stated that during surveillance and inspections, it ensures that the maintenance information being used by an operator or repair station is “current and part of the information incorporated into the operator’s program.” Additional commentary and discussion of FAA, manufacturer, and related correspondence concerning the use of IPCs is included in the public docket of this report. When properly installed, the cotter pin is inserted through the castellations on the nut and a hole in the bolt’s shank, then one leg of the cotter pin is bent up and over the top of the nut and the end of the bolt, while the other leg of the cotter pin is bent down, parallel with the bolt. This method of installation prevents the loosening of the nut during operation. According to the DC-8 overhaul manual (OHM), chapter 27-16-1, the hardware required to secure the elevator control tab’s aluminum pushrod end to the aluminum tab crank fitting at this location includes a drilled-shank alloy steel bolt, a washer, a steel castellated nut, and a cotter pin. The Emery work cards and DC-8 MM did not cite the DC-8 OHM as a reference for installing the elevator assemblies. TTS maintenance records indicate that the installation of the elevator assembly on the horizontal stabilizer was performed in accordance with work card 3504D, titled “Install Right Elevator Assembly.” This work card stated the following: NOTE: Use applicable DC-8 M/M, Chapter 27, when performing this card. 1. Inspection OK to install right elevator assembly to horizontal stabilizer. 2. Hoist overhauled elevator into position, install eyebolt nuts….

Factual Information 22 Aircraft Accident Report 3. Torque elevator hinge eyebolt nuts. 4. Install bolts and shims to inboard elevator hinge fitting. 5. Torque inboard hinge fitting bolts and check clearance. 6. Install control tab drive crank and outboard drive torque tube. 7. Connect and safety control tab pushrod to drive crank.[36] 8. Connect and safety inboard and outboard geared tab drive cranks to horizontal stabilizer rear spar links. 9. Connect inboard elevator damper crank to horizontal stabilizer rear spar fittings.

1. Remove sling and install screws in hoist points of elevator surface.
2. Inspector check elevator assembly for proper installation and security.
3. Rig R/H elevator [assembly] per DC-8 M.M. Chapter 27. [37]

The required signatures and stamps were present on the completed 3504D work card. The first step on work card 3504D was stamped by a TTS inspector and steps 2 through 10 were signed by a TTS mechanic. Steps 11 and 12 were stamped by a TTS inspector; step 12 was also signed by a mechanic. As with work card 3502D, there was no indication of the date of completion of the individual steps, nor did the work card call for such an indication. The completion date listed on the card was November 4, 1999. TTS’s time card database indicated that 19 mechanics/inspectors performed tasks described on work card 3504D between September 27 and November 2, 1999. TTS personnel did not document the specific tasks performed by individual mechanics/inspectors, nor was such documentation required by Emery or the FAA. Maintenance records indicated that TTS personnel performed a functional check of the right elevator and tab in accordance with work card 3506D, titled “Functionally Check Right Elevator and Tab.” This work card stated the following: NOTE: Use applicable DC-8 M/M, Chapter 27, when performing this work card. (This card to be worked in conjunction with 3504D.) 1. Perform elevator and tab travel check. See work card #3501. 2. Perform elevator and tab system for excessive friction check. 3. Perform geared tab mismatch check. 4. Perform control tab mismatch check. 5. Perform elevator mismatch check. 6. Perform elevator and tab clearance check. 36 This instruction refers to the forward end of the pushrod. 37 Chapter 27-30-03 of the DC-8 MM contains information regarding elevator assembly rigging and includes after-rigging instructions to “inspect and check…mechanism rods secure and safetied.”

Factual Information 23 Aircraft Accident Report 7. Perform elevator geared tab mechanism clearance check. All seven steps were signed off by a TTS mechanic and stamped by a TTS inspector; the overall work card completion date listed on the card was October 14, 1999. Work card 3601D, titled “L/H and R/H Horizontal Stabilizer and Elevator Close,” contained three steps—one step instructing an inspector to verify the inspection areas before access plates and fairings were reinstalled and secured and fairing seams were sealed (this step required an inspector signature) and two closure steps for a mechanic to perform (a mechanic signature was required). This work card contained no specific reference to inspection of the elevator control tab crank fitting/pushrod attachment area. All required signatures were present on the completed work card 3601D for the accident airplane; the completion date listed on the card was October 26, 1999. During this investigation, the Safety Board interviewed personnel from TTS, including the general manager, vice president, director of quality control, a lead mechanic, and two of the three inspectors involved in the installation of the elevator assembly.38 Subsequently, the Board conducted formal interviews with the president of TTS, the director of quality control, and one inspector; these individuals were also witnesses at the Board’s public hearing on this accident. None of the mechanics/inspectors interviewed specifically recalled the work they performed on the accident airplane. For example, one of the TTS inspectors involved in the installation of the right elevator assembly stated that the elevator control tab crank fitting/pushrod attachment area on the accident airplane would have been inspected at least three or four times (including at the end of the elevator installation and twice during the elevator rigging process) before the fairing would have been replaced. Specifically, he said that TTS mechanics were not allowed to close a panel/fairing unless an inspector was there to inspect the area and witness the closing of that panel/fairing. The TTS inspector stated that he would only stamp the work card for the elevator control tab installation after he had touched the cotter pin to ensure proper installation. 1.6.3.1.2 Reversed Installation of Elevator Dampers The accident airplane’s maintenance records revealed that on November 25, 1999, eight days after the D inspection was completed (which included the installation of the elevator assemblies), a pilot reported that he had to apply “more back pressure than normal” on the control column to flare during the preceding landing and during the elevator check before the previous takeoff. The corrective action for this pilot report (performed by Emery maintenance personnel) was described in the accident airplane’s maintenance logbook as follows: “Found [left/right] elevator dampers reversed, moved [left to right] side, [right to left] side, ops ck’d good, no defects noted.” Figure 5 shows the elevator damper’s location on the right elevator of a DC-8. 38 The third inspector who was involved with the elevator assembly installation was no longer working at TTS and was unavailable when the Safety Board conducted its interviews.

Factual Information 24 Aircraft Accident Report Figure 5. Photograph showing the elevator damper’s location on the right elevator of a DC-8. Emery’s third-shift lead mechanic at DAY described the troubleshooting efforts that led to the discovery of the reversed dampers. He stated, in part, that he and another Emery mechanic moved the control column in the airplane through its range of motion while other maintenance personnel (including his supervisor) watched the elevator assembly’s motion from the ground at the rear of the airplane. The lead mechanic told investigators that during this exercise, his supervisor “noted that there was a problem with the [elevator] dampers and that the mechanical operation wasn’t correct.” Maintenance personnel confirmed that the dampers were installed in the wrong positions and removed and swapped the dampers. According to the lead mechanic, maintenance personnel did not check cable tensions, access the elevator control tab pushrod fairing, rig the elevator control or geared tabs, or discover any obstructions to control column movement during the troubleshooting efforts. Postaccident interviews with the mechanics involved in the maintenance action indicated that they had nearly finished swapping the elevator dampers at the end of the third shift when there was a change in lead mechanic personnel. According to the Emery mechanic who moved the control column during the initial troubleshooting efforts (and stayed on duty to complete the elevator damper work), “once the dampers were placed into the correct position, no further maintenance was done…beyond a visual inspection and checking the feel of the flight controls. It seems to me that the flight controls, after swapping of the dampers, felt smoother.”

Factual Information 25 Aircraft Accident Report Maintenance personnel reported that after the damper exchange, they noted no excessive control column forces or elevator binding; the damper exchange was examined by an inspector and signed off, and the airplane was returned to service. The maintenance logbooks contained no further pilot complaints regarding this anomaly. Chapter 27-00-37 of Emery’s DC-8 MM, “Mechanical Controls—Trouble Shooting,” listed the following procedures, in part, for troubleshooting elevator/tab issues: A. Part 1 1. Clean and lubricate elevator cable cabin pressure seals per MM…. 2. With airplane out of the wind (in hangar), gust lock off, check elevator controls for binding and roughness. Cause of any roughness or binding is to be located. Experience has shown that tab torque tube bearings inside the elevator inboard hinge fitting are very susceptible to binding and rough operation. 3. Check elevator control cable tensions, per MM…and record them. 4. Check cable on elevator autopilot servo drum for binding or damage. 5. Check top and bottom surface contours of elevators outboard of tabs. Top and bottom surfaces to be flat and trailing edge should not bow up or down…. 6. Repeat check “5,” but on all four elevator tabs. B. Part 2 1. Check that elevator trailing edge forward of tabs fairs with tab leading edges. Correct any discrepancies. 2. Check control tab pushrods in elevators for clearance per MM….Correct conditions not within limits. 3. Check that elevator servo support rig holes…are aligned per MM….Record any discrepancies. 4. Check elevator controls rigging per MM…record any out-of-tolerance conditions. 5. Remove the RH pilot seat and floorboards and check the MPT (mach pitch trim) controls for evidence of binding….Operate the MPT to the extend position and check elevator controls for binding. Correct any binding. 6. Check end play (looseness) of the elevator load feel/centering mechanism shaft relative to the mechanism housing….If end play exceeds 0.010 inch the mechanism should be replaced. The mechanism can be removed, checked and reinstalled without disturbing its adjustment. 7. Check that elevator control system friction is within the limits of [the MM]. C. Part 3

Factual Information 26 Aircraft Accident Report 1. Disconnect elevator control cables and control tab pushrods from tab torque tubes at the elevator inboard end. Check the torque tube bearings for binding or roughness. If bearings do not operate smoothly, replace the elevator hinge fitting. Rerig elevator controls. 2. Correct all discrepancies recorded during accomplishment of parts 1 and 2, preceding. Additional commentary and discussion of the troubleshooting procedures used to address pilot write-ups regarding elevator controls is included in the public docket of this report. 1.6.3.2 Most Recent B-2 Inspection of the Accident Airplane The accident airplane’s most recent B-2 inspection was conducted overnight at Emery’s DAY facility, on January 21-22, 2000. One of Emery’s DC-8 work cards (B009) for the B-2 inspection of the right elevator control tab stated the following: RH AND LH HORIZONTAL STABILIZER EXTERNAL SURFACE INSPECTION 1. Inspect external surface of RH and LH horizontal stabilizers for signs of damage, deformation, fluid leakage, and security of attachment. Inspect static dischargers for general condition and security. RH AND LH ELEVATOR AND TAB INSPECTION 1. Visually inspect elevators and tabs for general condition, corrosion, leakage, and security of attachment. Inspect static dischargers for general condition and security. Both steps were signed off by an Emery mechanic. Because of the DC-8 elevator assembly design, the elevator control tab inboard fairing would have to be removed for maintenance personnel to inspect the inboard hinge fitting and crank fitting/pushrod attachment. During the Safety Board’s public hearing on this accident, there was conflicting testimony regarding the intended depth and scope of the B-2 inspection. For example, Emery’s Director of Engineering and Director of Line Maintenance indicated that the general visual inspection dictated by the B-2 inspection work cards would not require the removal of any panels or fairings and, therefore, would not include a visual inspection of the elevator control tab inboard hinge fitting or crank fitting/pushrod attachment. Boeing supported this interpretation of the B-2 inspection work card tasks. In a letter to the Board dated June 14, 2002, Boeing’s Chief Engineer, Air Safety Investigation, stated that the manufacturer’s recommended program work cards “do not call for the removal of the inboard control tab fairing during the B [inspections]. The inboard control tab fairing is not removed until the [C- and D-inspection equivalent]…Therefore, the Emery B-2 inspection work card…would be…an inspection to be accomplished without removing access or inspection panels, fairings, or the like.”

Factual Information 27 Aircraft Accident Report However, during his public hearing testimony, the lead mechanic for TTS stated that although the work card did not specifically call for removal of the inboard control tab fairing, TTS mechanics “would remove the fairings on the elevator itself…and the control tab…and the geared tab…to accomplish all of that card.” The president of TTS also stated that the company’s maintenance personnel would remove the fairings on the elevator, control tab, and geared tab to visually inspect each attachment to accomplish the work card tasks. The Safety Board is aware that several air carrier operators have tried to provide their mechanics with additional guidance regarding the proper accomplishment of a work card item by enumerating the necessary steps or tasks on that item’s work card. 1.7 Meteorological Information The automated weather observation system (AWOS) weather observation taken at MHR on February 16, 2000, at 1950 stated the following: Winds calm; visibility 10 miles plus; scattered clouds at 2,000 feet, ceiling 7,000 feet broken; temperature 46° Fahrenheit (F); dew point 46° F; altimeter setting 30.01 inches of Hg [mercury]. According to postaccident interviews with witnesses, the ceiling and nighttime visibility at MHR at the time of the accident were such that the witnesses could clearly observe the airplane as it taxied from the ramp to the runway, took off, climbed out, and turned to return to the airport. The CVR did not record any pilot comments regarding the weather conditions at the time of the accident. 1.8 Aids to Navigation No difficulties with the navigational aids were known or reported. 1.9 Communications No difficulties with communications were known or reported. 1.10 Airport Information MHR is a former U.S. Air Force Base that is currently operated by the County of Sacramento and located about 12 miles east of downtown Sacramento, California. The airport has an elevation of 96 feet and two parallel runways; runway 4L/22R is 6,040 feet long and 150 feet wide and runway 4R/22L is 11,301 feet long and 150 feet wide. The accident airplane departed from runway 22L.

Factual Information 28 Aircraft Accident Report 1.11 Flight Recorders 1.11.1 Cockpit Voice Recorder The CVR installed on the accident airplane was a Sundstrand AV557, S/N 7286. Examination of the exterior of the CVR revealed evidence of severe fire and heat damage, while the interior exhibited heat damage. When the crash-survivable case containing the CVR tape drive assembly was opened, its contents exhibited no sign of severe heat damage; however, the CVR magnetic tape that was outside of the spool showed some signs of shrinkage, which can be the result of exposure to heat. The sections of tape that had shrunk were permanently damaged, resulting in small areas of unusable audio at the beginning and end of the recording. The overall recording, however, was in playable condition and was successfully downloaded. The CVR recording consisted of four channels of good quality audio information.39 One channel contained audio information recorded by the cockpit area microphone, and the other three channels contained audio information recorded through the radio/intercom selector panels at the captain, first officer, and flight engineer positions. The recording began at 1917:45 and ended at 1951:09, 1 second after it recorded a sound similar to impact. A transcript was prepared of the entire 33-minute 24-second recording. See appendix B for a complete transcript of the CVR recording. 1.11.2 Flight Data Recorder The FDR was a Loral Fairchild digital FDR model F800, S/N 04018, part number (P/N) 17M303-282, which recorded 17 parameters40 of airplane information on a 450-foot long, 1/4-inch wide magnetic tape. The tape is divided width-wise into 6 equally sized tracks, which record a total of 25 hours of data (4 hours 10 minutes of data on each track). The 17 recorded parameters included time, altitude, indicated airspeed, magnetic heading, vertical acceleration, pitch attitude, roll attitude, VHF microphone keying for two VHF channels, engine N1 (rotational fan speed) for all four engines, autopilot engage, longitudinal acceleration, control column position, elevator position, control wheel position, aileron position (left), rudder pedal position, and rudder position. Visual examination of the FDR revealed evidence of internal and external heat and fire damage, including heat damage to some of the tracks on the tape recording medium. 39 The Safety Board uses the following categories to classify the levels of CVR recording quality: excellent, good, fair, poor, and unusable. A good recording is one in which most of the crew conversations can be accurately and easily understood. The transcript that is developed may indicate several words or phrases that are not intelligible. Any loss in the transcript can be attributed to minor technical deficiencies or momentary dropouts in the recording system or to a large number of simultaneous cockpit/radio transmissions that obscure each other. 40 Title 14 CFR Section 121.344 required all airplane FDR systems to be upgraded to record more parameters (airplanes with more than two engines, like the accident airplane, had to be upgraded to record 17 parameters) by August 2001. The accident airplane’s FDR was upgraded during the D inspection that was completed in November 1999.

Factual Information 29 Aircraft Accident Report Despite this damage, the FDR installed on the accident airplane yielded data of good quality for the accident flight without any losses of data synchronization.41 1.11.2.1 Track-Switching Anomaly The Safety Board’s examination of the transcribed FDR data revealed that the FDR erroneously switched to the first track of the tape every time electrical power to the FDR stopped. Thus, the FDR did not record data throughout the length of its 25-hour loop tape (and would not have, unless the FDR was powered nonstop during that 25 hours). As a result of this anomaly, only the last 8 hours and 11 minutes of data for the accident airplane were available; these data included information from portions of the three previous flights (the arrival at DAY and the flights from DAY to RNO and RNO to MHR) and the accident flight. These data were recorded on one complete track and portions of two other tracks; other portions of the tape contained data from various previous flights, including some that took place before the FDR was upgraded in November 1999. As a result of this tracking-switching anomaly, only limited FDR data was available to the Board from flights that occurred in the days leading up to the accident.42 Because of previously identified instances of tracking-switching anomalies in F800 FDR systems, Loral Fairchild43 has identified several potential causes for tracking-switching problems and has issued three field service bulletins (FSB) since February 1988 to address these anomalies. Although two of these FSBs44 appeared to address anomalies like the one observed in the accident airplane’s FDR, Emery personnel stated that its maintenance records showed that the FSBs were not applicable to the accident airplane’s FDR unit. The FSBs only applied to F800 FDRs with particular components installed; maintenance records indicated that those components were not installed on the accident airplane’s FDR.45 The FDR damage sustained during the accident precluded physical confirmation of the specific components that were installed on the accident airplane’s FDR. 1.11.2.2 Elevator Position Data Conversion Anomaly The Safety Board’s examination of the FDR data also revealed an anomaly with the accident airplane’s recorded elevator position data. The Board converted the recorded FDR data to engineering units appropriate to each parameter (for example, feet for altitude, knots for airspeed, and degrees for heading, pitch, roll, etc.) using conversion formulas based on documentation provided by Emery through L2 Consulting Services, Inc. (L2 Consulting Services performed the FDR parameter correlation on the accident 41 A loss of synchronization can result from either a mechanical or electrical interruption of the data. 42 During the FDR correlation check in November 1999, maintenance personnel evaluated real-time data from the FDR system through a download and diagnostic tool. Because the FDR history was not examined during this check, the tracking-switching anomaly would not have been detected. 43 Loral Fairchild is now L3 Communications. 44 Loral Fairchild FSBs Digital Flight Recorder (DFR) 011 and DFR 027. 45 According to Emery records, the accident FDR contained components addressed by Loral Fairchild FSBs DFR 015, 016, 017, 020, 021, and 029.

Factual Information 30 Aircraft Accident Report airplane in November 1999, after the airplane was upgraded to record 17 parameters.)46 The documentation for elevator position provided a relationship between elevator position data recorded by the FDR and the degrees of elevator travel that data represents. The Board’s subsequent conversion of the data based on this relationship resulted in a potential range of elevator positions from 12.8° TEU to 26.6° TED; the elevator’s normal operating range is from 27° TEU to 16.5° TED. The accident airplane’s FDR data indicated that the elevator surfaces were deflected 11º TED relative to the horizontal stabilizer when the airplane was on the ground with the elevator gust lock engaged. However, by design, when the gust lock is engaged, the elevators are physically locked in their neutral, or 0º, position. Additionally, the FDR data recorded during the accident airplane’s climb out from RNO (the flight immediately preceding the accident flight) showed the elevators in a significant TED deflection when the control columns were near their rigged neutral position, which normally corresponds to a neutral elevator position of about 0º. The elevator’s total range of motion was slightly smaller than and offset from its normal range. Therefore, an 11° offset (based on the elevator’s position with the gust lock engaged) in the TEU direction was applied to the elevator recorded position data. Figure 6 shows the elevator, pitch, and control column plots recorded by the accident airplane’s FDR during ground operations before the accident flight. On this plot, the uncorrected data on the far left side of the plot shows an 11º TED elevator deflection when the gust lock was engaged (and the elevator was in its neutral, or 0º, position). 46 According to the FAA’s advisory circular (AC) on this subject (AC 20-141), “a correlation describes the relationship between two variables. In this case the two variables are the raw data stored in the digital FDR and the engineering units or discretes that this raw data represents.” The work card provided by L2 Consulting Services, Inc., titled “F800 [FDR] Correlation Test Procedure—17 Parameters,” documented the ground test performed on the accident airplane to collect correlation data for Emery’s upgrade configuration for that airplane model. For additional information regarding this documentation, see “Addendum 2 to the Digital Flight Data Recorder Factual” in the docket for this accident.

Factual Information 31 Aircraft Accident Report Figure 6. Elevator, pitch, and control column plots recorded by the accident airplane’s FDR during ground operations before the accident flight. The first 20 seconds of data were recorded while the gust lock was engaged. The Safety Board’s examination of the corrected elevator position data revealed that the airplane’s elevator never traveled below its neutral position to a TED deflection during the accident flight, although recorded forward control column inputs should have resulted in a TED elevator deflection. For example, although the FDR data indicated that, during the 80-knot elevator check at MHR, the control columns were moved to about 6º forward of their rigged neutral position, the elevators did not deflect below 2.2º TEU. In contrast, during the 80-knot elevator check on the previous takeoff (at RNO) the FDR recorded elevator movement to 8º TED, with less forward control column movement. Figure 7 shows plots of the pitch attitude, control column position, and elevator position FDR data for the accident flight. Elevator position is shown using the conversion that corrected for the 11º offset. Figure 7 also shows when the 80-knot elevator check and takeoff occurred. Figure 8 shows the same information for the takeoff from RNO.

Factual Information 32 Aircraft Accident Report Figure 7. Pitch attitude, control column position, and (corrected) elevator position FDR data from the accident flight. About the first 20 seconds of data were recorded while the gust lock was engaged. Figure 8. Pitch attitude, control column position, and (corrected) elevator position FDR data for the previous takeoff from RNO. About the first 1 minute 20 seconds of data were recorded while the gust lock was engaged.

Factual Information 33 Aircraft Accident Report 1.11.2.3 Other Examples of Inaccurate FDR Elevator Data During its investigation of this accident, the Safety Board discovered FDR elevator position conversion problems with the FDR data from other Emery DC-8s. For example, the Board noted that the FDR data from the Emery DC-8 used during the elevator flight control tests (described in section 1.16.1) produced elevator position values that were not consistent with the elevator travel that was physically measured on the test airplane during the ground tests.47 The Board’s initial parameter conversions were performed using documentation provided by Emery that had full TEU and TED engineering values that were the same as those obtained for the accident airplane (12.8º and 26.6º, respectively). Further investigation revealed that in Emery’s DC-8 fleet, a full FDR correlation was only completed on one airplane (as permitted by the Federal Aviation Regulations [FARs]).48 In this case, Emery’s only full correlation was completed on the accident airplane. After that initial full correlation, the correlation for the accident airplane was applied to the rest of Emery’s DC-8 fleet as their FDRs were upgraded; the actual control surface positions on those airplanes were not measured.49 After the ground tests, the FDR on the test airplane was replaced and the airplane was returned to service. Several weeks later, the test airplane was involved in a landing incident that the Board investigated.50 Evaluation of the elevator position data recorded by the replacement FDR (converted using conversion data provided by Emery) revealed that, as with the data recorded by the previously installed FDR, the recorded elevator travel data did not match the elevator travel measured during the ground tests. The Safety Board then examined the FDR data from another Emery DC-8 that was involved in another incident.51 The Board’s evaluation of this recorded elevator position data revealed that the recorded elevator values did not fall entirely within the elevator’s normal operating range. 47 Because the test airplane’s neutral, maximum TEU, and maximum TED elevator positions were measured during the ground tests, these measured elevator position values were used as the basis for the test airplane’s elevator conversion and the Safety Board’s subsequent examination of that airplane’s FDR data. 48 According to 14 CFR 121.343(j), operators are permitted to establish a single correlation for any group of airplanes if “1) the airplanes are the same type, 2)…the flight recorder system and its installation are the same, and 3)…there is no difference in the type design with respect to the installation of those sensors associated with the flight data recorder system. Documentation sufficient to convert recorded data into the engineering units and discrete values specified in the applicable appendix must be maintained by the certificate holder.” 49 The Safety Board also noted that when the original conversions for the test airplane were used, recorded control column positions were not consistent with the control column input that was physically measured on the test airplane during the ground test; however, the ranges of the recorded and measured control column ranges were almost the same. As with the elevator, the control column values measured during the ground tests were used as the basis for the control column conversion and subsequent examination of the data. 50 The description of this incident, MIA01IA129, can be found on the Safety Board’s Web site at http:www.ntsb.gov. 51 The description of this incident, SEA01IA039, can be found on the Safety Board’s Web site at http:www.ntsb.gov.

Factual Information 34 Aircraft Accident Report The FAA had previously notified Emery of deficiencies with its DC-8 FDR documentation. On December 1, 1998 (about 11 months before the accident airplane’s FDR was upgraded to 17 parameters), the FAA’s principal avionics inspector for Emery sent a letter to Emery’s Director of Quality Control, in which he listed the following FDR-related findings: There are no correlation documents required by FAR 121.343(j) on file for any of Emery Worldwide Airlines DC-8 aircraft. As discussed with you and Mr. Robbins the minimum correlation requirement is derived from FAR 25.1459(c).[52] There is no current maintenance manual procedure for the upgraded 11 parameters of each make/model of DFDR [digital flight data recorder] in use. 1.11.2.4 FDR Control Column Position Data In the original correlation measurements (intended to establish a relationship between the geometry of the accident airplane’s control column and the corresponding data recorded by the FDR), the FDR recorded the airplane’s control column position at 15º forward of vertical when the gust lock was engaged. The control column correlation also showed that the total range of control column position at the time of the FDR upgrade was 29.6º (nearly the DC-8 design control column maximum range of 30.25º) and fell within the design range of forward and aft movement. However, the recorded control column range of motion at the time of the accident was less than that observed during the original correlation. Although the recorded forward and neutral control column positions came close to those indicated by the original correlation, the maximum recorded aft control column range was significantly reduced from that indicated by the original correlation. The Safety Board did not determine the cause of this reduction in recorded control column range. 1.11.2.5 Previous FDR Data-Related Safety Recommendations The Safety Board has previously encountered problems related to the absence of reliable FDR data53 and has made a series of safety recommendations regarding these issues since the early 1970s. In its correspondence with the FAA regarding these safety recommendations, the Board has noted that the FDR-related problems were especially prevalent for airplanes that were originally equipped with six-parameter FDRs and subsequently retrofitted to record additional parameters in accordance with 52 As previously discussed, Emery personnel were able to provide the Safety Board with conversion documentation for the accident airplane and the airplanes involved in the other incidents. L2 Consulting Services, Inc., the company that correlated and verified the FDR parameter upgrades on Emery’s DC-8s, provided Emery with the documentation. 53 Accidents in which unreliable or missing FDR data were discovered included four accidents involving DC-9 airplanes operated by ValuJet in 1996; the February 16, 1995, accident involving an ATI DC-8; the November 12, 1996, accident in Orebro, Sweden, involving an Express One Boeing 727; the August 7, 1997, accident involving a Fine Airlines DC-8-61, and the February 9, 1998, accident involving an American Airlines 727. Other accidents are discussed later in this section.

Factual Information 35 Aircraft Accident Report Section 121.343(c).54 As a result of its ongoing concerns, the Board issued Safety Recommendations A-97-29 and A-97-30 on May 22, 1997.55 Safety Recommendation A-97-29 asked the FAA to do the following: Take action within 180 days to ensure compliance of the U.S. carriers subject to 14 CFR 121.343(c). Actions should include (a) performing a readout of each retrofitted airplane’s 11-parameter flight data recorder (FDR) to determine that all required FDR parameters are being recorded and to verify that each parameter is working properly; and (b) reviewing the FDR system documentation to determine compliance with the range, accuracy, resolution, and recording interval specified in 14 CFR Part 121, Appendix B. In a letter to the Safety Board dated July 14, 1997, the FAA stated that it agreed with the intent of this safety recommendation. In response, the FAA issued Flight Standards Handbook Bulletin for Airworthiness (HBAW) 97-13C, which became effective on December 15, 1997. HBAW 97-13C provided FAA airworthiness inspectors with “policy/guidance to ensure continued proper operation and recording of data” by FDRs. The bulletin outlined items inspectors should look for in a comprehensive FDR maintenance program, defined time requirements for addressing identified discrepancies in FDR maintenance programs, and described a functional evaluation as a “recorded data dump, conversion to engineering units and assessing that the [FDR] is receiving, transcribing and decoding sensor information properly.” In a July 10, 1998, safety recommendation letter to the FAA (regarding the August 1997 accident involving Fine Airlines flight 101 in Miami, Florida56), Safety Recommendation A-97-29 was classified “Closed—Unacceptable Action/Superseded” (the recommendation that superseded A-97-29 is discussed later in this section). The Board indicated that this classification was based on “the continued discovery of malfunctioning 11-parameter FDRs” and the findings of the Fine Air investigation, which indicated that “it is advisable to require air carriers to maintain the records of FDR readout.” 54 There have been two required FDR upgrades that apply to Emery’s DC-8s (which were manufactured before May 26, 1989, and type certificated before September 30, 1969). The first upgrade, which became effective on May 26, 1995, required that the following additional parameters be recorded: pitch attitude, roll attitude, longitudinal acceleration, control column or pitch control surface position, and N1 (rotational speed) of each engine. The second upgrade required the affected airplane to be upgraded to record 17 parameters; this upgrade had to be completed by the airplane’s first heavy maintenance inspection after August 18, 1999. As previously mentioned, the accident airplane was modified to record these additional parameters during its most recent D inspection in November 1999. 55 In this safety recommendation letter, the Safety Board listed a series of recent accidents and incidents that involved malfunctioning FDRs, including the October 22, 1996, accident involving a Millon Air Boeing 707 and the May 28, 1995, accident involving a Millon Air DC-8. 56 See National Transportation Safety Board, Uncontrolled Impact with Terrain, Fine Airlines Flight 101, Douglas DC-8-61, N27UA, Miami, Florida, August 7, 1997, Aircraft Accident Report NTSB/AAR-98/02 (Washington, DC: NTSB, 1998).

Factual Information 36 Aircraft Accident Report Safety Recommendation A-97-30 asked the FAA to do the following: Complete the planned flight data recorder (FDR) advisory circular (AC) to define FDR certification requirements and FDR maintenance requirements, and incorporate the FDR documentation standards contained in Notice N8110.65. The AC should be released no later than January 16, 1998. In a July 14, 1997, letter, the FAA stated that it agreed with the intent of this safety recommendation and promised to complete an AC for FDR certification and maintenance requirements by January 1998. In its July 10, 1998, safety recommendation letter regarding the Fine Air accident, the Safety Board classified Safety Recommendation A-97-30 “Open—Unacceptable Response,” pending completion of the proposed AC. In its July 10, 1998, safety recommendation letter, the Safety Board also issued Safety Recommendations A-98-53 through -56. Safety Recommendation A-98-53, which superseded Safety Recommendation A-97-29, asked the FAA to do the following: Require an immediate readout of all 11-parameter retrofitted…flight data recorders (FDR) to ensure that all mandatory parameters are being recorded properly; that the FDR system documentation is in compliance with the range, accuracy, resolution, and recording interval specified in 14 CFR Part 121, Appendix B; and require that the readout be retained with each airplane’s records. In response to Safety Recommendation A-98-53, the FAA indicated that it would complete a survey of all FDR-equipped airplanes (not just those with 11-parameter retrofitted FDRs) by February 2001. However, as of June 2003, the FAA had not initiated this survey, and the gradual implementation of new FDR system upgrade rules in the interim has increased the scope of the survey significantly.57 Because the FAA’s response did not satisfy the intent of the recommendation (which, in part, was to ensure that FDRs were being properly retrofitted and that the retrofitted equipment was recording parameters properly), the Safety Board classified Safety Recommendation A-98-53 “Open—Unacceptable Response” on March 12, 2001. The Safety Board has received no correspondence from the FAA regarding Safety Recommendation A-98-53 since its March 12, 2001, classification. 57 Implementation of the 1997 rule for Section 121.344 required upgraded parameters for all aircraft by August 18, 2001.

Factual Information 37 Aircraft Accident Report Safety Recommendation A-98-54 asked the FAA to do the following: Require maintenance checks for all…flight data recorders (FDR) of aircraft operated under…14 CFR Parts 121, 129, 125, and 135 every 12 months or after any maintenance affecting the performance of the FDR system, until the effectiveness of the proposed advisory circular and new FAA inspector guidance on continuing FDR airworthiness (maintenance and inspections) is proven; further, these checks should require air carriers to attach to the maintenance job card records a computer printout, or equivalent document, showing recorded data, verifying that the parameters were functioning properly during the FDR maintenance check and require that this document be part of the permanent reporting and recordkeeping maintenance system. On October 5, 1999, the FAA issued AC 20-141, “Airworthiness and Operational Approval of Digital Flight Data Recorder Systems,” which addressed design, installation, and continued airworthiness of FDR systems. AC 20-141 instructs operators to “establish a schedule for accomplishing an operational and functional [FDR] ground check at intervals not to exceed 12 calendar months.” As previously mentioned, the FAA indicated that it would conduct a survey of all FDR-equipped airplanes by February 2001. In part, this survey was intended to determine the effectiveness of AC 20-141 and whether any changes were needed. Pending the results of the FAA’s survey, on March 12, 2001, the Safety Board classified Safety Recommendation A-98-54 “Open—Acceptable Response.” There has been no further correspondence from the FAA regarding Safety Recommendation A-98-54. Safety Recommendation A-98-55 asked the FAA to do the following: Provide FAA principal avionics inspectors with training that addresses the unique and complex characteristics of flight data recorder systems. In response to Safety Recommendation A-98-55, the FAA developed a training course in evaluating the certification and maintenance of FDRs for all FAA PAIs. The implementation of this course began in October 2000. The curriculum addresses FDR regulatory requirements, flight recorder systems specifications, certification records and documentation, maintenance program requirements, and maintenance program data analysis. The course is intended to help PAIs determine whether FDR systems comply with the FAR requirements and evaluate an operator's FDR maintenance/inspection and training program. The course should train PAIs to identify whether FDR recorded values are within required specifications and to evaluate the reasonableness and quality of the recorded data.58 On March 12, 2001, the Safety Board classified Safety Recommendation A-98-55 “Open—Acceptable Response,” pending the completion of this training by all of the FAA’s PAIs. 58 According to the FAA, as of May 8, 2003, all active FAA PAIs had completed the required training; three non-active PAIs had not completed the FAA’s training because of other commitments.

Factual Information 38 Aircraft Accident Report Safety Recommendation A-98-56 asked the FAA to do the following: Create a national certification team of flight data recorder (FDR) system specialists to approve all supplemental type certificate changes to FDR systems. In response to Safety Recommendation A-98-56, the FAA trained a team of electrical systems engineers and avionics inspectors to approve all STC changes to FDR systems and to determine if the modified FDR installations would record the required FDR parameters effectively. As a result of the FAA’s actions, on January 11, 2000, Safety Recommendation A-98-56 was classified “Closed—Acceptable Action.” 1.12 Wreckage Recovery and Documentation The airplane wreckage was located in an automobile salvage yard about 1 mile east of MHR. The wreckage path was oriented approximately on a heading of 295 and was strewn over an area about 1,500 feet long by 450 feet wide. Examination of the wreckage revealed that the main fuselage was broken into several sections. Several pieces of airplane wreckage were located along the wreckage path to the southeast of the main wreckage, including the engines, engine components, nacelles, pylons, landing gear assemblies, flight control surfaces, sections of each wing, stabilizers, the tail cone, and numerous systems components. Portions of all major sections of the airplane were accounted for in the wreckage. However, significant portions of the airframe, its associated systems, and onboard cargo were severely damaged and/or consumed by fire. Continuity of the flight control cables and components, including those that control the elevator tabs, could not be established because of the breakup of the airplane and postaccident fire. The cockpit wreckage and portions of the fuselage nose section were located about 30 feet south of the center of the main wreckage and exhibited evidence of severe impact and fire damage, with much of the associated structure missing. Additional cockpit/forward fuselage components, including the control column torque tube, pitch trim compensator (PTC) motor and actuator, throttle quadrant, throttle handles, flap handle, spoiler handle, and thrust reverser levers, were located beneath a section of cockpit floor. The PTC actuator was found in its retracted position.59 The flap handle was found with its lever latched in the third detent aft of its stowed position, which corresponded to 15º of flap extension. The flap position gauge was recovered but was unreadable because of mechanical and fire damage. The spoiler handle was found in its retracted position, and the thrust reverser levers were found in their 59 The PTC system is installed to prevent the airplane’s tendency to nose-down while operating at higher Mach numbers. According to the system design, when the airplane is operating at low altitudes and airspeeds, such as during takeoff and landing, the PTC actuator is retracted and exerts no force on the control columns.

Factual Information 39 Aircraft Accident Report stowed positions. The landing gear lever was not recovered; however, CVR data and physical evidence indicate that the landing gear were extended throughout the accident flight. The left and right wings were fractured; portions of the wings were recovered separate from the fuselage and exhibited severe impact, heat, and fire damage. Portions of the left aileron and the flap surfaces and spoiler panels from both wings were found scattered throughout the debris. All four engines were recovered and examined; FDR data and engine damage were consistent with a high power setting at impact. There was no indication of any preimpact engine damage, fire, or uncontainment. The tail section wreckage was located aft of the rear fuselage. Portions of the vertical stabilizer rear spar were located adjacent to the tail structure. However, the remaining vertical stabilizer and rudder structures were not recovered and were presumed consumed by fire based on the presence of previously melted and resolidified aluminum adjacent to the tail section wreckage. The horizontal stabilizer center section and surrounding tail structure exhibited evidence of heat and fire damage. The horizontal stabilizer jackscrew and associated drive mechanisms exhibited severe heat damage. Both jackscrews were fully extended, corresponding to a full nose-down trim position. 1.12.1 Longitudinal Flight Control Surfaces The right horizontal stabilizer was recovered largely intact, whereas the right elevator was recovered in several pieces. The inboard section of the right elevator, with the control tab and the inboard 2 feet of the geared tab, remained mostly intact and attached to the stabilizer. The right elevator geared tab inboard crank arm, which connects the geared tab pushrod to the horizontal stabilizer, was manufactured of aluminum and was found fractured.60 Portions of the left horizontal stabilizer (about 75 percent, including the inboard portions of the left stabilizer, elevator, and control tab surfaces) were not recovered; because they were located in an area that was exposed to intense fire, they were presumed consumed by postcrash fire. The left elevator inboard geared tab crank arm was manufactured of aluminum and was found fractured, similar to the inboard geared tab crank arm on the right elevator. (Although the left and right geared tab outboard crank arms, which were manufactured of steel, exhibited severe twisting and other impact-related damage, they were recovered intact.) 1.12.1.1 Flight Control Connections at the Elevator Control Tabs The right elevator control tab crank fitting was found structurally intact and attached to the control tab inboard hinge fitting on the inboard section of the right elevator. 60 For additional information regarding fractured elevator geared tab crank arms, see section 1.16.1.3.

Factual Information 40 Aircraft Accident Report (See figure 2, in section 1.6.2, for a diagram of the elevator control tab installation.) The right control tab pushrod was recovered separately, with its aft rod end (which would normally have been bolted to the tab crank fitting) intact. Examination of the forward edges of the elevator control tab crank fitting lugs revealed evidence of repeated contact damage (including gouge marks and indentations). (Figure 9 is a photograph of damage to this area.) The internal surfaces of the pushrod aft rod end bearing and the bushings in the crank fitting lugs showed no visible signs of damage or deformation. The bolt and associated hardware that normally secures the right elevator control tab pushrod to the tab crank fitting61 was missing and not recovered. Although the inboard portions of the left elevator, control tab, crank fitting, and attachment hardware were not recovered and were presumed consumed by postcrash fire, the left elevator control tab pushrod was recovered. Unlike the right control tab pushrod, the left control tab pushrod’s aft rod end (normally attached to the tab crank fitting) was fractured and about 75 percent of it and its associated bearing were missing. The forward end of this pushrod was fractured at its rod end attachment holes, and the pushrod had about an approximately 90º bend at its midpoint. No fire damage was observed on the left control tab pushrod assembly. Figure 9. A photograph of the accident airplane’s right elevator control tab crank fitting. Note damage on forward face of control tab crank fitting lugs. 61 As previously stated, the hardware required to secure the elevator control tab pushrod to the tab crank fitting at this location includes a 5/16-inch drilled-shank alloy steel bolt, a washer, a steel castellated nut, and a cotter pin. The bolt has a rated shear strength of 7,300 pounds; if properly installed, the attachment hardware has a tensile strength of 3,250 pounds. The alloy steel hardware had a melting temperature of about 2,700º F, whereas the aluminum crank fitting and pushrod aft rod end had a melting temperature of about 1,000º F.

Factual Information 41 Aircraft Accident Report 1.13 Medical and Pathological Information 1.13.1 Flight Crew Information Tissue specimens from the captain, first officer, and flight engineer were sent to the FAA’s Civil Aerospace Medical Institute in Oklahoma City, Oklahoma, for examination. The specimens tested negative for all drugs of abuse,62 as well as prescription and over-the-counter medications. 1.13.2 Cargo Handlers—Postaccident Drug and Alcohol Testing The FARs do not require postaccident drug or alcohol testing of cargo handlers. The provisions of 14 CFR Part 121, Appendix I, titled “Drug Testing Program,” state the following: Each employer shall test each employee who performs a safety-sensitive function for the presence of marijuana, cocaine, opiates, phencyclidine (PCP), and amphetamines, or a metabolite of those drugs in the employee’s system if that employee’s performance either contributed to an accident or can not be completely discounted as a contributing factor to the accident. The employee shall be tested as soon as possible but not later than 32 hours after the accident. The decision not to administer a test under this section must be based on a determination, using the best information available at the time of the determination, that the employee’s performance could not have contributed to the accident. Additionally, the provisions of 14 CFR Part 121, Appendix J, titled “Alcohol Misuse Prevention Program,” state the following: As soon as practicable following an accident, each employer shall test each surviving covered employee for alcohol if that employee's performance of a safety-sensitive function either contributed to the accident or cannot be completely discounted as a contributing factor to the accident. The decision not to administer a test under this section shall be based on the employer’s determination, using the best available information at the time of the determination, that the covered employee's performance could not have contributed to the accident. If a test required by this section is not administered within 2 hours following the accident, the employer shall prepare and maintain on file a record stating the reasons the test was not promptly administered. If a test required by this section is not administered within 8 hours following the accident, the employer shall cease attempts to administer an alcohol test and shall prepare and maintain the same record. Records shall be submitted to the FAA upon request of the Administrator or his or her designee. 62 The five drugs of abuse for which specimens are tested in postaccident analysis are marijuana, cocaine, opiates, phencyclidine, and amphetamines.

Factual Information 42 Aircraft Accident Report Appendixes I and J specify “safety-sensitive” functions to which the postaccident drug and alcohol testing requirements apply. These functions include the duties of flight crewmembers, flight attendants, flight instructors, aircraft dispatchers, aircraft maintenance or preventive maintenance personnel, ground security coordinators, aviation screeners, and air traffic controllers. Cargo handler duties are not included under “safety-sensitive” functions, nor are load planners or ramp supervisors.63 Although testing was not required, voluntary drug tests were conducted on eight cargo handlers, the load planner, and the ramp supervisor who were involved with the cargo loaded on the accident airplane; all tests were conducted between February 17 and February 22, 2000. The load planner tested positive for amphetamines and was relieved of duties on February 25. A cargo handler who was tested on February 22 tested positive for amphetamines and cocaine metabolites and was relieved of duties on March 2, 2000. 1.14 Fire/Explosion A fuel-fed fire occurred after impact. 1.15 Survival Aspects The airplane was destroyed by impact and postimpact fire. According to the Sacramento County Coroner’s Office, the captain and flight engineer died as a result of thermal and traumatic injuries, and the first officer died of thermal injuries and inhalation of combustion products. 1.16 Tests and Research 1.16.1 DC-8 Elevator Flight Control Tests Using an Emery DC-8-71F that was equipped and had been operated similarly to the accident airplane, the Safety Board conducted tests to document the deflections of the test airplane’s elevator, control columns, and control tabs (with the right elevator control tab disconnected from its pushrod) while the elevators were moved to duplicate a range of travel consistent with that recorded by the FDR from the accident airplane. The Board also conducted tests to determine the test airplane’s EPI indication during elevator checks before taxi, during taxi, and at 80 knots during a simulated takeoff roll to identify what a flight crew might see at various elevator deflections under normal conditions. 63 The Safety Board notes that on May 8, 2003, the FAA proposed rulemaking that would broaden its existing regulations regarding hazardous materials training by requiring such training for all personnel who might be involved in the handling of hazardous materials; this proposal reinforces the safety-sensitive nature of these functions.

Factual Information 43 Aircraft Accident Report During these tests, the Safety Board also examined the fractured geared tab crank arms and surrounding test airplane structure to determine whether the fractures might have occurred before the accident. For additional information regarding the geared tab crank arm fractures, see section 1.16.1.3. For information regarding other tests conducted, see Airworthiness Group Chairman’s Factual Report, dated February 28, 2002, in the docket for this accident. 1.16.1.1 Disconnected Elevator Control Tab/Interference Tests After the test airplane’s baseline deflections were measured, investigators removed the right elevator control tab aft pushrod attachment bolt from its crank fitting. With no additional manual input, the right elevator control tab moved to a 29º TED deflection, where it contacted the geared tab linkage fairing. With this control tab movement, the aft end of the pushrod moved free of the crank fitting. When the aft end of the test airplane’s pushrod cleared the crank fitting, it shifted slightly inboard so that it was aligned with the inboard leg of the forward face of the crank fitting. When the test airplane’s control tab was manually raised TEU (simulating the effects of aerodynamic forces that would be experienced during the takeoff roll), the crank fitting contacted the aft rod end, obstructing any attempt to further deflect the elevator control tab in the TEU direction. Figure 10 shows the test airplane’s pushrod in this position. Figure 10. Photograph of the test airplane’s right elevator control tab pushrod contacting the crank fitting.

Factual Information 44 Aircraft Accident Report When the test airplane’s elevator surfaces were manually moved to their TEU limit (about 27º TEU) in this condition, the control columns moved aft from 15.0º forward of vertical (the position in which they were held by the centering device) to about 8.8º forward of vertical, and both elevator geared tabs moved to 27.5º TED. The left elevator control tab deflected fully to about 8.5º TEU; however, the right elevator control tab could not be moved further in the TEU direction than 15.9º TED because of interference with the disconnected pushrod. The test airplane’s elevator surfaces were then moved manually to various TEU deflections (simulating the range of elevator travel that occurred during the accident flight), and measurements were taken to document the right and left elevator control tab deflections and control column positions at those elevator deflections. Based on the Safety Board’s test and measurements, an average mismatch of 25º was noted between the left and right elevator control tabs (or about 8 inches of vertical separation if measured at the trailing edge), with TEU movement of the right elevator control tab restricted by contact between the pushrod and the crank fitting. This mismatch between the left and right elevator control tab positions existed regardless of elevator or control column position. Because a free elevator control tab pushrod might not necessarily always displace itself inboard into alignment with the crank fitting as it did on the test airplane (especially if the pushrod is disconnected while the airplane is in flight and aerodynamic forces are acting on the flight control surfaces), the Safety Board examined other potential interference modes between a free elevator control tab pushrod and crank fitting. These tests revealed that in general, contact between a free pushrod and the forward face of either crank fitting lug (accounting for rod end misalignment, etc.) resulted in a mismatch of approximately 25º between the left and right control tabs. These tests also revealed that a disconnected control tab could be rotated about 3º to 4º in the TEU direction if the crank fitting remained centered about the pushrod; however, further movement was restricted by contact between the crank fitting and shoulders of the aft end of the pushrod. Figure 11 is a photograph of the test airplane’s control tab in this position.

Factual Information 45 Aircraft Accident Report Figure 11. Photograph of the test airplane’s disconnected right elevator control tab pushrod centered between the lugs of the crank fitting with the control tab rotated 3º to 4º in the TEU direction after the attachment bolt was removed. 1.16.1.2 EPI Indication Checks The Safety Board also conducted tests to document the test airplane’s elevator movements and the corresponding EPI indications during the 80-knot elevator check during a simulated takeoff roll.64 During the 80-knot elevator check, the horizontal stabilizer trim was set to approximate the accident airplane’s trim setting for takeoff. When the test airplane accelerated to 80 knots, the right seat pilot (provided by Emery) moved the control column to its maximum forward position; the EPI needle immediately deflected to a position about 45 percent of the distance between the neutral and nose-down index marks, corresponding to about 10º of TED elevator travel. The pilot then relaxed the forward pressure on the control column and rejected the takeoff. A review of the data recorded by the test airplane’s FDR during this test confirmed an elevator deflection of about 10º. 64 The EPI on the test airplane was located on the lower left side of the first officer’s instrument panel, like that on the accident airplane. During these tests, the Safety Board noted that the EPI installed on the ground test airplane was not accurately calibrated such that when full down elevator was applied, the EPI needle moved about 75 percent of the distance between the neutral and nose-down marks.

Factual Information 46 Aircraft Accident Report 1.16.1.3 DC-8 Elevator Geared Tab Crank Arm Fractures As a result of several elevator jam events in which the jams were caused by interference from a fractured geared tab crank arm, in April 1977, Douglas issued Alert Service Bulletin (ASB) 27-262, titled “Flight Controls—Elevator and Tab—Inspect Elevator Geared Tab Mechanism and Gust Lock Crank Assembly.” The ASB advised all DC-8 operators of an aborted takeoff incident that resulted from the failure of the elevator geared tab pushrods (inboard and outboard) and recommended that the elevator gust lock be engaged at all times when the airplane is parked to prevent elevator damage caused by high/gusting winds and/or jet blast. In July 1977, Douglas issued SB 27-262, titled “Flight Controls—Elevator and Tab Modify Elevator Geared Tab Mechanism,” which indicated that “replacing the existing aluminum geared tab crank assemblies with forged stainless steel crank assemblies and improving the crank assembly clearance will minimize the possibility of crank failure when the aircraft is parked in high gusty wind.” Subsequently, the FAA issued AD 78-01-15 (effective June 1, 1978), which required, in part, all DC-8 operators to modify the clearances in the elevator geared tab crank assembly in accordance with Douglas SB 27-262 and to inspect and replace fractured geared tab crank arms; however, it did not require DC-8 operators to replace all existing aluminum crank assemblies with stainless steel crank assemblies. The Safety Board’s review of DC-8 elevator-related service difficulty reports (SDR) submitted to the FAA during the 5 years preceding the Emery flight 17 accident revealed six SDRs involving fractured elevator geared tab crank arms. One of these was detected during an elevator ground check, one was detected in flight, and four were detected during elevator checks during the takeoff roll, resulting in aborted takeoffs. (Although the SDRs did not always reference an EPI gauge, it is likely that all airplanes involved were equipped with EPIs because AD 78-01-15 required DC-8 operators to install an EPI system within 18 months of the AD’s June 1978 issuance unless an EPI had already been installed in accordance with SB 27-254.) Additionally, the Safety Board investigated a December 12, 2002, aborted takeoff event involving a Tampa Airlines DC-8-71F that did not rotate/lift off normally during the takeoff roll.65 According to Tampa Airlines personnel, the pilots performed an 80-knot elevator/EPI check and observed that the EPI did not respond to the control column. The pilots indicated that they aborted the takeoff when the airplane failed to rotate normally once it reached rotation speed. Subsequent examination revealed that the elevator jammed because the inboard and outboard aluminum crank arm assemblies on the left geared tab had fractured (which Tampa Airlines personnel believed to be the result of jet blast from a DC-10 while the DC-8 was waiting to takeoff). 65 This anomalous behavior is consistent with an elevator jam/restriction in a position near or below neutral.

Factual Information 47 Aircraft Accident Report Because the Emery accident airplane’s elevator geared tab inboard crank arms were found fractured and because interference from such a fracture could have resulted in restricted movement of the elevators, the Safety Board evaluated the fractures on the recovered right elevator geared tab inboard crank arm from the accident airplane relative to the surrounding structure on a test airplane to determine the possible effects of various interference modes. Investigators installed the forward end of the accident airplane’s fractured right elevator geared tab crank arm to the link assembly on the horizontal stabilizer rear spar on the test airplane. Tests on this airplane and further examination of the accident airplane wreckage revealed no evidence of damage on the horizontal stabilizer or the right geared tab crank arm itself that was consistent with any observed interference position. 1.16.2 Airplane Performance Studies 1.16.2.1 Center of Gravity Calculations Because the Emery flight 17 accident involved a nose-up pitch anomaly,66 the Safety Board conducted an airplane performance study to evaluate whether an aft c.g. problem was involved in the accident. The Safety Board extracted the aerodynamic forces and moments that acted on the airplane to produce the recorded aircraft motion then used the pitching moment and lift to calculate the accident airplane’s pitch stability, which can be related directly to c.g. The study concluded that the basic stability of the aircraft during the accident flight was consistent with a c.g. within the c.g. limits.67 The study also found that the airplane’s motion was consistent with elevators in a highly deflected nose-up position. 1.16.2.2 Elevator Control Tab Deflection Study Although the FDR recorded the elevator position, it did not record the left and right elevator control tab positions. Therefore, the Safety Board conducted an airplane performance study (assuming a disconnected right control tab) to determine which position(s) of the right68 control tab would match the elevator positions and airplane motions recorded during the accident flight. To determine the left elevator control tab’s position during the accident flight, investigators used the recorded control column and elevator position data and the known relationship between the control tab, the control column, and the elevator on a properly functioning system. 66 Potential indications of an aft c.g. problem included the first officer’s statement, recorded by the CVR almost immediately after takeoff, that the airplane’s c.g. was “way out of limits” and FDR data showing excessive nose-up pitching and unusual elevator positions. 67 Further, the Safety Board’s review of the loading reports and dispatch records for the accident flight, examination of the airplane wreckage, and postaccident statements from cargo loading personnel revealed no evidence indicating that the airplane was improperly loaded or that a c.g. shift occurred. 68 The performance study could not differentiate between failures of the right or left control tab. However, a disconnected right elevator control tab was assumed because physical evidence (for example, the missing aft pushrod attachment bolt at impact) indicated that the accident airplane’s right elevator control tab linkage was disconnected.

Factual Information 48 Aircraft Accident Report The results of this portion of the performance study were consistent with a left elevator control tab at or near its TEU stop throughout the accident flight. The performance study further indicated that the right control tab position required to match the recorded elevator position and airplane motion with a left control tab deflected fully TEU was about 17º TED to 25º TED. The results of the study were consistent with a 25º to 33º difference between the left and right control tab positions when the left control tab was at its TEU stop. As previously discussed, physical testing with a fully functioning and responsive left control tab and a disconnected right control tab, with movement restricted by contact with the free end of the control tab pushrod (see figure 10), showed a differential between the left and right control tabs of about 25º at all control column positions. The results of the performance study were consistent with a large split between the left and right control tabs, which is consistent with the physical evidence. 1.16.2.3 Control Column and Elevator Position Data The FDR data showed that the control columns were positioned forward of their neutral position throughout most of the accident flight, and the airplane performance study showed that the flight crew maintained a forward force on the control column throughout the accident flight. The performance study also indicated that the left control tab was at its TEU physical stop throughout most of the accident flight. After the control column moved forward to the point where the left control tab’s TEU stop was reached, the pilots could force the control columns further forward because of cable stretch; however, no additional nose-down elevator input would result. Figure 12 shows the control column position required for the left elevator control tab to reach its TEU physical stop (with no cable stretch) and the recorded control column position for the recorded elevator position during the accident flight. The plot indicates that at most points during the accident flight, the flight crew was trying to command additional forward control column. The Safety Board’s examination of the FDR data for the flights preceding the accident flight revealed that a change in the relationship of control column movement to elevator response occurred about 8 minutes and 20 seconds before the accident airplane landed at MHR. The Board’s performance study derived the control tab positions at the time of this change. The study showed that the change in FDR data could be explained by a shift of about 3º to 4º in the TEU direction of the right control tab, assuming that the right control tab’s pushrod to crank fitting attachment bolt separated at this time. This change in the FDR data was evident until the airplane landed at MHR. As previously discussed, a scenario in which a disconnected pushrod remained between the lugs of the aft crank fitting (shown in figure 11) resulted in a 3º to 4º control tab shift in the TEU direction.

Factual Information 49 Aircraft Accident Report Figure 12. The control column position required for the left elevator control tab to reach its TEU physical stop (for the recorded elevator position) and the actual recorded control column position for the accident flight. The study also showed that the stabilizer moved in an ANU direction at the same time that the pilot pushed the control column forward to resume the descent after a brief period of level flight at 10,000 feet. The direction of this stabilizer movement was opposite that which would be expected when the pilot provided a forward control column input. The study showed that the slight ANU stabilizer shift balanced the effect of the change in the relationship between the recorded elevator and control column movements and that the elevator remained responsive to pilot input. Figure 13 shows plots of the control column and elevator for the accident takeoff roll and the previous takeoff roll (from RNO).

Factual Information 50 Aircraft Accident Report Figure 13. Plots of the control column and corrected elevator position recorded by the accident FDR during the accident takeoff roll and the previous takeoff roll (from RNO). 1.17 Operational and Management Information 1.17.1 Emery Worldwide Airlines, Inc. Emery received its initial air carrier certification in May 1987 under the name of Air Train, Inc. When Emery began operating, its corporate offices were located in Redwood City, California, and its hub operations were located at DAY. In January 1990, the company name was changed to Emery Worldwide Airlines, Inc. Emery held air carrier certificate number RRXA558B and was authorized to conduct operations in accordance with 14 CFR Part 121, as a domestic and international airfreight carrier. Emery relocated its corporate offices from Redwood City to DAY in 1990. However, the FAA oversight responsibility for the airline remained with the San Jose Flight Standards District Office (FSDO) until December 1999, when Emery’s certificate was transferred to the FSDO in Cincinnati, Ohio. At the time of the accident, Emery operated 43 DC-8 and 2 DC-10 freighters, with most of its airplanes based at its main hub and corporate headquarters at DAY. The FAA’s August 13, 2001, news release indicated that in January 2000, about a month before the accident, the FAA placed Emery under a “heightened state of oversight”

Factual Information 51 Aircraft Accident Report because several inspectors reported observing numerous apparent violations of the FARs. After more than 1 1/2 years under this heightened oversight, on August 13, 2001, Emery signed an interim agreement with the FAA stating that it would immediately cease operating until it satisfactorily resolved the safety issues identified by the FAA during a series of inspections.69 According to the FAA’s news release regarding the interim agreement: Emery…has been under a heightened state of oversight by the FAA since January 2000. The FAA has conducted several special inspections of the airline, most recently in May and June. Those inspections uncovered more than 100 apparent violations of the Federal Aviation Regulations, including: • Improper/inadequate repairs to mechanical irregularities, including numerous repetitive pilot write-ups of the same problem on the same aircraft over extended time periods; • Unapproved aircraft installations/alterations; • Operating unairworthy aircraft; • Not following the policies and procedures in their manuals; • Inadequate record keeping; • Failure to distribute and use current manuals. The interim agreement indicated that a final settlement agreement must be signed within 30 days of the interim agreement. On September 17, 18, and 19, 2001, Emery and FAA representatives signed the final settlement agreement, stating that both parties would “use their best efforts…to conclude the process described [in the agreement—including disposition of aircraft and other assets, etc.], on an expedited basis.” However, Emery and FAA representatives subsequently signed an amendment (dated December 4, 2001) to the final settlement agreement, which indicated that Emery had informed the FAA that it did not wish to resume commercial air carrier flight operations and that it intended to dispose of its airplanes. On December 4, 2002, in accordance with the December 2001 agreement, Emery returned its operating certificate to the FAA. 1.17.1.1 Emery’s MMs and Practices Emery’s continuous airworthiness maintenance program was governed by a series of manuals, including the maintenance policy and procedures manual (MPPM), the reliability program manual, the inspection program manual, the time limits manual, maintenance manuals from the airplane’s former operators, the manufacturer’s maintenance manual, the structural repair manual, original equipment manufacturer manuals, the fueling manual, the minimum equipment list (MEL) manual, FAA-approved STCs, the airplane flight manual, and the airplanes’ weight and balance documentation.70 69 For additional information regarding the FAA’s inspections of Emery, see section 1.17.3.1.

Factual Information 52 Aircraft Accident Report More than 300 full-time mechanics who worked at various Emery facilities at the time of the accident performed airplane transit, terminating, service, and B inspections. Emery used contract repair facilities (including TTS) for heavy maintenance (C and D inspections) and major alterations of airframes, aircraft engines, and other components. A list of approved overhaul and repair facilities was contained in Emery’s MPPM.71 1.17.1.2 Operational Guidance Regarding the DC-8 Elevator 1.17.1.2.1 Emery’s DC-8 Preflight Inspection Procedures Emery’s DC-8 Aircraft Operating Manual (AOM), “Normal Operations,” stated, in part, the following regarding the flight engineer’s preflight inspection:72 Initial exterior inspection, elevators and tabs – with gust lock on Elevators…………………………………………………………CHECK Ensure elevators locked in faired position (gust lock on). If the gust lock is not on, contact maintenance for possible inspection requirement. Initial pilots’ station preflight Gust lock………………………………………………………………OFF Exterior preflight, elevators and tabs [Left and right side] elevators…………..TAB ALIGNMENT AND CONDITION With gust lock off, elevator should be up, control tabs up, and geared tabs down. 70 Title 14 CFR Part 121.369(b), states, in part, “the certificate holder’s manual must contain the programs required by §121.367 that must be followed in performing maintenance, preventive maintenance, and alterations of that certificate holder’s airplanes, including airframes, aircraft engines, propellers, appliances, emergency equipment, and parts thereof and must include the following…a designation of the items of maintenance and alteration that must be inspected (required inspections), including at least those that could result in a failure, malfunction, or defect endangering the safe operation of the aircraft, if not performed properly or if improper parts or materials are used… [and] procedures to ensure that all required inspections are performed.” 71 According to Section 121.363, “Responsibility for airworthiness:” (a) Each certificate holder is primarily responsible for – (1) The airworthiness of its aircraft, including airframes, aircraft engines, propellers, appliances, and parts thereof; and (2) The performance of the maintenance, preventive maintenance, and alteration of its aircraft, including airframes, aircraft engines, propellers, appliances, and parts thereof, in accordance with its manual and the regulations of this chapter. (b) A certificate holder may make arrangements with another person for the performance of any mainte- nance, preventive maintenance, and alterations. However, this does not relieve the certificate holder of the responsibility specified in paragraph (a) of this section.

Factual Information 53 Aircraft Accident Report Horizontal stabilizer and elevator………………………………………..CHECK Check between trailing edge of stabilizer and elevator for foreign objects, ice or snow. Check all access plates for security. Check condition of static dischargers. 1.17.1.2.2 Emery’s DC-8 Flight Control Operational Checks Emery’s DC-8 AOM section titled “Ground Operations, Taxi Procedures,” dated November 15, 1995, contained the following guidance regarding elevator checks: After the ailerons and rudder are checked, the captain and the first officer will check the elevator together. It is important that both pilots exert pressure on their yokes [control columns] to prevent excessive stress on either yoke. The normal indication of the [EPI] when the gust lock is off shows the elevator full nose up. If there is a strong headwind or a substantial amount of power is coming from the engines, [the EPI] may indicate a position between full nose up and neutral. To check the elevator, both pilots will push forward on their respective yokes until they reach the forward stop. This will require a substantial force, especially if there is a tailwind. The first officer should monitor the EPI during the check. When the yokes are full forward, expect to see the EPI indicate between neutral and very slightly nose up. Then both pilots should pull the yokes to the aft stop; expect to see the EPI move to full nose up. Additionally, in its section titled “Normal Operations, Taxi Checklist,” dated October 25, 1999, Emery’s DC-8 AOM stated the following: Check control freedom about all three axes. Aileron and rudder reversion light should remain off during the check. When checking the ailerons, check for spoiler pressure drop indicating spoiler operation. The first officer should call out “EPI checks” after the elevator check. Further, the Emery DC-8 AOM section titled “Normal Operation, Flight Control System, Elevator—Elevator Position Indicator Operative—Captain and First Officer (Perform Check Together),” dated May 1, 1989, stated the following: • Ensure that gust lock is disengaged. Disengagement of the gust lock should cause the following: A. The elevators will move to command aircraft nose-up condition (trailing edge up), due to their static balance characteristics. B. The elevator control tabs will have trailing edge up. C. The…control column moves slightly aft. 72 Postaccident interviews confirmed that the flight engineer conducted at least one preflight walkaround inspection of the airplane. The Safety Board reviewed the CVR and FDR information to further document the preflight inspections; however, such documentation was not possible because electrical power to the recorders was interrupted for about 50 of the more than 60 minutes that the airplane was parked on the ramp at MHR.

Factual Information 54 Aircraft Accident Report D. The elevator position indicator should move to the “UP” mark. • Pull control column aft until it reaches full travel against the [aft] stop. The [EPI] needle will remain pointing to the UP mark. The elevator control tabs will move to command aircraft nose up condition (trailing edge down). The force required to position the control column aft will be relatively light, since the elevators already have their trailing edge up and only the control tabs are being deflected. Variations of required force may, however, be expected, contingent upon wind conditions. • Push control column forward until it reaches full travel against [the forward] stop. Barring unusual wind conditions, the force required on the control column is initially light while only the control tabs are being deflected to command aircraft nose-down condition (tabs trailing edge up). The control tabs having reached their full throw, a substantial increase in required force to move the control column can be noted as the elevator itself deflects to a trailing edge down condition.[73] The elevator position indicator needle should now point between the [neutral] mark and the [down] mark. Movement of the elevator’s trailing edge to the full down position is not possible. Therefore, the position indicator needle will not reach the [down] mark. Freedom of the elevator to move is established by the indicator needle moving from the UP mark to a position just more than half-way between the [neutral] mark and the [down] mark. NOTE: If tailwinds prevail during control check and no elevator movement is indicated, turn the aircraft into the wind and repeat this procedure. Emery’s DC-8 AOM section titled “Takeoff, General, Takeoff Roll,” dated November 11, 1995, contained the following guidance regarding the 80-knot elevator check: Between 80 and 100 knots, the pilot flying shall exert a forward pressure on the elevator to the stop and then release the yoke to slightly forward of neutral. The crew should confirm a nose down response. Depending on weight and loading, the pilot flying may need to apply the nose down elevator more than once to get a satisfactory response. Once the check is complete the pilot flying should state, “Elevator checks.” The first officer looks for the EPI to respond to yoke movement when the elevator check is made. The captain must know the elevator is working properly early in the takeoff roll. If he is in doubt, he should consider aborting the takeoff. 73 During the Safety Board’s public hearing on this accident, the chief pilot for Boeing’s Douglas Product Division stated that forces up to about 100 pounds could be required to move the control column as specified during this check.

Factual Information 55 Aircraft Accident Report In addition, this section of the DC-8 AOM contained a table titled “Takeoff Roll— Callouts or Duties of Flight Crew” that included the following guidance regarding pilot duties during and after the 80-knot check: Table 2. Takeoff Roll—Callouts or Duties of Flight Crew (from DC-8 Aircraft Operating Manual). 1.17.1.3 Manufacturer’s Guidance Regarding Flight Control Operational Checks As previously mentioned, on March 5, 1975, Douglas issued SB 27-254, titled “Flight Controls – Elevator and Tabs – Install Position Indicator,” which recommended that operators install an EPI and associated transmitters and circuitry in their DC-8s to help flight crews detect restricted elevator movement. Douglas indicated that the SB was issued because of two instances of insufficient or abnormal elevator travel that were discovered by flight crews during preflight checks.74 SB 27-254 instructed DC-8 operators to install the EPI on the first officer’s instrument panel, in a location selected by the operator, such that the first officer’s view of the indicator was not obstructed by the full forward position of the control column. Another Douglas ASB (SB A27-264, issued on May 14, 1977) stated “Douglas is of the opinion that had [SB] 27-254…been accomplished on the aircraft involved, flight crews would have determined that the elevator surfaces were not moving normally. Therefore, Douglas strongly recommends prompt incorporation of DC-8 [SB] 27-254.” With regard to flight control checks, the SB stated the following: If it is not possible to check the elevator control with the aircraft turned into the wind, an optional procedure can be used during the initial takeoff roll (60 – 80 knots) by checking the response of the aircraft in relation to small up and down elevator inputs. The optional procedure should not be used when the takeoff is made on wet or icy runways or when moderate crosswind conditions exist. Incorporation of SB 27-254 constitutes terminating action for this alert Service Bulletin. Captain First Officer Pilot Not Flying Pilot Flying At 80 [knots indicated airspeed] Watch for nose strut compression. Watch EPI during the elevator check.

1. Callout “80

knots”

1. Callout “80 here”
2. Push forward on the

yoke

1. Callout “elevator

checks” 74 The SB was also partially responsive to Safety Recommendation A-70-54, which the Safety Board issued on October 28, 1970, as a result of the September 8, 1970, accident involving a Trans International Airlines Corporation DC-8-63, which crashed during takeoff from John F. Kennedy International Airport. See section 1.6.2.2 for further discussion of this accident.

Factual Information 56 Aircraft Accident Report Subsequently, the FAA issued AD 78-01-15 (effective June 1, 1978), which required all DC-8 operators to install an EPI system in accordance with Douglas SB 27-254. On June 4, 2001, as a result of the Emery flight 17 accident, Boeing issued a FOB, restating the recommendations contained in the DC-8 AOM and SB A27-264 for the elevator portion of the preflight control check. Specifically, the FOB stated the following: The proper functioning of the flight controls should be verified before every flight. If the exterior walk-around is made with the gust lock engaged, the flight crew should verify that the elevators and the tabs are faired, and that the Elevator Position Indicator (EPI) indicates in the white neutral band. If the check is made with the gust lock released, the elevators and control tabs should be positioned toward UP (symmetrically) and the geared tabs DOWN (again symmetrically). Then, during the flight control rollout check elevator function should be verified by first applying full up elevator and confirming that the needle on the EPI moves in the UP direction; followed by full down elevator to the [control] column mechanical stop and verifying that the needle moves through the faired position to a point below the white band. Because the elevator system’s viscous dampers resist rapid surface movement, flight crews should be aware that rapid application of full forward [control] column, followed by an immediate release, is not an effective check in that the [control] column release will interrupt elevator travel well short of its limit travel. Also, since the forces on the [control] column during these checks are high, Boeing recommends that a downward (forward) force be applied to both columns by both pilots simultaneously. Service Bulletin A27-264 (issued May 14, 1977 and mandated by AD 78-01-15), and “Know your DC-8” letter No. 53A, issued on May 25, 1977, state that if the [elevator control] checks cannot be made into the wind such that satisfactory elevator movement is verified, an optional procedure to check for airplane response to small up and down elevator movements during initial takeoff roll (60-80 knots) was allowed. Upon reviewing this procedure with the FAA, Boeing has determined that although the pitch response may still be useful as a check for weight distribution, it is not a valid substitute for a properly conducted flight control check as described above. Boeing no longer recommends it as an alternative to the rollout check. Operators who wish to continue the 60-80 knot check may do so, but are advised that the only acceptable alternative to a satisfactory flight control check is a positive visual check.[75] 1.17.1.4 Emery’s Postaccident Fleetwide Campaign Directive After discussions with Safety Board investigators, on March 16, 2001, Emery issued FCD A27-8, titled “Elevator Push/Pull Rod End Bolt Installation Inspection,” to ensure that on each of the 29 DC-8s Emery operated at the time, the elevator control tab pushrods were properly installed and secured at the crank fitting with a bolt, washer, nut, and cotter pin. The FCD also called for inspections of Emery’s DC-8 fleet for damage to 75 According to ASB A27-264, subpart E, this alternative was only acceptable on airplanes on which the EPI was inoperative.

Factual Information 57 Aircraft Accident Report the pushrod and orientation of the bolt used to attach the aft end of the pushrod to the control tab crank fitting. On March 22, 2001, Emery issued FCD A27-8, Revision 1, titled “Elevator Push/Pull Rod End Bolt Installation Inspection and Clearance Check,” which was required to be accomplished on the Emery DC-8 fleet no later than April 12, 2001. Revision 1 to FCD A27-8 changed the part number of the bolt and corrected a figure. It also added a parts list and extended the time limit to accomplish the FCD by 10 days. The title was also changed to reflect the clearance check not incorporated into FCD A27-8. The findings from the inspections that followed the issuance of FCD A27-8 indicated that the attachment hardware, including cotter pins, were installed at the forward and aft ends of each control tab pushrod on each airplane in Emery’s DC-8 fleet. Although orientation of the pushrod attachment bolts was not consistent across Emery’s fleet or from one side to the other on some airplanes, the manufacturer has indicated that orientation of the bolt is not critical if the bolt is properly installed and secured. One control tab pushrod was found installed incorrectly, and three control tab pushrods were replaced because of wear and/or suspected damage. 1.17.2 Tennessee Technical Services TTS, located in Smyrna, Tennessee, has been an FAA-approved 14 CFR Part 145 Repair Station since May 29, 1998, when it was issued Air Agency Certificate number T64R1640. TTS’s certificate was reissued on January 26, 2000, with the following limited ratings: airframe, powerplant, accessories, radio, instrument, non-destructive testing, and specialized services. This certificate allowed TTS to perform inspections, maintenance, modifications, and alterations on several airplane models, including DC-8-50/-60/-70 airplanes. TTS’s certificate stated that all work was to be accomplished in accordance with the customer’s 14 CFR Part 121 requirements for continuous airworthiness per 14 CFR Section 145.2, the manufacturer’s current technical data, or other data acceptable to the FAA administrator. In October 1998, upon successful completion of an Emery audit, TTS was added to Emery’s list of approved repair stations/vendors. TTS performed a variety of services for Emery, including heavy maintenance, special maintenance services (such as lighter maintenance [B] inspections, off-site maintenance assistance with ramp checks and ramp damage, and short- and long-term airplane storage), and off-base maintenance support for Emery. At the time of the Safety Board’s review of TTS facilities in 2001, TTS operated from a hangar that would accommodate four DC-8 airplanes and from another building in which it overhauled various components. Examination of TTS records indicated that from the time the company began operating as a repair station until March 1, 2001, TTS had performed maintenance on 173 airplanes, including many of Emery’s airplanes (TTS records contained 99 invoices for Emery airplanes). At the time of the accident, TTS employed about 91 certificated mechanics and 3 repairmen. Emery had designated 20 TTS inspectors to work on its airplanes.76 TTS

Factual Information 58 Aircraft Accident Report was awarded the FAA’s “Diamond Certificate of Excellence Award” in 1998, 1999, 2000, and 2001, for actively participating in the FAA Aviation Technician Training Program.77 The Board’s review of the training records for the mechanics that participated in the installation of the elevator assembly on the accident airplane during its most recent D inspection revealed no discrepancies. 1.17.2.1 Reference Documents/Maintenance Manuals Provided by Emery TTS and Emery personnel indicated that when TTS maintenance personnel worked on Emery’s DC-8s, they followed the guidance on the work cards provided by Emery. However, the work cards provide only general guidance regarding the steps involved in a procedure and typically referred the mechanic to other DC-8 documents or manuals for more specific guidance regarding procedures and/or components. In accordance with its MPPM and FAA requirements, Emery provided TTS with pertinent DC-8 manuals and documents, including the Douglas Master DC-8 MM; the Douglas DC-8 Aircraft OHM; the Douglas DC-8 IPC, 60/70 series; and temporary revisions to manuals, as applicable, when Emery added TTS to its list of approved maintenance facilities. Emery also provided TTS with the DC-8 MM and IPC that were applicable for the accident airplane. 78 According to TTS personnel, mechanics working on the accident airplane would have used the United Airlines DC-8 MM as the primary reference for their work cards, using other available manuals and documents to augment as necessary. TTS personnel indicated that there is no consolidated list/description for these manuals and documents; however, because of their experience, mechanics would know that the manuals and documents existed and would know the information each item contained.79 According to TTS personnel, if a mechanic did not know about all the available reference materials, his lead mechanic/supervisor would. The Safety Board’s examination of the documents and manuals available to TTS revealed that the DC-8 MMs provided by Emery did not contain detailed drawings, lists, or other specific instructions indicating the hardware and actions required for the proper installation and securement of the pushrod attachment bolt connecting the elevator control 76 When Emery added TTS to its list of approved repair stations/vendors, Emery sent quality control representatives to TTS to train TTS inspectors regarding Emery’s procedures and processes. The Emery-trained TTS inspectors were then the only inspectors designated to work on Emery’s airplanes. 77 In an attempt to improve the training of maintenance technicians and employers, the FAA set up an award-oriented training program that maintenance technicians and organizations could participate in voluntarily. The “Diamond Award” is the highest recognition from the FAA for technicians and employers that participate in available initial and recurrent maintenance training courses. According to TTS management personnel, the company designed its training program around the FAA’s program. 78 Emery’s DC-8 MM for the accident airplane was formerly a United Airlines DC-8 MM. 79 According to postaccident interviews and information contained in the TTS party submission for this investigation, the TTS workforce was very stable. All maintenance personnel who performed work on Emery’s DC-8s had years of experience working on DC-8s (the lead mechanics and inspectors who worked on the accident airplane had between 20 and 40 years of maintenance experience, mostly on DC-8s), and all such work was performed under the oversight of at least one Emery technical representative.

Factual Information 59 Aircraft Accident Report tab pushrod to the tab crank fitting. The DC-8 IPC provided by Emery identified the control tab crank/pushrod attachment point hardware except for the cotter pin. The DC-8 OHM provided by Emery did contain such information. 1.17.2.2 TTS DC-8 Elevator Control Tab Inspection Memorandum On October 24, 2001, based on information learned during this investigation, the TTS Director Of Quality Assurance issued a memorandum to all inspection personnel, requiring them, on an ongoing basis, to remove the inboard fairings on the right and left elevator control tabs on all DC-8s. The memorandum instructed personnel to do the following before an airplane leaves the facility: • Ensure that the correct hardware, per aircraft effectivity, is installed and properly safetied on each control tab pushrod to drive crank fitting. Use the appropriate Illustrated Parts Catalog. • Ensure that the bolt is installed with the head of the bolt being inboard, as illustrated in the Douglas Overhaul Manual 27-16-1, page 13/14. • Any discrepancies will be documented and corrected prior to the airplane departing our facility. 1.17.3 FAA Oversight of Emery Worldwide Airlines’ Certificate FAA oversight responsibility for the company’s certificate was located with the San Jose FSDO until December 1999, when Emery’s certificate was transferred to the Cincinnati FSDO.80 Because the transfer of FAA oversight responsibility occurred about 2 months before the accident, investigators interviewed FAA personnel at the San Jose and Cincinnati FSDOs during this investigation. The San Jose FSDO principal operations inspector (POI) indicated that most of the violations and issues discovered during the inspections conducted by that FSDO were maintenance/airworthiness related; he did not remember any specific operational changes as a result of these inspections. Emery’s POI from the Cincinnati FSDO indicated that managing Emery’s certificate was a heavy workload; he stated that he interacted frequently with Emery management personnel at DAY, oversaw the rewriting of several of Emery’s manuals, and was extremely busy conducting checkrides. The San Jose FSDO principal maintenance inspector (PMI) was responsible for the Emery certificate from September 1997 until the certificate was transferred in December 1999. He stated that he thought FSDO personnel were working productively with Emery personnel to address ongoing maintenance issues, including repetitive 80 According to Emery personnel, the company requested that the certificate be transferred from the San Jose FSDO because that FSDO was unable to provide adequate checkride support. According to FAA personnel, the oversight responsibility was reassigned to the Cincinnati FSDO because that FSDO was closer to Emery’s corporate offices and main base of operation and, thus, was better able to support/oversee the air carrier.

Factual Information 60 Aircraft Accident Report write-ups and instances of possible improper maintenance sign-offs. However, he characterized Emery as a “troubled carrier,” adding that “[t]here were a lot of issues.” When the Emery certificate was transferred, Cincinnati FSDO PMI personnel met with the San Jose FSDO PMI to become familiar with the issues involved with management of Emery’s certificate. Further, in January 2000, the Cincinnati FSDO conducted a Regional Aviation Safety Inspection Program (RASIP) inspection of Emery to evaluate the company. (For additional information regarding this RASIP, see section 1.17.3.1.) The Cincinnati FSDO PMI noted that of the 98 initial findings, 81 were maintenance related. 1.17.3.1 FAA Inspections of Emery Before the accident, the FAA conducted the following inspections of Emery: a National Aviation Safety Inspection Program (NASIP) inspection in June 1992; a RASIP inspection in June 1995;81 a focused RASIP in February 1999,82 and another RASIP inspection in January 2000. The FAA also conducted several postaccident inspections of Emery, including a surveillance inspection from May 11 to May 18, 2000; another RASIP inspection from October 16 to November 2, 2000; and a logbook review inspection in May/June 2001.83 The NASIP inspection, conducted June 8 to 26, 1992, resulted in 50 findings, 24 of which were maintenance-related, including multiple findings in the following areas: manuals and procedures (3 findings), records systems (2 findings), contractual agreements (5 findings), and MEL/deferred maintenance (3 findings). Several of these findings cited improper maintenance manual revisions. Other findings cited lengthy periods of operation with a maintenance discrepancy, inadequate corrective actions for repetitive flight crew write-ups in aircraft maintenance logbooks, and inconsistent/conflicting guidance in maintenance manuals. There were no discrepancies noted in Emery’s maintenance training program. The RASIP inspection conducted June 12 to 23, 1995, resulted in 18 findings, 12 of which were maintenance related, including multiple findings in the following areas: maintenance facilities (5 findings), training programs (2 findings), and maintenance manuals and procedures (3 findings). Specific maintenance-related findings included use 81 A RASIP is initiated by the FAA regional office with oversight responsibility for the operator being inspected and involves FAA personnel from that region, whereas a NASIP is initiated by FAA headquarters and involves both FAA headquarters and regional personnel. NASIP inspections are generally lengthier, involve more inspectors and are, therefore, more thorough than RASIP inspections. NASIP and RASIP inspections are conducted to evaluate whether an operator is in compliance with all applicable FARs, approved company procedures and policies, and other written FAA guidance. 82 The San Jose FSDO POI stated that a focused RASIP is one in which the inspectors look at specific areas within the airline. During the 1999 focused RASIP, the FAA examined loading procedures and the condition of unit loading devices (ULD). This focused RASIP resulted in 21 findings, 18 of which were maintenance related (including manuals/procedures, deferred maintenance, and maintenance program findings). There was no evidence to indicate that loading procedures and ULD condition were involved in this accident. 83 Emery’s responses to the FAA’s NASIP/RASIP findings are in the docket for this accident.

Factual Information 61 Aircraft Accident Report of an unapproved/unaccepted “part number cross reference” manual and an out-of-date MPPM in the stores area, an unqualified company technical representative, an untrained company technical representative, and Emery’s use of contract facilities not listed in the then-current MPPM.84 The FAA indicated that the RASIP conducted from January 18 to 28, 2000, was intended to evaluate the condition of the Emery certificate when it was transferred from the San Jose FSDO to the Cincinnati FSDO. This RASIP resulted in 98 findings, 81 of which were maintenance related. There were multiple findings in many areas, including the following: operations manuals and procedures (4 findings), maintenance manuals and procedures (11 findings), training program (6 findings), MEL/deferred maintenance (3 findings), reliability program (7 findings), and maintenance inspection system and required inspection items (9 findings). The report on this inspection noted that some company manuals had not been properly updated, instructions in manuals were not always followed, there was no AD compliance list, there was no traceability on C inspection work cards for non-routine items, Emery’s maintenance training program lacked sufficient formal training courses, and maintenance logbook entries were inadequate (specifically, they lacked detailed descriptions of work performed and/or lacked a reference for compliance). 1.17.3.2 FAA Inspection of TTS The FAA conducted a RASIP inspection of TTS between February 14 and 18,

1. The RASIP focused on management and administration, certificate and operation

specifications, manuals and procedures, training program, records system, maintenance facilities, contractual arrangements, AD compliance, maintenance inspection system and required inspection items, mechanical reporting procedures, major repair and alteration conformity, aging aircraft program, and part traceability and documentation. The FAA’s RASIP inspection report, dated July 25, 2000, noted findings in the following areas: manuals and procedures (1 finding), records systems (5 findings), maintenance facilities (4 findings), and maintenance inspection system and required inspection items (2 findings). The report indicated that all findings had been closed satisfactorily.85 The RASIP inspection report indicated that the FAA reviewed a random sample of training files for 10 mechanics and 10 inspectors for proper training and authorizations and that no discrepancies were noted in this area. 84 TTS was listed in Emery’s MPPM. 85 The TTS employee numbering system was clarified and an explanatory memorandum was issued; information regarding proper maintenance documentation and signoffs was disseminated; lapses in parts documentation were corrected; shop test stand instruments were calibrated; and calibration of precision tools in the shop was confirmed.

Factual Information 62 Aircraft Accident Report 1.18 Additional Information 1.18.1 Design and Certification of DC-8 Elevator System As previously discussed, the DC-8 was originally type-certificated in 1959 under CAR 4b (dated December 31, 1953). (The DC-8 type certificate [TC No. 4A25] was amended on April 13, 1982, to include DC-8-71F model airplanes.) For example, CAR Section 4b.320, “Control Systems, General,” states the following: [A]ll controls and control systems shall operate with ease, smoothness, and positiveness appropriate to their function. The elements of the flight control system shall incorporate design features, or shall be distinctively and permanently marked to minimize the possibility of incorrect assembly which could result in malfunctioning of the flight control system. Tab control systems shall be such that disconnection or failure of any element…cannot jeopardize the safety of flight. CAR Section 4b.303, “Standard Fastenings” (the predecessor to FAR 25.607), states, “self-locking nuts shall not be used on bolts which are subject to rotation in operation.” FAR 25.60786 states, in part, the following: (a) Each removable bolt, screw, nut, pin, or other removable fastener must incorporate two separate locking devices if – (1) Its loss could preclude continued flight and landing within the design limitations of the airplane using normal pilot skill and strength; or (2) Its loss could result in reduction in pitch, yaw, or roll control capability. In its submission on this accident, Boeing stated that a failure/disconnection of the control tab crank fitting/pushrod attachment was considered by the manufacturer and the FAA during DC-8 development and certification. The submission noted, however, that “the TED [control] tab motion and the subsequent [push]rod end escape from between the crank [fitting] lugs was a mode that had not been anticipated, nor had it been experienced prior to this accident.” Boeing indicated it has “begun developing an enhanced design of the control tab pushrod that will prevent the pushrod from dropping or otherwise moving in front of the control tab crank should the bolt migrate out of the connecting joint. The front end of the pushrod is also being reviewed for consequences should it become disconnected.” In a letter to the Safety Board dated May 14, 2003, Boeing stated that a “prototype part has been built. The design and installation will be ground tested on a DC-8.” 86 FAR 25.607 did not apply to the certification of the DC-8.

Factual Information 63 Aircraft Accident Report Additionally, Boeing indicated that it examined more than 180 attachment points on the DC-8 elevator, aileron, and rudder flight control systems to determine the effect of a separation of the securing hardware (that is, the castellated nut and cotter pin) at those attachment points. According to Boeing, this evaluation indicated that a disconnection at any of these attachment points would result in “mostly minor or no degradation in the control system operation.” Boeing also conducted an evaluation of tab-driven flight controls on its other airplanes, including the DC-9, MD-80/90, and 717, to determine whether similar unanticipated failure modes might exist in those airplanes. Specifically, Boeing tried to identify other “previously unanticipated adverse consequences of a single joint disconnect in the tab mechanisms of tab-driven flight control systems.” (Boeing’s evaluation of the tab-driven flight controls on the 707 was ongoing at the time of this writing. The primary flight controls on all other Boeing airplanes are hydraulically actuated (not tab-driven) and, therefore, were not evaluated.) Boeing described the results of its evaluations in its May 14, 2003, letter to the Safety Board, stating “[t]he only tab surface that can pose a loss-of-control disconnect concern is the elevator control tab.” 1.18.2 Party Submissions Regarding Contact/Possible Contact with the Bolt In its submission on this accident, Emery stated that although Emery maintenance personnel performed maintenance on the accident airplane after TTS performed the D inspection, these maintenance activities did not result in contact with the bolt at the control tab crank fitting to pushrod attachment. Further, Emery proposed the following probable cause for the accident: …loss of elevator control that resulted from the loss of the bolt connecting the right-hand elevator pushrod to the elevator control tab crank fitting. The loss of the bolt was due to the failure of the TTS mechanics conducting the D check to install the cotter pin, or the nut and cotter pin, to safety the bolt properly. Contributing to the accident was the failure of the TTS inspector to identify the missing hardware at the time that the work on the elevator control tab installation was completed during the D check installation. In contrast, TTS stated in its submission on this accident that several maintenance actions performed by Emery after TTS completed the D inspection could have resulted in contact with the bolt connecting the right elevator control tab pushrod to the elevator control tab crank fitting. Specifically, TTS cited Emery’s troubleshooting efforts during damper-related maintenance, work performed as a result of repeated pilot writeups about PTC anomalies, and the B-2 inspection. The TTS submission proposed the following probable cause for the accident:

Factual Information 64 Aircraft Accident Report …a mechanical failure in the elevator control system. The likely cause was a failure at the control tab clevis fitting due to either a failure of or improper securing of the nut, bolt, and/or cotter pin. This resulted in the pilot’s inability to control the aircraft. Improper and inadequate maintenance performed by [Emery] likely caused the bolt/nut assembly to come loose or fail during the fatal takeoff. In its submission on this accident, the Air Line Pilots Association (ALPA) stated that the accident “was the result of a disconnect and subsequent jam in the linkage of the pitch control system, which rendered the aircraft uncontrollable.” ALPA’s submission further stated the following: Evidence and analysis indicates that the bolt which attaches the pushrod to the tab crank fitting for the right-hand…elevator control tab was jammed in the airplane nose up (ANU) position….Although the root cause for the loss of the bolt is unknown, the most likely scenario is that the bolt’s locking hardware was either never or improperly installed after maintenance activity by Emery.…given the…vague and/or ambiguous work card and maintenance guidance, the sparse aircraft logbook write-ups…regarding both the damper reversal and the B-checks, it seems highly likely that the elevator system linkage was parted by [Emery] during one of those maintenance actions, and that locking hardware was either never or improperly reinstalled. In its submission on this accident, Boeing stated the following: Based on the factual evidence and the analytical studies conducted for this investigation, Boeing believes that the probable cause of this accident was improper maintenance practices that led to the separation of the control tab pushrod from the control tab crank [fitting], a subsequent restriction of the control tab in an extreme trailing edge down position, and the subsequent loss of control of the airplane.” Boeing’s submission also stated “the right elevator control-rod-to-control-tab-crank joint was improperly installed either during the…‘D’ check at TTS, or during troubleshooting at Emery for the flight crew-reported difficulty with flaring the aircraft.

65 Aircraft Accident Report 2. Analysis 2.1 General The captain, first officer, and flight engineer were properly certificated and qualified and had received the training and off-duty time prescribed by Federal regulations and company requirements. No evidence indicated any preexisting medical or behavioral conditions that might have adversely affected the flight crew’s performance during the accident flight. The accident airplane was certificated, equipped, and dispatched in accordance with applicable regulations and industry practices. Cargo loading for the accident flight was routine, and the airplane was operating within prescribed c.g. limits. At the time of the accident, light winds and scattered clouds were in the area; no significant meteorological conditions were present that might have disrupted the flight. The Safety Board’s review of air traffic control (ATC) information revealed no evidence of any ATC problems or issues related to the accident. Therefore, weather and ATC were not factors in this accident. 2.2 The Accident Sequence There was no indication that the pilots were concerned about the airworthiness of the accident airplane as they prepared to depart from MHR. The airplane’s performance during ground operations and CVR evidence indicated that the initial takeoff roll did not appear to cause the pilots any concern and the takeoff continued in an apparently routine manner through the 80-knot elevator check.87 However, FDR and CVR evidence indicate that as the airplane reached its rotation speed, it began to pitch nose-up although neither pilot had moved his control column aft to command this movement, as would normally be expected at this time in the takeoff. To the contrary, CVR and FDR evidence indicates that the first officer began to move the control column forward, countering the airplane’s unusual nose-up pitch rate, about the time the airplane reached its rotation speed. Further, CVR evidence indicates that the first officer began to add nose-down stabilizer trim about 4 seconds after the airplane passed its rotation speed and attained full nose-down trim about 3 seconds after liftoff. CVR and FDR evidence indicates that as the pilots maneuvered the airplane in the traffic pattern in an attempt to return to the airport to land, the first officer primarily worked to maintain nose-down force on the control column, while the captain primarily tried to bank the airplane in an apparent attempt to control the pitch. The flight engineer 87 The pilots actions during the airplane’s ground operations and takeoff are discussed in section 2.4.

Analysis 66 Aircraft Accident Report adjusted the engine power in response to the first officer’s requests. Throughout the accident flight, the airplane rolled and pitched and climbed and descended, as the pilots tried different combinations of flight control inputs and engine power settings to counter the airplane’s uncommanded pitch-up while they attempted to maneuver back to the runway. The investigation focused on discovering the reason for this pitch-up anomaly. 2.2.1 Disconnection of the Right Elevator Control Tab The Safety Board’s examination of the airplane wreckage revealed that the bolt that usually attaches the right elevator control tab crank fitting to its pushrod was missing. This bolt and its attaching hardware were not recovered.88 The aluminum control tab crank fitting and the aft end of the pushrod were intact and exhibited no evidence of internal damage, indicating that the bolt was not in place at impact. By contrast, the aft end of the left control tab pushrod (the only piece of the left control tab crank fitting/pushrod attachment that was not consumed by fire) showed evidence of damage consistent with the bolt having been in place until impact; it was fractured and about 3/4 of the aft pushrod end and its associated bearing were missing. The Safety Board tried to determine when the right elevator control tab bolt separated, disconnecting that control tab from its pushrod. Examination of FDR data for the accident airplane’s previous departure (from RNO) revealed no evidence of anomalous elevator movement—elevator deflections followed control column movements proportionally throughout that takeoff roll and rotation. Therefore, it is likely that the right elevator control tab bolt was still in place at that time. However, FDR data revealed that a 1º to 2º change in the relationship between the airplane’s control column movement and elevator response began about 8 minutes 20 seconds before the airplane landed at MHR and continued until touchdown. The Safety Board’s subsequent airplane performance study indicated that the change observed in the FDR’s control column and elevator data at this time could be explained by a 3º to 4º TEU shift in the airplane’s right control tab position relative to the left control tab. This shift in control tab position is consistent with one of the scenarios considered by the Board during this investigation—specifically, a scenario in which an elevator control tab disconnected in flight and shifted in a TEU direction (with the disconnected pushrod remaining between the lugs of the crank fitting), resulting in about a 3º to 4º TEU mismatch with respect to the left control tab. Postaccident ground tests conducted on an Emery DC-8 similar to the accident airplane showed that when the right elevator control tab bolt was removed and no aerodynamic loads were present, the right control tab deflected to about 29º to 30º TED, which allowed the pushrod to disengage from the lugs of the crank fitting. Assuming the bolt separated before the accident airplane landed at MHR, the control tab would likely have shifted TED when the aerodynamic loads decreased as the airplane decelerated after landing. 88 For additional discussion regarding the maintenance-related issues in this accident, see section 2.3.

Analysis 67 Aircraft Accident Report FDR data revealed abnormal elevator movements during the accident takeoff roll, indicating that the bolt had certainly migrated free by this time and was no longer securing the pushrod end bearing. Specifically, FDR data indicated that during the accident flight’s 80-knot check, the pilots moved the control column forward significantly, but the elevators moved relatively little (from about 5.5º TEU to about 2.2º TEU). By contrast, during the accident airplane’s previous takeoff (from RNO), when the pilots applied less forward control column motion, the elevators moved from about 5.4º TEU to about 7.8º TED. Further, FDR data showed that as the airplane rotated during the accident takeoff, the control columns were positioned to command a nose-down elevator deflection while the elevators remained in an extreme nose-up deflection. When the aerodynamic forces on the airplane increased as it accelerated during the accident takeoff roll, the right control tab would have moved to a point where the crank fitting lugs contacted the end of the disconnected pushrod (about 16º to 17º TED). From that point on, the right control tab’s TEU motion would have been restricted to a deflection that was about 25º lower than the left control tab positions. This scenario is consistent with evidence of contact damage observed on the forward edges of the accident airplane’s right control tab crank fitting and would have resulted in the abnormal nose-up pitching observed in the FDR data as the airplane neared rotation speed. Therefore, the Safety Board concludes that at some time after the previous takeoff (from RNO) and before the accident takeoff roll, the bolt connecting the right elevator control tab crank fitting to the pushrod migrated out of the fitting, allowing the control tab to disengage from its pushrod and shift to a TED position. DC-8 ground tests conducted with a disconnected right control tab pushrod showed that the pilots’ nose-down control column inputs resulted in a full (about 8º) TEU left control tab deflection and an extreme (about 16º to 17º) TED right control tab deflection. During the accident flight, the aerodynamic forces acting on the extreme TED-deflected right control tab would have driven both elevator surfaces abnormally TEU, resulting in a strong airplane nose-up elevator effect throughout the accident flight, regardless of the flight crew’s inputs. This TEU elevator movement was consistent with the elevator data recorded by the accident FDR. Therefore, the Safety Board concludes that when the aerodynamic forces increased as the airplane accelerated during the takeoff roll, the right elevator control tab crank fitting contacted the disconnected pushrod, restricting that control tab’s further TEU movement and leaving it in an extreme TED deflection. The Safety Board further concludes that as a result of the right elevator control tab’s extreme TED deflection, the accident airplane’s elevator surfaces were driven to command an extreme airplane nose-up pitch attitude; despite the large nose-down forces the pilots applied to the control columns, the pilots were unable to overcome the effects of the restricted right elevator control tab.

Analysis 68 Aircraft Accident Report 2.3 Role of Aircraft Maintenance in the Accident The FDR data and the physical evidence indicated that the bolt that normally attaches the right elevator control tab pushrod to the control tab crank fitting separated before the accident takeoff. There was no physical damage or other evidence indicating that the bolt failed or fractured, and failure of an installed castellated nut and/or cotter pin during normal operation would be very unlikely. Therefore, the bolt must have separated because it had not been properly secured; that is, the required castellated nut was either never installed, or it was improperly installed (for example, installed without a cotter pin). The Safety Board reviewed the accident airplane’s maintenance history to determine when and where the improper installation of the attachment bolt may have occurred. On the basis of its review, the Safety Board concludes that the bolt attaching the accident airplane’s right elevator control tab was improperly secured and inspected, either during the most recent D inspection or subsequent maintenance; however, the Board was unable to determine when this improper securement and inspection occurred. The installation of the overhauled elevator assembly during the D inspection completed by TTS in November 1999 was the last documented maintenance action involving attachment of the right elevator control tab to the pushrod. According to documentation and postaccident interviews, TTS maintenance personnel installed the overhauled elevator assembly in accordance with work cards and the maintenance manual MM that were provided by Emery. TTS maintenance personnel told the Safety Board that they were aware that this connection should be secured with a drilled-shank bolt, a castellated nut, and a cotter pin. TTS maintenance personnel had another opportunity to come into contact with the bolt at that attachment during the postinstallation testing and rigging procedures. If adjustments to the pushrod length were required during the rigging process (as they commonly are), the aft rod end bolt, nut, and cotter pin might have been removed and the bolt reinstalled upon completion of the rigging. However, because the forward rod end is designed to be the adjustable end of the pushrod, it is possible to adjust the rod length without removing the aft rod end hardware; therefore, an experienced mechanic might not have removed this bolt during the rigging process.89 In its submission on this accident, Emery contends that TTS mechanics failed to properly secure the bolt during the D inspection. However, submissions received from several other parties to the investigation suggested that there was an opportunity for Emery maintenance personnel to access this bolt/attachment after TTS completed the D inspection. Specifically, these submissions referenced work accomplished by Emery 89 Emery’s postaccident inspection of its DC-8 fleet (which was maintained and inspected by both TTS and Emery personnel) revealed that control tab attachment hardware (including cotter pins) was installed at the forward and aft ends of each control tab pushrod on each airplane. In addition, physical damage to the accident airplane’s left control tab pushrod (the only piece of wreckage from that attachment that was recovered) indicated that the bolt at the left control tab crank fitting to pushrod attachment was in place at the time of impact.

Analysis 69 Aircraft Accident Report (to address a pilot report of increased control column forces) about 1 week after the accident airplane’s D inspection was completed. Emery’s DC-8 MM contained troubleshooting procedures for the reported problem that included inspecting the control tab pushrods and their linkage; had Emery mechanics followed these procedures, their work could have involved contact with the bolt at the inboard control tab fitting. However, during postaccident interviews, Emery’s lead mechanic stated that they identified and corrected the reversed elevator damper installation early in their troubleshooting efforts and, therefore, never accessed the control tab pushrods. 2.4 Preflight Inspection and Flight Control/EPI Checks 2.4.1 Preflight Inspection Emery’s procedures required the flight engineer to examine the elevator control surfaces twice during his preflight inspections of the airplane—once with the elevator gust lock engaged and once with the gust lock disengaged. Although it was not possible to determine what position the control tabs were in during the flight engineer’s preflight inspection of the airplane, if the right elevator control tab was disconnected when the preflight inspections were conducted, an asymmetry between the right and left control tabs would likely have existed. Emery’s AOM instructed pilots to check the elevator and tabs for “alignment and condition” and specified “with gust lock off, elevator should be up, control tabs up, and geared tabs down.” Although this guidance is accurate, it should more strongly emphasize the importance of pilots ensuring that the right and left side elevators and tabs are deflected symmetrically during the preflight inspection. After the accident, Boeing emphasized flight control symmetry in its June 19, 2001, FOB, which stated the following: The proper functioning of the flight controls should be verified before every flight. If the exterior walk-around is made…with the gust lock released, the elevators and control tabs should be positioned toward UP (symmetrically), and the geared tabs DOWN (again symmetrically). The Safety Board concludes that DC-8 operators’ procedures and training should more clearly emphasize that DC-8 flight crewmembers need to verify symmetry between the right and left side elevators, control tabs, and geared tabs during the preflight inspection. Therefore, the Safety Board believes that the FAA should require all DC-8 operators to train DC-8 flight crewmembers to look for symmetry between the right and left side elevators, control tabs, and geared tabs during the preflight inspection, consistent with Boeing’s June 2001 FOB guidance.

Analysis 70 Aircraft Accident Report 2.4.2 Elevator Checks/Use of the EPI Gauge FDR and CVR evidence indicates that the pilots attempted to verify elevator movement (presumably using the EPI) during the elevator taxi check. However, the EPI gauge would not have provided the pilots with an indication of a restricted control tab during this check (regardless of the range or direction of control column input). CVR evidence indicates that the pilots also attempted to verify the elevator’s proper operation during the 80-knot elevator check by checking the EPI indication in accordance with Emery’s procedures and practices. The flight crew appeared satisfied with the results of the 80-knot elevator check and continued the takeoff roll. However, because the aerodynamic forces acting on the elevator and control tabs would have been significant as the airplane accelerated during the takeoff roll, the abnormal control tab condition would have prevented the elevator from moving to its full TED position. Therefore, under the circumstances of this accident, the EPI needle would not have moved below the neutral mark during the 80-knot elevator check, thus providing an indication that the elevator was not fully operational. Emery’s AOM regarding the use of the EPI during the 80-knot elevator check instructed pilots to apply “full forward” control column pressure, then “release slightly forward of neutral…confirm nose DN response…look for EPI to respond to yoke movement.” Although the AOM did not explicitly describe the expected EPI indications during the 80-knot elevator check, Emery’s AOM guidance for the ground taxi check stated that, with the control columns full forward, the EPI needle “should now point between [neutral] mark and the [down] mark.” On an airplane with a properly functioning elevator, a similar indication would be expected during the 80-knot elevator check. AOM guidance to this effect might have been helpful to the pilots because when the accident airplane’s EPI needle did not move below the neutral mark, they might have been alerted to the elevator’s abnormal operation. Review of other DC-8 operator’s procedures indicated that Emery’s guidance regarding EPI usage was among the most thorough in the industry. The AOMs of five of the other six DC-8 operators surveyed did not mention using the EPI during the 80-knot elevator check.90 Postaccident interviews with Emery personnel and FDR data indicate that Emery’s pilots used the EPI but only to confirm elevator response in the proper direction. Observation of EPI needle movement below the neutral mark during the 80-knot elevator check would provide a more quantitative determination that the elevator was functioning properly. The Safety Board found that there is no standardization of EPI guidance and EPI use across DC-8 operators. The 80-knot elevator check provides flight crews with their last chance to detect abnormal elevator performance (which could result from foreign object damage, fractured geared tab arms, mechanical failure [as with the accident flight], and/or damage to components that might have occurred since the earlier elevator checks) 90 AD 78-01-15 did not require operators to use the EPI during 80-knot elevator checks.

Analysis 71 Aircraft Accident Report before the airplane lifts off the runway.91 However, the procedures and practices currently in use appear to make minimal use of the EPI’s potential as a go/no-go tool during the 80-knot check, resulting in pilots continuing a takeoff with a potentially unsafe elevator condition. The Safety Board concludes that DC-8 operators, including Emery, do not use the EPI to confirm elevator movement indications above and below the neutral range during the 80-knot elevator check and, thus, do not take full advantage of the EPI’s capabilities to provide pilots with an indication of an abnormal elevator condition. Therefore, the Safety Board believes that the FAA should require the development of DC-8 80-knot elevator check procedures that will ensure that pilots are clearly made aware of whether the elevator is functioning properly before the airplane lifts off, then require all DC-8 operators to incorporate these procedures into their training and normal operations. The procedures should contain specific guidance regarding an expected range of EPI needle movement (including EPI needle movement well below the neutral mark with forward control column movement) and specific criteria for aborting a takeoff as a result of an inadequate elevator movement indication. The Safety Board’s review also indicated that there is no ongoing calibration requirement for the EPI gauge/system. Although the Board could not determine the calibration of the accident EPI, it notes that the EPI installed on the test airplane was not accurately calibrated when the ground tests were performed. The Safety Board concludes that the EPI needs to be periodically calibrated to ensure that it provides the most accurate information possible to the pilots. Therefore, the Safety Board believes that the FAA should require all DC-8 operators to incorporate periodic EPI calibration inspections into their maintenance programs to ensure that the EPI indications observed by pilots accurately represent the condition of the elevator. Finally, the Board noted that the small (1-inch diameter) EPI gauge was installed in a location on the accident airplane (the lower left side of the first officer’s instrument panel) that was not ideally visible for either pilot. The Safety Board concludes that the EPI gauge should be readily visible to both pilots. Therefore, the Safety Board believes that the FAA should require DC-8 EPIs to be located and sized so that they are visible and usable for both the captain and first officer. 2.5 Elevator Design Issues CAR 4b.320 amendment 4b-3, under which the DC-8 was certificated, stated that “Tab control systems shall be such that disconnection or failure of any element…cannot jeopardize the safety of flight.” According to Boeing’s submission on this accident, the company and the FAA considered the possibility of a failure of the crank fitting/pushrod attachment during the development and certification of the DC-8; however, subsequent 91 For example, during the December 12, 2002, Tampa Airlines aborted takeoff, the pilots performed an 80-knot elevator check and observed that the EPI did not respond to their control column inputs. See section 1.16.1.3 for more information on this event.

Analysis 72 Aircraft Accident Report control tab and pushrod end movements, such as those that likely occurred on the accident airplane, and the resultant jam/restricted movement of the control tab were not considered. The submission further stated that Boeing has “begun developing an enhanced design of the control tab pushrod that will prevent the pushrod from dropping or otherwise moving in front of the control tab crank should the bolt migrate out of the connecting joint. The front end of the pushrod is also being reviewed for consequences should it become disconnected.” Boeing also conducted a postaccident review of more than 180 additional attachment points on the DC-8 elevator, aileron, and rudder flight control systems to identify other potentially vulnerable attachments. In a letter to the Safety Board dated May 14, 2003, Boeing stated that its review showed that a disconnection at any of these other attachment points would result in “minor or no degradation” in the associated system’s operation. Further, Boeing stated that its survey of flight control attachment points on other tab-driven airplanes (including the DC-9, MD-80/90, and 717)92 indicated that the DC-8 elevator control tab was the “only tab surface that can pose a loss-of-control disconnect concern.” The Safety Board concludes that the circumstances of the Emery flight 17 accident show that the current DC-8 design does not preclude a catastrophic result from a disconnection or failure of the existing control tab crank fitting to pushrod attachment. Therefore, the Safety Board believes that the FAA should require Boeing to redesign DC-8 elevator control tab installations and require all DC-8 operators to then retrofit all DC-8 airplanes with these installations such that pilots are able to safely operate the airplane if the control tab becomes disconnected from the pushrod. Current Federal regulations (14 CFR Section 25.607) require manufacturers of transport-category airplanes to incorporate two separate locking devices at every removable bolt (or other fastener) if the loss of the bolt could result in reduction in pitch, yaw, or roll control capability. The use of dual-locking devices at critical flight control attachments was intended as additional protection against a catastrophic result from disconnection of a flight control. However, airplanes certificated under CAR 4b were not required to incorporate dual-locking devices. The Safety Board concludes that there may be airplanes that were certificated to CAR 4b standards other than the DC-8 on which the disconnection of a critical flight control could have catastrophic results. Therefore, the Safety Board believes that the FAA should evaluate airplanes other than the DC-8 certificated to CAR 4b standards to evaluate whether disconnection or failure of critical flight control systems could have catastrophic results and, if so, require that they also be redesigned and retrofitted and/or equipped with dual-locking devices to preclude such catastrophic results. 92 Boeing’s evaluation of the flight controls on the 707 was ongoing at the time of the letter.

Analysis 73 Aircraft Accident Report 2.5.1 Elevator Geared Tab Crank Arm Fractures During this investigation, the Safety Board reviewed the history of fractured DC-8 geared tab crank arms, which, though not a factor in this accident, have been involved in other elevator jam events over the years. Although AD 78-01-15 required DC-8 operators to modify the clearances for the geared tab crank arms, DC-8 elevator system jams caused by fractured aluminum geared tab crank arms are still occurring. The Board notes that AD 78-01-15 does not require operators to replace the existing aluminum crank arms with forged stainless steel crank arms, as suggested by Douglas in SB 27-262. The SB stated that “replacing the existing aluminum geared tab crank assemblies with forged stainless steel crank assemblies and improving the crank assembly clearance will minimize the possibility of crank failure.” Stainless steel is stronger than aluminum and the Safety Board is not aware of any fractures of stainless steel DC-8 geared tab crank arms that have occurred in normal operation. In fact, although both elevator geared tab aluminum crank arms on the accident airplane (the inboard crank arms) fractured as a result of the impact forces, the elevator geared tab stainless steel crank arms were twisted but not fractured. Therefore, the Safety Board concludes that replacement of the DC-8 aluminum elevator geared tab crank arms on DC-8 airplanes with stainless steel elevator geared tab crank arms would likely eliminate the possibility of a jam resulting from fractured geared tab crank arms. Therefore, the Safety Board believes that the FAA should require all DC-8 operators to replace all DC-8 aluminum elevator geared tab crank arms on their DC-8 airplanes with stainless steel elevator geared tab crank arms. 2.6 Emery’s DC-8 Maintenance Documents and Guidance 2.6.1 Required Inspection Items The Safety Board notes that Emery’s work cards for installation of the right elevator tabs (work card 3502D) and right elevator assembly (work card 3504D) contained specific instructions for verification of proper “installation and security” and that an inspector stamp/signoff was required for these steps. However, Emery’s work card 3504D contained another step after the inspector verification of installation and security— “rig R/H elevator [assembly] per DC-8 MM chapter 27.” Although an inspector stamp/signoff was required for this task and the MM cited inspection of elevator “mechanism rods secure and safetied,” there was no discrete work card step requiring an inspector to re-verify the security of attachments after the rigging work was completed. Thus, it is possible that a once-properly secured bolt, which was inspected and signed off during the installation inspection, could be returned to service after the postinstallation rigging process without a properly secured bolt or subsequent inspection.

Analysis 74 Aircraft Accident Report The Safety Board notes that 14 CFR 121.369[b][2] requires operators to designate “items of maintenance…that must be inspected…including at least those that could result in a failure, malfunction, or defect endangering the safe operation of the airplane, if not performed properly.” Although the instructions and steps contained on Emery’s DC-8 work card 3504D were consistent with industry standards that have been in use for decades, the Board is concerned that the lack of specificity regarding a postrigging inspection could result in a hazardous condition. As demonstrated in this accident, if a missing securing device at a critical attachment goes undetected, it can have catastrophic consequences. Although the Board did not determine whether the lack of specific information on Emery’s work cards was directly related to the improper securement of the bolt in this case, the addition of discrete inspection items, specifically identifying the attachments/fittings to be inspected, could only help ensure the security of this critical flight control93 attachment. (The Board is aware of one carrier that included in in its maintenance documents a specific “safety check” work card, requiring inspection of all previously installed/assembled/inspected components.) The Safety Board concludes that DC-8 elevator rigging procedures should be fully addressed in a separate work card that specifically lists required inspection items, including verifying the security of elevator control tab attachments after the rigging is completed. Therefore, the Safety Board believes that the FAA should require all DC-8 operators to create or revise DC-8 work cards to ensure they specifically include a postrigging inspection of the elevator assembly, including verifying the security of elevator control tab attachments. Because carriers customarily base their maintenance programs on the manufacturer’s recommendations, Emery’s DC-8 work card 3504D was most likely based on a generic work card originally prepared by the manufacturer as part of an overall recommended DC-8 maintenance program. Therefore, the Safety Board is concerned that other DC-8 work cards based on that set of generic work cards may contain a similar level of detail, or lack thereof. The Safety Board concludes that all DC-8 work cards related to critical flight controls should identify required inspection items as discrete tasks with individual inspection signoff requirements. Therefore, the Safety Board believes that the FAA should require all DC-8 operators to review their work cards related to critical flight controls, and revise them as necessary to ensure that appropriate tasks are identified as discrete tasks with individual inspection signoff requirements. 2.6.2 Emery’s B-2 Inspection The B-2 inspection conducted by Emery between the November 1999 D inspection and the accident included instructions for maintenance personnel to “visually inspect elevators and tabs for general condition, corrosion, leakage, and security of attachment.” However, when the control tab fairing is installed, it prevents any visual examination of the control tab crank fitting to pushrod attachment or the inboard hinge 93 The DC-8 elevator control tab is a critical flight control because certain failures of this flight control can be catastrophic.

Analysis 75 Aircraft Accident Report fitting, making it impossible to inspect either attachment point for “security of attachment,” as called for by the B-2 inspection work card. During postaccident interviews, Emery maintenance personnel stated that they did not remove the control tab fairing or inspect the crank fitting/pushrod attachment during the B-2 inspection. In public hearing testimony, witnesses from Emery indicated that its B-2 inspection was intended to be a general visual inspection, to be accomplished without removing access or inspection panels or fairings. However, witnesses from TTS stated that, although not specifically listed as a step, removal of the control tab fairing was necessary to satisfactorily perform the tasks described in Emery’s B-2 work card. Further, the Safety Board’s survey of several other DC-8 operators revealed inconsistent interpretation and application of the work card task regarding the inspection of the elevator and control tab for security of attachment. Emery’s interpretation of its B-2 work card was consistent with Boeing’s position that the manufacturer’s recommended program work cards “do not call for the removal of the inboard control tab fairing during the B [inspections]. The inboard control tab fairing is not removed until the [heavy maintenance inspection equivalent to Emery’s C- and D-inspections]…Therefore, the Emery B-2 inspection work card…would be…an inspection to be accomplished without removing access or inspection panels, fairings, or the like.” (Emery performed C inspections about every 2 years and D inspections about every 12 years.) The Safety Board notes that several air carrier operators have tried to clarify the intended scope of maintenance tasks by including in work cards an enumeration of the actions that are necessary for the proper accomplishment of the associated work task. Although this additional detail on work cards is not required by the FAA, its inclusion should result in more consistent accomplishment of maintenance tasks. The Safety Board concludes that all air carrier operators should provide maintenance personnel with more detailed information regarding the steps or actions that are necessary to satisfactorily accomplish a maintenance task. Therefore, the Safety Board believes that the FAA should require all 14 CFR Part 121 air carrier operators to revise their task documents and/or work cards to describe explicitly the process to be followed in accomplishing maintenance tasks. 2.6.3 DC-8 MM Information The information regarding the control tab installation that was in Emery’s DC-8 MM and IPC in use at the time of this accident did not specify that a cotter pin was required. However, the Safety Board has no evidence that the lack of specific reference to, or depiction of, a cotter pin at this attachment in the DC-8 MM and/or IPC was a factor in this accident. In fact, that information had been used for years with no other known instance of an incorrectly safetied bolt separating. Boeing subsequently improved the related information in its DC-8 MM, revising it to explicitly state that a cotter pin is needed to secure the elevator control tab crank fitting to pushrod attachment. The five

Analysis 76 Aircraft Accident Report primary U.S. operators (that is, those who operate multiple DC-8s) have all adopted this revision in their MMs. Boeing did not issue a similar revision to the DC-8 IPC because it was not intended to be used as a reference for installation and/or assembly of components; rather, Boeing intended that mechanics use its installation drawings for installation and assembly tasks. However, the Safety Board notes that Emery did not list the manufacturer’s installation drawings as a reference to be used in Emery’s maintenance program, and Emery did not provide TTS with Boeing’s DC-8 installation drawings. In the absence of installation drawings, it is possible that a mechanic would use the IPC as a reference for installation and/or assembly of components. Because the IPC is not required to be updated, the information contained in that document might be incomplete or might not accurately reflect an airplane’s configuration. The Safety Board concludes that the use of outdated, incomplete, or otherwise unsuitable reference materials by maintenance personnel during the installation and/or assembly of airplane components can occur and is a potentially unsafe practice. Therefore, the Safety Board believes that the FAA should require all air carrier operators to either: 1) provide all pertinent maintenance personnel with the manufacturer’s current installation drawings for pertinent airplanes, update those installation drawings as needed, and require use of those drawings during installation and/or assembly of that airplane’s components; or 2) list the IPC on that operator’s operation specifications, provide maintenance personnel with up-to-date IPCs for reference, continue to update those IPCs as needed, and require maintenance personnel to use the pertinent updated IPCs during installation and/or assembly of an airplane’s components. 2.7 FDR-Related Issues The elevator data conversion problems encountered with the accident airplane’s FDR complicated this investigation and delayed the Safety Board’s recognition of the significance of the elevator movement during the accident sequence. Observing abnormalities in the recorded elevator data, the Board reviewed the data more thoroughly and determined that the elevator’s neutral position was not accurately identified during the original correlation. Specifically, the Board noted that an 11° TEU adjustment to the elevator conversion value resulted in an elevator position of 0° when the gust lock was engaged. In compliance with Federal regulations, the accident airplane’s FDR was upgraded to record additional parameters (including elevator position) during its most recent heavy maintenance inspection in November 1999. The accident airplane was the first of Emery’s DC-8 fleet to be so upgraded, and a full correlation of the data recorded by the FDR to the actual elevator positions was performed and documented. Given that the total range of elevator travel from the documented data from the accident airplane’s original correlation was similar to the elevator’s normal operating range and that the recorded travel above and below neutral (when corrected) was consistent with its design, it is apparent that the entire

Analysis 77 Aircraft Accident Report range of elevator travel, including the elevator neutral position, was not accurately identified during the original correlation. Fortunately, the Board was able to adjust the conversion for use in this investigation; however, the Board’s identification of the incorrect elevator conversion delayed a thorough evaluation of the elevator’s behavior during the accident and previous flights. This problem could have been identified and corrected at the time of the upgrade if L2 Consulting Services, Inc. (the company that performed the correlation after the upgrade) or Emery had verified that the accident airplane’s original correlation reflected the elevator’s actual (design) range of travel during the correlation or after the correlation was completed. The subsequent readout and evaluation of three other Emery DC-8 FDRs (two of which were installed at different times on the Emery DC-8 used in postaccident tests) also indicated problems with the elevator data conversions. According to documentation the Safety Board received from Emery and L2 Consulting Services, Inc., the accident airplane’s FDR system was the only FDR system on which a complete correlation of recorded FDR data to actual elevator position was accomplished. The other two airplanes examined were only subjected to a verification test during which the elevator was moved to its neutral, full up, and full down positions,94 then the measured values from the accident airplane’s correlation were applied. Unfortunately, the elevator position correlation for the accident airplane, which was used by Emery for the remainder of its upgraded DC-8 fleet, was incorrect. The FARs (specifically, Section 121.343[j]) permit the use of a single correlation for airplanes of the same type if they have the same FDR and sensors, presumably because full correlations on similar equipment would be expected to be similar. However, the Board observed significant differences in the conversions required for Emery’s DC-8s. The correlation problems observed during this investigation raise concerns about the use of a single correlation for a fleet of airplanes. The Safety Board’s discovery of a shift in the control column range of travel between the time of the original correlation and the accident provides further evidence of inconsistencies with the FDR-to-actual position correlations. Although the shift in control column range of travel did not result in a change to the control column conversion, the Board is concerned about the cause of the shift, which was not determined. The Safety Board has found that FDR correlation inconsistencies occur more frequently on airplanes manufactured on or before August 18, 2000, that have been retrofitted to record additional parameters (in compliance with Federal regulations). Consequently, the use of a single correlation document for an existing fleet, while permitted by regulation, may be more problematic when applied to older airplanes that have been retrofitted to record additional FDR parameters. These difficulties have often resulted in more difficult and time-consuming investigations.95 94 These elevator movements were not physically measured; rather, the erroneous correlations from the accident airplane were applied to data obtained from the other two airplanes.

Analysis 78 Aircraft Accident Report Because older airplanes with retrofitted FDRs are not required to record as many parameters as newly manufactured airplanes,96 the loss of data from just one parameter on an older retrofitted airplane can significantly hamper and slow progress in an investigation. Although investigators are often able to estimate the values for the lost or invalid data using data from other parameters and sources of information, this reconstruction of the data takes time and can delay the identification of potentially critical safety issues (and can potentially lead to incorrect conclusions regarding the recorded data). When more recorded data is available during an investigation, it is more likely that investigators will be able to identify critical safety issues early in the investigation and not spend a significant amount of investigative time compensating for lost or unreliable FDR data. The Safety Board concludes that the use of a single airplane’s FDR parameter correlation for all airplanes of the same type is inadequate to ensure accurate correlations for older airplanes that have been retrofitted to record additional FDR parameters. Therefore, the Safety Board believes that the FAA should require operators of airplanes manufactured before August 18, 2000, that have been retrofitted with additional FDR parameters in compliance with Federal requirements and for which an operator maintains a common correlation document for that airplane type to conduct a full correlation of all such airplanes’ FDR parameters at the airplanes’ next required FDR maintenance inspection to verify accurate FDR system documentation and sensor function. Additionally, a thorough evaluation of the accident airplane’s elevator behavior was further complicated by the abnormal FDR track switching. As previously noted, the FDR switched to the first track every time electrical power to the FDR stopped. The process of viewing all 25 hours of data recorded on the FDR’s six tracks, identifying the locations of track switching, and identifying the data that corresponded to the airplane’s most recent operations was time consuming. Further, because of the tracking-switching anomaly, the Safety Board had only the most recent 8 hours 11 minutes of elevator data to examine instead of the required 25 hours of recent data. (The remaining data recorded by the FDR was from unidentified previous flights, some of which occurred at least 3 months prior to the accident [before the FDR was upgraded to 17 parameters].) The Safety Board has previously observed tracking-switching anomalies with other F800 model FDRs. The F800 manufacturer, Loral Fairchild,97 identified several potential causes of tracking-switching anomalies and issued three FSBs to correct them. Two of the three FSBs appear to address a condition like that of the accident FDR (S/N 04018, P/N 17M303-282). However, according to Emery’s records, none of the 95 The Safety Board has issued many related safety recommendations to the FAA to remedy these difficulties throughout the years and has included improvements in on-board recording devices on its list of most wanted safety improvements since 1997. 96 Airplanes manufactured on or before August 18, 2000, are required to be upgraded as necessary to record 17 parameters (as with the accident airplane) or 34 parameters, while newly manufactured airplanes are required to record 57 or 88 parameters (depending on the date of manufacture). 97 Loral Fairchild is now L3 Communications.

Analysis 79 Aircraft Accident Report components of the accident FDR were subject to modifications per any of the FSBs regarding track switching. The Safety Board considered two possible explanations for the accident airplane’s tracking-switching anomaly: 1) the accident FDR’s tracking-switching condition was a previously unidentified condition for which no remedy had been developed, and therefore none of the FSBs applied, or 2) one or more of the existing FSBs were applicable to the accident FDR, but Emery’s paperwork did not reflect installation of the relevant components (whether accomplished or not). Regarding the second scenario, although the FSB’s targeted replacement of one or more specific components on a board in the FDR and such component revisions should be marked on the boards, a mechanic could easily remove one board and replace it with another without documenting the components on the replacement board if slight differences exist. Thus, it is possible that one or more of the FSBs designed to address track switching applied to the accident airplane’s FDR but this was not indicated in Emery’s documentation for that FDR. (The condition of the recorder prevented the Board from physically verifying the components installed on the accident FDR.) The Safety Board concludes that Loral Fairchild Model F-800 FDRs with unaddressed or unidentified tracking-switching anomalies may currently be in operation. Therefore, the Safety Board believes that the FAA should require all operators of airplanes equipped with Loral Fairchild Model F-800 FDRs to comply with Loral Fairchild FSBs DFR 011 and DFR 027 for recorders with applicable part numbers and installed component numbers. Further, the Safety Board believes that the FAA should require overhaul facilities that service Loral Fairchild Model F-800 FDRs to monitor those recorders to determine whether abnormal track switching is occurring and to report any such findings to the FAA and the manufacturer. 2.8 Drug and Alcohol Testing of Ground Personnel The FARs require that all employees who perform a “safety-sensitive” function be tested for drugs or alcohol if their performance could have contributed to or could “not be completely discounted as a contributing factor to the accident.” Drug testing and alcohol testing are required to be accomplished as soon as possible but no later than 32 and 2 hours after the accident, respectively. However, the ground personnel at MHR who were involved with the accident airplane (including cargo handlers, load planners, and ramp supervisors) were not required to submit to drug or alcohol testing promptly after the accident, in part because the applicable regulations (specifically 14 CFR Part 121, Appendixes I and J) do not define their duties as “safety-sensitive.” Although not required, voluntary drug tests were eventually conducted on eight cargo handlers, a load planner, and the ramp supervisor involved with the accident flight. Samples were taken from the 10 tested employees between 1 and 6 days after the accident; 2 of the 10 employees tested positive for drugs and were subsequently relieved of their duties.

Analysis 80 Aircraft Accident Report Although it was determined that the performance of cargo-handling personnel was not a factor in this accident, improper loading of the airplane’s cargo and/or a cargo shift during takeoff have been involved in previous accidents and were considered possibilities during the early stages of this investigation. As evidenced by the history of cargo-related accidents, the way cargo-handling personnel conduct their duties (whether those duties involve the loading of cargo in cargo compartments; the loading/packing of the containers, pallets, and other items for placement within the cargo compartments; or planning the placement of the load) can have a significant effect on the safety of a flight. This potential effect is no less serious than several of the functions that are currently defined as safety-sensitive by the FARs, including aircraft dispatcher duties, ground security coordinator duties, aviation screening duties, and aircraft maintenance or preventive maintenance duties. Therefore, the Safety Board concludes that the current regulatory definition of safety-sensitive functions is too narrow for the issue of postaccident testing because it does not include cargo handlers, load planners, and ramp supervisors, all of whom have a demonstrated potential to affect the safety of a flight. Therefore, the Safety Board believes that the FAA should modify the list of safety-sensitive functions described in 14 CFR Part 121, Appendixes I and J, to include all personnel with direct access to the airplane and a direct role in the handling of the flight, including cargo handlers, load planners, and ramp supervisors.

81 Aircraft Accident Report 3. Conclusions 3.1 Findings 1. The captain, first officer, and flight engineer were properly certificated and qualified and had received the training and off-duty time prescribed by Federal regulations and company requirements. No evidence indicated any preexisting medical or behavioral conditions that might have adversely affected the flight crew’s performance during the accident flight. 2. The accident airplane was certificated, equipped, and dispatched in accordance with applicable regulations and industry practices. 3. Cargo loading for the accident flight was routine, and the airplane was operating within prescribed center of gravity limits. 4. Weather and air traffic control were not factors in this accident. 5. At some time after the previous takeoff (from Reno, Nevada) and before the accident takeoff roll, the bolt connecting the right elevator control tab crank fitting to the pushrod migrated out of the fitting, allowing the control tab to disengage from its pushrod and shift to a trailing edge down position. 6. When the aerodynamic forces increased as the airplane accelerated during the takeoff roll, the right elevator control tab crank fitting contacted the disconnected pushrod, restricting that control tab’s further trailing edge up movement and leaving it in an extreme trailing edge down deflection. 7. As a result of the right elevator control tab’s extreme trailing edge down deflection, the accident airplane’s elevator surfaces were driven to command an extreme airplane nose-up pitch attitude; despite the large nose-down forces the pilots applied to the control columns, the pilots were unable to overcome the effects of the restricted right elevator control tab. 8. The bolt attaching the accident airplane’s right elevator control tab crank fitting to the pushrod was improperly secured and inspected, either during the most recent D inspection or subsequent maintenance; however, the Board was unable to determine when this improper securement and inspection occurred. 9. DC-8 operators’ procedures and training should more clearly emphasize that DC-8 flight crewmembers need to verify symmetry between the right and left side elevators, control tabs, and geared tabs during the preflight inspection.

Conclusions 82 Aircraft Accident Report

1. DC-8 operators, including Emery, do not use the elevator position indicator (EPI) to

confirm elevator movement indications above and below the neutral range during the 80-knot elevator check and, thus, do not take full advantage of the EPI’s capabilities to provide pilots with an indication of an abnormal elevator condition.

1. The elevator position indicator needs to be periodically calibrated to ensure that it

provides the most accurate information possible to the pilots.

1. The elevator position indicator gauge should be readily visible to both pilots.
2. The circumstances of the Emery flight 17 accident show that the current DC-8 design

does not preclude a catastrophic result from a disconnection or failure of the existing control tab crank fitting to pushrod attachment.

1. There may be airplanes that were certificated to Civil Aviation Regulations 4b

standards other than the DC-8 on which the disconnection of a critical flight control could have catastrophic results.

1. Replacement of the DC-8 aluminum elevator geared tab crank arms on DC-8

airplanes with stainless steel elevator geared tab crank arms would likely eliminate the possibility of a jam resulting from fractured geared tab crank arms.

1. DC-8 elevator rigging procedures should be fully addressed in a separate work card

that specifically lists required inspection items, including verifying the security of elevator control tab attachments after the rigging is completed.

1. All DC-8 work cards related to critical flight controls should identify required

inspection items as discrete tasks with individual inspection signoff requirements.

1. All air carrier operators should provide maintenance personnel with more detailed

information regarding the steps or actions that are necessary to satisfactorily accomplish a maintenance task.

1. The use of outdated, incomplete, or otherwise unsuitable reference materials by

maintenance personnel during the installation and/or assembly of airplane components can occur and is a potentially unsafe practice.

1. The use of a single airplane’s flight data recorder (FDR) parameter correlation for all

airplanes of the same type is inadequate to ensure accurate correlations for older airplanes that have been retrofitted to record additional FDR parameters.

1. Loral Fairchild Model F-800 flight data recorders with unaddressed or unidentified

tracking-switching anomalies may currently be in operation.

1. The current regulatory definition of safety-sensitive functions is too narrow for the

issue of postaccident testing because it does not include cargo handlers, load planners, and ramp supervisors, all of whom have a demonstrated potential to affect the safety of a flight.

Conclusions 83 Aircraft Accident Report 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of the accident was a loss of pitch control resulting from the disconnection of the right elevator control tab. The disconnection was caused by the failure to properly secure and inspect the attachment bolt.

84 Aircraft Accident Report 4. Recommendations As a result of the investigation of the Emery Worldwide Airlines flight 17 accident, the National Transportation Safety Board recommends that the Federal Aviation Administration: Require all DC-8 operators to train DC-8 flight crewmembers to look for symmetry between the right and left side elevators, control tabs, and geared tabs during preflight inspection, consistent with Boeing’s June 2001 flight operations bulletin guidance. (A-03-22) Require the development of DC-8 80-knot elevator check procedures that will ensure that pilots are clearly made aware of whether the elevator is functioning properly before the airplane lifts off, then require all DC-8 operators to incorporate these procedures into their training and normal operations. The procedures should contain specific guidance regarding an expected range of elevator position indicator (EPI) needle movement (including EPI needle movement well below the neutral mark with forward control column movement) and specific criteria for aborting a takeoff as a result of an inadequate elevator movement indication. (A-03-23) Require all DC-8 operators to incorporate periodic elevator position indicator (EPI) calibration inspections into their maintenance programs to ensure that the EPI indications observed by pilots accurately represent the condition of the elevator. (A-03-24) Require DC-8 elevator position indicators to be located and sized so that they are visible and usable for both the captain and first officer. (A-03-25) Require Boeing to redesign DC-8 elevator control tab installations and require all DC-8 operators to then retrofit all DC-8 airplanes with these installations such that pilots are able to safely operate the airplane if the control tab becomes disconnected from the pushrod. (A-03-26) Evaluate airplanes other than the DC-8 certificated to Civil Aviation Regulations 4b standards to evaluate whether disconnection or failure of critical flight control systems could have catastrophic results and, if so, require that they also be redesigned and retrofitted and/or equipped with dual-locking devices to preclude such catastrophic results. (A-03-27) Require all DC-8 operators to replace all DC-8 aluminum elevator geared tab crank arms on their DC-8 airplanes with stainless steel elevator geared tab crank arms. (A-03-28)

Recommendations 85 Aircraft Accident Report Require all DC-8 operators to create or revise DC-8 work cards to ensure they specifically include a postrigging inspection of the elevator assembly, including verifying the security of elevator control tab attachments. (A-03-29) Require all DC-8 operators to review their work cards related to critical flight controls, and revise them as necessary to ensure that appropriate tasks are identified as discrete tasks with individual inspection signoff requirements. (A-03-30) Require all 14 Code of Federal Regulations Part 121 air carrier operators to revise their task documents and/or work cards to describe explicitly the process to be followed in accomplishing maintenance tasks. (A-03-31) Require all air carrier operators to either: 1) provide all pertinent maintenance personnel with the manufacturer’s current installation drawings for pertinent airplanes, update those installation drawings as needed, and require use of those drawings during installation and/or assembly of that airplane’s components; or 2) list the IPC on that operator’s operation specifications, provide maintenance personnel with up-to-date IPCs for reference, continue to update those IPCs as needed, and require maintenance personnel to use the pertinent updated IPCs during installation and/or assembly of an airplane’s components. (A-03-32) Require operators of airplanes manufactured before August 18, 2000, that have been retrofitted with additional flight data recorder (FDR) parameters in compliance with Federal requirements and for which an operator maintains a common correlation document for that airplane type to conduct a full correlation of all such airplanes’ FDR parameters at the airplanes’ next required FDR maintenance inspection to verify accurate FDR system documentation and sensor function. (A-03-33) Require all operators of airplanes equipped with Loral Fairchild Model F-800 flight data recorders to comply with Loral Fairchild Field Service Bulletins digital flight recorder (DFR) 011 and DFR 027 for recorders with applicable part numbers and installed component numbers. (A-03-34) Require overhaul facilities that service Loral Fairchild Model F-800 flight data recorders to monitor those recorders to determine whether abnormal track switching is occurring and to report any such findings to the Federal Aviation Administration and the manufacturer. (A-03-35) Modify the list of safety-sensitive functions described in 14 Code of Federal Regulations Part 121, Appendixes I and J, to include all personnel with direct access to the airplane and a direct role in the handling of the flight, including cargo handlers, load planners, and ramp supervisors. (A-03-36)

Recommendations 86 Aircraft Accident Report BY THE NATIONAL TRANSPORTATION SAFETY BOARD ELLEN G. ENGLEMAN Chairman CAROL J. CARMODY Member MARK V. ROSENKER Vice Chairman JOHN J. GOGLIA Member RICHARD F. HEALING Member Adopted: August 5, 2003

87 Aircraft Accident Report Board Member Statements Member John J. Goglia’s Statement I concur with the findings and probable cause of the accident; but I would like to emphasize the significance of information contained in the public docket for this accident that is not included in the report. This is clearly a maintenance accident, related to many operations of each of the organizations involved. There is concern regarding the accuracy of company and aircraft manufacturer manuals, poor quality of task documentation and job cards, and a lack of sufficient detail to satisfactorily complete the tasks. Both the report and the public docket identify deficiencies that are not unique. There are similar examples in the recent past contained within the NTSB accident database. The Board has made recommendations in this report which attempt to focus attention on the inconsistent use of and responsibility for maintenance manuals, illustrated parts catalog, and task documents used to accomplish maintenance on aircraft. Detailed task descriptions, well trained mechanics, thorough inspection of work, along with complete and accurate documentations is the only method for ensuring that a maintenance task is properly completed. Chairman Engleman, Vice Chairman Rosenker, and Members Carmody and Healing concurred with this statement.

this page intentionally left blank

89 Aircraft Accident Report 5. Appendixes Appendix A Investigation and Hearing Investigation The National Transportation Safety Board was initially notified of this accident on the evening of February 16, 2000. Investigators from the Safety Board’s Southwest Regional Office went immediately to the scene of the accident. A full go-team was assembled and departed Washington, D.C., early on the morning of February 17, arriving at the accident site by late morning Pacific standard time. The go-team was accompanied by then-Safety Board Member George Black and representatives from the Safety Board’s Office of Government, Public, and Family Affairs. The following investigative groups were formed during the course of this investigation: Airworthiness (Structures/Systems), Maintenance Records, Maintenance Inspection, Powerplants, Air Traffic Control, Operations/Human Performance, Aircraft Performance, Flight Data Recorder, Cockpit Voice Recorder (CVR), CVR Sound Spectrum, and Hazardous Materials. Parties to the investigation were the Federal Aviation Administration (FAA); the Boeing Company; Emery Worldwide Airlines, Inc. (Emery); the Air Line Pilots Association (ALPA); Miami Aircraft Support (now known as Worldwide Flight Services); Tennessee Technical Services (TTS); and General Electric Aircraft Engines. Public Hearing A public hearing was conducted for this accident on May 9 and 10, 2002, in Washington, D.C. Member John Goglia presided over the hearing. Parties to the public hearing were the FAA, Boeing, Emery, TTS, and ALPA.

90 Aircraft Accident Report Appendix B Cockpit Voice Recorder Transcript The following is an excerpted transcript of the Sundstrand AV557 cockpit voice recorder (CVR) installed on the accident airplane. Only radio transmissions to and from the accident airplane were transcribed. The full CVR transcript (available in the public docket for this accident) reflects the 33 minutes and 24 seconds before power was lost to the CVR. All times are Pacific standard time, based on a 24-hour clock.

LEGEND

CAM Cockpit area microphone voice or sound source

RDO Radio communications transmitted to and from N8079U

APR Radio transmission from Sacramento approach controller

GND Radio transmission from Mather Field ramp personnel

-1 Voice identified as the Captain

-2 Voice identified as the First Officer

-3 Voice identified as the Second Officer

-4 Unidentified female voice

-? Voice unidentified

Unintelligible word Expletive

@ Non-pertinent word

( ) Questionable insertion

[ ] Editorial insertion

... Pause

Note 1: Times are expressed in pacific standard time (PST).

Note 2: Generally, only radio transmissions to and from the accident aircraft were transcribed.

Note 3: Words shown with excess vowels, letters, or drawn out syllables are a phonetic representation of the words as spoken.

Note 4: A non-pertinent word, where noted, refers to a word not directly related to the operation, control or condition of the aircraft.

Appendix B 91 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 43 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:42:17

CAM-1 ready on the rudders?

19:42:18

CAM-3 yep.

19:42:20

CAM-2 you're ah... clear right.

19:42:21

CAM-1 left rudder. center.

19:42:23

CAM-3 checked.

19:42:24

CAM-1 right rudder. center.

19:42:25

CAM-3 checked.

19:42:27

CAM-1 elevator forward. coming back.

19:42:29

CAM-2 EPI checks.

Appendix B 92 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 44 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:42:30

CAM-1 taxi check.

19:42:31

CAM-3 taxi check list. flaps and slots.

19:42:36

CAM-1 ahh fifteen. fifteen. fifteen. slot light's out.

19:42:39

CAM-2 fifteen. fifteen. fifteen. slot light's out.

19:42:43

CAM-3 controls EPI.

19:42:44

CAM-2 checked.

19:42:45

CAM-3 checked.

19:42:46

CAM-3 fuel panel set. spoilers.

19:42:49

CAM-2 retracted. lights out.

Appendix B 93 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 45 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:42:51

CAM-3 fuel levers.

19:42:52

CAM-2 on in detent.

19:42:53

CAM-3 yaw damper.

19:42:54

CAM-2 on.

19:42:55

CAM-3 stabilizer.

19:42:58

CAM-1 one point six.

19:43:00

CAM-2 set one point six.

19:43:01

CAM-3 one six.

19:43:03

CAM-3 shoulder harness.

Appendix B 94 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 46 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:43:06

CAM-1 on the left.

19:43:06

CAM-2 on the right.

19:43:08

CAM-3 (rear).

19:43:09

CAM-3 take off data briefing.

19:43:12

CAM-? [sound of throat clearing]

19:43:13

CAM-1 set left reviewed.

19:43:15

CAM-2 set and reviewed.

19:43:16

CAM-? set ***.

19:43:19

CAM-3 flight nav instruments.

Appendix B 95 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 47 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:43:20

CAM [sound of click]

19:43:21

CAM-1 set left.

19:43:22

CAM-2 set right.

19:43:23

CAM-3 taxi checklist complete.

19:43:26

RDO [transmission from guard helicopter one six seven one nine – position report to Mather]

19:43:30

CAM-? **.

19:43:30

CAM [sound of laughter]

19:43:32

CAM-2 sounds like he's getting a massage.

19:43:39

CAM-3 whirling dervish.

Appendix B 96 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 48 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:43:43

CAM-2 that'd be fun. I've never been I've been in one of those airstar helicopters you know like the Cadillac of helicopters. I've never really been in a a helicopter you know.

19:43:53

CAM-3 I went up one those R twenty two Robinsons.

19:43:56

CAM-2 yeah...

19:43:56

CAM-3 that was a * thing.

19:43:57

CAM-2 ...now that was a helicopter.

19:43:58

CAM-2 yeah.

19:43:59

CAM-3 went up to * and did some autorotations. that was a blast.

19:44:04

CAM-3 really weird going that slow in the air though. I don't like it. [sound of chuckle]

19:44:09

CAM-2 hey you're you're hanging by that bolt you know.

Appendix B 97 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 49 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:44:12

CAM-3 yeah... Jesus nut.

19:44:14

APR [Sacramento approach release for UPS nine fifty five]

19:44:15

CAM-2 yep.

19:44:28

RDO [UPS nine fifty five transmission departing Mather]

19:44:40

CAM-1 he must be in a hurry.

19:44:42

CAM-2 he must be yeah.

19:44:48

CAM [sound similar to engine rpm increasing]

19:44:49

CAM-2 he probably gets ICP.

19:45:13

CAM [sound of snap]

Appendix B 98 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 50 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:46:12

RDO [UPS nine fifty five in left hand turn to zero nine zero heading]

19:46:43

RDO [guard helicopter seven one nine crossing the numbers for two two left for taxi to north helipad]

19:46:52

CAM-2 oh there he is.

19:46:53

CAM-1 yeah. *.

19:46:58

RDO-2 Sacramento departure Emery seventeen heavy number one two two left Mather. need our release to ah... Dayton.

19:47:07

CAM-2

• position lights?

19:47:07

CAM-1 clear right.

19:47:08

CAM-2 yeah just that one beacon.

19:47:11

CAM-3 no I I see 'em.

Appendix B 99 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 51 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:47:12

CAM-? ***.

19:47:13

CAM-2 that's * light. yeah that's an instrument light.

19:47:14

APR Emery seventeen heavy Sacramento approach you're released for departure report airborne.

19:47:16

CAM [sound of four clicks]

19:47:18

CAM [sound of clicking]

19:47:20

RDO-2 Emery seventeen heavy we'll call you in the air.

19:47:21

CAM-? ** position lights.

19:47:24

CAM-1 before takeoff.

19:47:25

CAM [sound similar to brake release]

Appendix B 100 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 52 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:47:28

CAM-1 before takeoff checklist.

19:47:29

CAM [sound similar to increasing engine rpm]

19:47:30

RDO-2 Mather area traffic Emery seventeen heavy runway two two left be a left downwind departure Mather.

19:47:30

CAM [sound of a clunk]

19:47:34

CAM [sound of two clunks]

19:47:40

CAM-? [sound of clearing throat]

19:47:40

CAM-2 okay you're clear on the right.

19:47:52

CAM-3 anti-skid.

19:47:55

CAM-2 armed. light's out.

Appendix B 101 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 53 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:47:56

CAM-3 ignition.

19:47:57

CAM-2 all engines both.

19:47:58

CAM-3 transponder. DME.

19:47:59

CAM-2 on.

19:48:00

CAM-2 reverse switch.

19:48:01

CAM-2 open pressure checks.

19:48:02

CAM-3 spoiler pumps normal. stand by rudder pump start. packs are off. boost pumps boost and feed. landing lights.

19:48:07

CAM-1 on.

19:48:08

CAM-3 parking brake.

Appendix B 102 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 54 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:48:09

CAM [sound of three clicks]

19:48:10

CAM-1 released.

19:48:10

CAM-3 before takeoff checklist complete.

19:48:11

CAM-1 your brakes.

19:48:12

CAM-2 yeah.

19:48:15

CAM [sound similar to increasing engine rpm]

19:48:16

CAM [sound of click]

19:48:21

CAM [sound of creak]

19:48:23

CAM-2 stand by four. there we go.

Appendix B 103 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 55 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:48:24

CAM-3 four spooled.

19:48:40

CAM-1 set reduced.

19:48:44

CAM-1 airspeed's alive.

19:48:44

CAM-2 alive here.

19:48:45

CAM [sound of two clicks, first louder than second]

19:48:50

CAM-1 eighty knots.

19:48:51

CAM-2 eeighty knots...

19:48:52

CAM [sound of two clunks, first softer than second]

19:48:53

CAM-2 ...elevator checks.

Appendix B 104 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 56 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:48:54

CAM [sound of two clunks, first louder than second]

19:48:55

CAM [sound of ratcheting noise, ending with clunk]

19:48:57

CAM [sound of clunk]

19:49:02

CAM-1 V one.

19:49:06

CAM-1 rotate.

19:49:08

CAM [sound similar to stabilizer trim in motion alert]

19:49:08

CAM-1 ** (go)...

19:49:09

CAM [sound similar to stabilizer trim in motion alert]

19:49:09

CAM-1 ...watch the tail.

Appendix B 105 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 57 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:49:11

CAM [sound similar to stabilizer trim in motion alert]

19:49:12

CAM [sound similar to stabilizer trim in motion alert]

19:49:13

CAM-1 V two.

19:49:14

CAM [sound similar to stabilizer trim in motion alert]

19:49:14

CAM-1 positive rate.

19:49:16

CAM-2 I got it.

19:49:17

CAM-1 you got it?

19:49:17

CAM-2 yep.

19:49:18

CAM-1 all right.

Appendix B 106 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 58 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:49:18

CAM [sound of two clicks]

19:49:19

CAM-2 we're going back.

19:49:20

CAM-3 what the #?

19:49:20

CAM-2 CG's waay out of limits.

19:49:25

CAM-3 #. do you want to pull the power back?

19:49:27

CAM [sound similar to decreasing engine rpm]

19:49:29

CAM [sound similar to stick shaker]

19:49:30

CAM-2 oh #.

19:49:30

CAM-1 push forward.

Appendix B 107 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 59 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:49:31

CAM-2 goddd... #.

19:49:34

CAM-2 god.

19:49:36

RDO-1 Emery seventeen emergency.

19:49:38

CAM-2 ahhh #.

19:49:40

APR Emery seventeen Sacramento departure radar contact say again?

19:49:40

CAM-2 you steer. I'm pushing.

19:49:44

RDO-1 Emery seventeen has an emergency.

19:49:44

CAM-3 we're sinking. we're going down guys.

19:49:46

APR Emery seventeen go ahead.

Appendix B 108 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 60 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:49:46

CAM [sound similar to increased engine rpm]

19:49:47

CAM whoop whoop pull up whoop whoop pull up whoop whoop pull up whoop whoop pull up whoop...

19:49:47

CAM-2 power.

19:49:51

CAM-2 #.

19:49:51

CAM ... whoop pull up. [GPWS voice]

19:49:52

CAM-1 all right all right... all right.

19:49:54

CAM-2 push.

19:49:54

CAM-3 okay so... we're going back up.

19:49:55

CAM [sound of two clunks]

Appendix B 109 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 61 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:49:57

CAM-3 there you go.

19:49:58

CAM-1 roll out.

19:49:59

CAM-? roll out.

19:50:01

CAM-? [sound of strained exhale]

19:50:04

RDO-1 Emery seventeen extreme CG problem.

19:50:06

APR Emery seventeen roger.

19:50:07

CAM-3 #.

19:50:10

CAM-? [sound of strained exhale]

19:50:11

CAM-3 anything I can do guys.

Appendix B 110 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 62 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:50:11

CAM-1 roll out to the right.

19:50:12

CAM-2 okay.

19:50:15

CAM-2 push.

19:50:16

CAM-? push forward.

19:50:18

CAM-2 awww...

19:50:19

CAM [sound of creaking]

19:50:19

CAM-2 ...#.

19:50:22

CAM-? #.

19:50:25

CAM-2 okay.

Appendix B 111 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 63 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:50:26

CAM-3 you got the trim maxed?

19:50:28

CAM-2 power.

19:50:28

CAM-3 more?

19:50:29

CAM-2 yeah.

19:50:29

CAM whoop whoop pull up whoop whoop pull up whoop...

19:50:32

CAM-2 we're gonna have to land fast.

19:50:32

CAM ...whoop pull up whoop whoop pull up. [GPWS voice]

19:50:36

CAM-1 left turn.

19:50:36

CAM-2 okay.

Appendix B 112 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 64 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:50:37

CAM-2 what I'm trying to do is make the airplane's position match the elevator. that's why I'm putting it in a bank.

19:50:45

CAM-1 all right.

19:50:45

CAM-2 okay.

19:50:46

CAM-1 left turn.

19:50:46

CAM-2 so we're gonna have to land it in like a turn.

19:50:47

CAM-1 bring it around.

19:50:48

CAM [sound similar to stick shaker]

19:50:49

CAM-1 bring it around.

19:50:49

CAM-2 god #.

Appendix B 113 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 65 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:50:51

CAM-? [sound of grunt]

19:50:51

CAM [sound of rustling]

19:50:53

CAM-3 #.

19:50:54

CAM-2 you got the airport?

19:50:56

CAM-1 bring it around.

19:50:56

CAM [sound of snap]

19:51:00

CAM-2 power.

19:51:02

CAM whoop whoop pull up whoop. [GPWS voice]

19:51:02

[audio interruption on all four channels due to CVR tape heat damage]

Appendix B 114 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION 66 of 66 AIRCRAFT-TO-GROUND COMMUNICATION

Time (PST) Time (PST) SOURCE CONTENT SOURCE CONTENT

19:51:07

CAM-2 power.

19:51:07

CAM-2 aww #.

19:51:08

CAM-? **.

19:51:08

CAM [sound similar to impact]

19:51:09

End of Transcript

End of Recording

FD07267 ｜ 2003_美国_AAR0303.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2003 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Loss of Control and Impact With Terrain Aviation Charter, Inc. Raytheon (Beechcraft) King Air A100, N41BE Eveleth, Minnesota October 25, 2002 Aircraft Accident Report NTSB/AAR-03/03 PB2003-910403 Notation 7602 National Transportation Safety Board Washington, D.C.

this page intentionally left blank

Aircraft Accident Report Loss of Control and Impact With Terrain Aviation Charter, Inc. Raytheon (Beechcraft) King Air A100, N41BE Eveleth, Minnesota October 25, 2002 NTSB/AAR-03/03 PB2003-910403 National Transportation Safety Board Notation 7602 490 L’Enfant Plaza, S.W. Adopted November 18, 2003 Washington, D.C. 20594 E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N

National Transportation Safety Board. 2003. Loss of Control and Impact With Terrain, Aviation Charter, Inc., Raytheon (Beechcraft) King Air A100, N41BE, Eveleth, Minnesota, October 25, 2002. Aircraft Accident Report NTSB/AAR-03/03. Washington, DC. Abstract: This report explains the accident involving Aviation Charter, Inc., which crashed while the flight crew was attempting to execute the VOR approach to runway 27 at Eveleth-Virginia Municipal Airport, Eveleth, Minnesota, on October 25, 2002. The safety issues discussed in this report include flight crew proficiency, Aviation Charter operational and training issues, inadequate crew resource management (CRM) training, Federal Aviation Administration (FAA) surveillance, and the need for improved low-airspeed awareness. Safety recommendations concerning CRM training, FAA surveillance, and low-airspeed alert systems are addressed to the FAA. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2003-910403 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Aircraft Accident Report Contents Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

1. Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
2. 1

History of Flight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.2 Injuries to Persons. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1.3 Damage to Airplane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.4 Other Damage. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.5 Personnel Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.5.1 The Pilot. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.5.1.1 The Pilot’s 72-Hour History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.5.1.2 The Pilot’s Logbook History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 1.5.2 The Copilot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 1.5.2.1 The Copilot’s 72-Hour History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 1.6 Airplane Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 1.7 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1.7.1 National Weather Service Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1.7.2 Airport Weather Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 1.7.3 Additional Icing and Cloud Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 1.8 Aids to Navigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 1.8.1 EVM VOR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 1.8.1.1 Preaccident Flight Checks of the EVM VOR . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 1.8.1.2 Postaccident Ground and Flight Checks of the EVM VOR . . . . . . . . . . . . . . . . 20 1.8.1.3 VOR Navigation System Special Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 1.9 Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 1.10 Airport Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 1.10.1 Air Traffic Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 1.11 Flight Recorders. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 1.12 Wreckage and Impact Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 1.12.1 General. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 1.12.2 Cockpit Instrumentation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 1.13 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 1.14 Fire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 1.15 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 1.16 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 1.16.1 Airplane Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 1.16.2 Operational Factors and Human Performance Simulations. . . . . . . . . . . . . . . . . . . 28 1.17 Organizational and Management Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 1.17.1 Company Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 1.17.1.1 Crew Resource Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 1.17.1.2 Stall Recovery Maneuvers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 1.17.1.3 Instrument Approaches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 1.17.1.4 Standard Operating Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Contents iv Aircraft Accident Report 1.17.2 Operational Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 1.17.2.1 Manufacturer’s Guidance on Operation in Icing Conditions. . . . . . . . . . . . . . . . 36 1.17.2.2 Company Guidance on Operation in Icing Conditions . . . . . . . . . . . . . . . . . . . . 36 1.17.2.3 Weight and Balance Load Manifest Procedures . . . . . . . . . . . . . . . . . . . . . . . . . 37 1.17.3 FAA Surveillance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 1.17.3.1 General. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 1.17.3.2 FAA Surveillance Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 1.17.3.3 Minneapolis FSDO Oversight of Aviation Charter . . . . . . . . . . . . . . . . . . . . . . . 39 1.17.3.4 FAA En Route Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 1.17.3.5 Preaccident FAA Regional Aviation Safety Inspection Program Inspection . . . 40 1.18 Additional Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 1.18.1 Previous Aviation Charter Operations-Related Accident . . . . . . . . . . . . . . . . . . . . 41 1.18.2 Previous CRM-Related Safety Recommendation . . . . . . . . . . . . . . . . . . . . . . . . . . 41

1. Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
2. 1

General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 2.2 Determination of Flying Pilot. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 2.3 Accident Sequence of Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 2.3.1 Flight Crew’s Inadequate Setup for the Approach. . . . . . . . . . . . . . . . . . . . . . . . . . 44 2.3.2 Flight Crew’s Failure to Stabilize the Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 2.3.3 Summary of Flight Crew’s Performance During the Approach . . . . . . . . . . . . . . . 46 2.4 Weather Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 2.4.1 Clouds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 2.4.2 Airframe Icing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 2.5 ATC Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 2.6 EVM VOR Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 2.7 Flight Crew Proficiency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 2.8 Aviation Charter Operational and Training Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 2.8.1 Operational Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 2.8.2 CRM Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 2.9 FAA Surveillance Issues. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 2.9.1 FAA Surveillance of Aviation Charter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 2.9.2 FAA Surveillance of Part 135 On-Demand Operations. . . . . . . . . . . . . . . . . . . . . . 53 2.9.3 FAA CRM Training Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 2.10 Low-Airspeed Alert Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 2.10.1 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 2.10.2 Need for Improved Low-Airspeed Awareness . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

1. Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
2. 1

Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 3.2 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

1. Recommendations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
2. 1

New Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 4.2 Previously Issued Recommendation Classified in This Report . . . . . . . . . . . . . . . . . . . 61

1. Appendix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

A: Investigation and Public Hearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

v Aircraft Accident Report Figures

1. The published EVM VOR approach chart. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2. Ground track of the accident flight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
3. Profile view of the accident flight. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
4. Reconstruction of pilot’s reported flight hours. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

vi Aircraft Accident Report Abbreviations AC advisory circular AFM Aircraft Flight Manual AFSS Automated Flight Service Station agl above ground level AIM Aeronautical Information Manual AIRMET airmen’s meteorological information ARAC Aviation Rulemaking Advisory Committee ASOS automated surface observing system ATC air traffic control ATCT air traffic control tower ATP airline transport pilot ATSS Airway Transportation System Specialist AWC Aviation Weather Center AWOS automated weather observing system BIS Bismarck Municipal Airport C Celsius CAMI Civil Aerospace Medical Institute CDI course deviation indicator CFI certified flight instructor CFR Code of Federal Regulations CG center of gravity CRM crew resource management CVR cockpit voice recorder DLH Duluth International Airport DME distance measuring equipment EVM Eveleth-Virginia Municipal Airport

Abbreviations vii Aircraft Accident Report FA area forecast FAA Federal Aviation Administration FAF final approach fix FAR Federal Aviation Regulations FBO fixed-base operator FCM Flying Cloud Municipal Airport FGS flight guidance system fpm feet per minute FSDO Flight Standards District Office FSI Flight Safety International ft-lbs foot-pounds GOM General Operations Manual HSI horizontal situation indicator IFR instrument flight rules ILS instrument landing system IMC instrument meteorological conditions JAR Joint Aviation Requirements KCAS knots calibrated airspeed MAP missed approach point MDA minimum descent altitude msl mean sea level NASA National Aeronautics and Space Administration NCAR National Center for Atmospheric Research NOTAM notice to airmen NWS National Weather Service PIC pilot-in-command PIREP pilot report POI principal operations inspector

Abbreviations viii Aircraft Accident Report RASIP Regional Aviation Safety Inspection Program ROC Rochester International Airport RTCA Radio Technical Commission of Aeronautics SLD supercooled large droplets SOPs Standard Operating Procedures STP St. Paul Downtown Airport TAF terminal aerodrome forecast UTC coordinated universal time VOR very high omnidirectional range

ix Aircraft Accident Report Executive Summary On October 25, 2002, about 1022 central daylight time, a Raytheon (Beechcraft) King Air A100, N41BE, operated by Aviation Charter, Inc., crashed while the flight crew was attempting to execute the VOR approach to runway 27 at Eveleth-Virginia Municipal Airport, Eveleth, Minnesota. The crash site was located about 1.8 nautical miles southeast of the approach end of runway 27. The two pilots and six passengers were killed, and the airplane was destroyed by impact forces and a postcrash fire. The airplane was being operated under the provisions of 14 Code of Federal Regulations Part 135 as an on-demand passenger charter flight. Instrument meteorological conditions prevailed for the flight, which operated on an instrument flight rules flight plan. The National Transportation Safety Board determines that the probable cause of this accident was the flight crew’s failure to maintain adequate airspeed, which led to an aerodynamic stall from which they did not recover. The safety issues discussed in this report include flight crew proficiency, Aviation Charter operational and training issues, inadequate crew resource management (CRM) training, Federal Aviation Administration (FAA) surveillance, and the need for improved low-airspeed awareness. Safety recommendations concerning CRM training, FAA surveillance, and low-airspeed alert systems are addressed to the FAA.

this page intentionally left blank

1 Aircraft Accident Report 1. Factual Information 1.1 History of Flight On October 25, 2002, about 1022 central daylight time,1 a Raytheon (Beechcraft) King Air A100,2 N41BE, operated by Aviation Charter, Inc., crashed while the flight crew was attempting to execute the VOR3 approach to runway 27 at Eveleth-Virginia Municipal Airport (EVM), Eveleth, Minnesota. The crash site was located about 1.8 nautical miles4 southeast of the approach end of runway 27. The two pilots and six passengers were killed, and the airplane was destroyed by impact forces and a postcrash fire. The airplane was being operated under the provisions of 14 Code of Federal Regulations (CFR) Part 135 as an on-demand passenger charter flight. Instrument meteorological conditions (IMC) prevailed for the flight, which operated on an instrument flight rules (IFR) flight plan. The accident flight was chartered for U.S. Senator Paul Wellstone. The flight was scheduled to depart St. Paul Downtown Airport (STP), St. Paul, Minnesota, about 0920 and arrive at EVM around 1020. The flight crew planned to drop off the passengers at EVM and then ferry the accident airplane from EVM to Duluth International Airport (DLH), Duluth, Minnesota, with a scheduled arrival of about 1054. The passengers were to be transported by car to DLH after their activities were concluded in Eveleth. The flight crew planned to remain at DLH until the flight back to STP, which was scheduled to depart at 2115. According to Federal Aviation Administration (FAA) records, the pilot called the Princeton Automated Flight Service Station (AFSS) for an abbreviated weather briefing about 0716. The AFSS specialist informed the pilot that AIRMETs [airmen’s meteorological information] for IFR and icing conditions were current over the entire route.5 He added that IFR conditions were reported throughout central and northern Minnesota and that cloud conditions near STP were reported as broken between 800 and 1,000 feet6 and overcast between 1,300 and 1,600 feet. He also stated that cloud 1 Unless otherwise indicated, all times in this report are central daylight time, based on a 24-hour clock. 2 Raytheon Aircraft Company acquired Beech Aircraft Corporation in February 1980. 3 VOR stands for very high frequency omnidirectional range. 4 Unless otherwise indicated, all distances in this report are reported in nautical miles. 5 An AIRMET is an in-flight weather advisory issued by the National Weather Service (NWS) to indicate weather that may be hazardous to single-engine and other light aircraft and visual flight rules pilots. Operators of large aircraft may also be concerned with the information included in an AIRMET. For more information about the meteorological conditions that existed surrounding the time of the accident, see section 1.7. 6 Altitudes referenced in this report from surface weather observations and terminal aerodrome forecasts (TAF) are reported as height above ground level (agl). Unless otherwise indicated, all other altitudes referenced in this report are reported as height above mean sea level (msl).

Factual Information 2 Aircraft Accident Report conditions at EVM were reported as scattered at 1,000 feet and overcast at 2,000 feet and that visibility was reported as 4 statute miles in light snow. He added that between STP and EVM the cloud ceilings were reported between 300 and 600 feet and visibility was reported as between 1 to 4 statute miles in light snow and mist. The pilot then asked for freezing level information7 and weather information for DLH in case he had to land there as an alternate to EVM. The AFSS specialist indicated that at that time, DLH was reporting an overcast cloud ceiling of 500 feet and visibility of 2 statute miles in light snow and mist. He added that the terminal forecast indicated an overcast cloud ceiling of 500 to 900 feet and visibility of 1 to 3 statute miles in rain or snow. About 0719, the pilot stated, “you know what[,] I don’t think I’m going to take this flight.” According to the Senator’s campaign scheduler, the pilot contacted her about 0720 and informed her that they might experience icing conditions during the flight. She stated that the pilot did not indicate that he was thinking of canceling the flight. The campaign scheduler stated that when she asked the pilot what he would do if icing became a problem, he told her that the airplane was equipped with deicing equipment and, if necessary, that he could turn the airplane back toward warmer air to melt the ice or divert to DLH. She stated that the pilot then reassured her that he was an experienced and conservative pilot. About 0730, the pilot contacted Aviation Charter’s headquarters in Eden Prairie, Minnesota, and asked the receptionist who answered his call to inform the company’s scheduling office that the Senator’s flight would be delayed because of the weather. The pilot then contacted the Million Air fixed-base operator (FBO) at STP and told its general manager that he would be departing about 1300 instead of 0920 and asked her to ensure that the airplane would be available at that time. However, the Senator’s campaign scheduler stated that when she talked to the pilot again about 0800, he indicated that the cloud ceiling had improved, and they agreed to go ahead with the flight as originally scheduled. According to FAA records, at 0817:57, the pilot contacted the Princeton AFSS and asked, “can you give me Eveleth weather right now?” The AFSS specialist stated that the latest automated weather for EVM was issued at 0754 and that it indicated calm winds, visibility of 3 statute miles in light snow, and an overcast cloud ceiling at 900 feet. He added that there was reported light mixed icing at 7,000 to 10,000 feet at Hibbing, Minnesota, and that the AIRMETs for IFR and icing conditions were still current. At 0818:38, the pilot began filing an IFR flight plan with an estimated departure time from STP of 0920. While filing the flight plan, the pilot asked the AFSS specialist if any turbulence was forecast, and the AFSS specialist replied, “no just icing they’ve been collecting in the tops and…it’s been running between ten and fifteen thousand.” The pilot then asked for a cruise level of 13,000 feet. 7 The AFSS specialist stated that the freezing level was reported to be from the surface to 7,000 feet in the northern portion of the area, sloping to 8,000 to 11,000 feet in the southern portion of the area.

Factual Information 3 Aircraft Accident Report According to Aviation Charter’s director of charter, sales, and marketing, the pilot called her about 0840 and stated that he had done a weather check with the Senator’s campaign staff and that they still wanted to depart as planned. He indicated that he was getting conflicting guidance from another of the Senator’s staffs and that he did not feel comfortable deciding whether or not to make the flight. The director of charter, sales, and marketing stated that she told the pilot to contact the company’s chief pilot and that the pilot indicated that he had tried to contact the chief pilot but had not been able to reach him. She stated that she suggested to the pilot that he speak to the company’s director of operations. She also stated that the pilot did not seem overly stressed, just concerned about doing a good job. Aviation Charter’s director of operations stated that he did not speak with the pilot that morning but that the pilot had left him a voice message stating that there was some confusion about whether they should depart. He indicated that the pilot stated on the message that icing conditions might prevent them from returning to STP later that day as planned. According to Million Air’s general manager, the copilot checked with her before the flight to ensure that the airplane had been fueled and then went to the hangar to get catering items for the flight and to preflight the airplane. The airplane had been in the hangar overnight and was towed from the hangar after the copilot arrived at STP. According to Million Air’s general manager and another King Air pilot, the accident pilot arrived at STP shortly before 0900, and the Senator and his staff were already at the airport. The other King Air pilot, who had just arrived at STP from the DLH area, indicated that the accident pilot asked him about the weather conditions he had encountered on his flight and then asked him if he would mind sharing this information with the Senator. The other King Air pilot indicated that he told the Senator that the weather was at minimums, but he was sure the pilots could handle the flight. According to FAA air traffic control (ATC) records, the flight departed STP about 0937 and was cleared to proceed directly to EVM at 13,000 feet. ATC services were provided by the Minneapolis Terminal Radar Approach Control and the Minneapolis Air Route Traffic Control Center for the en route portion of the flight, and these services were routine. About 1001, the copilot8 contacted the DLH Air Traffic Control Tower (ATCT)9 and reported level at 13,000 feet proceeding direct to EVM. The DLH approach control south radar controller responded, “king air four one bravo echo duluth approach[,] when you have eveleth weather advise what approach you [would] like…had icing reports 8 The accident airplane was not equipped with a cockpit voice recorder (CVR); therefore, the Operations Group listened to the recorded ATC voice communications to identify which flight crewmember was operating the radios for each transmission. Although the group determined that the copilot made all but one of the transmissions to ATC, it could not determine who was the flying pilot (that is, the pilot manipulating the airplane’s flight controls) during the flight. 9 The DLH ATCT provides radar approach control services to EVM.

Factual Information 4 Aircraft Accident Report through the morning[;] the last report was from a saab…descended into duluth had light rime ice but earlier just about an hour ago…a dc nine had moderate rime between niner thousand and one one thousand.”10 The copilot acknowledged the transmission. About 1002, the controller instructed the flight crew to descend to and maintain 4,000 feet at pilot’s discretion. About 1004, the copilot contacted the DLH approach control south radar controller indicating that he had the current EVM weather11 and that he would like the VOR runway 27 approach. The controller advised, “expect vectors for the approach.” The copilot acknowledged the transmission. About 1006, the controller asked the flight crew what they intended to do in the event of a missed approach. The pilot responded, “well let’s hope we don’t have that if we…do have a missed approach we’ll go up and circle and figure this out[;] I’ll hold at the vor.”12 About 1009, the copilot reported leaving 13,000 feet for 4,000 feet. Radar data indicate that the airplane was approximately 34 miles south of EVM at this time. About 1012, the DLH approach control south radar controller instructed the flight crew to descend to 3,500 feet at pilot’s discretion.13 Radar data indicate that at 1015:17, the airplane was descending through 6,200 feet at about 194 knots calibrated airspeed (KCAS)14 when the controller instructed the flight crew to turn right to a heading of 50°. At 1017:21, the controller instructed the flight crew to turn left to a heading of 360°. By 1017:35, the airplane had leveled off at 3,500 feet and was heading northward with the airspeed decreasing through about 190 KCAS. At 1018:13, when the airplane was less than about 1/2 mile south of the published VOR runway 27 approach course (see figure 1), the DLH approach control south radar 10 In this report, the following terms are used to describe icing conditions: “rime,” “trace,” “light,” and “moderate.” According the to the Aeronautical Information Manual (AIM), rime ice is “rough, milky, opaque ice formed by the instantaneous freezing of small supercooled water droplets.” The AIM states that the term “trace” should be used to describe ice that has become perceptible, the term “light” should be used to describe ice that is accumulating at a rate that may create a problem if flight in such an environment is prolonged (over 1 hour) and the occasional use of deice/anti-icing equipment prevents the problem, and the term “moderate” should be used to describe ice that is accumulating at a rate that can become potentially hazardous even in short encounters and use of deicing/anti-icing equipment or flight diversion becomes necessary. 11 The 0954 weather observation from the automated weather observing system (AWOS)-3, which is located at EVM about 2 miles northwest from the accident site, included a reported visibility of 2 1/2 statute miles in light snow and a sky condition of 400 feet scattered, 700 feet overcast. Visibility of 1 statute mile was required to execute the VOR runway 27 approach. 12 For more information about Aviation Charter’s Abandoned Approach procedure, see section 1.17.1.3. 13 The VOR runway 27 approach procedure prescribes 2,800 feet as the initial approach altitude (within 10 miles of EVM). However, according to standard operating procedures for the DLH ATC facility, controllers assign a greater initial approach altitude than prescribed because intermittent radar coverage and radio communication exist below 3,000 feet in the vicinity of EVM. The DLH south radar controller stated that he assigned an initial approach altitude of 3,500 feet to ensure that he did not lose radar contact with the accident airplane. 14 KCAS was derived from FAA and U.S. Air Force 84th Radar Evaluation Squadron radar and atmospheric data. Because of limitations inherent in radar data, all radar-derived calculations of the airplane’s performance parameters presented in this report should be considered approximations.

Factual Information 5 Aircraft Accident Report controller advised, “one zero miles from the vor turn left heading three zero zero maintain three thousand five hundred [un]til established on the final approach course cleared for the vor runway two seven approach eveleth.” The copilot acknowledged the instruction at 1018:31. Radar data indicate that shortly thereafter, the airplane began turning left while maintaining 3,500 feet and slowing through about 164 KCAS. Almost immediately after the airplane began its left turn, it overshot the approach course and traveled for almost 1 mile north of the course as it continued the turn toward the course until establishing a ground track of about 262°. See figures 1 and 2 for the ground track and profile view of the accident flight. Figure 1. The published EVM VOR approach chart.

Factual Information 6 Aircraft Accident Report Figure 2. Ground track of the accident flight. Figure 3. Profile view of the accident flight.

Factual Information 7 Aircraft Accident Report At 1019:12, the controller stated, “king air one bravo echo change to advisory frequency approved[;] advise cancellation of ifr with the princeton flight service when on the ground.” The copilot acknowledged the instruction at 1019:20. This was the last transmission received by ATC from the accident airplane. Radar data indicate that at this time, the airplane began its descent from 3,500 feet and that its airspeed stopped decreasing about 155 KCAS and began increasing. The airplane’s airspeed increased to about 170 KCAS and its vertical speed increased through 1,000 feet per minute (fpm) as it descended through 3,200 feet. The airspeed stabilized briefly at about 170 KCAS and the vertical speed peaked at about 1,400 fpm. At 1020:06, as the airplane passed through (south of) the approach course about 5 miles east of the runway 27 threshold, a slight right turn was initiated, and the airplane’s airspeed and vertical speed began decreasing. The airplane established a ground track of about 269° and maintained this track until the end of the radar data at 1021:42. The last two radar returns indicate that the airplane had slowed to about 76 KCAS at 1,800 feet.15 One witness indicated that he saw the airplane to the west of his location (approximately 4.5 miles east of the runway 27 threshold) “just beneath a low layer of clouds” and that “the top of the airplane may still have been in the clouds.” He stated that he noticed the landing gear was down, but that he could not remember if any lights were illuminated on the airplane. The airplane impacted the ground about 1.8 miles southeast of the approach end of runway 27. The main wreckage was found at 47° 24.36' north latitude and 92° 27.05' west longitude at an elevation of 1,361 feet. The wreckage location was about 1/4 mile south-southwest of the last radar return. 1.2 Injuries to Persons Table 1. Injury chart. 15 Mode C radar data altitudes have a resolution of ± 50 feet. Injuries Flight Crew Cabin Crew Passengers Other Total Fatal 2 0 6 0 8 Serious 0 0 0 0 0 Minor 0 0 0 0 0 None 0 0 0 0 0 Total 2 0 6 0 8

Factual Information 8 Aircraft Accident Report 1.3 Damage to Airplane The airplane was destroyed by impact forces and a postcrash fire. 1.4 Other Damage Trees and other vegetation at and surrounding the crash site were damaged as a result of this accident. 1.5 Personnel Information 1.5.1 The Pilot The pilot, age 55, was hired by Aviation Charter on April 26, 2001. He held a multiengine airline transport pilot (ATP) certificate, issued August 4, 1989, with a type rating in the Cessna Citation (CE-500). (In April 1989, the pilot had been issued a notice of disapproval by the FAA following a flight check for his ATP certificate because of his unsatisfactory performance in several areas, including area arrivals, instrument landing system [ILS] approaches, normal/abnormal procedures, and judgment. He received additional training before retaking and passing the test on August 4, 1989.) The pilot’s most recent FAA first-class medical certificate was issued on December 17, 2001, and contained the limitation that he must wear corrective lenses for near and distant vision.16 According to documentation provided by the pilot’s wife, the pilot worked at Simmons Airlines (doing business as American Eagle) from November 1989 until April 27,

1. Simmons could not provide investigators with any documentation regarding his

employment at the company.17 However, the pilot’s personal records indicate that he reported for Simmons’ ground training on November 27, 1989. The pilot’s personal records indicated that Simmons’ ground training program consisted of 17 days of ground instruction, 3 days of training in a Frasca 121 flight-training device, more than 30 hours of flight training, and about 20 hours of initial operating experience. One of the pilot’s personal logbooks indicated that he had completed only 13.6 hours of flight training in Avions de Transport Regional 42 aircraft and that he had passed a checkride during this training. The pilot’s logbook also indicated that he had flown four revenue service flights as a first officer for Simmons on January 29 and 30, 1990 (a total of 4.5 hours). The Safety Board’s investigation was unable to determine if the pilot gained any additional flying experience while employed at Simmons. 16 It could not be determined if the pilot was wearing corrective lenses at the time of the accident. 17 The Pilot Records Improvement Act of 1996 requires any company hiring a pilot for air transportation to request and receive records from any aviation carrier, company, organization, or person that had employed a pilot applicant during the previous 5 years. Simmons did not have the pilot’s employment records because he had last been employed at the company more than 5 years previously.

Factual Information 9 Aircraft Accident Report From February 2 to 20, 1990, the pilot stood trial on criminal charges for mail and wire fraud. He was convicted and sentenced to 2 years in prison and 5 years probation. The pilot submitted a letter of resignation to Simmons dated April 27, 1990. He began his prison sentence on June 8, 1990, and remained in prison until November 8, 1991, at which time he started serving the probation sentence, which he completed on November 7, 1996. According to the employment application the pilot filled out at Aviation Charter, he worked as a registered nurse for four different employers between March 1992 and March 2001. The pilot’s employment application did not contain any information regarding previous aviation-related employment. According to Aviation Charter records, the pilot had flown approximately 5,116 total flight hours, 598 hours of which he flew with the company, 200 hours of which were as a company pilot-in-command (PIC) in King Airs.18 He had flown approximately 101, 53, and 36 hours in the 90, 60, and 30 days, respectively, before the accident. His last recurrent ground training occurred on April 23, 2002. Since completion of his last simulator training on August 21, 2002, the pilot had flown 32 flights for Aviation Charter, 21 as PIC in King Airs and 11 as copilot in Cessna Citations. Six of the 21 King Air flights were conducted in the A100, including one flight the day before the accident in the accident airplane. His last proficiency and line checks occurred on October 23, 2002. A search of FAA and company records showed no accident or incident history or enforcement or disciplinary actions, and a search of the National Driver Register database found no record of driver’s license revocation or suspension. Aviation Charter’s lead ground instructor stated that the pilot was average on learning airplane systems and that several company pilots had indicated that the pilot’s flying skills were below average. Several Aviation Charter pilots who had flown with the accident pilot described him as “very meticulous,” “by the book,” “calm,” and “laid back.” The pilot was also described as “friendly,” “cheerful,” “pleasant,” “calm,” and “diligent in his use of checklists.” According to several Aviation Charter copilots, the accident pilot was generally well liked by them because he had a reputation for letting them fly the airplane. A few copilots stated that because the pilot often let them handle the flight controls, they were not certain of his skill level. Several Aviation Charter pilots indicated that the accident pilot often allowed them to conduct the flights they flew with him as if they were single-pilot operations (that is, he allowed them to handle the flight controls and communications and perform all of the checklists without his assistance). One Aviation Charter pilot expressed concerns about the pilot’s flying skills, monitoring capabilities, and tendency to become distracted. Some company pilots stated that the accident pilot was not particularly assertive; however, other pilots stated that they thought the accident pilot could be assertive, if necessary. One company pilot, who had flown with the accident pilot shortly after Aviation Charter hired him, described him as “too timid to be a pilot.” An Aviation Charter King Air pilot indicated that he had taken the airplane controls away from the accident pilot during an instrument approach because he 18 For more information about the pilot’s logbook history, see section 1.5.1.2.

Factual Information 10 Aircraft Accident Report could not maintain altitude. A company King Air copilot indicated that during level flight in IMC, he had to take the controls away from the accident pilot because he allowed the airplane to enter a 45° bank and a 1,000-fpm descent. Further, another company King Air copilot indicated that during a flight with the accident pilot about 2 months before the accident, the pilot did not have his navigational radio tuned to the VOR in use for the approach, which caused the pilot’s course deviation indicator (CDI) to provide erroneous indications during the entire approach. The copilot was the flying pilot and had his navigation radio tuned to the correct VOR and completed the approach without incident. The copilot stated that he later had to explain to the accident pilot the reason that his CDI was not indicating properly during the approach. According to Aviation Charter’s director of operations and the company pilots who told Safety Board investigators about these incidents, none of them were ever reported to company management. According to Aviation Charter, the pilot and copilot had flown four flights together before the accident flight, all of which were in King Airs.19 The pilot’s wife indicated that he had never mentioned having any problems flying with the copilot, and the copilot’s fiancée indicated that he had never mentioned having any problems flying with the pilot. According to company records, the pilot had landed at EVM on four previous occasions, twice in King Airs and twice in Citations.20 The pilot’s wife indicated that he was generally “healthy,” exercised regularly, was a nonsmoker, and did not drink alcohol or take prescription drugs. No significant life events occurred in the previous 12 months, and his personal situation was reported to be stable. In addition to working for Aviation Charter, the pilot occasionally worked as a nurse. The pilot’s logbook indicated that he had flown Senator Wellstone at least 12 times. According to the pilot’s wife, he got along well with the Senator, who would often call her husband at home before scheduled trips. 1.5.1.1 The Pilot’s 72-Hour History On October 22, 2002, 3 days before the accident, the pilot flew Senator Wellstone from STP to Rochester International Airport (ROC), Rochester, New York, in a King Air 90.21 The copilot of this flight, who had flown with the pilot many times, indicated that the pilot did not appear tired before the flight. The copilot, who was the flying pilot, stated that during takeoff, instead of activating the yaw damper switch, the pilot activated the adjacent autopilot switch, which caused the airplane to pitch down. The copilot stated that he (the copilot) immediately applied back pressure and then disconnected the 19 Since the pilot’s completion of simulator training in August 2002, the pilots had flown together in a King Air A100 on September 9, 2002, and in a King Air 200 on October 4, 2002. 20 The pilot’s most recent landings at EVM were in a Citation on September 19 and 20, 2002. 21 The flight crew had to fly a positioning flight from Flying Cloud Municipal Airport (FCM), Flying Cloud, Minnesota, to STP to pick up the Senator for the flight to ROC.

Factual Information 11 Aircraft Accident Report autopilot, which caused the airplane to pitch up erratically before it returned to normal climb. The copilot stated that after the airplane was stabilized, he had to explain to the pilot that he had engaged the autopilot instead of the yaw damper and that the pilot replied, “Oh, that could have been pretty bad.” The copilot stated that the remainder of the flight segment was uneventful. The copilot reported that on the return flight to STP, the pilot repeatedly identified the airplane as “Citation 6356K” instead of “King Air 6356K.” An air traffic controller eventually asked, “You wouldn’t happen to be in a King Air today would you?” The pilot acknowledged his error and apologized to the controller. The copilot reported that the remainder of the flight segment was uneventful. The copilot also stated that after the pilot had completed the after-start and before-takeoff checklists at the beginning of each flight, he took control of the radios and told the copilot to fly the airplane. After arriving at FCM around 1830, the pilot returned home. The pilot’s wife indicated that he engaged in routine activities during the evening and that she was unsure what time he went to bed. On October 23rd, the pilot met Aviation Charter’s chief pilot for his 6-month proficiency check. The chief pilot stated that the pilot was in a good mood when he arrived for the check. Maneuvers performed during the check included a recovery from a stall,22 a steep turn, a recovery from an unusual attitude, an ILS approach, a missed approach, a go-around, a simulated engine failure during a VOR approach, and a no-flaps landing. A vision-obscuring device was used to test the pilot’s ability to conduct IFR approaches. The chief pilot recalled that the checkride went smoothly and that the pilot’s ILS and VOR approaches were precise. The chief pilot stated that after the simulated engine failure, he told the pilot to pick up the pace and to feather the engine “a couple of seconds faster for comfort.” The pilot’s wife indicated that he returned home after the proficiency check, engaged in routine activities, and went to bed early, between 1900 and 2000. During the early morning of October 24th, the pilot was contacted by Aviation Charter and asked to fly a charter flight from STP to Bismarck Municipal Airport (BIS), Bismarck, North Dakota, for the Red Cross in the accident airplane; the flight was scheduled to depart at 0340. The Red Cross team coordinator stated that the pilot had indicated that he did not feel well that morning but that, although he looked tired, he did not show any signs of having a cold or the flu. The copilot for this flight indicated that the pilot slept in the BIS FBO from the time that they landed until about 20 minutes before they were to return to STP, which was a little over 1 hour. The copilot indicated that after the pilot had obtained their IFR clearance, he took over the radios and gave the copilot control of the airplane for both flights. The copilot stated that both flights were routine. The pilot’s wife stated that he returned home later that morning and that he was shortly thereafter contacted by his nursing supervisor at the North Memorial Medical Center and asked if he wanted to perform dialysis on a patient. She stated that the pilot indicated that he was interested but that he needed to get some sleep because he had just completed an early morning flight. Two nurses at the medical center indicated that the 22 According to the chief pilot, the company did not allow its airplanes to enter a full stall during training or proficiency checks because of safety reasons.

Factual Information 12 Aircraft Accident Report pilot did not appear tired when he arrived at the center about 1500 to perform the dialysis. While at the center, the pilot was contacted by Aviation Charter and informed about the flight with Senator Wellstone the next morning. The customer service representative at Aviation Charter who spoke to the pilot about the flight indicated that he did not sound fatigued. According to the pilot’s nursing supervisor, the pilot left the center about 2100. The pilot’s wife stated that he arrived home between 2130 and 2140 and went to sleep right away. Although the pilot’s wife did not know exactly what time he awoke, she stated that he slept at least 8 hours the night before the accident flight. 1.5.1.2 The Pilot’s Logbook History After the accident, Safety Board investigators obtained five of the pilot’s logbooks from his wife, the most recent of which began with a statement signed by the pilot and a notary public, dated January 23, 2001, which stated that the pilot had “lost his logbook(s) dating from 1979 to December 1994.” The letter summarized the pilot’s flight hours from 1979 to 1994 as 4,518 total hours, 3,379 hours of which were in multiengine airplanes. The notarized statement also stated that the pilot had “not operated an aircraft from 1994 to December 2000.” Safety Board investigators reviewed all of the logbooks provided by the pilot’s wife. One logbook covered a period from December 1978, when the pilot received initial flight training, through May 1986. The pilot’s flight time from May 1986 to May 1990 was recorded in two separate logbooks, and these logbooks contained conflicting accounts of his activity during this period. The disparities between these two logbooks included the following: • different flight hours for the same flights; • different departure and arrival airports for the same flights; • different flight times and dates for the same flights; • some flight segments mentioned in one logbook were not mentioned in the other logbook; and • one logbook indicated that the pilot had flown 1,600 total flight hours from June 1986 to September 1987, and the other logbook indicated that he had flown 1,850 total flight hours during the same period.23 In addition, the two logbooks contained multiple entries by a certified flight instructor (CFI) who provided the pilot with training for his ATP certificate, but the signatures in the two logbooks were different. According to the CFI named in the logbooks, only one of the logbooks contained his actual signature. The flight hours reported in the January 23, 2001, notarized statement contained in the pilot’s most recent logbook represent an increase of more than 1,460 undocumented 23 On FAA medical forms, the pilot listed “construction” as his primary occupation and “pleasure” as his primary purpose for flying during this period.

Factual Information 13 Aircraft Accident Report hours from the flight hour totals in the final entries of the two conflicting logbooks. Further, in August 1992, the pilot reported on an FAA medical certificate application form that he had a total of 3,250 flight hours, which is 1,268 fewer hours than he claimed in the notarized statement to have acquired as of December 1994.24 Safety Board investigators did not find any records that could verify the hours reported by the pilot in his private logbooks. See figure 4 for a reconstruction of the pilot’s reported flight hours. Figure 4. Reconstruction of pilot’s reported flight hours. 1.5.2 The Copilot The copilot, age 30, was hired by Aviation Charter on February 7, 2001. The copilot held a single- and multi-engine land, instrument airplane commercial pilot certificate, which was issued in May 1997. The copilot’s most recent FAA first-class medical certificate was issued on August 2, 2002, with no restrictions. 24 As mentioned previously, the pilot indicated on his employment application for Aviation Charter that he was working as a nurse during this period.

Factual Information 14 Aircraft Accident Report According to Aviation Charter employment records, the copilot had never been employed previously as a pilot. However, his logbook entries and other records indicated that he worked as a pilot for a skydive operator from October 1998 through March 1999. According to the skydive operator, the copilot was let go when he did not meet pilot qualifications standards for flying the Cessna 182. In February 1999, Northwest Airlines hired the copilot to provide instruction to company pilots on Airbus A320 systems and procedures and cockpit procedures during initial and recurrent ground school. As part of his employment, the copilot observed two complete sequences of systems training lessons and one complete sequence of flight-training lessons. He also received seven flight-training lessons in an A320 simulator. The copilot’s instructor during these lessons twice noted that the copilot needed to be reminded to keep his hands on the throttles during approaches. After observing Northwest’s systems and flight training, the copilot was trained to teach each of the systems and procedures lessons. During this training, the copilot had to thoroughly learn the systems of the A320 one at a time and then demonstrate his ability to teach each system before moving onto the next system. Northwest records indicate that the copilot was not able to successfully complete this stage of the training program. According to his supervisor, the copilot’s ability to learn and retain the details of the A320 systems was far lower than that of fellow trainees with comparable flying experience. He added that, by the time the other trainees finished learning to teach all of the A320 systems lessons, the copilot had mastered less than half of the lessons. The company provided the copilot with special assistance, but he was still unable to master the material. He resigned from the company in October 1999 and began working as a customer service representative for another company located at the same training facility. According to Aviation Charter records, the copilot had flown approximately 701 total flight hours, 304 hours of which were with the company, 107 hours of which were in King Airs.25 He had flown approximately 69, 54, and 36 hours in the 90, 60, and 30 days, respectively, before the accident. His last recurrent ground training occurred on August 2,

1. His last proficiency check occurred on August 3 and 4, 2002, and records from the

check indicated that the check was satisfactorily completed.26 A search of FAA and company records showed no accident or incident history or enforcement or disciplinary actions, and a search of the National Driver Register found no record of driver’s license revocation or suspension. Aviation Charter’s lead ground instructor characterized the copilot’s performance in ground school as below average and stated that he spent extra time working with him. He stated that the copilot had problems remembering memory items, calculating weights 25 Aviation Charter did not have a minimum flight-hour requirement for copilot applicants; therefore, it was not uncommon for the company to hire a copilot with fewer than 1,000 total flight hours. 26 The copilot’s training records revealed that the proficiency check was discontinued on August 3rd because of weather. The records showed that the copilot did not perform a missed approach during the check. The record of the copilot’s initial proficiency check, which occurred on July 18, 2001, also showed that the copilot did not perform a missed approach during the check. FAA guidance only requires that PICs demonstrate proficiency on this maneuver during checkrides.

Factual Information 15 Aircraft Accident Report and balances, and applying formulas. He added that the copilot’s performance was acceptable at the conclusion of ground training. Pilots who had flown with the copilot described him as “friendly,” “happy,” “organized,” “motivated,” and “eager to learn.” Several pilots who had flown with the copilot described him as “not assertive” and expressed concern about his flying skills, especially his inability to land the airplane without assistance. Two pilots stated that the copilot had difficulties with power management when flying an approach and that he had to be reminded to keep one hand on the throttles and to monitor his power gauges. One of these two pilots, who had been mentoring the copilot and flew with him often, stated that this was a consistent problem for the copilot. 1.5.2.1 The Copilot’s 72-Hour History On October 22nd, the copilot flew to Ontario, Canada, for Aviation Charter. The pilot of that flight, who had flown with the copilot on two previous occasions, stated that the copilot was in a good mood, looked healthy, and seemed rested and excited about the trip. The pilot added that the flight was uneventful. The copilot flew the return leg of the trip and logged two-tenths of an hour of instrument time for this flight, which was the only flight flown by the copilot in the 3 days before the accident. The copilot’s fiancée described his activities in the 3 days before the accident as routine. The copilot’s fiancée stated that he went to sleep about 2200 the night before the accident, slept until about 0630 or 0645, and left the house some time after 0830. She indicated that the copilot was in great health, was a nonsmoker, and did not drink alcohol or take prescription drugs. The copilot was laid off from his job as a customer service representative at a flight-training academy in September 2002, but his fiancée reported that his financial situation remained stable. She reported that other aspects of his personal life were also stable. 1.6 Airplane Information The accident airplane, serial number B245, was manufactured on January 28,

1. The airplane was equipped with Pratt & Whitney Canada PT6A-28 turbine engines

and Hartzell model HC-B4TN-3 four-bladed, constant-speed propellers. The time since new for the No. 1 (left) engine was 12,726.1 hours, and the time since overhaul was 6,102.5 hours. The time since new for the No. 2 (right) engine was 13,039.4 hours, and the time since overhaul was 6,102.5 hours. The time since overhaul for both the No. 1 (left) propeller and the No. 2 (right) propeller was 1,637.3 hours. Aviation Charter and Raytheon provided Safety Board investigators with the estimated weight and balance information for the accident airplane.27 According to these 27 The original and a copy of the weight and balance load manifest that the two pilots completed before the accident flight were on board the airplane and destroyed by postcrash fire. The estimates provided by Aviation Charter and Raytheon were calculated using applicable information and graphs contained in the Raytheon King Air A100 Aircraft Flight Manual (AFM). For more information about Aviation Charter’s weight and balance load manifest procedures, see section 1.17.2.3.

Factual Information 16 Aircraft Accident Report estimates, the accident airplane’s takeoff weight was 11,052 pounds, including 2,345 pounds of fuel and 1,050 pounds of passenger weight,28 and the airplane’s takeoff center of gravity (CG) was 184 inches.29 The airplane was equipped with several ice protection systems, including heating elements in the windshield and pneumatic deicer boots on the wings and horizontal and vertical stabilizers, to prevent ice accumulation during flight.30 The cockpit had a selector switch that allowed the pilot to select either automatic single cycle or manual operation of the deicer boots. The propellers were equipped with electrothermal boots on each blade that automatically cycle to prevent ice accumulation. The airplane had a stall warning system designed to sound a horn in the cockpit 5 to 8 knots before the actual stall speed of the airplane in any configuration. The stall warning system included a heated lift transducer vane and faceplate on the leading edge of the left wing.31 When the aerodynamic pressure on the lift transducer vane indicates that a stall is imminent, a switch is actuated to complete the circuit to the stall warning horn in the cockpit. 1.7 Meteorological Information 1.7.1 National Weather Service Information NWS surface analysis chart station models showed that at 1000 the sky was overcast, dew point depressions32 were less than or equal to 2° Celsius (C), surface winds ranged from calm to about 5 knots throughout most of the State of Minnesota, and surface temperatures were below freezing over most of northern Minnesota. 28 This total does not include the weight of the flight crew. The combined weight of the flight crew is figured into the basic operating weight of the airplane. 29 The maximum certificated takeoff gross weight for the accident airplane was 11,500 pounds, and the takeoff CG limits were between 182.8 and 191 inches. 30 Regulated bleed air pressure and vacuum are cycled to the pneumatic boots for the inflation and deflation portions of the deicing cycle. 31 The lift transducer vane and faceplate are protected from ice accumulation by heaters. The heater for the lift transducer receives power while the master switch is ON. The heater for the faceplate is activated by positioning the right pitot and stall warning switch to ON. Although the heaters on the lift transducer vane and faceplate protect them from ice accumulation, buildup of ice on the wing can disrupt the airflow and prevent the stall warning system from providing an adequate stall margin. For more information about Aviation Charter’s guidance regarding operation in icing conditions, see section 1.17.2.2. 32 Dew point depression is the difference between the atmospheric temperature and the dew point temperature. This value can be used as a measure of relative humidity.

Factual Information 17 Aircraft Accident Report A TAF33 prepared by the Duluth Forecast Office for Hibbing, Minnesota (the closest TAF location to the accident site), which was valid starting at 0900 and transmitted at 0917, stated, in part, the following:34 Wind variable at 5 knots, visibility 3 statute miles with mist, overcast 500 feet; Temporary conditions from 1400Z to 1800Z, visibility 2 statute miles, mist, overcast 200 feet. An area forecast (FA)35 covering northern Minnesota was issued about 0945 by the NWS Aviation Weather Center (AWC), Kansas City, Missouri, and was valid at the time of the accident. The FA stated, in part, the following: Northern Minnesota…AGL…scattered at 2,000 feet, scattered to broken at 4,000 feet, tops at 6,000 feet. 1200Z…AGL…scattered to broken at 1,500 feet, ceiling broken at 4,000 feet, broken at 7,000 feet and tops at 12,000 feet. Occasional visibility from 3 to 5 [statute] miles with mist. 1600Z ceiling broken at 1,500 to 2,500 feet, overcast at 4,000 feet. Occasional light snow. An AIRMET prepared by the NWS AWC was issued about 0745 and covered the area surrounding the airplane’s flightpath and the accident site. The AIRMET, which was valid at the times the pilot received the two preflight weather briefings, warned of occasional moderate rime or mixed icing in clouds and precipitation above freezing level to 20,000 feet. The AIRMET warned that the freezing level was from the surface to 7,000 feet over northern portions of the area and sloping to between 8,000 to 10,000 feet over southern portions of the area. According to the meteorologist responsible for issuing the next scheduled AIRMET at 0845, shortly after he issued it, he received a pilot report (PIREP) of moderate icing at 10,000 feet. He stated that, about 0905, he issued an updated AIRMET, which was valid at the time of the accident, warning of occasional moderate rime to mixed icing in clouds and precipitation below 10,000 feet. The 0700 upper air sounding (that is, a vertical profile of atmospheric conditions) from Chanhassen, Minnesota (160 miles south-southeast of the accident site), showed a saturated boundary layer, with a surface temperature of 3° C and an easterly wind of about 3 knots. Freezing level was approximately 2,700 feet. The 1300 upper air sounding from International Falls, Minnesota (79 miles north-northwest of the accident site), did not show a completely saturated near-surface environment.36 The sounding showed a surface temperature of -2° C and south-southeasterly surface winds of about 5 knots. The sounding also showed a saturated layer from about 3,400 to 7,000 feet, with southwesterly winds in this layer ranging from 10 to 23 knots. The NWS also provided 33 TAFs are normally issued every 6 hours with amendments issued as conditions warrant. 34 Weather forecasts are transmitted in coordinated universal time (UTC). The “Z” designation that follows the time in the weather observation stands for Zulu, which indicates UTC time. Central daylight time is 5 hours behind UTC time. 35 The NWS AWC issues FAs at regular intervals and special reports as necessary, usually in the form of AIRMETs. 36 Radiosonde balloons are typically launched a little after 0600 and 1800, and the nominal times of the data are 0700 and 1500. Because of problems with equipment at International Falls, a 0700 sounding was not accomplished. After notification of the accident, the DLH NWS office instructed staff at International Falls to launch a radiosonde balloon, and the sounding was accomplished at 1300.

Factual Information 18 Aircraft Accident Report Safety Board investigators with the Eta model37 1000 forecasted profile for Hibbing, Minnesota, which was consistent with the upper air sounding profiles. Specifically, the profile confirmed the existence of below-freezing temperatures and verified that saturated conditions existed between about 3,000 and 7,000 feet. 1.7.2 Airport Weather Information Weather observations at EVM are made by an AWOS,38 which is located about 2 miles northwest of the accident site at an elevation of about 1,380 feet. Observations from this station are reported every 20 minutes. At 1014 on the day of the accident, the AWOS reported that the visibility was 3 statute miles in light snow and that the sky condition was scattered clouds at 400 feet and overcast at 700 feet. At 1034, the AWOS reported that the visibility was 4 statute miles in mist and that the sky condition was overcast at 400 feet. Both AWOS reports indicated calm winds and temperatures of 1° C. The Hibbing, Minnesota, ASOS, which is located about 16 miles west of the accident site at an elevation of 1,351 feet, provides high-resolution data that is recorded every 5 minutes. At 1005 on the day of the accident, the ASOS reported that the visibility was about 3 statute miles in mist and that the sky condition was overcast at 500 feet. At 1025, the ASOS reported that the visibility was 4 statute miles in mist and that the sky condition was overcast at 300 feet. Both ASOS reports indicated temperatures of 1° C. 1.7.3 Additional Icing and Cloud Information On December 2, 2002, Safety Board investigators met with three scientists from the National Center for Atmospheric Research (NCAR), Boulder, Colorado, regarding the potential icing environment around the time of the accident. These scientists use an icing diagnostic program called the Current Icing Potential algorithm, which incorporates multiple sources of weather data to determine the icing and supercooled large droplets (SLD) potential. One of the scientists reported that his analysis of the program’s output for the day of the accident indicated a high potential for icing from St. Paul to Eveleth but suggested a low potential for SLD around Eveleth. The scientist added that because of the increase in temperature and the lower water content expected at lower levels of the atmosphere, moderate icing was not likely to extend to the lower levels of the atmosphere. 37 The Eta model is a numerical weather model used by the NWS. 38 AWOS and ASOS (ASOS stands for automated surface observing system) are systems that continuously measure weather information, including wind speed and direction, visibility, precipitation, cloud cover, temperature, dew point, and altimeter setting.

Factual Information 19 Aircraft Accident Report Several PIREPs were transmitted around the time of the accident in the area surrounding EVM. One PIREP, received about 0810 from a pilot flying a Piper Cheyenne around Ely, Minnesota, which is 43 miles northeast of EVM, reported moderate mixed icing between 11,000 and 8,000 feet and light rime icing below 8,000 feet. Another PIREP, received about 0908 from a pilot flying a DC-9 about 10 miles southeast of DLH, reported cloud tops at 11,000 feet and trace rime icing from 4,500 to 7,000 feet, light rime icing from 7,000 to 9,000 feet, and moderate rime icing from 9,000 to 11,000 feet. Another PIREP, received about 1118 from a pilot flying an RJ Avroliner in the Duluth area, reported the sky was overcast at 1,600 feet with cloud tops at 10,800 feet, trace icing from 5,000 to 7,000 feet, and light rime icing from 7,500 to 10,800 feet. The first two PIREPs were discussed at the December 2002 NCAR meeting. According to an NCAR scientist, the reports indicate that icing was occurring around the time of the accident at two distinct altitude bands with differing intensities: moderate icing was present at upper elevations (8,000 to 11,000 feet), and light icing was present at lower elevations (4,500 to 8,000 feet). Additionally, the last two pilots who landed at EVM before the accident (both pilots were flying QueenAire BE-80s) provided statements to Safety Board investigators. One of these pilots stated the following: I left Minneapolis for Eveleth…at 7 a.m. I climbed to 7,000 [feet] MSL and I was IMC all the way to Eveleth. The tops were at approximately 10,000 [feet] MSL. No icing was encountered until approximately 60 miles south of the Hibbing VOR. The temperature was 28 degrees [Fahrenheit] at 7,000 [feet] MSL. I started getting light to moderate rime ice at 7,000 [feet]. He added that as he descended to 5,000 feet, at which altitude he recorded the temperature to be about -1.1° C, the ice began to shed off the airplane’s surfaces and that as he continued his descent to 3,500 feet, at which altitude he recorded the temperature to be about -0.5° to 0° C, most of the remaining ice shed off the airplane’s surfaces during the approach. He concluded, “I did get the airport in sight at approximately 5 miles from the airport. I then landed at approximately 8 a.m.” The other pilot who landed at EVM before the accident stated the following:

Factual Information 20 Aircraft Accident Report I flew at 5,000 feet en route and was IMC with light rime ice in the clouds. I flew the VOR/DME [distance measuring equipment]-A approach and circled to [runway] 27. I don’t remember getting any more ice after descending from 5,000 feet. On the approach, I broke out of the clouds a little above the MDA [minimum descent altitude, which for the EVM VOR/DME-A final approach is 2,120 feet39]…and the best I can remember…the visibility was probably 1 ½ to 2 ½ miles. I landed in EVM at approximately 8:30 a.m. I do remember that the weather that the AWOS was reporting seemed accurate at the time and the VOR – both [Hibbing] and EVM seemed to work fine. The first pilot to depart EVM after the accident also told Safety Board investigators that he experienced trace to light icing below 6,000 feet. EVM’s assistant airport manager stated that, when he was looking for the crash site from the air, he was flying at 1,800 feet (that is, about 420 feet agl), and he never entered the clouds. He stated that the AWOS (which was reporting a 700-foot overcast ceiling) seemed to be reporting correctly because the cloud tops appeared to be about 200 to 300 feet above his airplane. He added that the cloud bases were somewhat ragged and variable in height. He stated that he could see landmarks on the ground up to 4 to 5 miles away. The Geostationary Operational Environmental Satellite 8 visible and infrared satellite imagery taken at 1015 showed a large distribution of clouds along the airplane’s flightpath. Satellite-derived cloud top temperatures along the airplane’s flightpath ranged from -11° to -16° C. During the descent portion of the airplane’s flight, cloud top temperatures were mainly near -15° C. Comparisons between satellite-derived cloud top temperatures and sounding data indicated that the cloud tops were approximately 12,000 feet. 1.8 Aids to Navigation 1.8.1 EVM VOR The EVM VOR is a low-power (50 watts), terminal-type VOR owned and maintained by the State of Minnesota. The EVM VOR is located on the airport property just north of runway 27, about 1,134 feet from the runway’s departure end. A State of Minnesota technician ground checks the facility annually under oversight of an FAA representative, and the FAA flight checks the facility every 540 days. According to postaccident interviews with the State of Minnesota technician and the FAA Airway Transportation System Specialist (ATSS) responsible for maintenance and oversight of the EVM VOR, the EVM VOR is continuously monitored using an 39 For the EVM VOR runway 27 approach, which is the approach the accident flight crew was flying, if the airplane does not have DME, then the MDA for the final approach to EVM is 1,840 feet. If the airplane does have DME, then the MDA is 1,840 feet between 2 and 10 miles from the EVM VOR and 1,740 feet inside of 2 miles from the EVM VOR.

Factual Information 21 Aircraft Accident Report external receiver with an antenna located on the outer edge of the VOR counterpoise (elevated ground plane). If the radial position indicated by the monitoring receiver varies by >1°, or the modulation deviates appreciably from the nominal 85 percent, the facility will automatically shut down. Reactivation requires intervention and a ground check by a State of Minnesota technician. 1.8.1.1 Preaccident Flight Checks of the EVM VOR The FAA’s most recent periodic flight check of the EVM VOR occurred on June 12 and 13, 2001, and the facility status was listed as “satisfactory” on FAA Form 8240-2; however, the form also indicated that the EVM VOR remained restricted per a December 4, 1996, notice to airmen (NOTAM), which was still in effect at the time of the accident. The NOTAM indicated that the EVM VOR was unusable in the area from the 204° radial through the 264° radial and in the area from the 264° radial through the 204° radial beyond 20 miles and below 4,000 feet. 1.8.1.2 Postaccident Ground and Flight Checks of the EVM VOR About 1530 on the day of the accident, technicians from the State of Minnesota conducted a standard ground check of the EVM VOR and found it to be transmitting normally. On October 26 and 27, 2002, the FAA conducted a series of flight checks on the EVM VOR using a King Air A100. On both days, the signal was found to be misaligned about 2.3° to the north, but within tolerance (a maximum variation of ±2.5° is permitted) in the region between 5 to 10 miles from the station. However, the signal was found to be out-of tolerance for bends40 (a maximum distortion of +4.1° was measured; a maximum distortion of ± 3.5° is allowed) in this same region.41 On October 28th, a State of Minnesota technician conducted another, more comprehensive postaccident ground check of the EVM VOR under the supervision of the FAA ATSS. The EVM VOR was again found to be transmitting normally. On December 16, 2002, the pilots who conducted the October 2002 flight checks told Safety Board investigators that the VOR runway 27 approach took them approximately 1 mile south of the field when hand-flying the approach, but that it took them to the correct aiming point (the position from which a normal transition to landing can be made) when flown coupled to the autopilot.42 Further, in a January 8, 2003, written statement concerning the October 26, 2002, flight check, the PIC of the flights indicated that during the first test, while hand-flying the approach, 40 Bends are fluctuations in the calculated VOR radial position that occur slowly enough to be followed by a pilot under normal conditions. 41 For example, with a +4° error in the VOR signal, a pilot would need to fly the airplane inbound on the physical 100° radial from the station to center the CDI needle on an indicated 096° radial inbound. 42 According to the FAA’s Flight Inspection Standard Operating Procedures Manual, approaches should be flown by autopilot whenever possible during flight checks.

Factual Information 22 Aircraft Accident Report approximately 7 miles from the runway we noticed that the approach radial was leading us to the right of runway centerline extended. As we continued the approach, we remained to the right of runway centerline extended until about 4 miles out. Then the approach radial began to lead us to the left of centerline. We crossed centerline extended and continued left of centerline. We ended up between 1 to 2 miles to the left of the runway at the MAP [missed approach point].[43] We completed the approach again and the results were close to the same as the first run. On our third run we coupled the autopilot to the flight director and let it fly the approach. For most of the approach the autopilot held us approximately ½ dot left of course. The autopilot took us to the runway, just left of centerline[;] however[,] the approach radial was found to have an out of tolerance bend. On December 23, 2002, a special demonstration flight was conducted at the Safety Board’s request to resolve the discrepancy between the hand-flown and autopilot-flown approaches made in October 2002. On this demonstration flight, the pilots reported to Safety Board investigators that the airplane was brought to a position at the approach end of runway 27 appropriate for normal transition to landing. 1.8.1.3 VOR Navigation System Special Study To further study the accuracy of the EVM VOR, the Safety Board requested that the December 23rd demonstration flight be flown using an airplane capable of digitally storing the signal obtained by the on-board VOR receiver. The study also used data derived from the October 2002 flight checks. The results of the study confirmed that the EVM VOR was misaligned to the north by about 2.3° in the area between 5 to 10 miles from the station, which caused the on-board VOR receiver to calculate that the airplane was at a radial position north of its actual physical location with respect to the station. This is consistent with flight check radar data from the October 2002 flight tests. Further, the study showed that the VOR signal measured on December 23rd had changed little in character from the signal measured on the flight checks in October; however, the misalignment was slightly smaller, deviating about 1.5° to the north. Data collected from the October 2002 flight tests and radar data were analyzed to estimate what was likely indicated by the CDI needle in the accident airplane’s cockpit during the approach to EVM. The computations estimated that the CDI needle was likely about three dots to the left (indicating the airplane was north of course) when the airplane was approximately 8.5 miles from the EVM VOR. The computations also estimated that the CDI likely indicated on-course at a position approximately 5 miles from the station and that the needle would have continued to move to the right (indicating the airplane was now moving off-course to the south). Finally, computations estimated that the CDI needle was likely fully deflected approximately 2.6 miles from the EVM VOR.44 43 Radar data from the FAA’s October 26th flight checks show that the check airplane maintained a track slightly south of course throughout the approach and that it passed within 1/2 mile of the field at the end of all three approaches.

Factual Information 23 Aircraft Accident Report 1.9 Communications No communication problems were reported with any of the ATC facilities that handled the accident flight. 1.10 Airport Information EVM is located 3 miles southeast of Eveleth, Minnesota, near the western shore of Lake Superior and is bordered by dense forest to the east and west. EVM has an elevation of 1,378 feet and is a nontowered airport. Because the EVM VOR is located slightly north of and near the middle of runway 27, the published EVM VOR approach course is aligned about 2° south of the runway centerline to bring aircraft in near the runway threshold. Runway 27 is 4,215 feet long and 100 feet wide with no displaced threshold. Runway 27’s magnetic heading was determined to be 274°. Runway 27 is equipped with a medium-intensity approach lighting system, a runway-end identifier light system, and a four-light precision approach path indicator, which is located on the left side of the runway. The runway lights are pilot-controlled on the common traffic advisory frequency 122.7, which is monitored at EVM in the airport manager’s office. The EVM assistant airport manager stated in postaccident interviews that he heard the accident pilots report their position before the accident and the runway lights being activated on 122.7 after the pilots’ position report and that he saw that the runway lights were on at the time of the accident. 1.10.1 Air Traffic Control The Duluth ATCT has three radar positions: approach control south, approach control north, and approach control local. At the time of the accident, all of the radar positions were combined at the approach control south workstation, which is located in the facility’s radar room. The approach control south radar controller was responsible for airspace within a 30-mile radius of DLH from the surface to 12,000 feet and for airspace that extended 20 miles northwest of Hibbing, Minnesota, from the surface to 8,000 feet; EVM lies within this area of airspace. The DLH approach control south radar controller began working for the FAA on December 2, 1984, and was assigned to the Duluth ATCT on March 21, 1985. He became fully certified at the Duluth ATCT on February 27, 1987. The DLH approach control south radar controller stated that at the time he was handling the accident airplane, the range of his radar display was set at 60 miles. He stated that he remembered observing the accident airplane’s radar target intercepting the final approach course about 9 miles from the runway threshold and that it appeared to him that the radar target was aligned correctly on final approach at a steady 3,500 feet. 44 The error bands for these calculations could not be determined with certainty.

Factual Information 24 Aircraft Accident Report The controller stated that he was surprised to see the accident airplane off course when he reviewed the radar playback at a closer range after the accident. The DLH approach control south radar controller stated that about 1019, he instructed the flight crew to report cancellation of IFR with the Princeton AFSS, and he noted the airplane’s estimated arrival time at EVM on the flight progress strip. He stated that when he did not receive an IFR cancellation after about 15 minutes had passed, he called the flight data controller via the interphone and asked him to check to see if the airplane had landed at EVM; the flight data controller responded that the airplane had not landed. The DLH approach control south radar controller stated that he did not recall any NOTAMs reporting problems with the EVM VOR and added that the VOR runway 27 approach was the most commonly used approach at the airport. The controller stated that NOTAMs were provided to the Duluth ATCT by the Princeton AFSS and that any NOTAMs are annotated in the facility’s daily log and on the system information area in the tower cab and radar room. The controller indicated that if the facility does receive a PIREP about a malfunctioning navigational aid, a second PIREP would be solicited and, if the reports were the same, the information would be forwarded to the facility’s flight data controller and then to Mid States Operations for Airways Facilities. 1.11 Flight Recorders The accident airplane was not equipped with either a CVR or a flight data recorder nor was either required by Federal regulations. As a result of a previous investigation of an accident involving a Cessna 208B, operating as an on-demand charter flight for the Department of the Interior, on February 8, 2000, the Safety Board issued Safety Recommendation A-99-60, which asked the FAA to “require, within 5 years of a technical standard order’s issuance, the installation of a crash-protective video recording system on all turbine-powered nonexperimental, nonrestricted-category aircraft in 14 Code of Federal Regulations Part 135 operations that are not currently required to be equipped with a crashworthy flight recorder device.” Safety Recommendation A-99-60 is on the Safety Board’s Most Wanted List.45 On May 3, 2000, the FAA responded that this issue should be submitted to the Radio Technical Commission of Aeronautics (RTCA) Future Flight Data Collection Committee for consideration. The FAA added that the committee will look at future trends in flight data collection to support safety investigations and operational efficiencies, with a primary focus on the appropriateness, timing, economic impact, and social acceptance of the proposed data collection concepts. 45 In October 1990, the Safety Board adopted a program to identify the “most wanted” safety improvements. The purpose of the Board’s Most Wanted List, which is drawn up from safety recommendations previously issued, is to bring special emphasis to the safety issues the Board deems most critical.

Factual Information 25 Aircraft Accident Report On September 8, 2000, the Safety Board replied to the FAA that it disagreed with the FAA on the appropriateness of the RTCA committee’s involvement in the implementation of this safety recommendation because the committee’s goal is to look 10 to 15 years into the future to set the course for recorder technology and determine how it will be used to solve problems. The Board stated that it had no evidence that the RTCA committee was going to address the use of video recorders in the near term for the small aircraft for which this recommendation was targeted. Pending the implementation of the recommended actions, Safety Recommendation A-99-60 was classified “Open— Unacceptable Response.” 1.12 Wreckage and Impact Information 1.12.1 General The accident airplane’s wreckage was located about 1.8 miles southeast of the EVM runway 27 threshold. The majority of the airplane sustained severe damage consistent with impact forces and/or postimpact fire. Several of the airplane’s systems, including the stall warning and deicing systems, were too damaged by postimpact fire and impact forces to determine their preimpact configuration and operability. The horizontal distance from the point at which the airplane entered the trees to the resting place of the aft section of the fuselage was about 130 feet. Crash site damage included blunt force tree damage consistent with airframe impact and cleanly severed trunks and limbs consistent with cuts resulting from propeller blade strikes. Handheld tape measurements, survey data, and aerial observations indicated that the airplane descended through the trees wings level and upright on about a 26° downward flightpath angle on a ground track of about 180°. The majority of the wreckage, which consisted of the forward fuselage, the cockpit, and most of the wings, was found at the southern end of the main wreckage field. The left horizontal stabilizer was found essentially intact with a substantial crease approximately 41 inches from its root. The horizontal stabilizer trim actuator was found still attached to the tail structure, and the exposed actuator lengths were both found to be 3.25 inches. (According to Raytheon documentation, this measurement equals a horizontal stabilizer trim setting of 1° airplane nose down.) The left elevator was found intact and attached to the horizontal stabilizer at both hinges. The vertical stabilizer was found intact with damage to the leading edge. None of these components exhibited evidence of in-flight fire or preimpact structural damage. The right elevator was found attached to the stabilizer and exhibited severe impact and fire damage. Sections of both wings were recovered and exhibited postimpact fire damage. The flap actuators were recovered. (According to Raytheon documentation, the measurements taken of the flap actuators were consistent with the flaps being in the approach position [about 30 percent] at the time of the accident.)

Factual Information 26 Aircraft Accident Report Inspections of the nose and main landing gear found indications consistent with the gear having been down at the time of impact. However, because of extensive impact and fire damage, it could not be determined if the gear were in the locked position. From November 19 to 22, 2002, the engines were examined at Pratt & Whitney Canada’s facility in Longueuil, Quebec, under Safety Board supervision. These examinations revealed evidence of normal engine operation at the time of impact. From November 12 to 14, 2002, the propellers were examined at Hartzell Propeller’s facility in Piqua, Ohio, under Board supervision. These examinations revealed evidence of low-power system operation at the time of impact. The blade angles calculated from the propellers’ piston positions (19.3° and 21.3°) correspond to power settings just above flight idle at the time of impact. (As installed in a properly rigged King Air A100, selection of the flight-idle power setting will result in a blade angle of 19.0° ±0.1°.) Most of the components of the deicing system were destroyed by postimpact fire. Deicer boots were present on the remaining leading edges of the horizontal and vertical stabilizers. All of the surviving pneumatic deicing lines leading to the tail deicer boots were assessed visually and determined to be in good condition. The deicer boots were also present on the leading edges of the wings; however, they were extensively damaged. 1.12.2 Cockpit Instrumentation The cockpit instrument panel was extensively damaged by postimpact fire, and all of the instruments were found settled into a large pile under the cockpit window frame. Several of the instruments were recovered and transported to the Safety Board’s Materials Laboratory for further examination. Several of the cockpit instruments were too damaged to warrant further examination. The left-side airspeed indicator’s case was severely burned, melted, and distorted, and the indicator’s data plate was missing. All of the exterior markings and paint were burned off, and the glass face was broken and discolored. The dial assembly was found attached to the mechanism assembly and had distinct blackened areas on it, one of which was located directly above a small screw that is above the 100-knots-airspeed mark (despite the fire damage, the airspeed numbers were still legible on the dial assembly). The airspeed indicator needle was not found with the indicator; however, the maximum airspeed indicator needle was still attached and was pointing to 195 knots.46 The right-side vertical speed indicator was found with the indicator needle pointing to about 2,200 fpm (rate of descent). The right-side horizontal situation indicator (HSI) was badly damaged by fire but exhibited less severe impact damage than the pilot-side HSI. The right-side CDI faceplate was found contained within the indicator and dial ring. The head of the course indicator needle was not found; however, the needle base was still attached to the CDI faceplate, 46 The maximum airspeed pointer is designed to indicate the “never exceed” airspeed limit for an aircraft at a given altitude.

Factual Information 27 Aircraft Accident Report and the tail of the needle was located adjacent to the number 9 on the heading dial. The heading bug was visible on the heading dial at a position of approximately 307°. The heading warning flag was not found; however, the flag needle was found in the retracted position.47 The right-side radio magnetic indicator was severely damaged by impact forces and fire, the glass plate was shattered, and the flag positions could not be determined. The compass card and both indicator needles were contained within the plate display and were damaged by heat; however, the numbers were legible. The compass card was positioned with the number 180 directly beneath the lubber line. Indicator needle No. 1 was pointing to approximately 335°, and needle No. 2 was pointing to approximately 332°. 1.13 Medical and Pathological Information Tissue and fluid specimens from both pilots were transported to the FAA’s Civil Aerospace Medical Institute (CAMI) for toxicological analysis. The CAMI laboratory performed analysis for a wide range of legal and illegal drugs,48 and the results were negative. The analysis detected no ethanol or carbon monoxide in either of the pilot’s blood and tissue specimens. 1.14 Fire A fuel-fed fire erupted after the airplane impacted the ground. 1.15 Survival Aspects According to the Saint Louis County Medical Examiner’s autopsy reports, the cause of death for the pilot, copilot, and all of the passengers was multiple traumatic injuries sustained during impact. Three of the individuals showed evidence of postimpact smoke and soot inhalation. 47 According to the Honeywell (Sperry) Component Maintenance Manual for the HSI, the unit requires both a.c. and d.c. power to operate. The heading warning flag is displayed when power is lost to either the primary a.c. power supply or the d.c. signal for the instrument. 48 The drugs tested for included the following: marijuana, cocaine, opiates, phencyclidine, amphetamines, benzodiazapines, barbiturates, antidepressants, antihistamines, meprobamate, mathaqualone, and nicotine.

Factual Information 28 Aircraft Accident Report 1.16 Tests and Research 1.16.1 Airplane Performance The Safety Board conducted an airplane performance study to establish a history of the accident airplane’s motions and the pilot’s actions. As stated in section 1.1, radar data from the last two recorded radar returns indicate that the accident airplane had slowed to about 76 KCAS at 1,800 feet. The Raytheon King Air A100 AFM and Raytheon calculations indicate that the wings-level, gear-down stall speed, assuming an estimated landing weight of about 10,500 pounds with the flaps in the approach setting, would have been about 77 KCAS with the power at flight idle. Safety Board investigators also planned and executed flight simulations at Flight Safety International (FSI) using a King Air C90B simulator.49 These simulator tests were conducted to determine whether the airplane’s flightpath and time histories, as shown by the radar data during the final approach, could be matched or approximated with and without simulated airframe icing and which configurations and control inputs were required to match the data. To conduct the test, the accident airplane’s weight and CG values (about 10,500 pounds and 184 inches, respectively) were scaled to equivalent values for the C90B. Several tests were performed starting at 3,500 feet and descending to 1,800 feet to try to match the final approach descent of the accident airplane as shown by the radar data. An additional test was conducted starting at 13,000 feet and descending to 3,500 feet as the airplane was vectored onto the approach course. For simulation purposes, the airplane’s descent from 3,500 feet was broken down into three time periods, each with linear approximations of vertical speed and airspeed decay based on the radar data. During the tests, the landing gear was extended just after the airspeed decreased below the maximum gear extension speed of 156 KCAS, which occurred as the accident airplane was descending through 2,200 feet. Various engine power and pitch control inputs and simulated icing effects were used to try to match the radar data. The tests conducted without simulated airframe icing showed that the flightpath and speed of the accident airplane, as indicated by the radar data, could be reasonably matched making minor pitch control inputs and engine power reductions. The stall warning occurred during these tests between 81 and 84 KCAS. During the tests, increasing the power quickly resulted in an increase in airspeed and no further stall warnings. The tests conducted with light to moderate simulated airframe icing50 showed that the flightpath and speed of the airplane, as indicated by the radar data, could also be 49 According to Raytheon and FSI, no known King Air A100 simulators exist. The Airplane Performance Group chose the King Air C90B model for simulations because it has a similar configuration and stall speeds to the A100 model; however, it is not fully certified to replicate the A100’s flight characteristics.

Factual Information 29 Aircraft Accident Report reasonably matched making minor pitch control inputs and engine power reductions. However, occasional use of the deicer boots was required, and the engine power settings were significantly higher between the boot cycles than they were during the tests conducted without simulated airframe icing. Tests conducted with heavy icing required frequent cycling of the deicer boots, and the engine power settings often exceeded the power limits shown on the cockpit gauges.51 1.16.2 Operational Factors and Human Performance Simulations In April 2003, the Operational Factors/Human Performance Group conducted flight simulations at FSI using a U-21, which is the military version of the C90 and has similar cockpit controls and displays to the accident airplane,52 to observe and evaluate Aviation Charter’s procedures and interaction between a company pilot and copilot. In addition, flight characteristics were observed during slow flight, stall recovery, and various airplane configurations. The Aviation Charter pilot who participated in the simulations had worked for the company for over 5 years and had about 5,200 hours total flight time, about 2,400 hours of which were in King Airs. The Aviation Charter copilot who participated in the simulations had worked for the company for over 3 years and had about 2,100 hours total flight time, about 600 hours of which were in King Airs. These two crewmembers nearly always flew together during revenue operations for Aviation Charter. The simulator was programmed with weight and CG parameters scaled to match those of the accident airplane and used to fly simulated VOR approaches to runway 27 at EVM.53 During the simulations, both pilots were given the opportunity to act as the pilot flying during the approach. Numerous approaches were executed to observe company procedures and piloting techniques, including briefing the approach and preparing and executing the VOR runway 27 approach. Particular attention was focused on cockpit setup, duties for the flying pilot and the nonflying pilot, callouts, and checklist usage. During the simulations, approach procedures and callouts were in accordance with Aviation Charter’s procedures. The simulator exhibited normal characteristics during slow flight and stall maneuvers and immediately recovered from a stall when power was increased. 50 The FSI King Air simulators allow selection of simulated airframe icing as a percentage of a maximum, with the selection of 0 percent resulting in no simulated icing and selection of 100 percent resulting in maximum simulated icing. The FSI King Air C90B icing model introduces lift, drag, and other aerodynamic degradations based on FSI data. 51 The King Air A100 has about 130 horsepower more per engine than the C90B; therefore, the A100 power settings may not exceed the limits in heavy icing, as occurred during the C90B simulations. 52 Although the U-21 has cockpit controls and displays similar to the A100, it is not certified to fully replicate the A100’s flight characteristics. 53 The simulator was not capable of displaying EVM or its surrounding terrain.

Factual Information 30 Aircraft Accident Report To observe flight crew workload, the following three VOR approaches to runway 27 were conducted consecutively with simulated weather conditions matching those reported at EVM at the time of the accident:54 • a straight-in approach from 13.5 miles east of the runway 27 threshold, • an approach using ATC vectors similar to those given to the accident flight crew, and • an approach using ATC vectors similar to those given to the accident flight crew during which the flight crew was instructed to delay the descent from 3,500 feet until 7.5 miles from the runway 27 threshold and to delay landing gear extension until 3.5 miles from the runway 27 threshold. During each scenario, the flight crew made a successful approach and landing. During the second and third scenarios, the flight crew initially overshot the approach course but was able to reintercept the course from the north, establish a stabilized approach, and land successfully.55 After each approach, the pilots completed a National Aeronautics and Space Administration (NASA) Task Load Index questionnaire, which gave them the opportunity to rate the following six aspects of workload: mental and physical demand, time pressure, effort, performance, and frustration level.56 The questionnaire completed by the flying pilot after the second approach indicated that it was more difficult than the first approach in terms of time pressure, effort, and frustration level. The questionnaire completed by the flying pilot after the third approach indicated that it was more difficult than the second approach in terms of mental and physical demand, time pressure, effort, and frustration level. Regarding the third approach, the flying pilot commented that there was a “noticeably higher workload – with gear delayed, I felt behind the airplane.” The questionnaire completed by the nonflying pilot after the third approach indicated that the “fast, late turn, [at] high altitude increased workload.” Another scenario was flown to duplicate the descent profile and ground track of the accident flight. Investigators noted that when the pilots were attempting to maintain a low-descent rate at a low-torque setting (about 400 foot-pounds [ft-lbs]) with the airspeed lower than 100 knots, a gradual, significant pitchup was necessary to maintain altitude. The stall warning horn sounded when the airplane was at 82 knots. 54 During these approaches, the Aviation Charter pilot was the flying pilot. 55 The distance by which the flight crew overshot the approach course to the north was not precisely measured during these simulations. 56 S.G. Hart and L.E. Staveland, “Development of NASA-TLX (Task Load Index): Results of Empirical and Theoretical Research,” eds. P.A. Hancock and N. Meshkati, Human Mental Workload (Amsterdam: North-Holland, 1988) 139-183.

Factual Information 31 Aircraft Accident Report 1.17 Organizational and Management Information At the time of the accident, Aviation Charter,57 which is headquartered in Eden Prairie, Minnesota, operated about 120 flights per month with a fleet of 24 turbojet, turboprop, and piston-powered airplanes, 4 of which were King Air A100s. According to FAA documents, the company employed 25 pilots, 8 copilots, and 3 check airmen. The company also used copilots employed by Eagle Jet International, which had an airline first officer program through which it would place both new and experienced pilots with various companies so that they could gain additional flying experience. Following an accident in December 1997 involving a King Air A100,58 Aviation Charter instituted a policy to have two flight crewmembers in the cockpit for all 14 CFR Part 135 charter flights, even though the King Air A100 is certified to operate for Part 135 on-demand revenue flights with only one pilot in visual flight rules conditions and with one pilot and an operable, FAA-approved autopilot in IFR conditions. (See 14 CFR 135.105.) Further, according to Aviation Charter’s director of operations, the company changed insurance carriers in April 2000, and the new carrier required that all Part 135 flights have two flight crewmembers. 1.17.1 Company Training Aviation Charter had a Part 135 Multiengine Turbopropeller Aircraft Maneuvers Guide59 and a Part 135 Aircraft Training Manual, which received approval from the FAA on March 3, 1995, and September 19, 1996, respectively. All pilots hired by the company were required to attend its FAA-approved, in-house ground and flight training at its headquarters. All company pilots were also required to take and pass the appropriate Part 135 checkrides, which were conducted by a company check airman, before being assigned line flights. In addition, Aviation Charter’s insurance carrier required company PICs to receive flight simulator training.60 Aviation Charter contracted with SimuFlite, Inc., to provide all PICs additional training in a flight-training device, which satisfied the insurance requirement for simulator training (about 8 to 10 hours of training in the simulator was required), at SimuFlite’s Quick Turn subsidiary in Dallas, Texas. PICs received this additional training after successfully completing the company’s FAA-approved, in-house ground and flight training. Company copilots were not required to and did not attend the training at Quick Turn.61 57 Aviation Charter operates as an on-demand charter operation in partnership with Executive Aviation, which operates as an FBO at FCM. 58 For more information about this accident, see section 1.18.1. 59 Pilots were not provided copies of the Maneuvers Guide; however, copies of the guide were provided to the chief pilot and each company flight instructor, who used the guide to train and evaluate pilots. Pilots were expected to adhere to the procedures contained in the Maneuvers Guide during line operations. Copies were maintained at the company’s headquarters (the master copy) and the FAA’s Minneapolis Flight Standards District Office (FSDO). 60 This training was not required by the FAA.

Factual Information 32 Aircraft Accident Report According to a Quick Turn instructor, SimuFlite offered 3- and 2-day recurrent training courses in the flight-training device; Aviation Charter sent its PICs to the 3-day course annually. The instructor added that when two PICs attended training, the pilot in the right seat was responsible for operating the gear, flaps, and radios, and the pilot in the left seat received training and was evaluated on single-pilot operations. According to Aviation Charter’s chief pilot, when two PICs attended training, the pilot in the right seat performed Aviation Charter’s normal copilot duties (for example, standard callouts and checklist assistance routinely performed during 14 CFR Part 135 on-demand charter flights). 1.17.1.1 Crew Resource Management On May 21, 1997, the FAA approved Aviation Charter’s ground school training module on crew resource management (CRM), and the module was subsequently added to the company’s training manual. The CRM training module did not indicate a specific hourly requirement for instruction and completion.62 The suggested CRM curriculum topics included the following: communication processes and decision behavior; briefings; inquiry, advocacy, and assertion; crew self critique (decisions and actions); team building and maintenance;63 theory and practice in using communication, decision-making, and team building techniques and skills; training for new copilots in performing the nonflying-pilot role to establish a positive attitude toward monitoring and challenging errors made by the flying pilot; training for pilots in giving and receiving challenges of errors; and training for all crewmembers that identifies conditions in which additional vigilance is required, such as holding in icing or near convective activity (the manual states that this training should emphasize the need for maximum situational awareness and the appropriateness of sterile cockpit discipline, regardless of altitude). According to Aviation Charter’s training manual, pilots were required to complete an oral or written examination given by a company instructor to determine adequate knowledge of CRM. Further, according to the training manual, instructors and check airmen evaluated a pilot’s CRM knowledge and techniques during company flight training and checkrides, and the pilots were graded as either satisfactory or unsatisfactory in that area.64 According to Aviation Charter’s director of operations and its agent for service, CRM training was also incorporated into the training at Quick Turn, and pilots received CRM evaluations during this training. However, the chief pilot stated that he could not recall being briefed on CRM at Quick Turn. Further, according to a Quick Turn instructor, 61 Subsequent to the accident, Aviation Charter started sending all of its pilots to full-motion simulator training at FSI. 62 For information about an April 1997 FAA Regional Aviation Safety Inspection Program (RASIP) finding regarding CRM training at Aviation Charter, see section 1.17.3.5. 63 Subtopics of team building and maintenance included leadership, interpersonal relationships, workload management and situational awareness, and individual factors and stress reduction. 64 Both accident pilots’ most recent proficiency check records indicated that they were evaluated on CRM and graded as satisfactory.

Factual Information 33 Aircraft Accident Report pilots who attended training at Quick Turn were not evaluated on CRM because its training specifically evaluated pilot competency during single-pilot operations. During postaccident interviews, Aviation Charter’s lead ground instructor stated that he was not aware of the CRM module but that he did teach CRM techniques, including standard callouts and operating procedures, during ground school. The FAA principal operations inspector (POI) at the time the CRM module was added to the training manual stated that he did not remember if he had ever reviewed the CRM training module or observed the training.65 He also stated that because a CRM module was in the company’s training manual, the lead ground instructor should have been aware of it. Aviation Charter’s chief pilot and its director of operations stated that even though its training manual contained a module on CRM, it was not required by any rule or regulation.66 The FAA POI for Aviation Charter at the time of the accident stated that, subsequent to the accident, he encouraged Aviation Charter to conduct line checks during nonrevenue flights to evaluate CRM procedures. Further, he stated that he encouraged the company to put an instructor in the left seat and a copilot in the right seat during proficiency checks so that the company could monitor CRM procedures. 1.17.1.2 Stall Recovery Maneuvers Aviation Charter’s Multiengine Turbopropeller Maneuvers Guide contains guidance on stall recovery maneuvers to “afford familiarization with the airplane handling characteristics in the initial stall buffet region and provide training in stall recognition and proper recovery techniques.” The Maneuvers Guide contains guidelines to determine acceptable pilot performance during training of the stall recovery maneuver. According to the Maneuvers Guide, a pilot’s performance of the stall recovery maneuver is acceptable if the following conditions, in part, are met: a. Exhibits adequate knowledge of the factors, which influence stall characteristics, including the use of various drag configurations, power settings, pitch attitudes, weights, and bank angles. Also, exhibits adequate knowledge of the proper procedure for resuming normal flight… e. Initiates recovery [from stall] at the first indication of buffeting, decay of control effectiveness, other cues related to specific aircraft design characteristics, or as directed by the instructor. f. Recovers to a reference airspeed, altitude and heading, allowing only the acceptable altitude, airspeed, heading loss, or deviation. 65 This POI was replaced by another POI in June 2002, who was responsible for the oversight of Aviation Charter’s operating certificate at the time of the accident. The original POI was reassigned to Aviation Charter in December 2002. 66 For information about a previously issued CRM-related recommendation to the FAA, see section 1.18.2.

Factual Information 34 Aircraft Accident Report g. Demonstrates smooth, positive airplane control during entry, stall regime, and recovery. Specific stall recovery initiation procedures, including how to respond if the stall warning horn sounds in flight, were not noted in any of Aviation Charter’s manuals. However, one Aviation Charter copilot stated that during company flight training, she was instructed to initiate stall recovery when the stall warning horn sounded. Further, a Quick Turn instructor indicated that because the flight-training device was not a motion-based device, pilots were expected to initiate stall recovery when the stall warning horn sounded. 1.17.1.3 Instrument Approaches Aviation Charter’s Multiengine Turbopropeller Maneuvers Guide states that the flying pilot must brief the nonflying pilot before executing an instrument approach. The Maneuvers Guide indicates that the instrument approach briefing should include the type of approach, minimums, missed approach procedure, and the required callouts, including altitudes, times, airport in or not in sight, MDA, and deviations. Although the Maneuvers Guide states that an instrument approach briefing is a required item that must be accomplished by the flight crew before executing an instrument approach, Aviation Charter’s General Operations Manual (GOM) did not contain this requirement, and none of its company checklists called for conducting an approach briefing.67 The Maneuvers Guide also contains procedures for making an approach when the PIC is the flying pilot.68 The guide states that the nonflying pilot should tune and identify the VHF navigational receiver and set the course selector for the approach. The guide further states that an in-range checklist69 must be accomplished immediately before commencing an approach to reduce workload and permit the flying pilot to concentrate on the approach. The guide states, “the landing checklist may be accomplished at any time during the approach with the exception of landing gear and flaps.” The guide states that upon passing the final approach fix (FAF), the flying pilot should begin the descent to the MDA or step-down fix and that the landing gear should be extended at the FAF. The guide adds that landing flap extension can be delayed until the landing is assured. Aviation Charter’s chief pilot stated that pilots were instructed to extend the landing gear and reduce the power simultaneously once they have started the descent to the MDA. Aviation Charter’s Maneuvers Guide states that the recommended approach speed for precision approaches is 120 knots. However, neither the guide nor any other Aviation Charter manual specified the approach speed for nonprecision approaches.70 According to Aviation Charter’s chief pilot, he instructed pilots to fly all approaches at 130 knots and 67 At the time of the accident, the approach briefing was contained in SimuFlite’s Standard Operating Procedures (SOPs) located in Aviation Charter’s Differences Manual. Subsequent to the accident, the approach briefing was incorporated into the company’s FAA-approved GOM. 68 The Maneuvers Guide did not contain procedures for making an approach when the copilot is the flying pilot. 69 No in-range checklist could be found by Safety Board investigators in any of Aviation Charter’s manuals, and the company’s chief pilot and agent for service acknowledged that the company did not have an in-range checklist.

Factual Information 35 Aircraft Accident Report that 130 knots should be maintained from the FAF (or before starting descent) until the runway is in sight. He added that he instructed pilots to cross the threshold and touch down at 100 knots. The chief pilot further indicated that with the gear down, about 400 ft-lbs of torque, and 130 knots of airspeed, the airplane should descend at a rate just under 1,000 fpm. He stated that 100 feet before reaching the MDA, the torque would normally be brought up to 800 ft-lbs, and 130 knots would be maintained as the airplane was leveled off. He added that, at that point, the flying pilot should have his eyes inside the cockpit, not looking out, unless the nonflying pilot has called the airport in sight. The Maneuvers Guide contains criteria to determine acceptable pilot performance of a stabilized VOR approach. According to the guide, a pilot’s performance of a stabilized approach is acceptable if the following conditions, in part, are met: f. Recognizes if heading indicator and/or attitude indicator is inaccurate or inoperative, advises controller, and proceeds with approach… i. Maintains, prior to beginning the final approach segment, altitude within 100 feet [of the initial approach or assigned altitude], heading within 10 degrees [of initial approach or assigned heading] and allows less than a full-scale deflection of the CDI…and maintains airspeed within 10 knots [of initial approach or assigned airspeed]… k. Establishes a rate of descent and track that will ensure arrival at the MDA prior to reaching the MAP with the aircraft continuously in a position from which descent to a landing on the intended runway can be made at a normal rate using normal maneuvers. l. Allows, while on the final approach segment, no more than a three-quarter-scale deflection of the CDI…and maintains airspeed within 10 knots [of the approach airspeed]. m. Maintains the MDA, when reached, within +100 feet, -0 feet to the MAP. Standard callouts to be made during an approach and conditions that would warrant abandoning an approach were contained in SimuFlite’s SOPs, which were contained in Aviation Charter’s Differences Manual. The chief pilot stated that the Differences Manual was provided to all pilots during initial training. According to the Abandoned Approach procedure contained in the SOPs, within 500 feet agl, the airplane must be within the following approach window: the airspeed must be within ±10 knots of approach speed, and the vertical speed must be no greater than 1,000 fpm. If the airplane is not within this window, the flight crew must execute a go-around. 1.17.1.4 Standard Operating Procedures At the time of the accident, Aviation Charter did not have its own documented SOPs; however, as mentioned, the company was using Simuflite’s SOPs, which were in the Aviation Charter’s Differences Manual. The SOPs included the following: flying-pilot 70 According to Aviation Charter, it clarified its approach speed guidance subsequent to the accident by making 120 knots the recommended speed for all approaches.

Factual Information 36 Aircraft Accident Report and nonflying-pilot responsibilities, challenges and standard callouts that the flight crew should make during checklist completion in all phases of flight, emergency response procedures, and instrument approach criteria and procedures. According to Aviation Charter’s chief pilot, who conducted most of Aviation Charter’s King Air flight training, company pilots were taught SOPs during ground and flight instruction and were expected to use them. He added that since the accident, the company had started reviewing and incorporating SimuFlite’s SOPs into the company’s training manual and GOM. A company check airman rated the company’s standardization as 6 on a scale of 1 to 10. Another company pilot stated that the company’s standardization was fair to good, and the lead ground instructor stated that it was fair. The lead ground instructor also indicated that he suspected that some pilots were following SOPs and that some were not. One company pilot indicated that if the company was going to continue operating with two crewmembers, she would like to see the company adopt SOPs. Regarding callouts, one Aviation Charter pilot stated that she used the callouts that she used while employed at another company and added that she had never seen any standard callouts documented in any company manual. A company copilot stated that no formal airspeed callouts were required during an approach but that the company’s Differences Manual did document the approach briefing format and airspeed callouts. On April 3, 2003, the FAA approved revision 14 to Aviation Charter’s GOM. This revision incorporated Aviation Charter’s newly developed SOPs into its GOM, Section R, “Company Policies.” According to the company’s chief pilot and director of operations, following the accident, the company started teaching pilots SOPs during training and implemented random line checks to evaluate SOPs, CRM, and crew coordination. 1.17.2 Operational Guidance 1.17.2.1 Manufacturer’s Guidance on Operation in Icing Conditions The Raytheon King Air A100 AFM, Section I, “Limitations,” states that for sustained operation in icing conditions, the minimum airspeed should be 140 knots and adds that sustained flight in icing conditions with flaps extended is prohibited except for approach and landing. Raytheon’s AFM, Section II, “Normal Procedures,” contains the following caution regarding operation in icing conditions: Stalling airspeeds should be expected to increase when ice has accumulated on the airplane due to the distortion of the wing airfoil. For the same reason, stall warning devices are not accurate and should not be relied upon. Keep a comfortable margin of airspeed above the normal stall airspeed when ice is on the airplane. Further, Raytheon’s AFM states that an airplane’s surface deicer system should be operated when 1/2 to 1 inch of ice has accumulated on the airplane’s surfaces. The AFM also states that when the temperature is 5° C or lower, pitot heat,71 engine heat, and stall warning heat should be on before any visible moisture is encountered.

Factual Information 37 Aircraft Accident Report 1.17.2.2 Company Guidance on Operation in Icing Conditions At the time of the accident, Aviation Charter’s GOM, Section R, “Company Policies,” Chapter R-2.4, “Enroute Icing Conditions Procedures,” stated that its company policy is to avoid moderate icing conditions if possible but that if moderate icing is encountered, the flight crew should request an altitude change before the ice becomes heavy. The GOM added that because the additional weight of the ice will make it harder for the airplane to maintain airspeed, additional power will be needed. The GOM also stated that the deicer boots “should be used only after the ice has accumulated to 1/2 inch.” The manual adds that if the deicer boots “are prematurely activated the ice may form a shell around the boot[s] and render them useless.” Aviation Charter’s lead ground instructor stated that the procedure for activating the deicer boots was taught in ground school and that the company used to instruct pilots to wait until 1/2 inch of ice had accumulated to activate the boots. However, he stated that because of recent NASA research that recommended that deicer boots be activated at the first sign of ice buildup, he was instructing his students to activate the boots once about 1/4 inch of ice had built up. The lead ground instructor indicated that he was aware that the procedures taught in the company’s ground school were different from those contained in Raytheon’s AFM and the company’s GOM. He stated that this discrepancy was only discussed with the pilots during ground school. He stated that the training included a test on tailplane stall and icing conditions and that he covered winter operations as part of recurrent and initial training. When asked about the company’s deicing procedures, several Aviation Charter pilots indicated that there were no clear standardized procedures regarding how much ice should accumulate before activating the deicer boots. The POI responsible for Aviation Charter at the time of the accident told Safety Board investigators that he believed that a bulletin had been issued stating that deicer boots should be activated at the first sign of ice rather than waiting until 1/2 inch of ice had accumulated. The POI stated that he thought the FAA had issued the bulletin but that he was unsure if it was regulatory or overrode the AFM.72 The current POI also stated that a bulletin had been issued regarding activation of the deicer boots immediately upon encountering any kind of ice and that he believed that the lead ground instructor was teaching in accordance with the bulletin. Subsequent to the accident, Aviation Charter standardized its deicer boot operations training and adopted the Raytheon AFM recommendation to wait until the accumulation of 1/2 inch of ice before activating the deicer boots. 1.17.2.3 Weight and Balance Load Manifest Procedures At the time of the accident, Aviation Charter’s GOM, Section R, Chapter R-1.1, “Load Manifest,” indicated that the pilot was responsible for preparing a load manifest in 71 According to Aviation Charter’s chief pilot, company pilots were trained to use pitot heat for the entire flight. 72 The POI could not locate the bulletin for Safety Board investigators.

Factual Information 38 Aircraft Accident Report duplicate before each takeoff and ensuring its accuracy. The GOM added that the original copy of the load manifest must be carried in the aircraft to the company’s base of operations. It stated further that “Although FAR [Federal Aviation Regulations] 135.63(c) and (d) does not specify the disposition of the duplicate copy, it is Company policy to either FAX or mail the duplicate to the company base of operations” before station departure. The GOM stated that if a pilot was unable to mail or fax a copy of the load manifest, a copy should be carried in the most aft compartment of the airplane that is accessible to the pilot. As mentioned previously, the original and a copy of the accident airplane’s weight and balance load manifest were destroyed by postcrash fire. Subsequent to the accident, Aviation Charter issued revision 13 to the GOM to modify the load manifest form and to require that pilots leave a copy of the manifest at each departure station in a place where it could be located at a later time if needed. The FAA approved Aviation Charter’s revised manifest form on January 13, 2003. 1.17.3 FAA Surveillance 1.17.3.1 General Aviation Charter’s operating certificate was effective as of November 30, 1988, and was managed by the FAA’s Minneapolis FSDO. According to the FAA, at the time of the accident, the POI was responsible for 8 Part 135 operators, 37 Part 137 operators (agricultural airplanes), 1 Part 141 pilot school, 7 designated airmen, and 5 check airmen. In a postaccident interview in January 2003, the POI told Safety Board investigators that he was the only general aviation inspector in the Minneapolis FSDO and that he was responsible for 37 Part 135 operators, 155 Part 137 operators (agricultural airplanes), 4 Part 133 operators (heavy-lift helicopters), 11 Part 141 pilot schools, 79 designated airmen, 17 check airmen, and 168 Part 91 noncertificated operators.73 During an interview in January 2003, the Minneapolis FSDO’s operations supervisor told Safety Board investigators that the general aviation airworthiness unit, which is authorized to have five inspectors, had three inspectors; the general aviation operations unit, which is authorized to have six inspectors, had two inspectors; and the general aviation avionics unit, which is authorized to have two inspectors, had two inspectors. Both the FSDO’s manager and its operations supervisor stated that the office was not fully staffed with general aviation inspectors because of a hiring freeze and budget constraints.74 The operations supervisor stated that if the POI could not complete his 73 Although this POI was not responsible for Aviation Charter’s operating certificate from late June 2002 through the date of the accident, he was responsible for conducting surveillance of the company from about December 1997 through June 2002 and was reassigned the certificate in December 2002. The POI responsible for Aviation Charter at the time of the accident did not perform any surveillance of the company during the time he was responsible for the company’s operating certificate. For more information about the Minneapolis FSDO’s oversight of Aviation Charter, see section 1.17.3.3. 74 According to the FAA, the hiring freeze was lifted in March 2003, and three general operations inspectors and three air carrier operations inspectors have been hired at its Minneapolis FSDO.

Factual Information 39 Aircraft Accident Report current work program for 2003, certain items would be moved to other inspectors in the office. 1.17.3.2 FAA Surveillance Guidance FAA Order 1800.56C, “National Flight Standards Work Program Guidelines,” contains guidance for the development and execution of annual surveillance work programs, the planning and the performance of which was the responsibility of the regional Flight Standards division. According to the order, “the primary objective of surveillance is to provide the FAA with accurate, real-time, comprehensive information for the evaluation of the safety status of the air transportation system” and to ensure that the “highest level of safety is maintained within the aviation community.” FAA Order 1800.56C, Appendix 1, “Work Program Activities,” states that the Flight Standards work program comprises required (R-items) and planned (P-items) surveillance activities. R-items comprise the mandatory core inspection program, which is based on critical oversight issues that have been identified at a national level, and provide an essential level of surveillance activity for certificate holders. Specifically, appendix 1, Paragraph 5, “Required Surveillance,” states that one inspection in each of the following areas is required for Part 135 on-demand charter operations: manual/procedures, training program, crew/dispatcher records, and trip records. In addition to the R-items, each field office is tasked to design a mandatory P-items inspection program to provide comprehensive targeted inspections that meet special surveillance requirements for each certificate holder operating within a field office’s geographic district. 1.17.3.3 Minneapolis FSDO Oversight of Aviation Charter Each general aviation inspector at the Minneapolis FSDO was responsible for a combined total of about 630 hours of surveillance (R- and P-items) at their assigned operators. According to the Minneapolis FSDO’s operations supervisor, inspectors were required to complete at least 25 percent of their work program requirements every 3 months. The operations supervisor also stated that, in addition to their surveillance responsibilities, POIs shared the following extra duties: accident standby, processing enforcement actions and parachute waivers, assisting walk-in customers, approving and supervising air shows, and other FAA support activities. The POI responsible for the surveillance of Aviation Charter at the time of the accident did not perform any surveillance activities at the company from June 2002, when he was assigned the certificate, through the date of the accident (about 4 months). He stated that he had not visited the company during this time because of his workload, which he characterized as “high.” The POI also stated that it was a struggle to “keep his head above water” and that he wished the office had more people. He added that Aviation Charter still received a high level of surveillance compared to other operators because its headquarters was near the Minneapolis FSDO. According to the Minneapolis FSDO’s manager, this POI was not required to perform any surveillance activities from June to October 2002 because the previous POI

Factual Information 40 Aircraft Accident Report had already completed all of Aviation Charter’s R- and P-items before he left for his new assignment. FAA work program records indicated that for fiscal year 2002 (October 1, 2001, to September 30, 2002),75 the previous POI conducted the following surveillance activities at Aviation Charter: 1 operations manual inspection, 10 training program inspections, 8 crewmember training records inspections, 1 trip records inspection, 1 ramp inspection, and 2 operations inspections of aircraft/line operations. According to the previous POI, he was prevented from attending to such things as approving manual revisions because of his high workload.76 The Minneapolis FSDO’s operations supervisor and its manager stated that, subsequent to the accident, the principal inspectors for Aviation Charter were tasked to visit the company once every week or two, and other inspectors in the office were also encouraged to conduct surveillance of the company if time permitted. 1.17.3.4 FAA En Route Inspections According to FAA Order 8400.10, “Air Transportation Operations Inspector’s Handbook,” the FAA conducts en route inspections to observe and evaluate a certificate holder’s in-flight operations. The order adds that en route inspections are the most effective method for accomplishing surveillance objectives and responsibilities and that such inspections can be conducted from either the forward observer’s seat in the cockpit (jumpseat) or from a forward cabin seat if no jumpseat is available. According to the order, the following elements could be observed and evaluated during an en route inspection: crewmember proficiency; operator’s use of manuals, checklists, approved procedures, and safe operating practices; and crew coordination and resource management. FAA Order 8400.10 also states that POIs are responsible for coordinating with their assigned operators to ensure that established procedures are used by FAA inspectors for scheduling the jumpseat/forward passenger seat and that the operator’s procedures allow inspectors to have free and uninterrupted access to the jumpseat/forward passenger seat. En route inspections are required to be conducted at Part 121 operations and 135 scheduled (commuter) operations; however, they are not required to be conducted at Part 135 unscheduled (on-demand) charter operations. According to Aviation Charter’s POI and the Minneapolis FSDO’s operations supervisor, en route inspections are rarely conducted at Aviation Charter because they are not a required oversight item for POIs of 14 CFR Part 135 on-demand charter operators. The POI added that other reasons that en route inspections are rarely conducted for such operations were because on-demand charter flights are scheduled with little advance notice, most of the smaller airplanes used in these operations do not have jumpseats installed, and the passengers on such flights tended to desire privacy. He stated that he had tried to perform surveillance of actual charter flights at Aviation Charter, but he stated that 75 As stated previously, the previous POI conducted his last surveillance activity before the accident on June 27, 2002. 76 This POI was reassigned to Aviation Charter in December 2002.

Factual Information 41 Aircraft Accident Report he found it difficult because of limited passenger accommodations on the airplanes. He added that the best way for him to ensure adequate oversight of an operator was to monitor ground training. 1.17.3.5 Preaccident FAA Regional Aviation Safety Inspection Program Inspection A team of aviation safety inspectors conducted a RASIP inspection at Aviation Charter from April 7 to 11, 1997. The RASIP Inspection Report included seven operations-related findings (two Category A, three Category B, and two Category C findings).77 Specifically, the report stated that CRM was only addressed in the training curriculums for two types of airplanes flown by the company. The report added that CRM should be addressed in all of the company’s training curriculums because, if not, “it could possibly result in improper crew coordination requirements in aircraft operated with a flight crew of more than one member.” Another operations finding indicated that Aviation Charter’s GOM was contrary to 14 CFR 135.63(c), which states that it is the certificate holder’s responsibility for preparation and accuracy of the load manifest. The report noted that the company used load computer and flight manuals for weight and balance calculations, but that the information was not being retained to determine load manifest accuracy at a later date.78 The RASIP report also noted that starting in January 1997, Aviation Charter had a Safety Officer to heighten safety awareness throughout the company; however, at the time of the accident, this position no longer existed. Subsequent to the October 2002 accident, Aviation Charter hired a Director of Safety (this action was not required by the FAA). 1.18 Additional Information 1.18.1 Previous Aviation Charter Operations-Related Accident On December 21, 1997, an Aviation Charter King Air A100 crashed at Colorado Springs, Colorado, after encountering ground fog during landing. The pilot and one passenger were killed. The Safety Board determined that the probable causes of the accident were the failure of the pilot to follow IFR procedures and maintain the MDA. As mentioned previously, subsequent to the accident, the company began operating with 77 The FAA defines the three categories of findings as follows: a Category A finding is any noncompliance with FARs; a Category B finding is a failure of the certificate holder to adhere to documented company procedures regarding regulations and safety; and a Category C finding is a lack of systems that would ensure that the certificate holder complies with continuing or reoccurring FAR requirements. The RASIP Inspection Report notes that compliance issues raised during the inspection were discussed with company personnel and principal inspectors and that issues that were not satisfactorily resolved became findings in the body of the report. 78 Aviation Charter’s agent for service indicated that this finding referred to the pilots not being required to leave a copy of the manifest at the departure station.

Factual Information 42 Aircraft Accident Report two flight crewmembers. According to the Minneapolis FSDO’s manager, the FAA did not implement any changes to its oversight of Aviation Charter after the Colorado Springs accident. 1.18.2 Previous CRM-Related Safety Recommendation As a result of its investigation of the March 29, 2001, accident involving a Gulfstream III operated by Avjet Corporation as a Part 135 on-demand charter passenger flight, the Safety Board issued Safety Recommendation A-02-12, which asked the FAA to “revise 14 Code of Federal Regulations (CFR) Part 135 to require on-demand charter operators that conduct operations with aircraft requiring two or more pilots to establish a Federal Aviation Administration-approved crew resource management training program for their flight crews in accordance with 14 CFR Part 121, subparts N and O.” On February 3, 2003, the FAA announced a comprehensive regulatory review of 14 CFR Parts 125 and 135, including a review of CRM training. The FAA also stated that it was finalizing its notice to inspectors who have oversight responsibility for Part 135 on-demand operators to remind them of the circumstances of the Avjet accident and to direct them to point out to their assigned operators information contained in Advisory Circular (AC) 120-5 lD, “Crew Resource Management Training.” According to the FAA, the notice will also state that the FAA strongly endorses CRM training. On August 7, 2003, the Board classified Safety Recommendation A-02-12 “Open—Acceptable Response.”

43 Aircraft Accident Report 2. Analysis 2.1 General The flight crewmembers were properly certificated and had received the training for pilot certification prescribed by Federal regulations.79 No evidence indicated any preexisting medical or other physical condition that might have adversely affected the flight crew’s performance during the accident flight. Fatigue most likely did not degrade the performance of either pilot on the day of the accident. The accident airplane was properly certificated, equipped, and maintained in accordance with Federal regulations and approved company procedures. The recovered components showed no evidence of preexisting powerplant, system, or structural failures. The weight and balance of the airplane were within limits for dispatch, takeoff, climb, cruise, and landing. This analysis discusses the accident sequence, including weather, ATC, and EVM VOR issues, and flight crew actions and competence. This analysis also discusses operational and training issues at Aviation Charter, FAA surveillance of the company, and the need for low-airspeed alert systems. 2.2 Determination of Flying Pilot ATC recordings indicated that the accident copilot made all but one of the transmissions to ATC during the approach and descent. Typically, dual-pilot operations are conducted with the flying pilot handling the flight controls and the nonflying pilot handling the communications. Aviation Charter company practices were in accordance with this standard. However, several Aviation Charter pilots interviewed by Safety Board investigators indicated that the accident pilot often allowed them to conduct the flights they flew with him as if they were single-pilot operations (that is, he allowed them to handle the flight controls and communications and perform all of the checklists without his assistance). Therefore, the Safety Board could not determine who was flying the airplane at the time of the accident. 79 As discussed in section 1.5.1.2, there were numerous discrepancies with the pilot’s logbooks that called into question the accuracy of his flight time record-keeping. However, the investigation found no evidence indicating that the pilot lacked the required flight time or that these discrepancies in the logbooks were related to the cause of this accident.

Analysis 44 Aircraft Accident Report 2.3 Accident Sequence of Events 2.3.1 Flight Crew’s Inadequate Setup for the Approach About 1009, 7 minutes after being instructed to descend from 13,000 feet to 4,000 feet at pilot’s discretion, the copilot reported leaving 13,000 feet. About 1012, the DLH approach control south radar controller cleared the flight to 3,500 feet. During the descent to 3,500 feet, the airplane slowed from about 220 to about 190 KCAS. By 1017:35, the airplane had leveled off at 3,500 feet with the airspeed continuing to decrease. Shortly after 1018:31, as the airplane approached the published EVM VOR runway 27 final approach course from the south at about 164 KCAS and decreasing, ATC instructed the flight crew to turn left to a heading of 300° until established on the final approach course.80 However, the flight crew overshot the approach course almost immediately after being issued the turn, and the airplane ultimately traveled for almost 1 mile north of the course as it continued the turn toward the course until establishing a ground track of about 262°. The airplane began its descent from 3,500 feet, and the airspeed began increasing about 1019:20. The airplane should have been at 130 knots at the start of the descent81 with flaps at the approach setting and the landing gear down. Because the airplane was fast at this point in the approach, the flight crew had to lose a significant amount of airspeed and altitude in a short amount of time. As the airplane descended through 3,200 feet, its airspeed and vertical speed peaked at about 170 KCAS and 1,400 fpm, respectively. At 1020:06, as the airplane descended through 2,700 feet about 5 miles east of the runway 27 threshold, a right turn was initiated and the airspeed began decreasing from about 170 KCAS. When the airplane was approximately 4 miles from the runway threshold, it was still at 2,300 feet and about 160 KCAS; however, at this point in the approach, the airplane still should have been at an airspeed of about 130 knots. Further, Aviation Charter’s chief pilot stated that the landing gear should be extended when the flight crew starts the descent to the MDA and that the power should simultaneously be reduced to get down to approach speed. However, the maximum speed for landing gear extension is 156 knots. The airspeed exceeded 156 knots when the airplane started its descent to the MDA and during most of the descent. The chief pilot and other Aviation Charter pilots indicated that it would have been difficult to exceed 156 knots with the gear extended. Therefore, it appears that the flight crew did not properly configure the airplane at the start of the approach (extending the landing gear or reducing power before descending from 3,500 feet). 80 For analysis of this ATC instruction, see section 2.5. 81 As noted previously, according to Aviation Charter’s chief pilot, the company instructed its pilots to fly nonprecision approaches at 130 knots until short final and to cross the runway threshold and touch down at 100 knots.

Analysis 45 Aircraft Accident Report As previously discussed, simulations performed by the Safety Board indicated that the later stages of the approach flown by the accident flight crew were more difficult in terms of mental and physical demand and time pressure than it would have been if they had not overshot the approach course and had not delayed their descent and landing gear extension. The flying pilot of these simulations commented that during this approach there was a “noticeably higher workload – with gear delayed, I felt behind the airplane.” The flight crew’s failure to monitor the airspeed and correct their course and airspeed deviations early in the approach and the fact that the flight crew did not properly configure the airplane at the start of the approach would have made the later stages of the approach more difficult. 2.3.2 Flight Crew’s Failure to Stabilize the Approach As stated previously, the flight crew initiated a slight right turn at 1020:06, as the airplane again passed through the final approach course (this time flying from north to south) about 5 miles east of the runway 27 threshold. The airplane continued its slight right turn until it established a ground track of 269°, which it maintained until the end of the radar data. At this point, the airplane was south of the published approach course (of 276°); therefore, this turn did not allow the airplane to intercept the course, and the flight crew never effectively maneuvered the airplane to remain near the approach course.82 At 1020:36, the airplane’s airspeed was about 156 knots about 3.7 miles from the runway 27 threshold and it was descending through about 2,200 feet. At 1020:54, when the airplane was 3 miles from the runway threshold, it was descending through about 2,100 feet and slowing through about 130 KCAS. The last two radar returns indicate that the airplane was at approximately 1,800 feet83 and slowing through about 76 KCAS, which is the approximate stall speed for the configuration in which the airplane was found after the accident. The last radar return was about 2 miles southeast of the runway threshold. Airplane simulations showed (and the stall warning system design indicates) that the flight crew should have received at least several seconds of aural stall warning in the cockpit if the airspeed decreased below 81 to 84 knots, if the stall warning system was working properly, and if the airplane was not affected by ice accumulation. Further, the flight crew should have had other indications of low airspeed, such as increased pitch attitude and a quieter slipstream, and might have experienced buffeting and less responsive flight controls, depending on the airspeed and whether there was any ice accumulation. However, because the airplane was not equipped with a CVR, because of the approximate nature of the airspeed calculations, and because airplane maneuvering or small amounts of ice accumulation can increase an airplane’s stall speed, the Safety Board 82 As further discussed in section 2.6, the bends (which, as noted previously, are fluctuations in the calculated VOR radial position that occur slowly enough to be followed by a pilot under normal conditions) in the VOR signal played no role in the flight crew’s failure to intercept the course. 83 Because of the ± 50-foot accuracy of the radar data, it could not be determined exactly how close the airplane was to the MDA of 1,840 feet at the time of the last radar returns.

Analysis 46 Aircraft Accident Report was not able to determine when or whether the stall warning horn activated on the accident flight or if buffeting or loss of flight control effectiveness occurred. Nevertheless, it is clear that the flight crew failed to monitor the airplane’s airspeed and allowed it to decrease to a dangerously low level (as low as about 50 knots below the company’s recommended approach airspeed) and to remain below the recommended approach airspeed for about 50 seconds. Further, the flight crew failed to recognize that a stall was imminent. According to the stabilized approach criteria contained in Aviation Charter’s Turbopropellers Maneuvers Guide, while on the final approach segment of a nonprecision approach, pilots should allow no more than a three-quarter-scale deflection of the CDI needle and maintain airspeed within 10 knots of the approach airspeed. Further, according to the Abandoned Approach procedure contained in Aviation Charter’s SOPs, when the flight is within 500 feet agl, the airspeed must be within ± 10 knots of the recommended approach speed. If the airplane does not meet these acceptable margins, the flight crew is expected to execute a go-around. Computations showed that the airplane’s position relative to the VOR course would result in the CDI needle likely at full deflection approximately 2.6 miles from the VOR station. Further, at this point in the approach, the airspeed had fallen to about 110 knots and was still decreasing, ultimately reaching a low of about 76 knots. Therefore, the inadequate airspeed or the full CDI needle deflection should have prompted the flight crew to execute a go-around. 2.3.3 Summary of Flight Crew’s Performance During the Approach In sum, the Safety Board concludes that the flight crew failed to maintain an appropriate course and speed for the approach and did not properly configure the airplane at the start of the approach, making the later stages of the approach more difficult. Further, the Safety Board concludes that, during the later stages of the approach, the flight crew failed to monitor the airplane’s airspeed and allowed it to decrease to a dangerously low level (as low as about 50 knots below the company’s recommended approach airspeed) and to remain below the recommended approach airspeed for about 50 seconds. The Board further concludes that the flight crew failed to recognize that a stall was imminent and allowed the airplane to enter a stall from which they did not recover. The Board also concludes that the inadequate airspeed or the full CDI needle deflection should have prompted the flight crew to execute a go-around; however, they failed to do so. Lastly, the Safety Board notes that if the flight crew had been adhering to Aviation Charter’s approach procedures and effectively applying CRM techniques in the cockpit, at least one of the flight crewmembers should have been monitoring the instruments. The evidence clearly indicates that neither flight crewmember was monitoring the airspeed indicator or CDI during the approach. Therefore, the Safety Board concludes that the flight crew was not adhering to Aviation Charter’s approach procedures and was not effectively applying CRM techniques during the approach segment of the flight.

Analysis 47 Aircraft Accident Report 2.4 Weather Issues 2.4.1 Clouds Because the surface visibility around the time of the accident was about 3 statute miles, the flight crew probably would have been able to see the airport to the right of their course if the airplane had been completely clear of the clouds. However, EVM and Hibbing surface observations and pilot statements indicate that around the time of the accident, the cloud bases at and near EVM were somewhere between 1,800 and 2,100 feet.84 The last two recorded radar returns indicate that the airplane was at approximately 1,800 feet and within 2 miles of the runway 27 threshold. Further, a witness indicated that he saw the accident airplane “just beneath a low layer of clouds” but that “the top of the airplane may still have been in the clouds.” Therefore, because the airplane was most likely in and out of the clouds before the accident, the Safety Board concludes that clouds might have prevented the flight crew from seeing the airport. 2.4.2 Airframe Icing The Safety Board considered whether airframe icing could have been a factor in the accident. Several pilot reports made in the vicinity of EVM about the time of the accident and an analysis of those reports indicated that icing was likely occurring in two distinct bands around the time of the accident: moderate icing was present between approximately 8,000 and 11,000 feet, and light/trace icing was present between approximately 5,000 and 8,000 feet. Icing studies conducted for the Board indicated that there was a low potential for SLD around Eveleth and, further, that moderate icing most likely did not extend to the lower levels of the atmosphere. One of the last two pilots who landed at EVM before the accident reported experiencing light to moderate rime icing at 7,000 feet, at which level the temperature was approximately -2° C. He added that after descending to 5,000 feet, the ice began to shed off the airplane and that the temperatures at this level were between about -0.5° to 0° C. The other pilot who landed at EVM stated that he encountered light rime icing at 5,000 feet. This pilot and the first pilot to depart EVM after the accident told Safety Board investigators that they experienced very little icing below 5,000 feet. Further, radar data show that the airplane was maintaining high airspeeds throughout the region in which icing might have been accumulated and lost airspeed at lower altitudes where performance would have been improving if any accumulated ice was shedding (as a result of warmer temperatures or activation of the deicer boots), indicating that icing was not affecting the airplane’s performance. On the basis of cloud top and base values, investigators determined that the airplane was in the clouds for approximately 9 1/2 minutes during the descent portion of 84 This equates to about 420 to 720 feet above the EVM runway 27 elevation.

Analysis 48 Aircraft Accident Report the flight. Specifically, the airplane was in the clouds in which moderate icing was present (between approximately 8,000 and 11,000 feet) for about 2 minutes 35 seconds, in the clouds in which light/trace icing was present (between approximately 5,000 and 8,000 feet) for about 2 minutes 24 seconds, and in the clouds in which very little icing was present and in which it was reported that any accumulated ice began shedding (below 5,000 feet) for about 4 minutes 23 seconds. On the basis of all of this evidence, the airplane was most likely not in the cloud layer in which moderate icing was present for enough time to accumulate any significant airframe icing. Further, any icing that the airplane might have accumulated would have been shed by the deicing equipment, or it would have begun shedding off the airplane’s surfaces as it was descending through 5,000 feet because of the warming temperatures. In addition, the airplane’s performance was not consistent with the effects of icing, and flight simulations showed that the performance could be matched with and without simulated icing with enough reserve engine power available to increase the airspeed during the descent. Therefore, the Safety Board concludes that icing did not affect the airplane’s performance during the descent. 2.5 ATC Issues At 1018:13, when the accident airplane was about 9.5 miles from the runway 27 threshold and less than about 1/2 mile from the published EVM VOR runway 27 final approach course at an airspeed of about 164 KCAS and a heading of about 360°, the DLH approach control south radar controller instructed the flight crew to turn left to a heading of 300° and issued an approach clearance for the EVM VOR runway 27 approach. The controller’s instruction provided a final approach course interception angle of about 25°. However, the airplane did not intercept the VOR approach course.85 Instead, it overshot the intended course and then began turning back toward the approach course a few seconds later. The airplane’s speed and close proximity to the VOR final approach course when the controller issued the 300° interception heading precluded the flight crew from completing their left turn in time to initially intercept the final approach course. However, the controller’s radar display was set at a range of 60 miles, which is an appropriate resolution for normal coverage of the DLH airspace, and, at that range, the controller would have had difficulty discerning the airplane’s exact position relative to the approach course or even its overshoot of the course. Further, if the pilots were unsure of their ability to intercept the approach course or safely execute the approach, they were responsible for requesting additional vectors from ATC. No evidence exists that the flight crew expressed any concerns about the execution of the approach to the DLH controller. Further, the controller’s instruction should not have prevented the flight crew from correcting their overshoot and properly intercepting and becoming established on the approach course. Lastly, during postaccident airplane simulations, the flight crew that flew an approach 85 As previously mentioned, the approach course is 276°.

Analysis 49 Aircraft Accident Report using ATC vectors similar to those given to the accident flight crew initially overshot the approach course but were able to reintercept the course from the north, establish a stabilized approach, and land successfully. Therefore, the Safety Board concludes that the DLH approach control south radar controller’s instructions did not prevent the flight crew from intercepting the EVM VOR runway 27 final approach course at a sufficient distance to safely execute an approach and landing. 2.6 EVM VOR Issues FAA flight checks indicated that the EVM VOR signal within the area between 5 to 10 miles from the station was out-of-tolerance for bends (a maximum distortion of +4.1° was measured; a maximum distortion of ± 3.5° is allowed). Despite the slight inaccuracy, the VOR signal positioned the airplane within an acceptable aiming point for landing. Within the area between 5 to 8 miles from the EVM VOR, the airplane was on a fairly steady course of 262° moving toward 276°, which is the VOR inbound approach course for runway 27. Therefore, because the airplane was converging on the inbound course in the area between 5 to 10 miles from the VOR, it is clear that the slight bends in the VOR signal were not misleading the flight crew or noticeably affecting the airplane’s operation. Further, when following a VOR, flight crews are expected to maneuver the airplane to keep the CDI needle centered. Accordingly, if they had been following the VOR, the accident flight crew most likely would not have perceived a slight bend in the course as they continued to maneuver the airplane to keep the CDI needle centered. Therefore, the Safety Board concludes that the out-of-tolerance condition and slight bends in the EVM VOR signal were not a factor in this accident. 2.7 Flight Crew Proficiency Although several changes and adjustments would had to have been made in a relatively short amount of time to stabilize the approach (with regard to speed, course, and airplane configuration), the pilots should have been able to handle the changes and successfully complete the approach. As noted previously, because the flight crew did not properly configure the airplane for the start of the approach and failed to monitor the airspeed and correct their course and airspeed deviations early in the approach, they increased the difficulty of the later stages of the approach. It is possible that the flight crew could not keep up with the multiple concurrent tasks that they would have needed to complete during the final phase of the flight. In addition, the multiple concurrent tasks would have required efficient coordination between the two crewmembers; however, as concluded previously, the flight crew likely was not effectively applying CRM techniques during the approach segment of

Analysis 50 Aircraft Accident Report the flight. Therefore, these tasks likely were not being effectively handled during the approach. Further, the Safety Board’s investigation revealed that the pilots often performed poorly when flying approaches. During the investigation, Safety Board investigators talked with company instructors and with pilots and check airmen who had flown with the pilot and copilot. These interviews identified several concerns about the flight proficiency of the pilot and copilot. Aviation Charter’s lead ground instructor, who was previously a check airman for the company, stated that some company pilots indicated that the pilot’s flying skills were below average. Several company pilots’ statements indicated that the pilot performed below average during flight operations. Specifically, one Aviation Charter pilot stated that he had concerns about the accident pilot’s flying skills, monitoring capabilities, and tendency to become distracted. Other company pilots indicated that the pilot occasionally lost awareness of the airplane’s altitude, attitude, and position during flight operations. A company copilot indicated that during a flight with the pilot about 2 months before the accident, he had to complete an approach for the pilot because the pilot did not have his navigational radio tuned to the VOR in use for the approach, which caused the pilot’s CDI to provide erroneous indications, and that he then had to explain to the pilot the reason his CDI was not indicating properly. Two pilots reported having to assume control of the airplane when the pilot failed to adequately control the airplane during instrument conditions. In addition, the pilot reportedly had a reputation for allowing his copilots to perform most of the flying, which might have reduced his flight proficiency and skills. Regarding the accident copilot, Aviation Charter’s lead ground instructor reported that the copilot’s performance during ground school was below average. Several statements made by company pilots indicated that the copilot performed below average during flight operations. Specifically, two pilots stated that he had difficulties with power management when flying an approach and that he had to be reminded to keep one hand on the throttles and to monitor power settings. Several pilots expressed concern about the copilot’s inability to land the airplane without assistance and described him as “not assertive.” Further, although the copilot claimed no previous aviation employment history on his employment application for Aviation Charter, his logbook entries and résumé indicated that he had been employed previously at two aviation operations: a skydive operator and Northwest Airlines. Records from the two companies indicate that he was let go from the skydive operator because he could not meet its pilot qualifications standards for flying the Cessna 182 and that he resigned from Northwest Airlines because he was unable to complete its systems and procedures training program. Postaccident statements from Aviation Charter pilots and other personnel indicate that both pilots often exhibited potentially serious performance deficiencies during flight operations. Therefore, the Safety Board concludes that both pilots had previously demonstrated potentially serious performance deficiencies during flight operations consistent with below-average flight proficiency.

Analysis 51 Aircraft Accident Report 2.8 Aviation Charter Operational and Training Issues 2.8.1 Operational Guidance Although Aviation Charter’s Multiengine Turbopropeller Maneuvers Guide stated that the flying pilot must brief the nonflying pilot before executing an instrument approach, its GOM did not contain this requirement, and none of its company checklists called for issuing an approach briefing. Also, although the Maneuvers Guide stated that an in-range checklist must be accomplished immediately before commencing an approach, an in-range checklist was not contained in any of the company’s manuals. Further, Aviation Charter’s Maneuvers Guide does not contain specific stall recovery initiation procedures, including how to respond if the stall warning horn sounds in flight, and such procedures were not contained in any of Aviation Charter’s other manuals. Further, although Aviation Charter’s GOM required pilots to either fax or mail a duplicate of the weight and balance load manifest form for every flight to the company base of operations, the company was not following this policy at the time of the accident. Lastly, company guidance on when to operate the deicer boots was inconsistent. On the basis of this evidence, the Safety Board concludes that at the time of the accident, Aviation Charter was not operating in accordance with its weight and balance load manifest procedures, it did not have adequate stall recovery guidance, it did not have consistent deicer boot operational guidance, and it did not have an in-range checklist. The Safety Board is aware that subsequent to the accident, Aviation Charter incorporated an approach briefing as part of the descent procedures contained in the SOPs in the GOM and revised the GOM to modify the weight and balance load manifest form and to require that pilots leave a copy of the manifest at each departure station in a place where it can be located at a later time if needed. SOPs are typically developed for each airplane type within a company’s fleet to ensure safe, logical, and efficient flight operations and to provide pilots with step-by-step guidance for completing all phases of ground and flight operations, especially in multicrew, complex, or high-performance aircraft. SOPs typically include flying-pilot and nonflying-pilot responsibilities, challenges and standard callouts that the flight crew should make during checklist completion in all phases of flight, emergency response procedures, and instrument approach criteria and procedures. The Safety Board’s review of the SOPs in effect at Aviation Charter at the time of the accident revealed that its approach procedures were adequate and determined that if the accident flight crew had adhered to these procedures, the accident might have been prevented. As noted, these SOPs were SimuFlite’s SOPs, which were located at the back of the Aviation Charter’s Differences Manual. The chief pilot indicated that SOPs were being taught to and used by company pilots, and both he and the director of operations stated that all pilots were given a Differences Manual during initial training. However, according to a company check airman, on a scale of 1 to 10, the company’s standardization was a 6. Another company pilot stated that the company’s standardization was fair to good, and the lead ground instructor stated that it was fair. The lead ground

Analysis 52 Aircraft Accident Report instructor also indicated that he suspected that some pilots were following SOPs and that some were not. One company pilot indicated that if the company was going to continue operating with two crewmembers, she would like to see the company adopt SOPs. In addition, one company pilot stated that she had never seen any standard callouts documented in any company manual, and a company copilot stated that no formal airspeed callouts were required during an approach. Therefore, on the basis of all of these statements and because the circumstances of the accident indicate that the accident flight crew was most likely not adhering to the SOPs for a nonprecision approach during the approach, the Safety Board concludes that Aviation Charter was not adequately making company pilots aware of its SOPs. The Safety Board is aware that subsequent to the accident, Aviation Charter incorporated the SOPs, with some revisions, into its company GOM. 2.8.2 CRM Training According to the FAA, Aviation Charter was not required by Federal regulations to provide CRM training to its pilots. However, it became mandatory to teach CRM in accordance with the CRM training module once the module was approved by the FAA. However, postaccident interviews with Aviation Charter’s lead ground instructor and its chief pilot and the FAA POI for the company revealed that CRM was not being taught during ground school in accordance with the training manual curriculum. Therefore, the Safety Board concludes that at the time of the accident, Aviation Charter was not training its pilots on CRM in accordance with its FAA-approved CRM training module. 2.9 FAA Surveillance Issues 2.9.1 FAA Surveillance of Aviation Charter FAA Order 1800.56C, “National Flight Standards Work Program Guidelines,” lists four required surveillance items for Part 135 on-demand charter operations, including annual manual/procedures and training program inspections. Between October 1, 2001, and June 27, 2002, the POI for Aviation Charter conducted 1 manual inspection, 2 line checks, 1 ramp inspection, 10 training program inspections, and 9 other operations-related inspections; however, during these inspections he failed to detect any of the operational discrepancies determined by the investigation to have existed at Aviation Charter at the time of the accident. On the basis of this evidence and the fact that the POI had not conducted any en route inspections, the Safety Board concludes that although the FAA’s surveillance of Aviation Charter was in accordance with its standard guidelines, it was not sufficient to detect the discrepancies that existed at Aviation Charter.

Analysis 53 Aircraft Accident Report 2.9.2 FAA Surveillance of Part 135 On-Demand Operations FAA Order 8400.10, “Air Transportation Operations Inspector’s Handbook,” states that “en route inspections are one of the most effective methods for accomplishing surveillance objectives and responsibilities” and that the primary objective of these inspections is to evaluate in-flight operations, including, but not limited to, crew coordination, cockpit procedures, and crewmember proficiency, of a certificate holder. However, although FAA Order 1800.56C requires inspectors to conduct en route inspections at Part 121 operations and 135 scheduled (commuter) operations, it does not require inspectors to conduct en route inspections at Part 135 unscheduled (on-demand) charter operations. Further, the Safety Board is aware that POIs of Part 121 operations routinely observe flight training and proficiency checks as a means to provide adequate surveillance of these operations. Aviation Charter’s POI and the Minneapolis FSDO’s operations supervisor indicated that because there was no FAA requirement to conduct en route inspections of 14 CFR Part 135 on-demand charter flights, such inspections were rarely performed. The POI added that the best way for him to ensure adequate oversight of an on-demand Part 135 operator was to monitor ground training. The Safety Board does not concur with the POI’s statement. Although ground school surveillance is a valuable tool that allows POIs to evaluate an instructor and the adequacy of course content, it does not allow POIs to conduct comprehensive and in-depth assessments of an operator’s policies and procedures or to determine how well the trained procedures are being assimilated into line operations, which could be accomplished through en route inspections and through observations of flight training and proficiency checks (in addition to ground school observations). The Safety Board is concerned that even though the FAA’s surveillance of Aviation Charter was in accordance with FAA Order 1800.56C, the POI did not detect the discrepancies that existed at Aviation Charter during his manual/procedures or training inspections, some of which might have been detected through en route inspections or through observations of flight training or proficiency checks. The Board is also concerned that the FAA requires en route inspections of Part 135 scheduled operations, but not for Part 135 on-demand operations, despite its own acknowledgement that en route inspections are one of the best means for ensuring adequate surveillance. The Safety Board is aware that subsequent to the accident, Aviation Charter implemented random line checks to evaluate SOPs, CRM, and crew coordination. Although the Board commends the company for its actions, it is concerned about the FAA’s relying too much on company check airmen and not enough on its own staff to evaluate these areas. Therefore, the Safety Board concludes that en route inspections, combined with ground training, flight training, and proficiency check observations, are essential for ensuring adequate oversight of a company’s operations and should be conducted on flights operated by 14 CFR Part 135 on-demand charter operators. Therefore, the Safety Board believes that the FAA should conduct en route inspections and observe ground training, flight training, and proficiency checks at all 14 CFR Part 135

Analysis 54 Aircraft Accident Report on-demand charter operations as is done at Part 121 operations and Part 135 commuter operations to ensure the adequacy, quality, and standardization of pilot training and flight operations. 2.9.3 FAA CRM Training Requirements Most Part 121 and scheduled Part 135 operators provide several days of dedicated CRM training in which accidents are reviewed and skills and techniques for effective crew coordination, resource allocation, and error management are presented. CRM training augments technical training and enhances pilots’ performance in the cockpit. In its April 1997 RASIP report, the FAA stated that CRM should be addressed in all of Aviation Charter’s training curriculums because, if not, “it could possibly result in improper crew coordination requirements in aircraft operated with a flight crew of more than one member.” On May 21, 1997, the FAA approved the company’s CRM training module. However, as previously noted, the Safety Board concluded that Aviation Charter was not teaching CRM in accordance with its CRM training module. As a result of its investigation of the March 29, 2001, Avjet Corporation accident in Aspen, Colorado, the Safety Board issued Safety Recommendation A-02-12, asking the FAA to “revise 14 Code of Federal Regulations (CFR) Part 135 to require on-demand charter operators that conduct operations with aircraft requiring two or more pilots to establish an FAA-approved CRM training program for their flight crews in accordance with 14 CFR Part 121, subparts N and O.” The Safety Board concludes that the circumstances of the October 2002 Aviation Charter accident indicate that CRM training should be extended to include all 14 CFR Part 135 on-demand charter operations that conduct dual-pilot operations regardless of whether the aircraft requires two or more pilots. Therefore, the Safety Board believes that the FAA should require that 14 CFR Part 135 on-demand charter operators that conduct dual-pilot operations establish and implement an FAA-approved CRM training program for their flight crews in accordance with 14 CFR Part 121, subparts N and O. Because of the issuance of this recommendation, Safety Recommendation A-02-12 is classified “Closed—Superseded.” 2.10 Low-Airspeed Alert Systems 2.10.1 Background Current Federal airworthiness standards require that airplanes be equipped to provide a clear and distinctive stall warning to the flight crew at a speed that is at least 5 knots higher than stall speed. However, stall warnings do not always provide flight crews with timely notification of developing hazardous low-airspeed conditions. For example, abrupt maneuvering can increase angle-of-attack so rapidly that a stall could

Analysis 55 Aircraft Accident Report occur nearly simultaneously with the stall warning, and ice accumulation, which raises the stall speed, could degrade the stall warning margin to the point at which little or no stall warning is provided. The accident airplane was equipped with a stall warning system designed to sound a horn in the cockpit 5 to 8 knots before the actual stall speed of the airplane in any configuration. However, as discussed previously, because the airplane was not equipped with a CVR, because of the approximate nature of the airspeed calculations, and because abrupt airplane maneuvering or even small amounts of ice accumulation can defeat the airplane’s stall warning system, the Safety Board was not able to determine when or if the stall warning horn activated before the onset of the stall. Regardless of when or whether the stall warning horn activated, it is clear that the accident flight crew failed to maintain airspeed during the approach. As discussed in section 2.3, radar data indicate that the accident flight was operated below Aviation Charter’s recommended approach speed for about the last 50 seconds of the flight. The Safety Board has investigated numerous accidents and incidents involving commercial flight crews that inadvertently failed to maintain adequate airspeed. For example, the Board has investigated at least 11 events since 1982 involving Part 135 flights and at least 7 events involving Part 121 flights in which stall or failure to maintain airspeed during the approach or landing phases was cited as a causal or contributing factor and in which icing was not cited as a factor. In addition, the Board has investigated other events in which the drag associated with airframe ice and pilot inattention led to a critical loss of airspeed. Failure to maintain airspeed during these flights resulted in catastrophic and other unsafe circumstances, such as loss of control, impact with terrain or water, hard landings, and tail strikes. A 1996 FAA Human Factors Team86 Report titled, “The Interfaces Between Flight Crews and Modern Flight Deck Systems,” expressed concern about the history of accidents involving lack of low-airspeed awareness in the context of flight crews monitoring automated systems. This report states the following: flight crews may not be provided adequate awareness of airplane energy state, particularly when approaching or trending toward a low energy state…Transport category airplanes are required to have adequate warnings of an impending stall, but at this point the airplane may already be in a potentially hazardous low energy state. Better awareness is needed of energy state trends such that flight crews are alerted prior to reaching a potentially hazardous low energy state.87 This accident history was also cited by the Flight Guidance System Harmonization Working Group of the Aviation Rulemaking Advisory Committee (ARAC), when, in March 2002, it proposed revisions to FAR 25.1329 and AC 25.132988 to provide low-airspeed protection and alerting during autopilot operations for newly certified 86 This team comprised FAA and industry representatives. 87 Federal Aviation Administration, Human Factors Team Report, The Interfaces Between Flightcrews and Modern Flight Deck Systems (Washington, DC: FAA, 1996).

Analysis 56 Aircraft Accident Report transport-category airplanes. The proposed regulatory revision would require, “[w]hen the flight guidance system [FGS] is in use, a means…to avoid excursions beyond an acceptable margin from the speed range of the normal flight envelope.” The proposed new AC, which is intended to provide an acceptable means for showing compliance with this new requirement, states the following: The requirement for speed protection is based on the premise that reliance on flight crew attentiveness to airspeed indications, alone, during FGS…operation is not adequate to avoid unacceptable speed excursions outside the speed range of the normal flight envelope….Standard stall warning and high speed alerts are not always timely enough for the flight crew to intervene to prevent unacceptable speed excursions during FGS operation….A low speed alert and a transition to the speed protection mode at approximately 1.2 Vs, [89] or an equivalent speed defined in terms of Vsr, [90] for the landing flap configuration has been found to be acceptable. The proposed changes to FAR 25.1329 reflect the advanced avionics capabilities characteristic of modern transport-category airplanes. However, the Safety Board notes that a low-airspeed alert system has been developed for Embraer EMB-120 airplanes; installation of the alert system was mandated by FAA Airworthiness Directive 2001-20-17.91 The system is designed to alert flight crews of low-airspeed conditions in certain airplane configurations and in icing conditions through the use of an amber-colored indicator light installed in the control panel and an audible alert. The Board is also aware that several avionics manufacturers offer low-airspeed alert devices associated with approach and maneuvering speeds for use in less sophisticated general aviation airplanes. This demonstrates that it may be feasible to develop low-airspeed alert systems for most airplane types. 2.10.2 Need for Improved Low-Airspeed Awareness The Safety Board recognizes that the development and requirement of a low-airspeed alert system is a departure from the previously accepted premise that adequate low-airspeed awareness is provided by flight crew vigilance and existing stall warnings. However, the circumstances of this accident and the history of accidents involving flight crew lack of low-airspeed awareness suggest that flight crew vigilance and existing stall warnings are inadequate to reliably prevent hazardous low-airspeed situations and that this unsafe condition is not unique to autopilot operations or flight in 88 Similar changes were also proposed to Joint Aviation Requirements (JAR) 25.1329 and Advisory Circular Joint 25.1329. The FAR/JAR and ACs are currently titled, “Automatic Pilot System”; the proposed new titles would be “Flight Guidance System.” 89 Vs is the stall speed or the minimum steady flight speed at which the airplane is controllable. 90 Vsr is the reference stall speed. 91 This low-airspeed alert system was developed as a result of the January 9, 1997, accident involving Comair flight 3272, an EMB-120RT that crashed near Monroe, Michigan, during a rapid descent after an uncommanded roll excursion in icing conditions and the March 19, 2001, accident involving Comair flight 5054, an EMB-120 that departed controlled cruise flight and descended 10,000 feet after it encountered icing conditions.

Analysis 57 Aircraft Accident Report icing conditions. If a low-airspeed alert system had been installed on the accident airplane, it might have directed the attention of the flight crew to the airplane’s decaying airspeed in time for them to initiate appropriate corrective action. For example, if a low-airspeed alert had activated when the airspeed dropped below 1.2 Vs (about 92 knots for the accident airplane), the flight crew would have received about 15 seconds advance notice before reaching the airplane’s estimated stall speed. In addition, if the flight crew had maintained an airspeed at or above the threshold set by such an early low-airspeed alert, the additional airspeed could have prevented an accelerated stall initiated by an abrupt last-second maneuver or provided an improved speed margin above a premature stall caused by ice accumulation on the wings. This change in philosophy is evident in the ARAC’s proposed changes to FAR 25.1329 and AC 25.1329, Embraer’s requirement for a low-airspeed alert system on the EMB-120, and the fact that several avionics manufacturers offer low-airspeed alert devices for general aviation airplanes. The Safety Board supports this change in philosophy. A low-airspeed alert associated with the minimum operationally acceptable speed for a particular phase of flight would likely help flight crews maintain airspeed awareness in much the same way that altitude alert systems help flight crews maintain altitude awareness. Enhanced airspeed awareness would also likely provide an additional safety margin against stall and loss of control events at low altitudes where recovery is difficult, as was the case in this accident. The Safety Board recognizes that there are unresolved technical, operational, and human factors issues that will need to be carefully evaluated and addressed in connection with the design and implementation of a low-airspeed alert system.92 The Board encourages the FAA to consult with representatives from NASA and other aviation industry specialists in resolving and addressing these issues. Despite these unresolved issues, the Safety Board concludes that the development of and requirement for the installation of low-airspeed alert systems could substantially reduce the number of accidents and incidents involving flight crew failure to maintain airspeed. Therefore, the Safety Board believes that the FAA should convene a panel of aircraft design, aviation operations, and aviation human factors specialists, including representatives from NASA, to determine whether a requirement for the installation of low-airspeed alert systems in airplanes engaged in commercial operations under 14 CFR Parts 121 and 135 would be feasible, and submit a report of the panel’s findings. The Safety Board further recommends that if the requested panel determines that a requirement for the installation of low-airspeed alert systems in airplanes engaged in commercial operations under 14 CFR Parts 121 and 135 is feasible, the FAA should establish requirements for low-airspeed alert systems, based on the findings of this panel. 92 Some of the issues that should be addressed include the following: defining the target speed at which the alert system would activate, effectively integrating such a system with other aircraft systems, preventing nuisance alarms and flight crew over-reliance on such a system (see, for example, A.R. Pritchett, “Reviewing the Role of Cockpit Alerting Systems,” Human Factors and Aerospace Safety Vol. 1, No. 1 [2001]: 5-38), differentiating such an alert from other kinds of cockpit alerts and warnings, and developing flight crew procedures on and training for the use of such systems.

58 Aircraft Accident Report 3. Conclusions 3.1 Findings 1. The flight crewmembers were properly certificated and had received the training for pilot certification prescribed by Federal regulations. No evidence indicated any preexisting medical or other physical condition that might have adversely affected the flight crew’s performance during the accident flight. Fatigue most likely did not degrade the performance of either pilot on the day of the accident. 2. The accident airplane was properly certificated, equipped, and maintained in accordance with Federal regulations and approved company procedures. The recovered components showed no evidence of preexisting powerplant, system, or structural failures. 3. The weight and balance of the airplane were within limits for dispatch, takeoff, climb, cruise, and landing. 4. The flight crew failed to maintain an appropriate course and speed for the approach and did not properly configure the airplane at the start of the approach, making the later stages of the approach more difficult. 5. During the later stages of the approach, the flight crew failed to monitor the airplane’s airspeed and allowed it to decrease to a dangerously low level (as low as about 50 knots below the company’s recommended approach airspeed) and to remain below the recommended approach airspeed for about 50 seconds. 6. The flight crew failed to recognize that a stall was imminent and allowed the airplane to enter a stall from which they did not recover. 7. The inadequate airspeed or the full course deviation indicator needle deflection should have prompted the flight crew to execute a go-around; however, they failed to do so. 8. The flight crew was not adhering to Aviation Charter’s approach procedures and was not effectively applying crew resource management techniques during the approach segment of the flight. 9. Clouds might have prevented the flight crew from seeing the airport.

1. Icing did not affect the airplane’s performance during the descent.

Conclusions 59 Aircraft Accident Report

1. The Duluth approach control south radar controller’s instructions did not prevent the

flight crew from intercepting the Eveleth-Virginia Municipal Airport VOR runway 27 final approach course at a sufficient distance to safely execute an approach and landing.

1. The out-of-tolerance condition and slight bends in the Eveleth-Virginia Municipal

Airport VOR signal were not a factor in this accident.

1. Both pilots had previously demonstrated potentially serious performance deficiencies

during flight operations consistent with below-average flight proficiency.

1. At the time of the accident, Aviation Charter was not operating in accordance with its

weight and balance load manifest procedures, it did not have adequate stall recovery guidance, it did not have consistent deicer boot operational guidance, and it did not have an in-range checklist.

1. Aviation Charter was not adequately making company pilots aware of its Standard

Operating Procedures.

1. At the time of the accident, Aviation Charter was not training its pilots on crew

resource management (CRM) in accordance with its Federal Aviation Administration-approved CRM training module.

1. Although the Federal Aviation Administration’s surveillance of Aviation Charter was

in accordance with its standard guidelines, it was not sufficient to detect the discrepancies that existed at Aviation Charter.

1. En route inspections, combined with ground training, flight training, and proficiency

check observations, are essential for ensuring adequate oversight of a company’s operations and should be conducted on flights operated by 14 Code of Federal Regulations Part 135 on-demand charter operators.

1. The circumstances of the October 2002 Aviation Charter accident indicate that crew

resource management training should be extended to include all 14 Code of Federal Regulations Part 135 on-demand charter operations that conduct dual-pilot operations regardless of whether the aircraft requires two or more pilots.

1. The development of and requirement for the installation of low-airspeed alert systems

could substantially reduce the number of accidents and incidents involving flight crew failure to maintain airspeed. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the flight crew’s failure to maintain adequate airspeed, which led to an aerodynamic stall from which they did not recover.

60 Aircraft Accident Report 4. Recommendations 4.1 New Recommendations As a result of its investigation of the October 25, 2002, Aviation Charter, Inc., accident, the National Transportation Safety Board makes the following recommendations to the Federal Aviation Administration: Conduct en route inspections and observe ground training, flight training, and proficiency checks at all 14 Code of Federal Regulations Part 135 on-demand charter operations as is done at Part 121 operations and Part 135 commuter operations to ensure the adequacy, quality, and standardization of pilot training and flight operations. (A-03-51) Require that 14 Code of Federal Regulations (CFR) Part 135 on-demand charter operators that conduct dual-pilot operations establish and implement a Federal Aviation Administration-approved crew resource management training program for their flight crews in accordance with 14 CFR Part 121, subparts N and O. (A-03-52) Convene a panel of aircraft design, aviation operations, and aviation human factors specialists, including representatives from the National Aeronautics and Space Administration, to determine whether a requirement for the installation of low-airspeed alert systems in airplanes engaged in commercial operations under 14 Code of Federal Regulations Parts 121 and 135 would be feasible, and submit a report of the panel’s findings. (A-03-53) If the panel requested in Safety Recommendation A-03-53 determines that a requirement for the installation of low-airspeed alert systems in airplanes engaged in commercial operations under 14 Code of Federal Regulations Parts 121 and 135 is feasible, establish requirements for low-airspeed alert systems, based on the findings of this panel. (A-03-54)

Recommendations 61 Aircraft Accident Report 4.2 Previously Issued Recommendation Classified in This Report The following previously issued recommendation is classified in this report:93 Safety Recommendation A-02-12 (previously classified “Open— Acceptable Response) is classified “Closed—Superseded.” 93 For the text of this recommendation, see section 2.9.3. BY THE NATIONAL TRANSPORTATION SAFETY BOARD ELLEN G. ENGLEMAN Chairman CAROL J. CARMODY Member MARK V. ROSENKER Vice Chairman JOHN J. GOGLIA Member RICHARD F. HEALING Member Adopted: November 18, 2003

this page intentionally left blank

63 Aircraft Accident Report 1. Appendix Appendix A Investigation and Public Hearing Investigation The National Transportation Safety Board learned about the accident about 1130 on October 25, 2002. A go-team was assembled, and it departed that same day and arrived on scene about 2045 that evening. Accompanying the team was Acting Chairman Carol J. Carmody and representatives from the Safety Board’s Offices of Government, Public, and Family Affairs. Parties to the investigation were the Federal Aviation Administration; Aviation Charter, Inc.; Raytheon Aircraft Company; and Hartzell Propeller, Inc. An accredited representative from the Transportation Safety Board of Canada and a technical advisor from Pratt & Whitney Canada also assisted in the investigation. Public Hearing No public hearing was held for this accident.

this page intentionally left blank

FD07268 ｜ 2003_美国_HAB2003.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2003 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

64836 1 NTSB/HAB-20/03 National Transportation Safety Board Washington, DC 20594 Highway Accident Brief Multivehicle Collision and Postcrash Fire in Partially Stopped Traffic on Interstate 290, Elmhurst, Illinois, March 1, 2018 Accident Number: HWY18MH007 Accident Type: Multivehicle collision Location: Interstate 290 (I-290) east near milepost 14.9 in Elmhurst, Cook County, Illinois (western outskirts of Chicago) Date and Time: March 1, 2018; 1:49 p.m. central standard time Vehicles: 2016 Kenworth truck-tractor in combination with a 2012 Wabash semitrailer (Pioneer truck); 2004 Chrysler Sebring; 2013 International truck-tractor in combination with a 1996 Strick trailer; 2009 Peterbilt truck-tractor in combination with a 2014 Wabash semitrailer; 2016 Subaru Outback; 2016 Ford Explorer; 2018 Toyota Sienna Fatalities: 1 Injuries: 5 Crash Description About 1:49 p.m. on Thursday, March 1, 2018, a multivehicle collision occurred in partially stopped traffic on I-290 east near milepost 14.9 in Elmhurst, Cook County, Illinois. At this location, I-290 has three travel lanes and paved shoulders in each direction, separated by a concrete barrier. The posted speed limit is 55 mph. The weather was overcast with no precipitation, and the roadway was dry. The striking vehicle was a 2016 Kenworth truck-tractor in combination with a 2012 Wabash enclosed van semitrailer, operated by Pioneer Transportation Ltd. The Pioneer truck had just entered I-290 east from the St. Charles Road interchange and was traveling in the right lane when it collided with the rear of a 2004 Chrysler Sebring, pushing the car forward into the rear of a 2013 International truck-tractor in combination with a 1996 Strick intermodal trailer, also in the right lane, operated by New Pro-Freight Inc. These impacts caused the New Pro-Freight truck to move forward, colliding with the rear of a 2009 Peterbilt truck-tractor in combination with a 2014 Wabash semitrailer, operated by Schneider National Carriers Inc. The collision also caused the rear of the intermodal trailer of the New Pro-Freight truck to rotate left into the center and left eastbound lanes and collide with a 2016 Subaru Outback, which was passing the slower-moving vehicles in the left lane. The Subaru then struck the rear of a 2016 Ford Explorer and was struck by a 2018 Toyota Sienna. Based on witness interviews, although vehicles were stopped or moving

Multivehicle Collision and Postcrash Fire in Partially Stopped Traffic on Interstate 290, Elmhurst, Illinois, March 1, 2018 2 NTSB/HAB-20/03 slowly in the right lane, the general flow of traffic in the center and left lanes was moving close to the posted speed limit of 55 mph. The Chrysler came to rest in the center lane between the swung-out intermodal trailer and the Pioneer truck, where a postcrash fire, originating from the Chrysler’s fuel tank, ensued. The driver of the Chrysler was fatally injured, and the car was consumed in the fire. The intermodal trailer, Pioneer truck, Subaru, and Toyota also sustained fire damage. Five of the six remaining drivers sustained minor injuries, and the driver of the Toyota was uninjured. There were no passengers in any of the seven vehicles involved. Figure 1 shows the final rest positions of the vehicles.

Figure 1. Six of the vehicles at final rest on I-290 east. The photo on the left shows the scene looking toward the east; the photo on the right depicts the crash site looking toward the west. (Source: WFLD-TV) Highway Information Roadway Location. The crash occurred on eastbound I-290 just south of the St. Charles Road interchange, near the end of the acceleration lane from St. Charles Road onto I-290, a metered on-ramp. The crash location lies between major interchanges with Interstate 294 (I-294) and Interstate 88 (I-88). I-290 is a concrete-paved roadway with three 12-foot-wide travel lanes in the eastbound direction. The roadway is separated from the westbound lanes by a concrete median barrier. Recurring Congestion. According to the Illinois Department of Transportation (IDOT), average daily traffic in this area of I-290 was 134,000 vehicles, of which 13 percent were truck-tractor combination vehicles. At the request of the National Transportation Safety Board (NTSB), the week after the crash, IDOT activated the recording function on the traffic camera at the St. Charles Road interchange. Beginning at 1:45 p.m. on Thursday, March 8, 2018, the camera recorded the traffic queue in 15-minute segments. The IDOT assessment found that slowing and stopped traffic on I-290 eastbound queued back to St. Charles Road on most weekdays in the early afternoon (about the same time as the crash), and the queue lengthened to as much as 2–2.5 miles in late afternoon.1 Analysis by IDOT has shown that the traffic demand exceeds the capacity of

1 See Highway Attachment of IDOT Traffic Camera Recorded Views of Traffic Queues on I-290 between the St. Charles Road interchange and the I-290/I-294 interchange in the NTSB docket, www.ntsb.gov, under accident number HWY18MH007.

N N

Multivehicle Collision and Postcrash Fire in Partially Stopped Traffic on Interstate 290, Elmhurst, Illinois, March 1, 2018 3 NTSB/HAB-20/03 the highway and that the highway network in this area is oversaturated, which frequently results in congestion and stopped traffic. The driver of the Pioneer truck reported being familiar with the route and the frequently occurring congestion; he told investigators he had been on that roadway “hundreds” of times. Crash History. Between 2011 and 2016, a total of 1,096 rear-end crashes occurred on I-290 within a 2-mile radius of this collision. Four of these crashes resulted in five fatalities, and one of them involved a heavy truck. IDOT identifies high-crash roadway segments by reviewing statewide crash data to “identify approximately 5 percent of all roadway locations within the State of Illinois with the greatest potential for safety improvement.” The IDOT process uses a 5-year period of crash data to identify locations that experience a higher severity of crashes compared to similar locations statewide. The crash site on I-290 was within 0.25 miles of one of these high-risk 5-percent segments. Injuries Each of the seven vehicles involved in the crash was occupied by only the driver. Five of the drivers sustained minor injuries; the driver of the Chrysler was fatally injured. One driver was uninjured. Three of the drivers were transported to Elmhurst Hospital for treatment. The Pioneer driver declined treatment but was later taken to Elmhurst Hospital to have blood drawn for toxicology testing. Emergency Response A total of 19 state, county, and local emergency service agencies responded to the crash. The first crash notifications were made to the Berkeley Fire Department and the Hillside Fire Department at 1:50 p.m. and 1:51 p.m., respectively, through the Cook County Sheriff’s Department 911 system. The first units arrived within 5 minutes of being dispatched. The Illinois State Police, the primary law enforcement agency for the interstate, was notified at 1:57 p.m. Its first trooper did not arrive until 21 minutes later because of high traffic volumes during that time of day and the increased congestion resulting from the crash. In total, the Illinois State Police responded with 30 state troopers, including its reconstruction team. The Illinois State Police handled the crash investigation while the chief of the Berkeley Fire Department coordinated command for transporting the injured and for fire suppression and HAZMAT. Human Performance The Pioneer truck was the initial striking vehicle in the collision sequence, and, because of that fact, the driver of this truck is the primary focus of the human performance discussion. Licensing, Certification, and Driver History. At the time of the crash, the Pioneer driver, a 47-year-old male, held a Wisconsin class A commercial driver’s license (CDL) issued in March 2017 and scheduled to expire in March 2025. The CDL showed restrictions for corrective lenses and did not contain special endorsements. The carrier produced a driver qualification (DQ) file,

Multivehicle Collision and Postcrash Fire in Partially Stopped Traffic on Interstate 290, Elmhurst, Illinois, March 1, 2018 4 NTSB/HAB-20/03 which met the regulatory requirements under 49 Code of Federal Regulations (CFR) Part 391. The driver’s US Department of Transportation (DOT) medical certificate was current with an issue date of October 2017 and an expiration date of October 2018. However, investigators identified anomalies with the medical certificate, which are discussed along with the driver’s medical history below. According to carrier records, the driver began his employment with Pioneer Transportation on August 10, 2010. During the postcrash interview, the driver stated that he had worked several other driving jobs before joining Pioneer. A summary of his employment history is documented in table 1. The driver had an employment gap between 2009 and 2010 because he lost his CDL privileges for 1 year from July 22, 2009, to July 22, 2010, due to a failure to appear in court. Table 1. Pioneer driver’s previous employment history. Pioneer Driver’s Precrash Activities. Investigators reconstructed the Pioneer driver’s precrash activities using his cell phone records, his vehicle’s electronic logging device, toll receipts, and his postcrash interview. The driver was off duty February 24–26. Phone records indicate that he averaged about 8 hours of sleep opportunity on the nights of the 25th and 26th. The driver had 6 hours of sleep opportunity on the morning of the 27th, 7 hours of sleep opportunity on the morning of the 28th, and 9 hours of sleep opportunity on the night of the 28th, before the crash. The driver’s sleep opportunities are shown in figure 2. The driver generally followed his sleep/wake schedule during these days, with the exception of the night before the collision, when he retired earlier and also awoke somewhat earlier than on other days.

Figure 2. Pioneer driver's sleep opportunities prior to the crash. The crash occurred at a time of day when individuals can experience an afternoon circadian low and thus tiredness. Factoring in the time of day, the shift in the Pioneer driver’s sleep schedule the night before the crash, and his sleep disorder (discussed in detail below), the driver was likely fatigued at the time of the collision. Pioneer Transportation is subject to the Federal Motor Carrier Safety Administration (FMCSA) hours of service (HOS) regulations (49 CFR Part 395). At the time of the crash, Pioneer Dates of employment Company Reason for leaving Aug 2008–Jul 2009 US Xpress License issue Nov 2005–Jun 2008 Elite Carrier Out-of-service violation (unknown nature) Nov 1998–May 2005 Lincoln-Wood Products Not stated

Multivehicle Collision and Postcrash Fire in Partially Stopped Traffic on Interstate 290, Elmhurst, Illinois, March 1, 2018 5 NTSB/HAB-20/03 Transportation was using an automatic onboard recording device to meet the FMCSA electronic logging requirements for HOS.2 Investigators reviewed the Pioneer driver’s logs for compliance with the HOS regulations (table 2).3 No violations were identified in the 30 days preceding the crash. NTSB investigators did not find any evidence of log falsification. Table 2. Pioneer driver’s last 7 days of HOS before the crash, based on information from the automatic onboard recording device. Date Day of the week Hours on duty February 22, 2018 Thursday 8.52 February 23, 2018 Friday 7.14 February 24, 2018 Saturday 0 February 25, 2018 Sunday 0 February 26, 2018 Monday 0 February 27, 2018 Tuesday 1.39 February 28, 2018 Wednesday 10.27 March 1, 2018* Thursday ~ 5.21

• This information was also obtained by the Illinois State Police after the crash.

Distraction. The Pioneer driver reported using his cell phone’s navigation application at the time of the crash. The phone had been positioned in a cup holder to the right of his knee, which would have required him to look down and away from the windshield to view it; however, the driver told investigators that the phone had been attached to a headpiece so that he could listen to the directions and not have to look down to view the navigation information.4 Use of the global positioning system (GPS) was also noted by a witness who helped the driver turn off the navigation application when they were on the side of the road following the crash. Before the crash, the GPS application had been providing new route guidance to the driver; he had missed the exit to I-290 east while traveling on I-294 north and was rerouting from St. Charles Road to take the I-290 east exit from I-294 south just before the collision. The driver’s cell phone records showed that he was not on a phone call and was not texting before the crash. It is unclear how much of a role his use of the navigation application and any associated distraction may have played in the collision. Medical Conditions. When the crash occurred, the Pioneer driver had already been diagnosed with a number of medical conditions, including obstructive sleep apnea (OSA), type 2 diabetes, an episode in 2012 of severe kidney disease, hypothyroidism, obsessive compulsive disorder (OCD), high cholesterol, and morbid obesity (body mass index [BMI] = 50 kg/m2). These

2 Using automatic onboard recording devices to meet FMCSA HOS logging requirements was permitted until December 17, 2019. Now all drivers/carriers must use an electronic logging device (ELD), which records and displays more data. For more information, visit the FMCSA website. 3 Investigators determined that the Pioneer driver was compliant with the 11-hour, 14-hour, and 70-hour HOS regulations, which correspond to a driver being allowed to operate for 14 hours from start to stop in a given day, for a maximum 11 hours of driving during that time period, and for 70 hours in an 8-day period. 4 Illinois allows hands-free use of portable electronic devices (PEDs) for most drivers; however, drivers operating under a learner’s permit, drivers under the age of 19, and school bus drivers are prohibited from using PEDs while driving, whether hands-free or not. A ban against texting and handheld phone use is in place for all Illinois drivers.

Multivehicle Collision and Postcrash Fire in Partially Stopped Traffic on Interstate 290, Elmhurst, Illinois, March 1, 2018 6 NTSB/HAB-20/03 conditions may affect an individual’s ability to safely operate a motor vehicle and are evaluated as part of the medical certification process for commercial motor vehicle operators. The driver’s diagnosis of a sleep disorder is particularly relevant because of its association with fatigue and thereby an increased crash risk, if untreated.5 OSA occurs when the musculature of the airway relaxes during sleep and obstructs the flow of air into and out of the body. When carbon dioxide levels rise as a result, the person arouses from sleep in order to breathe. These repeated disruptions interfere with restorative sleep functions and may lead to daytime somnolence, resulting in microsleep, lapses in attention and situational awareness, and performance decrements.6 The Pioneer driver was hospitalized twice in December 2011. During the second admission, one of the physicians listed OSA as a diagnosis. Supporting documentation was not provided in the record, and the driver was not discharged with a continuous positive airway pressure (CPAP) device at that time.7 The driver was again hospitalized on February 7, 2012, with severe anemia and pneumonia. During this admission, he underwent a brief diagnostic study for sleep apnea that revealed an apnea-hypopnea index (AHI) of 81 episodes/hour, indicating severe sleep apnea.8 Because of the results of this study, he then underwent a formal split-night study in the sleep lab to further document the problem on February 9, 2012. His repeat AHI without treatment was 6.7 episodes per hour, indicating mild sleep apnea. The driver was given a CPAP device during this sleep study that alleviated his apneas and hypopneas while in the lab. During follow-up outpatient appointments with his healthcare provider, the driver reported “getting used to it” in regard to his CPAP device and using it “most nights.” However, in interviews with NTSB investigators, the driver reported not using his CPAP device beyond this hospitalization. Furthermore, investigators found no evidence that the driver obtained any refills or replacement equipment for this device. Although sleep studies are used to diagnose OSA, numerous medically established risk factors exist for this condition, including male gender, age, obesity, hypertension, neck circumference (greater than 17 inches for men), hip circumference, and episodes of nocturnal gasping.9 The relationship with obesity is particularly strong; 40–90 percent of individuals with a

5 (a) A.T. Mulgrew, G. Nasvadi, A. Butt, and others. “Risk and Severity of Motor Vehicle Crashes in Patients with Obstructive Sleep Apnea/Hypopnea.” Thorax. 2008; 63(6):536–541. (b) O.K. Basoglu and M.S. Tasbakan. “Elevated Risk of Sleepiness-Related Motor Vehicle Accidents in Patients with Obstructive Sleep Apnea Syndrome: A Case-Control Study.” Traffic Inj Prev. 2014; 15(5):470–6. 6 (a) M.R. Rosekind, E.L. Co, K.B. Gregory, and D.L. Miller. 2000. Crew Factors in Flight Operations XIII; A Survey of Fatigue Factors in Corporate/Executive Aviation Operations. NASA/TM―2000-209610. (b) A. Sneddon, K. Mearns, and R. Flin. 2013. “Stress, Fatigue, Situation Awareness and Safety in Offshore Drilling Crews.” Safety Science, vol. 56, 80–88. (c) A. Smiley and G.J. Alexander. 2016. Human Factors in Traffic Safety. Tucson, AZ: Lawyers & Judges Publishing Company. 7 CPAP devices are commonly used to treat OSA. 8 An apneic episode is the complete absence of airflow through the mouth and nose for at least 10 seconds. A hypopnea episode is when airflow decreases by 50 percent for at least 10 seconds or decreases by 30 percent if there is an associated decrease in the oxygen saturation or an arousal from sleep. The AHI sums the frequency of both types of episodes per hour. An AHI of less than 5 is considered normal. An AHI of 5–15 is mild, 15–30 is moderate, and more than 30 episodes per hour is considered severe sleep apnea. 9 (a) P.E. Peppard and others. “Increased Prevalence of Sleep-Disordered Breathing in Adults.” Am J Epidemiol. 2013; 177(9):1006–14. (b) J.C. Seidell. “Waist Circumference and Waist/Hip Ratio in Relation to All-Cause

Multivehicle Collision and Postcrash Fire in Partially Stopped Traffic on Interstate 290, Elmhurst, Illinois, March 1, 2018 7 NTSB/HAB-20/03 BMI above 40 kg/m2 are reported to have moderate to severe sleep apnea.10 The Pioneer driver not only had most of these risk factors, including morbid obesity, but had in fact existing official diagnoses of OSA from sleep studies. These risk factors may help medical professionals, including certified medical examiners (discussed below), identify drivers most at risk for OSA. Postcrash Sleep Study. The NTSB requested that the Pioneer driver undergo a postcrash diagnostic sleep study to obtain a more up-to-date evaluation and better understanding of his sleep health. Both the driver and the carrier consented to this request, and the sleep study was conducted on October 24, 2018. The physician noted the driver’s neck circumference as 17.75 inches, his height as 5 feet 8 inches, and his weight as 325 pounds (a BMI of 49.4 kg/m2). The sleep study results indicated that the driver had poor sleep efficiency (57.6 percent) with 18 awakenings in 208 minutes of sleep. Only 17.7 percent of the sleep time was rapid eye movement (REM) sleep (normal range is 20–25 percent). The results did not meet the criteria for OSA, but the driver was diagnosed with upper airway resistance syndrome (UARS), a sleep disorder characterized by excessive daytime sleepiness and frequent awakenings during sleep due to increased respiratory effort.11 UARS causes increased airway resistance during sleep but not to a level high enough to trigger apneas or hypopneas. UARS has similarity to OSA in that the increased work of breathing leads to episodes of low oxygen saturation and arousal during sleep, causing sleep fragmentation and daytime fatigue. In the Pioneer driver’s case, during the postcrash sleep study, his oxygen saturation dropped below 90 percent eight times during his sleep period, all of it during REM sleep. A majority of the medical community now considers UARS a subtype of OSA, and many of the same treatments are used to combat the conditions and improve sleep.12 Some research even suggests that UARS patients have worse sleep quality and more fatigue than mild OSA patients.13 Medical Certification. The medical fitness of commercial motor vehicle drivers is covered under 49 CFR 391.41, which stipulates that an individual must not operate a commercial motor vehicle unless he or she meets physical qualifications. Accordingly, interstate drivers of commercial vehicles must undergo routine medical evaluation and certification. This medical evaluation process (defined in 49 CFR 391.43) includes driver self-reporting of previous medical conditions, current health, and medications. The process also includes a physical examination, including vital signs checking, vision testing, and urine dip testing by a certified medical examiner. The DOT examination is documented on Form MCA-5875, which contains two sections.14

Mortality, Cancer and Sleep Apnea.” Eur J Clin Nutr. 2010; 64(1):35–41. (c) T. Young and others; Sleep Heart Health Study Research Group. “Predictors of Sleep-Disordered Breathing in Community-Dwelling Adults: The Sleep Heart Health Study.” Arch Intern Med. 2002; 162(8):893–900. (d) T. Young, J. Skatrud, and P.E. Peppard. “Risk Factors for Obstructive Sleep Apnea in Adults.” JAMA. 2004; 291(16)2013–6. (e) A.R. Schwartz and others. “Obesity and Obstructive Sleep Apnea: Pathogenic Mechanisms and Therapeutic Approaches.” Proc Am Thorac Soc. 2008; 5(2): 185–192. 10 A.R. Schwartz and others. “Obesity and Obstructive Sleep Apnea: Pathogenic Mechanisms and Therapeutic Approaches.” Proc Am Thorac Soc. 2008; 5(2): 185–192. 11 C. Guilleminault and others. “A Cause of Excessive Daytime Sleepiness. The Upper Airway Resistance Syndrome.” Chest. 1993; 104(3):781–7. 12 American Academy of Sleep Medicine. International Classification of Sleep Disorders, 3rd ed., American Academy of Sleep Medicine, Darien, IL, 2014. 13 L.B.M. De Godoy and others. “Upper Airway Resistance Syndrome Patients Have Worse Sleep Quality Compared to Mild Obstructive Sleep Apnea.” PLoS One. 2016; 11(5):1–12. 14 Available at: https://www.fmcsa.dot.gov/regulations/medical/medical-examination-report-form-commercial- driver-medical-certification.

Multivehicle Collision and Postcrash Fire in Partially Stopped Traffic on Interstate 290, Elmhurst, Illinois, March 1, 2018 8 NTSB/HAB-20/03 Section 1 is filled out by the driver and requires name, address, license number, and other identifying information. This section also includes 32 health history questions that can be answered “Yes,” “No,” or “Not Sure” (see figure 3). Questions 25 and 26 specifically ask about driver sleep history. Section 1 relies heavily on drivers’ accurate and honest self-reporting of potential conditions. Section 2 of the examination report is filled out by a medical examiner and involves physically examining the drivers.

Figure 3. Sample driver health history questionnaire, section 1. (Source: FMCSA) Pioneer Driver’s Health Reporting and Medical Certifications. As mentioned previously, the Pioneer driver had several medical issues that may have contributed to the Elmhurst crash, the most salient of which was an untreated, serious sleep-related breathing disorder. This included being diagnosed with OSA in 2012 and later with UARS during a postcrash sleep study in 2018. The driver also had diabetes, hypothyroidism, OCD, high cholesterol, and kidney issues which―although likely not causal to the crash―all required reporting in the health questionnaire. As mentioned earlier, the driver’s DQ file showed a medical leave of absence of about 4 months at the end of 2011 and the beginning of 2012. On February 7, 2012, the Pioneer driver tried to obtain a CDL medical certificate at a Veterans Affairs health clinic. He was administered an Epworth Sleepiness Scale questionnaire, and the score suggested that he was not at risk of daytime sleepiness. Additionally, he reported not knowing if he snored and that he felt refreshed when waking. However, at that time, the driver appeared acutely ill, and the medical examiner directed the driver to a hospital for emergency evaluation, which resulted in his being admitted for an acute immune reaction (vasculitis).

Multivehicle Collision and Postcrash Fire in Partially Stopped Traffic on Interstate 290, Elmhurst, Illinois, March 1, 2018 9 NTSB/HAB-20/03 Although the Pioneer driver was diagnosed with OSA during this admission for vasculitis and acute renal failure, he did not disclose his sleep disorder in later DOT examinations. He told NTSB investigators that he believed the OSA was associated with a bout of pneumonia, which made sleeping difficult. He denied having any sleep issues following the pneumonia and also denied using a CPAP device. The driver attempted to obtain a medical certificate from his previous medical examiner on February 14, 2012, but in light of the new health information that was revealed during his hospitalization, the medical examiner did not grant him one. The driver did receive a full 2-year medical certification from a different medical examiner a week later, on February 21, 2012. The driver did not report the OSA or participation in a sleep study during later medical exams. During a CDL exam dated November 7, 2016, the medical examiner noted that the driver “denies any [side effects] to meds” and “any [sleep apnea] characteristics.” In October 2017, on the form for his most recent DOT examination before the crash, the driver did not report having a sleep disorder or having ever taken part in a sleep study. Ultimately, he did not report a number of his diagnoses, including his history of kidney disease, diabetes, and OSA during his CDL examinations. Issues with Medical Certifications of New Pro-Freight and Schneider Drivers. Although the New Pro-Freight and Schneider trucks were not the initiating vehicles in the collision, the drivers of these commercial vehicles also had histories of medical issues that they did not disclose on their medical certificates. The New Pro-Freight driver failed to disclose his type 2 diabetes and hypertension, and the Schneider driver failed to disclose his hypertension and other heart-related issues. In their cases, though, the conditions were controlled with medications (which were noted in their medical records), so disclosure would likely not have prohibited either driver from operating a commercial vehicle. However, their medical conditions would have limited the length of time the medical certificates were valid, to give medical examiners the opportunity to assess the drivers’ management of the diseases. Investigators obtained archival DOT medical examination records for the New Pro-Freight driver and found that he had disclosed his history of hypertension to medical examiners in 2013 and 2014, but failed to do so in 2016, when he was seen by a different examiner. On previous occasions, when the New Pro-Freight driver disclosed his history of hypertension, he received a medical certificate that was valid for 1 year; when he did not fully disclose his health condition, he received a certificate valid for 2 years. If his new medical examiner had had access to the New Pro-Freight driver’s past DOT examination forms, the examiner would have realized that the driver was not forthcoming with his health history and would have had a more comprehensive basis from which to evaluate the driver. Furthermore, the medical examiner would have had contact information for the driver’s previous examiner in case further follow-up was deemed necessary. Toxicology. Blood and urine specimens were taken from the Pioneer driver at Elmhurst Hospital and sent by the Illinois State Police to a lab for testing. The NTSB subpoenaed the remaining unused portion of the specimens and had them sent to the Federal Aviation Administration Forensic Sciences Laboratory for analysis. Fluoxetine and its metabolite norfluoxetine, as well as risperidone and its metabolite 9-hydroxyrisperidone, were identified in the blood and urine samples. This finding is consistent with medications that were prescribed for

Multivehicle Collision and Postcrash Fire in Partially Stopped Traffic on Interstate 290, Elmhurst, Illinois, March 1, 2018 10 NTSB/HAB-20/03 the driver’s OCD. Because of the reported success of the medications in treating his OCD and the length of time he had taken them, it is unlikely that either the OCD or related prescribed medications impaired the driver at the time of the crash. Vehicle Damage and Collision Mitigation Systems As shown in figure 4, the Pioneer (2016 Kenworth) truck-tractor sustained extensive damage in the collision and postcrash fire. Although this damage created challenges for evaluating the truck’s mechanical systems, investigators found no issues or defects in the steering, suspension, tires and wheels, air and braking, and electrical systems that would likely have contributed to the crash. The Kenworth truck-tractor had a history of regularly scheduled preventive maintenance, which showed no recalls or warranty claims.15

Figure 4. Right-side view of the 2016 Kenworth truck-tractor, showing postcollision impact and fire damage. The Kenworth truck-tractor was equipped with an engine electronic control module (ECM) capable of recording certain vehicle-related data in the event of a sudden deceleration or fast stop event. Investigators removed the ECM from the vehicle and sent it to the NTSB Recorder Laboratory for evaluation, which revealed widespread and extreme thermal damage to all internal electronic components, preventing investigators from recovering any data related to the collision event. At the time of its manufacture, the Kenworth truck-tractor was equipped with Bendix brake components, antilocking braking, and electronic stability controls. However, the vehicle was not equipped with a collision warning or mitigation system, nor was it required to be. Although an optional collision mitigation system was available at the time of manufacturing (Bendix Wingman Advanced), that system did not have the capability to detect stopped traffic. The latest generation

15 See the Vehicle Factual Report in the NTSB docket, www.ntsb.gov, under accident number HWY18MH007, for more information.

Multivehicle Collision and Postcrash Fire in Partially Stopped Traffic on Interstate 290, Elmhurst, Illinois, March 1, 2018 11 NTSB/HAB-20/03 of this system―Bendix Wingman Fusion―is capable of using camera, radar, and brake systems to identify stationary targets and automatically engage the brakes to assist the driver in mitigating or preventing a crash. Previous NTSB Action and Discussion The Elmhurst crash investigation highlighted several safety issues that the NTSB has previously identified involving commercial drivers. In fact, the 2019–2020 NTSB Most Wanted List of Transportation Safety Improvements includes both “Require Medical Fitness – Screen for and Treat Obstructive Sleep Apnea” and “Increase Implementation of Collision Avoidance Systems in All New Highway Vehicles.”16 Undiagnosed or untreated OSA has contributed to the probable cause in several other highway crashes involving commercial drivers.17 The Most Wanted List highlights several recommendations to address OSA, including the following two recommendations issued to the FMCSA in 2009: H-09-15 Implement a program to identify commercial drivers at high risk for obstructive sleep apnea and require that those drivers provide evidence through the medical certification process of having been appropriately evaluated and, if treatment is needed, effectively treated for that disorder before being granted unrestricted medical certification. H-09-16 Develop and disseminate guidance for commercial drivers, employers, and physicians regarding the identification and treatment of individuals at high risk of obstructive sleep apnea (OSA), emphasizing that drivers who have OSA that is effectively treated are routinely approved for continued medical certification. On January 18, 2019, the FMCSA provided the NTSB with an update on these recommendations, explaining that the agency was unable to complete certain OSA-related actions and rulemaking because of Public Law 113-45. This law limits the FMCSA to adding or revising requirements for screening, testing, or treatment of individuals operating commercial motor vehicles for sleep disorders pursuant to a rulemaking proceeding.18 The NTSB responded with disappointment at the lack of FMCSA progress on these OSA-related recommendations. As of

16 For more information about the medical fitness-related recommendations on the Most Wanted List, see this NTSB webpage. 17 (a) Work Zone Collision Between a Tractor-Semitrailer and a Tennessee Highway Patrol Vehicle, Jackson, Tennessee, July 26, 2000. NTSB/HAR-02/01 (Washington, DC: NTSB). (b) Truck-Tractor Semitrailer Rear-End Collision Into Passenger Vehicles on Interstate 44 Near Miami, Oklahoma, June 26, 2009. NTSB/HAR-10/02 (Washington, DC: NTSB). (c) Motorcoach Run-Off-the-Road and Collision with Vertical Highway Signpost, Interstate 95 Southbound, New York City, New York, March 12, 2011. NTSB/HAR-12/01 (Washington, DC: NTSB). (d) Motorcoach Collision with Combination Vehicle After Traffic Break on Interstate 10, Palm Springs, California, October 23, 2016. NTSB/HAR-17/04 (Washington, DC: NTSB). 18 See https://www.congress.gov/113/plaws/publ45/PLAW-113publ45.pdf.

Multivehicle Collision and Postcrash Fire in Partially Stopped Traffic on Interstate 290, Elmhurst, Illinois, March 1, 2018 12 NTSB/HAB-20/03 May 2020, Safety Recommendation H-09-15 remains classified “Open―Unacceptable Response” and Safety Recommendation H-09-16 remains classified “Open―Acceptable Response.” The Elmhurst investigation also highlighted the NTSB’s ongoing push for thorough medical reviews by medical examiners and an improved medical certification evaluation process for commercial vehicle drivers. It is noteworthy that the three commercial drivers involved in the crash all failed to report relevant medical conditions during their medical certifications. Most significant to the crash was the failure of the Pioneer driver to disclose his diagnosed OSA to medical examiners. Some progress has been made on providing clearer guidance to medical examiners regarding OSA. On March 10, 2016, the FMCSA issued an advance notice of proposed rulemaking regarding OSA (81 Federal Register 12642). However, the FMCSA withdrew the proposed rulemaking on August 8, 2017, instead calling attention to its updated August 2016 Medical Review Board recommendations on the topic (82 Federal Register 37038). Those recommendations provide specific information on screening commercial drivers for OSA, including that drivers with a BMI ≥ 40 kg/m2 be further evaluated for sleep disorders.19 For drivers with a BMI between 30 and 40 kg/m2, a formal sleep evaluation is recommended if they also meet three or more additional criteria. Given the Pioneer driver’s BMI at his October 2017 DOT exam (50 kg/m2), he would have met the Medical Review Board recommendations for a sleep study referral, regardless of the absence of reported symptoms or his failure to report his previous diagnosis. The Pioneer driver’s most recent medical examiner reported being unaware of the FMCSA’s 2016 Medical Review Board recommendations. In fact, the accessibility of these recommendations has been a recurring issue. The NTSB investigated a similar crash in Palm Springs, California, in 2016 where a 47-passenger motorcoach struck the rear of a stopped combination vehicle’s semitrailer.20 Following this investigation, the NTSB made the following recommendation to the FMCSA: H-17-49 Make the 2016 Medical Review Board/Motor Carrier Safety Advisory Committee recommendations on screening for obstructive sleep apnea (OSA) easily accessible to certified medical examiners, and instruct the examiners to use the recommendations as guidance when evaluating commercial drivers for OSA risk. Safety Recommendation H-17-49 remains classified “Open―Acceptable Alternate Response.” As with Safety Recommendations H-09-15 and -16, the NTSB is disappointed with the FMCSA’s lack of progress in addressing OSA. The NTSB is continuing to evaluate safety issues and recommendations regarding OSA and other relevant medical conditions in commercial motor vehicle drivers.

19 See letter to FMCSA Administrator Darling from the Motor Carrier Safety Advisory Committee and Medical Review. 20 Motorcoach Collision with Combination Vehicle after Traffic Break on Interstate 10, Palm Springs, California, October 23, 2016. NTSB/HAR-17/04 (Washington, DC: NTSB)

Multivehicle Collision and Postcrash Fire in Partially Stopped Traffic on Interstate 290, Elmhurst, Illinois, March 1, 2018 13 NTSB/HAB-20/03 The NTSB’s Most Wanted List also recognizes the important role of collision avoidance systems in reducing traffic crashes. These technologies are already available and vehicle manufacturers should make them standard equipment for all vehicles, including commercial vehicles. In 2015, the NTSB released a Special Investigation Report titled “The Use of Forward Collision Avoidance Systems to Prevent and Mitigate Rear-End Crashes.”21 That report made several recommendations for commercial vehicles that are directly relevant to the Elmhurst crash: H-15-5 (to the National Highway Traffic Safety Administration) Complete, as soon as possible, the development and application of performance standards and protocols for the assessment of forward collision avoidance systems in commercial vehicles. H-15-8 and -9 (to passenger vehicle, truck-tractor, motorcoach, and single-unit truck manufacturers) Install forward collision avoidance systems that include, at a minimum, a forward collision warning component, as standard equipment on all new vehicles. Once the National Highway Traffic Safety Administration publishes performance standards for autonomous emergency braking, install systems meeting those standards on all new vehicles. All three of the above recommendations are currently classified “Open―Acceptable Response.” Probable Cause The National Transportation Safety Board determines that the probable cause of the Elmhurst, Illinois, crash was the Pioneer Transportation truck-tractor driver’s failure to respond to slow-moving traffic due to a performance decrement likely caused by fatigue associated with his untreated sleep disorder. Contributing to the crash was the lack of a robust medical certification evaluation process to identify commercial drivers at high risk for obstructive sleep apnea and to ensure adequate screening. Report Date: June 15, 2020 For additional details about this crash, visit the NTSB public docket and search for NTSB accident ID HWY18MH007.

21 The Use of Forward Collision Avoidance Systems to Prevent and Mitigate Rear-End Crashes. Special Investigation Report NTSB/SIR-15/01 (Washington, DC: NTSB).

Multivehicle Collision and Postcrash Fire in Partially Stopped Traffic on Interstate 290, Elmhurst, Illinois, March 1, 2018 14 NTSB/HAB-20/03 The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties . . . and are not conducted for the purpose of determining the rights or liabilities of any person” (49 Code of Federal Regulations, Section 831.4). Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report (49 United States Code, Section 1154[b]).

FD07269 ｜ 2003_美国_HAR0301.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2003 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Collision of a Greyhound Lines, Inc. Motorcoach and Delcar Trucking Truck Tractor-Semitrailer Loraine, Texas June 9, 2002 Highway Accident Report NTSB/HAR-03/01 PB2003-916201 Notation 7532 National Transportation Safety Board Washington, D.C.

this page intentionally left blank

Highway Accident Report Collision of a Greyhound Lines, Inc. Motorcoach and Delcar Trucking Truck Tractor-Semitrailer Loraine, Texas June 9, 2002 NTSB/HAR-03/01 PB2002-916201 National Transportation Safety Board Notation 7532 490 L’Enfant Plaza, S.W. Adopted February 26, 2003 Washington, D.C. 20594

National Transportation Safety Board. 2003. Collision of a Greyhound Lines, Inc., Motorcoach and Delcar Trucking Truck Tractor-Semitrailer, Loraine, Texas, June 9, 2002. Highway Accident Report. NTSB/HAR-03/01. Washington, DC. Abstract: On Sunday, June 9, 2002, about 5:10 a.m. central daylight time, near Loraine, Texas, a 1993 Motor Coach Industries MC-12 motorcoach, operated by Greyhound Lines, Inc., and occupied by the driver and 37 passengers, was traveling east on Interstate 20, on a scheduled route from El Paso, Texas, to Abilene, Texas, at a driver-reported speed of 65 to 67 mph. A truck tractor-semitrailer, consisting of a tractor and a semitrailer leased by DelCar Trucking, which was being operated by a driver in training with a codriver in the sleeper berth, was entering the interstate from a picnic area at a driver-estimated speed of 40 mph and proceeding into the eastbound lanes. The motorcoach collided with the rear of the semitrailer near milepost 228 of Interstate 20, pushing the tractor-semitrailer approximately 276 feet. Three passengers on the Greyhound bus, all seated in the front of the bus, were fatally injured. Five passengers and the busdriver were seriously injured. Twenty-four passengers sustained minor injuries, and five passengers were uninjured. The truckdriver sustained a minor injury, and the codriver was uninjured. As a result of this accident investigation, which focuses upon the safety of and management oversight for new entrant motor carriers, the National Transportation Safety Board makes two recommendations to the Federal Motor Carrier Safety Administration. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2003-916201 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Highway Accident Report Contents Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi Factual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Motorcoach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Truck . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Accident Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Driver Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Truckdriver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Busdriver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Vehicle and Wreckage Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Truck . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Motorcoach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Highway Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Highway Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Picnic Area Acceleration Ramp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Lighting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Picnic Area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Physical Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Operational Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 DelCar Trucking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Greyhound Lines, Inc. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Acceleration Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Semitrailer Lights Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Federal Regulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 U.S. Department of Transportation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 U.S. Department of Defense . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 New Entrant Safety Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Requirements for New Entrants in Other Countries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Accident Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Lighting Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Tractor-Semitrailer Speed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Survival Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Highway Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Contents iv Highway Accident Report New Entrant Motor Carriers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Education . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Forms and Verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 SafeStat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Safety Audit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Appendixes A: Investigation and Public Hearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 B: Federal Motor Carrier Safety Administration Forms MCS-150, MCS-150A, and OP-1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

v Highway Accident Report Acronyms and Abbreviations AASHTO American Association of State Highway and Transportation Officials CDL commercial driver’s license CFR Code of Federal Regulations DelCar DelCar Trucking DOT U.S. Department of Transportation DPS Department of Public Safety (Texas) EMS emergency medical service FMCSA Federal Motor Carrier Safety Administration FMCSRs Federal Motor Carrier Safety Regulations Greyhound Greyhound Lines, Inc. I-20 Interstate 20 MCI Motor Coach Industries MTMC Military Traffic Management Command NHTSA National Highway Traffic Safety Administration SafeStat Safety Status Measurement System the act Motor Carrier Improvement Act of 1999 TRC Texas Transportation Code TXDOT Texas Department of Transportation Volpe Center Volpe National Transportation Systems Center

vi Highway Accident Report Executive Summary On Sunday, June 9, 2002, about 5:10 a.m. central daylight time, near Loraine, Texas, a 1993 Motor Coach Industries MC-12 motorcoach, operated by Greyhound Lines, Inc., (Greyhound) and occupied by the driver and 37 passengers, was traveling east on Interstate 20 (I-20), on a scheduled route from El Paso, Texas, to Abilene, Texas, at a driver-reported speed of 65 to 67 mph. A truck tractor-semitrailer, consisting of a tractor and a semitrailer leased by DelCar Trucking (DelCar), which was being operated by a driver in training with a codriver in the sleeper berth, was entering the interstate from a picnic area at a driver-estimated speed of 40 mph and proceeding into the eastbound lanes. The motorcoach collided with the rear of the semitrailer near milepost 228 of Interstate 20, pushing the tractor-semitrailer approximately 276 feet. Three passengers on the Greyhound bus, all seated in the front of the bus, were fatally injured. Five passengers and the busdriver were seriously injured. Twenty-four passengers sustained minor injuries, and five passengers were uninjured. The truckdriver sustained a minor injury, and the codriver was uninjured. The National Transportation Safety Board determines that the probable cause of this accident was the unnecessarily slow acceleration of the unlighted semitrailer onto a high-speed interstate by an inexperienced and unsupervised driver who was impaired by cocaine. Contributing to the accident was DelCar Trucking’s failure to exercise adequate operational oversight and the Federal Motor Carrier Safety Administration’s failure to ensure the safety of and provide management oversight for new entrant motor carriers. As a result of this accident investigation, which focuses upon the safety of and management oversight for new entrant motor carriers, the Safety Board makes two recommendations to the Federal Motor Carrier Safety Administration.

1 Highway Accident Report Factual Accident Narrative On Sunday, June 9, 2002, about 5:10 a.m. central daylight time, near Loraine, Texas, a 1993 Motor Coach Industries (MCI) MC-12 motorcoach, operated by Greyhound Lines, Inc., (Greyhound) and occupied by the driver and 37 passengers, was traveling east on Interstate 20 (I-20), on a scheduled route from El Paso, Texas, to Abilene, Texas, (see figure 1) at a driver-reported speed of 65 to 67 mph.1 A truck tractor-semitrailer, consisting of a tractor and a semitrailer leased by DelCar Trucking (DelCar), which was being operated by a driver in training with a codriver in the sleeper berth, was entering the interstate from a picnic area at a driver-estimated speed of 40 mph and proceeding into the . 1 The posted nighttime speed limit was 65 mph. Figure 1. Map of route.

Factual 2 Highway Accident Report eastbound lanes (see figure 2). The motorcoach collided with the rear of the semitrailer near milepost 228 of I-20, pushing the tractor-semitrailer approximately 276 feet. Three passengers on the Greyhound bus, all seated in the front of the bus, were fatally injured. Five other passengers and the busdriver were seriously injured. Twenty- four passengers sustained minor injuries, and five passengers were uninjured. The truckdriver sustained a minor injury, and the codriver was uninjured. Motorcoach The bus departed El Paso at 8:30 p.m., mountain daylight time, on June 8, 2002, en route to Abilene with a scheduled arrival time of 6:00 a.m. The location and time of the accident indicated that the bus was on schedule when the accident occurred. The driver estimated that he was traveling about 65 to 67 mph and said that he had the low-beam headlights illuminated. One bus passenger stated he observed the bus collide with the rear of the truck, and it appeared that the truck was stopped in the right lane of the highway. He stated that he “didn’t notice any lights” on the truck. Another passenger who also observed the collision thought the truck was stopped or parked in the right lane of the highway. A third bus passenger stated that after the accident, the busdriver told him the truckdriver “didn’t have his back lights on” and said he “couldn’t see the semi before it was too late.” Figure 2. Accident location.

Factual 3 Highway Accident Report Truck The truckdriver stated he departed El Paso on June 8, 2002, about 9:30 p.m. en route to Michigan. In a written statement that the truckdriver sent to his employer approximately 2 weeks after the accident,2 the truckdriver noted that he had stopped in the picnic area to go to the bathroom and check the lights on the semitrailer. He stated that “everything was okay.” He reported that he was entering the highway at about 40 mph. A Texas Department of Public Safety (DPS) investigating officer on scene reported that when he arrived, the tractor’s headlights were illuminated, but none of the lights on the rear of the semitrailer were illuminated. A truckdriver parked in the same picnic area told police that while monitoring his citizen’s band radio, he overheard a report by another trucker that a tractor-semitrailer was stopped in the roadway near the picnic area. When interviewed by National Transportation Safety Board investigators, he stated that he also overheard that the tractor-semitrailer was operating with no lights. From his location in the picnic area, he said he was unable to observe whether the truck had its lights on. Another truckdriver drove past the accident site and, in an interview with Safety Board investigators, stated that when he returned to help at the scene, he noticed that the headlights of the tractor were on. He also reported that when he found the busdriver trapped in the wreckage, the busdriver repeatedly stated that the “truck had no lights on” at the time of collision. Accident Damage After the collision, the vehicles traveled together for about 276 feet. The front of the motorcoach underrode the rear of the semitrailer and the motorcoach sustained damage extending about 100 to 125 inches rearward (see figure 3), while the tractor- semitrailer sustained crush damage to the semitrailer (see figure 4). The tractor was not damaged. 2 After being released by the Texas Department of Public Safety, the truckdriver returned to Mexico and has refused interviews with National Transportation Safety Board investigators.

Factual 4 Highway Accident Report Figure 3. Postaccident left side of motorcoach and semitrailer. Figure 4. Postaccident right side of motorcoach and semitrailer.

Factual 5 Highway Accident Report Injuries Table 1. Injury codes.3 Medical and Pathological Information Three motorcoach passengers sustained fatal injuries. The fatally injured passengers in row 1 (see figure 5) sustained severe impact injuries to the head, upper torso, and arms, as well as internal injuries. The passenger in row 2 by the left window sustained a fracture of the left temporal head area and fractures of the left scapula, arm, pelvis, and leg. Five motorcoach passengers and the busdriver sustained serious injuries. The passenger in row 1, right window seat, sustained a diffused fracture of the left hip and lacerations and contusions (bruises) to the left leg, ankle, femur, forearm, and wrist. The passenger seated in row 2, right aisle seat, sustained a fractured right femur, a contusion to the right upper chest, and multiple contusions and abrasions to the head and upper torso. The passenger in row 3, left aisle seat, incurred multiple facial and head contusions and abrasions, a fractured left shoulder, and lacerations of the left leg. The passenger in row 3, left window seat, sustained several lacerations to the face, closed head injuries, neck injuries, a fractured vertebra, and a dislocated left hip. The passenger in row 10, left aisle seat, sustained a fractured left mid tibia, fractured left hand, left forearm fracture, and contusions of the left arm. The busdriver sustained traumatic injuries to both legs, the abdomen, and internal organs; his right leg was amputated during extrication from the wreckage. Injuries Truckdriver Truck passenger Busdriver Bus passengers Total Fatal 0 0 0 3 3 Serious 0 0 1 5 6 Minor 1 0 0 24 25 None 0 1 0 5 6 Total 1 1 1 37 40 3 Title 49 Code of Federal Regulations (CFR) 830.2 defines a fatal injury as any injury that results in death within 30 days of the accident. It defines a serious injury as: an injury that requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; results in a fracture of any bone (except simple fractures of the fingers, toes, or nose); causes severe hemorrhages, nerve, muscle, or tendon damage; involves any internal organ; or involves second or third degree burns, or any burns affecting more than 5 percent of the body surface.

Factual 6 Highway Accident Report Figure 5. Motorcoach seating chart. (Probable seating locations based on passenger interviews.) Definition of passenger labels: Gender – Age : Injury Severity. 11 F - 74 : F F - 40 : F F - 52 : M F - 10 : S M - 31 : S M - 33 : M M - 29 : M F - 19 : M F - 62 : S F - 55 : S F - 50 : F F - 10 : M F - 72 : S F - 16 : M M - 18 : M M - 10 : N M - 36 : M M - 22 : N M - 37 : N M - 39 : S M - 22 : M F - 44 : M M - 15 : M M - 61 : M M - 21 : M F - 20 : M M - 42 : M M - 39 : M M - 16 : M M - 18 : M F - 26 : M M - 24 : M M - 50 : M F - 2 mos : N M - 01 : N F - 18 : M M - 24 : M M - 22 : M 12 10 9 8 7 6 5 4 3 2 1

Factual 7 Highway Accident Report Survival Aspects The front of the bus struck the rear of the semitrailer; intrusion damage was found about 100 inches rearward on the left (driver) side of the bus and about 125 inches rearward on the right (passenger) side. The occupant compartment from the windshield rearward to row 1 was destroyed. The instrument panel, left sidewall, and steering column were collapsed to the rear and to the left. The busdriver was trapped in the wreckage following the collision. The fatally injured passengers in row 1 were seated in the area of impact. The seriously injured passengers in rows 2 and 3 collided with collapsed portions of the front of the bus. The seriously injured passenger in row 10 was thrown into the aisle during the collision. Only the busdriver’s seating position was equipped with a lap/shoulder belt; the remaining seats had no restraints. After the impact, several passengers exited the bus via the side emergency window exits; impact damage prevented use of the front boarding door of the bus. Seven occupants, including the busdriver, were unable to exit the bus because of injuries and had to be extricated by emergency personnel. Emergency Response A citizen called 911 about 5:11 a.m. and reported that the accident was at milepost 242, which is in Nolan County, Texas. The call was initially routed to the Abilene Emergency Communications Center, but was immediately rerouted to the Sweetwater, Texas, dispatch because of the location reported by the caller. At 5:12 a.m., the Sweetwater Fire Department was dispatched. At 5:15 a.m., based on other calls received providing the accident’s true location, the Nolan County dispatch contacted the Mitchell County Sheriff’s Office. The first person to arrive on scene, at 5:18 a.m., was a Nolan County Deputy Sheriff, who notified dispatch that the accident scene was at milepost 228, in Mitchell County, Texas. At 5:20 a.m., one City of Loraine and three Mitchell County emergency medical service (EMS) units were dispatched. The Loraine Fire Department and EMS units established traffic control, shutting down the eastbound lanes of I-20 until 3:00 p.m. The Sweetwater Fire Chief was the incident commander for the extrication process, and the Mitchell County EMS Supervisor was responsible for triage and transportation of the injured. Area fire and EMS agencies provided a total of 12 firefighters and emergency medical technicians, as well as the battalion chief.

Factual 8 Highway Accident Report Driver Information Truckdriver The 36-year-old truckdriver possessed a Texas Class A commercial driver’s license (CDL) learner’s permit, issued on May 26, 2000, with an expiration date of January 28, 2005. Federal regulations at 49 CFR 383.23 required that the truckdriver be supervised by a licensed CDL holder when operating commercial vehicles and that the licensed CDL holder be positioned in the front seat of the vehicle. Another employee of the motor carrier was assigned as a codriver/supervisor but stated that he was in the truck’s sleeper berth at the time of the accident. Federal regulations at 49 CFR 391.41(a) require that drivers possess a valid medical certificate prior to operating a commercial vehicle; the truckdriver was not medically certified at the time of the accident nor did records indicate that he had ever been certified. Texas DPS cited the driver for not having a licensed CDL holder supervising him from the front passenger seat and for not having a medical certificate in his possession. The motor carrier reported that the truckdriver had been working for the company about 2 weeks and had worked for another motor carrier prior to his employment at DelCar (the owner of DelCar had no records indicating how long the driver had been driving or working for another motor carrier). The truckdriver was on his second trip and in his 4th day of supervised driving for the motor carrier at the time of the accident. (For the truckdriver’s logbook entries, see table 2.) The truckdriver’s logbook was not completed for June 8 or June 9. Table 2. Truckdriver logbook entries. After the accident, the truckdriver was released by Texas DPS to return to El Paso. According to the owner of DelCar, the truckdriver traveled to Juarez, Mexico, where he had relatives,4 and refused Safety Board requests to return to El Paso. Safety Board investigators were unable to contact the truckdriver. Date Times Logbook entry Hours June 6, 2002 0000 – 0600 Driving 6.0 — 0600 – 1715 Off duty/sleeper berth 11.25 June 6-7, 2002 1715 – 0315 Driving 10.0 June 7, 2002 0315 – 1900 Off duty/sleeper berth 15.75 — 1900 - ???? Driving — 4 Though born in Mexico, the driver was a U.S. citizen.

Factual 9 Highway Accident Report A postcrash urine specimen was collected from the truckdriver about 10:00 a.m. on the day of the accident and analyzed by laboratory staff at the Mitchell County Hospital in Colorado City, Texas. The specimen tested positive for benzoylecgonine, a cocaine metabolite, at a level of 2,890 nanograms/milliliter. A blood specimen, collected at 8:35 a.m., was analyzed by the Texas DPS toxicology laboratory and found to contain 0.37 milligrams of benzoylecgonine per liter. Busdriver The 39-year-old busdriver possessed a Texas Class A CDL with a passenger endorsement and corrective lens restriction having an expiration date of August 28, 2008. He also possessed a valid medical examiner’s certificate issued May 4, 2001, with an expiration date of May 4, 2003. The busdriver reported that he was wearing glasses at the time of the accident. The busdriver had been employed with Greyhound since June 13, 1998. The busdriver was a full-time extra-board driver5 with Greyhound. His home terminal was Abilene, and in the 4 months prior to the accident, he had driven roundtrips between Abilene and Dallas and Abilene and El Paso. According to the busdriver’s logbooks, he had begun driving at 8:30 p.m., the night before the accident. Table 3 lists the driver’s logbook entries for the 3 days prior to the accident. No records were completed for the day of the accident. The driver stated he was not using any prescriptions or over-the-counter medications, drugs, or alcohol prior to the accident. Specimens of blood and urine for the busdriver were collected at Hendricks Medical Center in Abilene following the accident. Both specimens were negative for alcohol and other drugs. The driver had received a preemployment drug test on March 11, 1998, and a random drug test on April 28, 1999, both with negative results. 5 Extra-board drivers are on-call drivers used as needed to provide extra capacity or substitute for regular drivers. They are not scheduled on the same route or at the same time every day of the work cycle.

Factual 10 Highway Accident Report Table 3. Busdriver logbook entries. Vehicle and Wreckage Information Truck The 2000 Peterbilt tractor was towing a 1991 Stoughton 53-foot van semitrailer. The total weight of the tractor-semitrailer and load6 was 40,710 pounds; the gross vehicle weight rating of the semitrailer was 68,080 pounds. The tractor, inspected by the Texas DPS on June 9, 2002, and released prior to the arrival of Safety Board investigators, was Date Times Logbook entry Hours June 6, 2002 0000 – 0600 Driving 6.00 — 0600 – 0615 On duty 0.25 — 0615 – 1930 Off duty 13.25 — 1930 – 2000 On duty 0.50 — 2000 – 2230 Driving 2.50 — 2230 – 2245 On duty 0.25 June 6 – 7, 2002 2245 – 0015 Off duty 1.50 June 7, 2002 0015 – 0030 On duty 0.25 — 0030 – 0300 Driving 2.50 — 0300 – 0315 On duty 0.25 June 7 – 8, 2002 0315 – 0115 Off duty 22.00 June 8, 2002 0115 – 0200 On duty 0.75 — 0200 – 0730 Driving 5.50 — 0730 – 0745 On duty 0.25 — 0745 – 0945 Driving 2.00 — 0945 – 1000 On duty 0.25 — 1000 – 2030 Off duty 10.50 6 The load, consisting of automotive seat cushions, weighed about 6,000 pounds.

Factual 11 Highway Accident Report found to have no mechanical defects. The Texas DPS commercial vehicle inspector stated that a 15-amp fuse found in a 30-amp receptacle for the clearance and identification lights7 was burned out. Texas DPS and Safety Board investigators inspected the semitrailer; no mechanical defects, other than the poorly maintained lighting system wiring and the burned-out fuse, were found. During a postaccident interview with the Texas DPS, the truckdriver stated that when the turn signal was used, the semitrailer’s lights sometimes shorted out.8 An examination of the wires supplying current to the clearance and identification lights showed that they were melted due to an electrical short. According to Texas DPS and Safety Board investigators, the general appearance of the wiring in the back of the semitrailer was poor; several splices covered with black electrical tape connected the wires. The wiring harness for the taillights on the right rear of the truck had an exposed wire where the insulation was cracked. The taillights and the license plate lights were on the same circuit. Testing of the lighting system could not be performed due to accident damage, but several of the lamps (bulbs) were analyzed by the Safety Board’s material’s lab (see Tests and Research). The semitrailer had not been retrofitted with retroreflective sheeting as required by Federal regulations.9 DelCar leased both the tractor and semitrailer but did not maintain maintenance records for either, even though the carrier was responsible for doing so. Motorcoach Safety Board investigators inspected the 1993 MCI MC-12 motorcoach after the accident. The defects noted were a leaking wheel oil seal on the second axle on the left and an excessive engine oil leak. Greyhound’s maintenance records did not reveal any recurring maintenance problems, and the busdriver stated the bus had no defects. The busdriver stated he had the low-beam headlights on, as was his normal practice. The headlights could not be tested because of accident damage. According to the Texas Transportation Code (TRC) 547.333, low-beam lights must reveal a person or vehicle at a distance of at least 150 feet. 7 Clearance lights are located along the sides of the trailer to allow the driver to see the edges of the trailer during maneuvers. 8 The driver did not specify which lights he was referring to. 9 Title 49 CFR 393.13 requires that all trailers manufactured before December 1, 1993, be retrofitted with retroreflective sheeting or reflex reflectors by June 1, 2001.

Factual 12 Highway Accident Report Highway Information Highway Design The accident occurred on eastbound I-20 approximately 1,200 feet east of milepost 228 in Mitchell County. I-20 is classified as a principal arterial and is a divided, two-way, four-lane, paved asphalt, controlled access highway. The posted speed limit was 70 mph during the day and 65 mph at night. A picnic area was along the south side of the interstate; the gore area10 for the entrance ramp from the picnic area was about 935 feet west of the accident site (see figure 6). 10 Triangular piece of land between the interstate and the ramp as the ramp transitions away from the interstate. Figure 6. Interstate 20 diagram. M RP1 0.00 0.10 0.20 0.30 NORTH Miles Interstate 20 Chevron alignment signs and easternmost area of highway safety lighting Narrel Road (overpass) Ramp leading to picnic area Designated truck parking location in picnic area Ramp leading from picnic area Milepost 228 Tire marks at accident scene To El Paso To Abilene

Factual 13 Highway Accident Report Each eastbound lane measured approximately 12 feet across and was divided by painted stripes approximately 10 feet long and spaced every 30 feet. The left paved shoulder was about 4 feet wide and delineated by a 4-inch-wide retroreflective yellow painted edge line; the right paved shoulder was about 10 feet wide and delineated by a 4-inch-wide retroreflective white painted edge line. Rolled rumble strips11 measuring 26 inches long were on the shoulder, approximately 4 inches from the right lane edge line. The westbound lanes were similarly configured and separated from the eastbound lanes by a 39-foot depressed earthen median. Records provided by the Texas Department of Transportation (TXDOT) revealed that in a 5-mile section of I-20 centered on milepost 228, one accident had occurred in the previous 5 years: a single-vehicle run-off-the-road accident with possible injury. According to TXDOT, the annual average daily traffic count for 1996 to 2000 ranged from 9,200 to 12,100 cars (see table 4), with trucks accounting for 35.7 percent of the total traffic in 2000. Table 4. Annual average daily traffic count. Picnic Area Acceleration Ramp The picnic area had a 975-foot acceleration ramp from the truck parking area to the interstate (see figure 7). The acceleration ramp from the picnic area was defined by the design plans as a single-lane, free-flow entrance terminal with a taper-type design. The interstate had a 4-percent upgrade beginning 375 feet east of the gore created by the picnic area’s acceleration ramp. No visual obstructions existed between the acceleration ramp and the interstate. According to current American Association of State Highway and Transportation Officials (AASHTO) guidelines, an acceleration ramp should be long enough for a driver to make the transition from the speed on the entering roadway to the operational speed of the highway. The design of the ramp should be such that motorists can attain a speed 11 Rolled rumble strips are installed into shoulders to assist in preventing drift-off accidents and are formed by a roller that leaves grooves during the compaction of asphalt during the pavement resurfacing process. Year Vehicles per day 1996 9,200 1997 9,800 1998 11,200 1999 12,100 2000 11,700

Factual 14 Highway Accident Report approximately equal to the average running speed of the highway, less 6.21 mph, by the time the left edge of the ramp joins the traveled portion of the highway. Under current AASHTO guidelines, a vehicle leaving the picnic area from a parked position and entering onto a highway with a design speed of 70 mph requires an acceleration ramp of 1,410 feet at a maximum grade of 2 percent. When the picnic area was built in 1965, no guidance existed for the lengths of acceleration ramps. According to TXDOT, a roadway’s design features are brought up to the current standards when a major rehabilitation project takes place. According to a TXDOT engineer, the agency plans to investigate the feasibility of revising the rehabilitation contract12 to include changes to the eastbound picnic area acceleration ramp in spring 2003. Lighting In the immediate area of the accident site, the highway did not have overhead safety lighting. The picnic area west of the accident site did not incorporate lighting along the ramps or within the picnic area. Approximately 1,500 feet west of the picnic area, a series of eight dual-mast-arm light poles were in the center median, and two single-mast light poles were along the right-side right of way in each direction. These 12 lights were used to illuminate the interchange between I-20 and Ranch Road 644, as well as the 3- degree left curve preceding the picnic area. The easternmost lights can be seen in figure 6. Figure 7. Picnic area acceleration ramp (looking west from accident site). 12 Currently underway in the westbound lanes of I-20 near the accident site.

Factual 15 Highway Accident Report Title 43, Texas Administrative Code, section 25.11, defines roadway lighting systems, as well as the rules specifying highways eligible for State funds, for each type of lighting. According to the code, TXDOT can only install and/or maintain lighting systems on eligible roadways where conditions warrant such installations. According to the TXDOT Operations Division Highway Illumination Manual, under rural conditions, safety lighting may be warranted for a partial interchange/intersection with a current average daily traffic count exceeding 10,000 on the through traffic lanes. Picnic Area A guidance sign on I-20 identified the rest area as a picnic area. The facility, constructed in 1965, incorporated covered shelters with picnic tables and several trash containers. The traffic lanes within the picnic area consisted of (1) a ramp from the interstate to the picnic area; (2) a main through lane running parallel to the interstate; (3) a paved area designed for pull-through truck parking with a lane back to the main through lane; (4) a ramp allowing access for traffic from the south side frontage road; and (5) an acceleration ramp from the picnic area back to the interstate. According to AASHTO,13 rest areas operating complete facilities, including a comfort station and a picnic area, should “generate a feeling of safety and security by ensuring the facility is adequately lighted for nighttime use.” The warrants for lighting developed by AASHTO only apply to complete facilities; the picnic area near the accident location was not a complete facility. Physical Evidence The motorcoach’s tandem wheel tire marks began in the right traffic lane about 1,202 feet east of milepost 228, continued in the right lane for about 48 feet, then transitioned into the left traffic lane in a right-hand arc for about 187 feet before crossing back into the right traffic lane and continuing an additional 64 feet to where the Texas DPS marked the final resting point of the motorcoach’s drive (rear) axle (see figure 8). A single tire mark was observed in the right traffic lane and followed the same general path as the tandem tire marks with an overall length of 242 feet. The single tire mark terminated in the right traffic lane, where the Texas DPS marked the final rest of the right side steer (front) axle of the motorcoach. Another single tire mark was observed in the left traffic lane running in a southeast direction with an overall length of 56 feet and terminating in the right traffic lane, where the Texas DPS marked the final rest of the motorcoach’s left-side steering axle. 13 American Association of State Highway and Transportation Officials, An Informational Guide for Roadway Lighting (Washington, DC: AASHTO, 1984).

Factual 16 Highway Accident Report Figure 8. Postaccident diagram. Beginning of tandem wheel tire marks Beginning of single wheel tire mark Beginning of single wheel tire mark Position of Greyhound bus at final rest Position of combination unit at final rest 0 25 50 75 100 FEET Eastbound Interstate 20 Westbound Interstate 20 NORTH To Abilene To El Paso

Factual 17 Highway Accident Report Operational Information DelCar Trucking DelCar was an authorized for-hire motor carrier of general freight, household goods, metal sheets, coils, and rolls based in El Paso. The motor carrier’s facility was a mobile trailer on a gravel lot. There was no maintenance garage or storage facility on the property, although the owner reported light maintenance work was conducted on the lot. Investigators found no maintenance contract. DelCar had been a registered motor carrier since August 17, 2000. The owner and his brother, who helped manage the company, had both been truckdrivers previously. The owner started driving trucks in 1984 and became an owner/operator in 1991. He had no previous experience running a motor carrier operation, nor did his brother; their only experience was driving commercial vehicles. A Texas DPS review of the owner’s criminal record revealed that he was found guilty of possession of marijuana over 50 pounds but less than 2,000 pounds in March 1999. He received 10 years’ probation. A review of the owner’s driving record revealed two accidents (in 1999 and 2000), two speeding convictions (in 1998 and 2000), and three speeding-in-a-commercial vehicle convictions (two in 1995 and one in 1999 for driving 15 mph over the speed limit). During interviews, the owner displayed some knowledge of driving rules, but little knowledge of motor carrier operator regulations, despite submitting Federal Motor Carrier Safety Administration (FMCSA) forms MCS-150 and OP-114 certifying that he was familiar with the Federal Motor Carrier Safety Regulations (FMCSRs). In addition, the owner was required to maintain a current version (2002) of the FMCSRs, but investigators found only a copy of the 2001 FMCSRs. Further, the owner signed Form OP-1 certifying he had not been convicted of distribution or possession of a controlled substance. When DelCar registered as a motor carrier, it had a fleet of two tractors and three trailers. At the time of the accident, DelCar had a fleet of 13 tractors and 25 semitrailers. When DelCar registered, it reported 4 interstate drivers; at the time of the accident, the owner reported having 2 full-time local drivers and 17 full-time long-distance drivers. Drivers were generally owner/operators and were hired through locally run advertisements. The owner did not conduct background checks on drivers nor conduct preemployment or random drug screening (the driver tested positive for drugs at the time of the accident). In addition, the owner did not require drivers to turn in their logbooks15 or prepare vehicle inspection reports, nor did he keep maintenance records for the vehicles. The FMCSRs require the owner to follow all of these procedures. In addition, DelCar drivers were cited seven times for moving violations from November 2000 to January 2002. 14 These forms must be submitted to the FMCSA to request authority to operate as a motor carrier. 15 The owner stated that he required drivers to maintain their logbooks but did not require them to turn them in.

Factual 18 Highway Accident Report According to the FMCSA inspector, the owner stated that he knowingly dispatched the accident driver to drive to Michigan as part of a team, even though the driver had only a learner’s permit and no medical certificate. The codriver, also the driver’s uncle, stated that he was aware of the driver’s non-CDL status and agreed to take the trip in the role of codriver, not as supervisor. At the time of the accident, DelCar did not have the minimum level of insurance, $750,000, required by the FMCSA. The FMCSA received notice of the cancellation of DelCar’s insurance for nonpayment of premiums on May 12, 2002. The FMCSA sent a notice of revocation of authority to DelCar on June 7, 2002 (2 days before the accident), giving the carrier 30 days to obtain insurance or cease operation. DelCar obtained the necessary insurance coverage on June 11, 2002 (2 days after the accident), and the revocation proceedings were discontinued on June 18, 2002. This was the second time that the FMCSA had sent notice of revocation to DelCar for a lack of insurance due to nonpayment of premiums. On September 20, 2001, notice of revocation was sent because DelCar’s insurance was cancelled on August 24, 2001. DelCar obtained insurance, and the revocation process was discontinued on October 9, 2001. FMCSA records indicate that, at the time of the accident, roadside inspections of DelCar vehicles and drivers resulted in a 35-percent out-of-service rate for vehicles16 (the national average is 23 percent) as a result of poor maintenance and 17-percent out-of- service rate for drivers17 (the national average is 8 percent) as a result of logbook, hours- of-service, and medical certification violations. Safety Board investigators have learned that the brother of DelCar Trucking’s owner applied for and received operating authority just prior to the accident. The brother also has a felony drug conviction. He is currently operating in DelCar’s former location and employs DelCar’s owner. Motor carrier safety rating. To measure the relative safety performance and compliance of individual motor carriers, the Safety Status Measurement System (SafeStat), developed for the FMCSA, uses data from State and Federal sources, including roadside inspections. Four safety evaluation areas (Accident History, Driver, Vehicle, and Safety Management) are measured and rated. SafeStat is currently used by the FMCSA to identify and prioritize motor carriers for on-site compliance reviews and roadside inspections. SafeStat identifies as deficient any carrier that is in the worst 25th percentile, as indicated by a score greater than 75 (out of 100) in a safety evaluation area. Using these SafeStat scores,18 the FMCSA assigns carriers to categories A through G; category A represents carriers with the highest range of SafeStat scores (a score of 350 to 550) and thus those carriers with the greatest deficiencies. According to FMCSA inspectors, only those carriers in categories A and B (a score greater than 225) receive a compliance review; category C carriers most likely do not receive a compliance review. Carriers that 16 Sixty-six vehicles were inspected, and 23 were placed out of service. 17 One hundred-two drivers were inspected, and 17 were placed out of service. 18 The overall SafeStat score is the sum of two times the Accident History safety evaluation area value plus 1.5 times the Driver safety evaluation area, plus the Vehicle safety evaluation area, plus the Safety Management safety evaluation area values.

Factual 19 Highway Accident Report are only deficient in one safety evaluation area are placed in categories D through G, which are used to prioritize carriers for roadside inspections. DelCar’s SafeStat score (as of March 23, 2002, the most recent data available) was based on 79.23 for the Vehicle safety evaluation area and 92.69 for the Driver safety evaluation area; both scores are considered deficient. SafeStat did not rate DelCar in the Accident History or Safety Management safety evaluation areas because, prior to the accident, DelCar did not have an accident record and had not received a compliance review from the FMCSA since beginning operation. The composite SafeStat score of 218.26 resulted in DelCar being placed in category C.19 The FMCSA also uses SafeStat to identify carriers for roadside inspections through the Inspection Selection System. The Inspection Selection System is a decision- making aid for determining whether to conduct commercial vehicle roadside safety inspections. A safety algorithm that uses a carrier’s SafeStat safety evaluation area scores calculates the value assigned by the Inspection Selection System. DelCar’s Inspection Selection System score was “96—Inspect.”20 The Inspection Selection System showed that the violation rates were higher than average for DelCar in the following areas: wheels or tires, steering or frame, medical certification, drivers’ logbooks, and drivers’ hours. Postaccident compliance review. Following the accident, the FMCSA conducted a compliance review of the motor carrier’s operations. Violations cited by the FMCSA included: • failing to conduct preemployment drug testing, postaccident drug testing, and random drug and alcohol testing (the accident driver was cited as support for this violation); • operating without having required minimum level of financial responsibility (lack of insurance); • failing to maintain an accident register; • failing to maintain driver qualification files; • using a driver not medically examined or certified (the accident driver was cited as support for this violation); • operating with drivers’ hours-of-service violations; • failing to maintain inspection and maintenance records; and • failing to require drivers to prepare vehicle inspection reports. 19 DelCar had received sufficient vehicle and driver inspections by September 2001 to be rated in the Driver and Vehicle areas. 20 Carriers are rated in the Inspection Selection System on a 100-point system, which is divided into three tiers: (a) Pass (no inspection required), for a score of 1 to 49; (b) Optional (may be worth a look), for a score of 50 to 74; and (c) Inspect (inspection warranted), for a score of 75 to 100. Since DelCar was in category C and had Driver and Vehicle safety evaluation area values greater than 75, the carrier automatically received an Inspection Selection System rating of 96-99.

Factual 20 Highway Accident Report The FMCSA inspectors did not look for or find information about the owner’s previous conviction for drug possession or for the misleading information contained on DelCar’s new entrant motor carrier application. As a result of the violations cited by the FMCSA, DelCar received an unsatisfactory rating on June 18, 2002. The operator had 60 days to improve the rating or cease operations; on August 18, 2002, the FMCSA placed DelCar out of service for not improving the safety of its operations. Greyhound Lines, Inc. Greyhound is an authorized, for-hire interstate carrier of passengers providing scheduled bus service, special destination service, charters, and package service throughout North America. Greyhound operates from 11 driver operation and customer service districts, and all schedules are monitored from a central location in Dallas, Texas. Drivers are assigned to and report for duty at 89 terminals, and passengers are picked up and discharged at 1,530 bus stop locations, which vary throughout the year. Greyhound’s most recent compliance review prior to the accident was September 14, 2001; the company received a satisfactory rating. In the 24 months prior to October 20, 2002, Greyhound had an 8.9 percent out-of-service rate for vehicles (national average is 23 percent) and a 1.8 percent out-of-service rate for drivers (national average is 8 percent). Meteorological Information At 4:52 a.m. on the day of the accident at the Abilene Regional Airport, about 3 miles southeast of Abilene,21 the weather was clear with an air temperature of 72 degrees Fahrenheit and a wind speed of 7 mph. The roadway was dry. In Loraine, on June 9, 2002, the beginning of nautical twilight22 was at 5:28 a.m., the beginning of civil twilight23 was at 6:07 a.m., and sunrise was at 6:36 a.m. Moonrise was at 5:37 a.m., and the phase was a waning crescent with 2 percent of the moon’s visible disk illuminated. The new moon occurred on June 10, 2002, at 6:47 p.m. 21 Abilene is about 54 miles east of the accident location. 22 At the beginning or end of nautical twilight, under good atmospheric conditions and in the absence of other illumination, general outlines of ground objects may be distinguishable, but detailed outdoor operations are not possible, and the horizon is indistinct. 23 Civil twilight is the limit at which twilight illumination is sufficient, under good weather conditions, for terrestrial objects to be clearly distinguished; at the beginning of morning civil twilight, the horizon is clearly defined and the brightest stars are visible under good atmospheric conditions in the absence of moonlight or other illumination. In the morning before the beginning of civil twilight, artificial illumination is normally required to carry on ordinary outdoor activities.

Factual 21 Highway Accident Report Tests and Research Acceleration Tests On June 18 and 19, 2002, Safety Board investigators recorded the acceleration rates of 16 commercial vehicles departing the picnic area near the accident scene. The average speed while the vehicles were still within the picnic area was about 17 mph. The vehicles accelerated for about 35 seconds to the general area of the accident scene and reached a speed at that location of about 34 mph. Both the highway and oncoming traffic can be seen from the acceleration ramp. Semitrailer Lights Examination Four taillights, an identification lamp, and a license plate lamp on the semitrailer (see figure 9) were examined to determine the condition of the lamp filaments. Each of the four rear semitrailer taillight lamps had two filaments, a smaller one connected to the taillights and a larger one connected to the stop lights. The filaments for all four of the semitrailer’s taillight lamps were intact and connected to their respective posts. The smaller filaments for the two center taillight lamps displayed age sagging. The support and electrical posts on the identification lamp were bent and distorted, but the single filament was intact with some deformation in the area of the support hangers. No indications of filament oxidation were found on the identification lamp, even though the glass envelope was broken. None of the filaments exhibited stretching. Figure 9. Rear semitrailer lighting. Left side taillights Right side taillights Rear identification lights License plate light Right side clearance lights (mounted on side of trailer) Left side clearance lights (mounted on side of trailer)

Factual 22 Highway Accident Report Examination of the license plate lamp revealed significant filament stretching between one electrical post and its nearest support post, sufficient to produce a visible loop. The filament showed faceting consistent with long-term use, and the portion opposite the stretched length showed age sagging. Federal Regulations U.S. Department of Transportation Prior to January 1, 2003, new entrant motor carriers had only to demonstrate their financial ability to operate and show proof of insurance. Once the appropriate forms24 were completed (see appendix B) and the application fee paid (currently $300), a motor carrier could be granted authority to operate. According to the FMCSA, applicants were rejected only if they did not pay the application fee or did not show proof of insurance. The forms required of new entrant motor carriers prior to January 1, 2003, when DelCar’s owner applied for motor carrier operating authority, FMCSA forms MCS-150 and OP-1, contained sections in which motor carrier applicants had to certify that they were familiar with the FMCSRs and that they would comply with these regulations. The applicant was only presented with the option of answering “yes” for these areas and had to certify that the answer given was true and that he or she had not been convicted for possession or distribution of controlled substances. The owner of DelCar signed and submitted both forms and was granted operating authority. Enacted on December 9, 1999, the Motor Carrier Safety Improvement Act of 1999 (the act) required the Secretary of Transportation to establish regulations specifying minimum requirements for applicant motor carriers seeking operating authority. The act states that the secretary shall require all new carriers to undergo a safety review within the first 18 months of operation. It also states that the secretary is to establish minimum requirements for applicants seeking interstate operating authority to ensure that carriers are knowledgeable about Federal motor carrier safety standards. The act specified that the secretary consider a proficiency examination and other requirements to ensure applicants understand applicable safety regulations. On May 13, 2002, the FMCSA issued an interim final rule on the New Entrant Safety Assurance Process, effective January 1, 2003. The deadline for comments on this rulemaking was July 12, 2002. The purpose of the rulemaking was to establish minimum requirements for new entrant motor carriers to ensure that they are knowledgeable about applicable Federal motor carrier safety standards. Motor carriers must pass a safety audit to obtain permanent U.S. Department of Transportation (DOT) registration during their first 18 months of operation. 24 The MCS-150 form must be used to register with the U.S. Department of Transportation as an interstate carrier and the OP-1 form (or its comparable form, depending on the type of business) requests authority to operate as a for-hire carrier; private carriers are only required to complete MCS-150.

Factual 23 Highway Accident Report In the rulemaking, the FMCSA stated that it did not require a proficiency exam prior to granting operating authority because it believes the educational and technical assistance materials provided to new entrants and the new entrant certification should suffice in demonstrating that new entrants understand the safety regulations. The MCS- 150A (see appendix B) form that all motor carriers must now submit, in addition to MCS- 150 and OP-1, requires new entrants to certify that they have a system in place to ensure compliance with applicable FMCSRs. The certification reminds a new entrant of its statutory and regulatory responsibilities, which, if neglected or violated, may lead to penalties or revocation of registration. According to the rulemaking, the safety audit, occurring within the first 18 months of operation, will assess the adequacy of the new entrant’s basic safety management controls. It will consist of a review of the new entrant’s safety data and motor carrier documents and an interview session with the motor carrier to educate the carrier on compliance with the FMCSRs and to determine areas in which the carrier may be deficient. In the rulemaking, the FMCSA states that it will monitor a new entrant’s roadside inspection performance and, if the percentage of drivers or vehicles placed out of service is above the national average, the FMCSA will expedite the safety audit. If, after the safety audit, the FMCSA determines that safety management controls are adequate, then, at the end of 18 months, the FMCSA will notify the new entrant of permanent registration. If, after the safety audit, the FMCSA notes deficiencies in the new entrant’s management controls, it will notify the new entrants within 45 days that the new entrant registration will be revoked unless the new entrant takes actions specified to remedy the safety management practices within 45 days for passenger and hazardous materials carriers and within 60 days for other entrants. If the corrective actions are not taken, the FMCSA will notify the new entrant that registration has been revoked. U.S. Department of Defense Since 1992, motor carriers providing transportation for the U.S. Department of Defense have been required to meet the Military Traffic Management Command’s (MTMC’s)25 prequalification inspection for safety. Prior to 1992, carriers were only required to demonstrate they had a DOT rating of “satisfactory” and had been in operation at least 12 months to qualify as a MTMC motor carrier. MTMC implemented the prequalification inspection in 1992 due to the high failure rates being experienced during inspections by motor carriers who had previously been considered qualified. Once prequalification requirements were implemented, the number of carriers applying dropped from an average of 25 per month to 2.8 per month, probably due to the enforcement of compliance with the FMCSRs, according to the contractor administering MTMC’s program. MTMC’s prequalification inspection is a full, on-site compliance review and performance evaluation. Prior to the prequalification inspection, MTMC’s contractor prescreens all passenger motor carriers seeking MTMC approval by testing the carrier’s knowledge and understanding of specific regulatory requirements. According to the 25 MTMC is the traffic manager for the U.S. Department of Defense.

Factual 24 Highway Accident Report contractor,26 not once has any motor carrier correctly answered all the compliance questions, even though the applicants are established motor carriers. Currently, about 25 percent of motor carriers who apply to MTMC fail the initial screening process, and about 40 percent of those carriers who pass the screening process fail the prequalification inspection by MTMC contractors. All of these carriers have “satisfactory” ratings from the FMCSA and have been in operation over 12 months. Since the implementation of the prequalification inspection, no fatalities have occurred to persons while being transported by a MTMC-approved carrier. New Entrant Safety Data In 1998, the Volpe National Transportation Systems Center (Volpe Center) issued a report on New Entrant Safety Research27 under a project agreement with the Federal Highway Administration’s Office of Motor Carriers (now the FMCSA). The study found that carriers with less than 1 year of experience had significantly more acute violations and patterns of critical violations28 of safety management regulations than carriers with more than 1 year of experience (see table 5). The number of violations drops dramatically after the first year and, as carriers gain more experience, continues to decrease. Table 5. Violations of safety management regulations per 1,000 drivers. The study recommended that the FMCSA provide education and training programs at the time a motor carrier begins operation to shorten the compliance learning curve and increase the speed at which new carriers come into compliance with the FMCSRs. 26 FMCSA Docket No. FMCSA-2001-11061. 27 National Transportation Safety Center, New Entrant Safety Research (Cambridge, MA: John A. Volpe National Transportation Systems Center, April 1998). 28 An acute violation demands immediate corrective action regardless of the overall safety posture of the motor carrier, whereas critical violations are regulatory violations that indicate breakdowns in a carrier’s management controls. A pattern of critical violations is necessary to downgrade a carrier’s safety rating, whereas a single acute violation can result in a lower safety rating. Carriers Acute violations Critical violations New entrants 128.8 206.3 Experienced 34.1 11.8

Factual 25 Highway Accident Report Another study by the Volpe Center in conjunction with a project for the FMCSA29 found that over half (55.2 percent) of new entrants (carriers who registered in the previous 2 years) were deficient in the Driver safety evaluation area in SafeStat. Among experienced carriers, about 26.9 percent were deficient in the Driver safety evaluation area. In the Vehicle safety evaluation area, 34.1 percent of new entrants were deficient, whereas 27.1 percent of experienced carriers were deficient. Researchers also found that a comparison of the Safety Management Review Indicator, which is based on compliance reviews and is part of the Safety Management safety evaluation area, showed that new entrants had significantly worse safety management compliance compared with experienced carriers (41.4 percent versus 23.8 percent). In the 2002 Volpe Center study, researchers assessed the compliance review data, which revealed that about 3.4 percent of experienced carriers received reviews in the 2- year period prior to September 1999, whereas only 1.3 percent of new entrants received compliance reviews. According to the authors of the study, since SafeStat is being used to identify and prioritize carriers based on safety performance and compliance data over a 30-month period, recent registrants are unlikely to have accumulated sufficient data to be scored by SafeStat. The report also found that although 18 percent of carriers are new entrants, they received fewer than 12 percent of driver inspections and vehicle inspections. Overall, the report concluded that new entrants receive disproportionately less FMCSA oversight than experienced carriers. As part of the rulemaking docket process, the FMCSA prepared a cost evaluation of interim final rulemaking on the New Entrant Safety Assurance Process.30 In the document, the FMCSA presented data on the motor carrier crash rates that show that crash rates fall as the carrier becomes more experienced. Carriers with less than 1 year of experience have a crash rate of 0.505 per million vehicle miles traveled;31 those with 1 to 6 years of experience, 0.469; those with 7 to 10 years of experience, 0.438; and those with more than 11 years of experience, 0.411. According to the FMCSA’s evaluation, cost savings realized from the New Entrant Safety Assurance Process were estimated to exceed the cost of implementing and administering the program. The evaluation also estimated that it would take new entrants 1 hour to read the educational and technical assistance package provided to applicants and to complete the application forms. 29 National Transportation Safety Center, Analysis of New Entrant Motor Carrier Safety Performance and Compliance Using SafeStat (Cambridge, MA: John A. Volpe National Transportation Systems Center, March 2002). 30 Federal Motor Carrier Safety Administration, New Entrant Safety Assurance Process Regulatory Evaluation, FMCSA-2001-11061-3 (Washington, DC: FMCSA, January 2002). 31 For instance, a new carrier with 100 vehicles, each traveling 100,000 miles per year, would have about five accidents in a year. The same size carrier with more than 11 years’ experience would have about four accidents in a year.

Factual 26 Highway Accident Report Requirements for New Entrants in Other Countries In Canada, the provincial governments are responsible for establishing new entrant requirements. In British Columbia, for example, new motor carrier operators must complete an application that includes a detailed self-assessment of their management controls. The questions go beyond yes or no answers to request specific information on who is responsible for each area and how the requirements will be managed. For instance, the self-assessment asks who is responsible for hiring, who is responsible for maintenance, how the carrier will ensure daily logs are accurate, and, if applicable, what the carrier’s plans for managing dangerous goods are. British Columbia implemented this system in April 1999; since then, the number of new applicants has decreased by about half. The National Safety Code (which administers the new motor carrier system) is exploring the possibility of requiring new applicants to pass a test prior to being granted operating authority. In Europe, the European Union requires that member countries ensure that all new motor carriers have a minimum level of knowledge that is certified through a professional competence exam in the area of goods transport. The minimum level of knowledge must include knowledge of civil law, commercial law, social law, fiscal law, business and financial management, regulations and procedures governing access to market, technical standards, and aspects of operation and road safety.32 The exam must include two tests: one with multiple choice or direct-answer questions and one with case studies. Each test must last at least 2 hours. In the United Kingdom, in addition to passing the professional competence exam, new motor carriers must show proof of adequate financial resources to maintain their vehicles and show that they have a maintenance contract in place or, if they undertake the inspection and repair of vehicles themselves, the facilities they have available. Once a motor carrier has been in operation for 9 months, the operator’s facilities and vehicles are inspected. 32 Council Directive 98/76/EC.

27 Highway Accident Report Analysis Exclusions The weather was clear and dry at the time of the accident. Neither maintenance records nor postaccident inspection of the motorcoach indicated mechanical problems that may have hampered operation of the vehicle. The busdriver was familiar with the roadway and had received adequate rest and time off prior to driving; data recorded in his logbook complied with hours-of-service regulations. Toxicological tests performed on the blood and urine specimens taken from the busdriver were negative for alcohol and other drugs. The first 911 caller misidentified the location of the accident by a few miles; however, the misidentification did not hamper the emergency response and did not prevent responders from providing adequate and appropriate treatment to the motorcoach occupants. The Safety Board concludes that there was no evidence of drug or alcohol use by the busdriver or of busdriver fatigue. The Safety Board further concludes that the weather and the mechanical condition of the motorcoach did not contribute to the accident and that the emergency response was adequate. Accident Discussion According to the truckdriver, he had stopped at the picnic area on I-20 to go to the bathroom. As the tractor-semitrailer was pulling back onto the interstate, it was struck in the rear by the motorcoach. The busdriver stated he did not see the semitrailer because none of its lights were illuminated. Speed calculations based on physical evidence found at the scene indicate that that the motorcoach was traveling about 65 to 70 mph and that the tractor-semitrailer was traveling about 15 to 18 mph at the time of collision. Lighting Conditions Semitrailer lighting. Witnesses on the motorcoach stated that they did not see any illuminated lights on the rear of the semitrailer. The busdriver also told several people at the accident scene that he could not see the semitrailer until it was too late to avoid hitting it. Prior to departing the picnic area, the truckdriver stated he checked the lights and that they were operational. However, investigators found shorted electrical wires for the clearance and identification lights. The Texas DPS inspector stated that he found a burned- out 15-amp fuse in a 30-amp receptacle for the clearance and identification lights. The general condition of the wiring to the back of the semitrailer was poor and there was an exposed wire in the wiring harness for the taillights and license plate light. The Texas DPS inspector also said that the truckdriver stated that the semitrailer’s lights went out when

Analysis 28 Highway Accident Report the turn signal was on. The semitrailer had not been retrofitted with retroreflective sheeting as required by the FMCSA. The filaments of the four taillight lamps showed no indications of hot stretching, which would be a sign of impact while they were illuminated. The filament of the identification lamp did show some stretching, but because it was near the posts, it may have been due to deformation of the posts during the collision sequence and thus not indicative of illumination at impact. Additionally, no tungsten oxide was present as would be expected if the glass envelope had been fractured while the bulb was illuminated. Also, since the fuse for the identification lamp circuit was burned out, the lamp could not have been illuminated. The filament of the license plate light did display hot stretching indicative of being hot (illuminated) during an impact. Investigators could not determine whether the impact that caused the hot stretching occurred during this accident or whether it occurred prior to this accident during a high-energy bump. Because DelCar had not maintained service records, investigators could not determine whether the semitrailer had been in a previous accident. However, if the license plate light was illuminated, the taillights should have been illuminated also because they are on the same circuit. However, based on the defective wiring on that circuit, suggesting an electrical short, no evidence of hot stretching of the taillight filament, and statements by several witnesses, the taillights were quite likely not illuminated prior to the crash and, therefore, the license plate light was probably not illuminated, either. The Safety Board concludes that the rear lighting on the semitrailer was inoperable at the time of the accident. Highway lighting. No highway lighting was present near the accident scene. TXDOT only installs or maintains lighting systems on roadways meeting specific criteria such as traffic volume and type of roadway; based on the average daily traffic count, this roadway would have become eligible for lighting in 1998. However, according to TXDOT, just because an area meets a warrant and becomes eligible for highway safety lighting does not necessarily mean that lighting will be installed; a warrant only implies that lighting will be installed should funding be authorized. Moreover, other factors, such as accident rates and their contributory factors, are typically taken into account as well. At the accident location, only one accident had occurred in the previous 5 years,33 and TXDOT did not consider it the type of collision likely to have been prevented by highway lighting. The circumstances of this collision suggest that safety lighting at this location could be beneficial in preventing similar accidents. Typically, on high-speed limited access roadways, commercial vehicles enter the interstate from entrance ramps at a speed significantly less than the through traffic. At the ramp near the accident site, the average speed measured by investigators was 34 mph. In this accident, the tractor-semitrailer was traveling about 47 to 50 mph less than the posted nighttime speed limit. Because the semitrailer did not have any operational lighting, overhead highway lighting would have afforded the busdriver greater opportunity to detect the slow-moving tractor-semitrailer ahead and possibly avoid the collision. Based on the information gathered during this 33 A single-vehicle rollover crash.

Analysis 29 Highway Accident Report investigation, TXDOT is evaluating the safety lighting associated with the picnic area near the accident scene and performing assessments of similar rest areas within the Abilene District. Following these evaluations, TXDOT will determine how to proceed with lighting modifications. Effects of lighting on the accident. The semitrailer had not been retrofitted with retroreflective sheeting, as required by Federal law, and the semitrailer’s rear lights were most likely nonoperational. Additionally, no ambient light was available in the area of the collision. The moon was not bright (it was a thin crescent, one day from being a new moon), the sun had not begun to rise at the time of collision, and no artificial lighting was present. At nighttime, differences in illumination levels occur where there are natural or artificial sources of illumination. However, when no other sources of illumination are present, little, if any, luminance contrast occurs between the objects—in this case, the semitrailer and the background or the night sky. For an object to be seen at night, it must be sufficiently brighter than the background.34 In this case, the only source of brightness was the motorcoach’s headlights, which probably only provided enough illumination to distinguish the dark semitrailer from the background at a distance of about 150 feet. Had the semitrailer been equipped with retroreflective sheeting or had its lighting illuminated, the busdriver probably would have been able to distinguish it earlier. At a closing speed of about 48 to 55 mph, as calculated based on physical evidence, the busdriver would have had about 1.8 to 2.1 seconds to perceive the unexpected slow moving semitrailer ahead and react to it. Typical driver perception and reaction time is about 1.5 seconds in noncomplex conditions35 but can be greater based on a variety of factors, including nighttime and surprise. Additionally, drivers tend to react and respond more slowly to a slow-moving vehicle ahead when they expect it to be moving at normal highway speed.36 Therefore, the Safety Board concludes that the lack of luminance contrast between the truck and the background due to the absence of both natural light and artificial highway lighting, in combination with the semitrailer’s inoperative lighting equipment, the lack of retroreflective material on the semitrailer, and the high closure rate between the vehicles, afforded the busdriver little opportunity to detect and identify the slow-moving tractor-semitrailer. Tractor-Semitrailer Speed The motorcoach driver stated to the Texas DPS that he was traveling between 65 and 67 mph, and on-scene evidence indicates that the bus was traveling between about 65 34 Robert E. Dewar and Paul L. Olsen, “Environmental Factors, “ eds. Robert E. Dewar and Paul L. Olsen, Human Factors in Traffic Safety (Tucson, AZ: Lawyers and Judges Publishing Company, Inc., 2002) 494-495. 35 Paul L. Olsen, “Driver Perception Reaction Time,” eds. Robert E. Dewar and Paul L. Olsen, Human Factors in Traffic Safety (Tucson, AZ: Lawyers and Judges Publishing Company, Inc., 2002) 60. 36 Robert E. Dewar, Paul L. Olsen, and Gerson J. Alexander, “Perception and Information Processing,” eds. Robert E. Dewar and Paul L. Olsen, Human Factors in Traffic Safety (Tucson, AZ: Lawyers and Judges Publishing Company, Inc., 2002) 26.

Analysis 30 Highway Accident Report and 70 mph. Based on the postcollision tire marks at the scene, the tractor-semitrailer was probably traveling about 15 to 18 mph at the time of collision. Although the truckdriver stated that he was traveling approximately 40 mph prior to the collision, the on-scene evidence and the postcollision distance traveled by both vehicles contradicts the truckdriver’s statement. After the accident, investigators measured the average speed of vehicles entering the interstate from the picnic area and found that the average speed of commercial vehicles when they reached the point of impact was about 34 mph, significantly higher than the calculated speed reached by the accident truckdriver. The accident semitrailer was not fully loaded and an inspection of the tractor revealed no mechanical problems that would have prevented the tractor-semitrailer from accelerating at a normal rate of speed. Had the tractor-semitrailer accelerated at a normal rate, the busdriver would have had nearly 4 seconds to detect the tractor-semitrailer and react. The Safety Board concludes that the tractor-semitrailer should have been able to attain a speed of approximately 34 mph as it reached the accident location, instead of the estimated speed of 15 to 18 mph, thus potentially reducing the closure rate between the tractor-semitrailer and the motorcoach and providing the busdriver with additional time to identify the semitrailer ahead and take evasive action. Because the truckdriver refused to be interviewed by the Safety Board, staff investigators were unable to ask him why the tractor-semitrailer was traveling at such a slow speed as it entered the interstate; however, several possible reasons exist. Postaccident toxicological tests indicate that the driver had recently used cocaine. Based on the levels of benzoylecgonine in the blood and urine, amounts of cocaine typically used, and the rate at which cocaine and benzoylecgonine are typically processed and excreted by the body, the driver is likely to have used cocaine within approximately 6 hours prior to the time that the blood was drawn (or about 2.5 hours prior to the accident). Given the truckdriver’s route and his statement that he had been driving since 9:30 p.m. and had just stopped at a picnic area, the driver most likely used cocaine while he was stopped in the picnic area just before the accident. The indication of recent cocaine use suggests the truckdriver was impaired by the effects of the drug, including overconfidence, hyperactivity, and irritability. The driver may have thought he could merge into traffic no matter what speed he was traveling or he may have misjudged his speed. On the other hand, had the driver used cocaine earlier than when he was stopped at the picnic area, he may have been suffering from acute withdrawal from the drug, primarily resulting in depression and fatigue. Thus, the driver may have been affected by fatigue, which may have impaired his motor skills. The circumstances of this accident suggest that the driver’s impairment due to cocaine use played a role in the accident. The driver was also a new employee and a trainee. He possibly had little experience in the operation of tractor-semitrailers and was only in the 4th day of supervised driver training with the motor carrier. However, the instructor stated that he was resting in the sleeper berth of the tractor and was not available to assist the driver. The driver’s inexperience may have affected his ability to operate the clutch and shift the transmission as he accelerated onto the interstate. The driver’s view was not an issue; the investigation found no visual obstructions that would have prevented the driver from

Analysis 31 Highway Accident Report seeing the approaching motorcoach as the semitrailer entered the interstate, had he looked over his shoulder or in the sideview mirror. The Safety Board concludes that the truckdriver’s performance was impaired due to the recent use of cocaine and his inexperience in the operation of a tractor-semitrailer, resulting in a slower acceleration of the truck onto the highway than was prudent or appropriate. Survival Factors The fatally injured occupants were seated within the area of impact. In its investigations of other motorcoach accidents,37 the Safety Board has found that most motorcoach passengers who are seriously or fatally injured are seated within the area of impact and sustain their injuries due to impact with the deformed areas within the vehicle or with the intruding vehicle. Those seriously injured passengers seated immediately behind the area of impact were probably thrown into the area of impact during the collision sequence. The seriously injured passengers further to the rear of the area of impact (rows 3 and 10) were most likely thrown out of their seating compartment during the collision events, thus sustaining their injuries. The Safety Board concludes that the lack of a restraint system for the passengers contributed to the injuries of those seated outside of the area of impact. In its 1999 bus crashworthiness study,38 the Safety Board found that one of the primary causes of preventable injury in motorcoach accidents is occupant motion out of the seat during a collision and recommended that the National Highway Traffic Safety Administration (NHTSA): H-99-74 Develop performance standards for motorcoach occupant protection systems that account for frontal impact collisions, side impact collisions, rear impact collisions, and rollovers. On October 27, 2000, NHTSA responded that it had initiated a research plan with motorcoach manufacturers to support bus crashworthiness recommendations. On March 6, 2002, NHTSA responded that it had assisted in the formation of the Bus Manufacturers Council, which will work to facilitate industry-wide standards development to enhance motorcoach passenger safety. NHTSA also sponsored a public meeting in spring 2002 on motorcoach safety. Safety Recommendation H-99-74 was classified “Open—Acceptable Action” on June 28, 2002, pending development of industry-wide standards in the area of occupant protection. 37 National Transportation Safety Board, Bus Crashworthiness Issues, Special Investigation Report NTSB/SIR-99/04 (Washington, DC: NTSB, 1999). 38 NTSB/SIR-99/04.

Analysis 32 Highway Accident Report Highway Design The picnic area was constructed in October 1965 in accordance with the design guidelines in use at the time. The length of the acceleration ramp from the picnic area to the interstate is 975 feet, but under current AASHTO design guidelines, an acceleration ramp of at least 1,410 feet would be required. AASHTO also recommends that the speed of merging vehicles under these conditions be at least 50 mph. When investigators measured the speeds of commercial vehicles entering the interstate from the picnic area, they found that the vehicles reached an average speed of about 34 mph over a distance of 1,351 feet. Typically, when the local transportation authority performs a major rehabilitation of a roadway, its geometric design features are brought up to current standards. At the time of the accident, TXDOT was performing a major rehabilitation project in the westbound lanes of I-20. As a result of this investigation, TXDOT is exploring the feasibility of revising the rehabilitation project to include changes to the eastbound picnic area that would lengthen the entrance ramp from the picnic area to the interstate. These changes will be considered during the spring 2003 highway rehabilitation. New Entrant Motor Carriers The FMCSA granted DelCar Trucking the authority to operate on August 17,

1. At the time, DelCar had sufficient insurance to operate. However, during

postaccident interviews, the owner displayed very limited knowledge of the FMCSRs. He did not need to demonstrate that he understood them when he submitted his application; he only had to sign a form (OP-1) certifying that he was familiar with the Federal regulations and had a system in place to comply with them. While the owner did sign the application form signifying that he had such a system in place, investigators found that he did not. The carrier did not maintain any records on drivers or vehicles, did not have a drug and alcohol program in place, did not conduct background checks, and operated out of a trailer on an empty lot. While he did have an outdated copy of the FMCSRs, he did not display any evidence during the postaccident compliance review or subsequent interviews that he understood them. The owner also knowingly dispatched the accident driver, who had only a learner’s permit and no medical certificate, to drive to Michigan as part of a team. The codriver was also aware of the driver’s non-CDL status and agreed to take the trip, even though he could not have supervised the accident driver and driven the truck while still getting the required hours of rest and making the trip on schedule. Twice, after receiving authority to operate, DelCar had its insurance canceled for nonpayment, and the FMCSA sent notices of revocation of authority to operate. After receiving these letters, DelCar obtained insurance and the revocation process was discontinued. The FMCSA conducted no further reviews of the carrier to ensure DelCar was operating safely and within the law.

Analysis 33 Highway Accident Report Some of the same problems that were found during the postaccident compliance review, such as hours-of-service violations, driving a commercial vehicle while disqualified, operating without a medical certificate, and maintenance violations, had been identified previously during roadside vehicle and driver inspections. Yet the motor carrier addressed none of these problems after the roadside inspections. DelCar’s owner had been found guilty of possession of large amounts of marijuana in 1999, yet he certified, under penalty of perjury on his application to the FMCSA (Form OP-1), that he had not been previously convicted of possession of a controlled substance. No system was in place at the FMCSA to verify whether the owner had a criminal record, even though this information was readily available to investigators after the accident. The owner was granted permission to operate as a motor carrier even though he had a recent drug conviction and insufficient knowledge of the FMCSRs. Education New motor carriers receive fewer compliance reviews than experienced carriers, yet they are more likely to be unfamiliar with the FMCSRs, as is evidenced in their higher SafeStat scores and higher accident rates. Motor carriers appear to have a learning curve; their safety improves over time, probably as they become more familiar with the safety regulations and learn how to implement them. One way to improve the operations of new entrants is to reduce the learning curve time by educating new carriers before they begin operations. The FMCSA’s new motor carrier entrant requirements attempt to do that. However, as written now, the requirements do not ensure that a motor carrier will comply with the regulations, nor even that the carrier understands the regulations until a safety audit is performed up to 18 months later. However, as the data indicate, new motor carriers have more pronounced patterns of critical violations of safety regulations (206.3 per 1,000 drivers for new entrants versus 11.8 for experienced carriers), far more acute violations (128.8 per 1,000 drivers for new entrants versus 34.1 for experienced carriers), and higher accident rates in the 1st year of operation (0.505 per million vehicle miles traveled versus 0.411 for those with more than 11 years of experience); consequently, the safety audit may come too late. Under the New Entrant Safety Assurance Process that began on January 1, 2003, the FMCSA plans to make available to new applicants educational and technical assistance materials. Although the FMCSA estimates that it will take a motor carrier operator about 1 hour to read and understand the regulations, a new motor carrier would probably need significantly more than 1 hour to attain a comprehensive understanding of them, since such an undertaking would require reading in numerous areas, including: • Organization and delegation of powers and duties of the Federal Highway Administration • Compliance with interstate motor carrier noise emission standards • Commercial motor carrier safety assistance program

Analysis 34 Highway Accident Report • Compatibility of State laws and regulations affecting interstate motor carrier operations • Waivers, exemptions, and pilot programs • Controlled substances and alcohol use and testing • Commercial driver’s license standards • Requirements and penalties • State compliance with commercial driver’s license program • Safety fitness procedures • Rules of practice for motor carrier safety and hazardous materials proceedings • Minimum levels of financial responsibility for motor carriers • Qualifications of drivers • Driving of commercial motor vehicles • Parts and accessories necessary for safe operation • Hours of service of drivers • Inspection, repair, and maintenance • Transportation of hazardous materials • Driving and parking rules • Employee safety and health standards Because of the regulations’ complexity, the DOT has issued numerous interpretations to assist the public’s understanding of them. The regulations, as originally printed, are 383 pages long. A guide containing all the FMCSRs and their interpretations is 520 pages long.39 One hour is inadequate for a new motor carrier entrant to fully understand the regulations and determine how they apply to the carrier’s operation. DelCar’s owner maintained a copy of the FMCSRs, yet he neither understood nor complied with a majority of the regulations. Forms and Verification Once an applicant reads the material, he or she completes forms MC-150, OP-1, and a new form, MCS-150A, which asks only whether the applicant will have procedures and systems in place to comply with each part of the FMCSRs, including driver qualifications, hours of service, drug and alcohol testing, vehicle condition, accident monitoring, production of records, and hazardous materials (as applicable). Apparently, the only difference between the MCS-150A and the OP-1 forms initially completed by new entrants prior to January 1, 2003, is that OP-1 combined the compliance areas into 39 Code of Federal Regulations, Title 49 – Department of Transportation (Chicago, Illinois: LabelMaster, 2002).

Analysis 35 Highway Accident Report one response, whereas MCS-150A requires the applicant to respond affirmatively to each area individually. Once a carrier checks all of the answers, certifies he or she understands the regulations (similar to what is required on the OP-1 form), and submits the applications, fees, and proof of insurance, the carrier is granted new entrant operating authority for 18 months. The FMCSA has no mechanism to determine whether a carrier reads the material, understands the regulations, and has developed a safety management system to ensure compliance, a situation similar to the one that existed prior to the new interim rulemaking, when DelCar applied to be a motor carrier. Nor does the FMCSA have a process in place to verify that the information submitted is correct. The owner of DelCar stated in his application that he had safety systems in place, understood the FMCSRs, and had no controlled substance convictions, but upon investigation, these statements were obviously not true. The MCS-150A form does little more than the previous new entrant form requirements did. The Safety Board concludes that the FMCSA’s Form MCS-150A, Safety Certification for Application for U.S. DOT Number, does not allow the FMCSA to determine a motor carrier’s level of safety fitness prior to operation because it does not require applicants to provide detailed information on operations. Further, no mechanism is in place to verify the validity of an applicant’s statements. The current application process relies on the motor carrier to read the material and do what is required. The FMCSA has no way of determining whether a motor carrier is complying with the FMCSRs until the safety audit occurs, up to 18 months after the motor carrier begins operations. In other countries and territories, the new applicant process is more stringent. In British Columbia, a new motor carrier must describe the types of systems that are in place and the records that will be kept. In all member countries of the European Union, a new motor carrier must take an examination to ensure that he knows the rules and regulations. In the United Kingdom, the new motor carrier must inform the licensing agency of its maintenance program and capabilities and is inspected within 9 months. In the U.S. motor carrier certification process, no such checks are in place. The FMCSA does not verify that the motor carrier understands or has complied with the regulations. While some new motor carriers will probably put safety management systems in place to comply with the FMCSRs, the Safety Board is concerned that some carriers, such as DelCar, will fail to do so. The new form that must be filled out only requires the carrier to check “yes” or “no” boxes; even the previous form required the motor carrier to verify that he understood the rules and regulations and had no possession or distribution of a controlled substance convictions. The Safety Board therefore concludes that the FMCSA’s New Entrant Safety Assurance Process lacks meaningful safeguards to ensure that a motor carrier is aware of, understands, and has a safety management system in place to comply with the FMCSRs.

Analysis 36 Highway Accident Report SafeStat DelCar obtained interstate operating authority from the FMCSA and operated for 22 months, apparently violating many Federal regulations, with no oversight other than roadside inspections, which do not examine a carrier’s overall operating posture. This lack of oversight appears to be typical for new motor carriers: only 1.3 percent of new carriers (those operating less than 2 years) receive compliance reviews, while 3.4 percent of older motor carriers do. One reason for this discrepancy is the practice of conducting compliance reviews based on a motor carrier’s SafeStat score, which consists of four safety evaluation areas: Accident History, Vehicle, Driver, and Safety Management. Many new motor carriers, because they have yet to be audited, do not have a score in the Safety Management safety evaluation area nor do they have an accident history. Even if the motor carrier has high scores in the Driver and Vehicle safety evaluation areas, the composite SafeStat score places the new motor carrier in category C, which does not warrant a compliance review. For instance, DelCar had a score of 79.23 for the Vehicle safety evaluation area and 92.69 for the Driver safety evaluation area, but was not rated in the Accident History or Safety Management safety evaluation areas; therefore DelCar was placed in category C. The FMCSA probably would not have conducted a compliance review had the accident not occurred, despite DelCar’s high scores in the Vehicle and Driver Safety evaluation areas. The Safety Board concludes that the current SafeStat system does not accurately reflect a new motor carrier’s safety posture because the composite score is based on areas in which a new motor carrier may not be rated and therefore is unlikely to provide FMCSA inspectors enough data to determine whether a safety audit should be performed sooner rather than later. The Safety Board believes that the FMCSA should revise SafeStat to base scores on the Driver and Vehicle safety evaluation areas for new motor carriers, so that new motor carriers with high scores in either of these areas can be identified and will receive an immediate safety audit or compliance review. Safety Audit Once a motor carrier is granted new entrant operational authority, it can operate for up to 18 months without review of its operations. The rulemaking states that the safety audit is primarily for educational purposes, that is, to ensure that the new entrant understands the FMCSRs and has the systems and procedures in place to comply with them. The FMCSA’s regulatory evaluation states that the safety benefits of this New Entrant Safety Assurance Process will result from the safety audits, which will deter more than 14,000 crashes over 10 years. But, if every new entrant carrier is to receive a safety audit before being granted full operating authority, it would be more advantageous for the FMCSA to conduct the safety audit before the motor carrier begins operation. The motor carrier can then comply with the regulations from the beginning of operation, and the FMCSA can ensure the motor carrier understands all of the regulations. This approach is likely to further reduce both the number of accidents involving new entrant motor carriers and the learning curve time that has been cited as a reason for the poorer performance of new entrant motor carriers. It may also discourage unsafe operators from seeking authority to operate in the first place.

Analysis 37 Highway Accident Report The experience of MTMC has been that those carriers that have satisfactory ratings from the FMCSA still do not understand all of the regulations and do not comply with them. In fact, 25 percent do not pass a written test of the regulations and 40 percent of those that do pass do not qualify to be a motor carrier for the military because of safety deficiencies found during a prequalification review similar to a compliance review. When MTMC began its testing and prequalification requirement, the number of motor carriers applying decreased significantly because of the more stringent criteria for carriers seeking to operate under contract to the military. British Columbia also experienced a decrease in the number of applicants when it instituted more stringent new applicant requirements. Similarly, new motor carrier entrants applying to operate under the FMCSA’s authority may not apply if they are held to more stringent requirements than filling out three forms and obtaining insurance. Although studies have shown that motor carriers have more safety violations and accidents within the 1st year of operation, the FMCSA’s New Entrant Safety Assurance Process does not require new motor carriers to undergo a safety audit for 18 months. The Safety Board concludes that by conducting safety audits up to 18 months after carriers begin operation, the FMCSA potentially allows unsafe carriers to operate without oversight and without the benefit of the educational and technical assistance that the FMCSA provides during the safety audit. The FMCSA could have performed a safety audit of DelCar before granting the carrier operating authority. Had it done so, the FMCSA may have detected the lack of a safety management system; deficiencies in hiring practices, maintenance, and drug and alcohol testing; and the owner’s previous drug conviction. Had a safety audit taken place before DelCar began operating, the FMCSA could have used the opportunity to educate DelCar on the FMCSR requirements and assist the carrier in implementing the necessary management systems. The FMCSA could have withheld operating authority unless DelCar complied with the FMCSRs. For instance, had the FMCSA required DelCar to demonstrate that it had a drug and alcohol testing program in place, the accident driver’s cocaine use may have been detected or the driver may have been deterred from obtaining a job with DelCar. He might not have been permitted to drive, and the accident may not have occurred. Further, the FMCSA may have noticed deficiencies in DelCar’s maintenance and driver inspection programs, and, if the carrier had upgraded its maintenance to comply with Federal requirements, the semitrailer’s lighting deficiencies may have been noted and corrected, the lights may have been operational, and the semitrailer may have had retroreflective sheeting, as required, providing the busdriver with the opportunity to see the slow-moving vehicle earlier. DelCar’s owner may have believed that by virtue of being able to drive a truck, he could operate as a motor carrier. He neither understood nor complied with many of the FMCSRs that are in place to ensure safety. In fact, DelCar’s owner made a false representation on his applications without detection because the FMCSA lacked a process to evaluate the validity of his statements. After the initial application, DelCar grew from 2 to 13 tractors, from 3 to 24 trailers, and from 4 to 17 drivers, none of which were under safety management oversight, further compounding the danger to the motoring public. Yet, the New Entrant Safety Assurance Process does not give the FMCSA an opportunity

Analysis 38 Highway Accident Report to evaluate the validity of applicants’ statements until a safety audit occurs 18 months later. DelCar’s situation was probably not unique, and no process is in place to ensure that the 40,000 new motor carrier applicants each year understand the safety regulations and have programs in place to comply with them. For at least 18 months or until a safety audit has been performed, the New Entrant Safety Assurance Process does nothing to prevent motor carriers such as DelCar from obtaining operating authority. In fact, DelCar, which successfully registered as a motor carrier in 2000, could do so again today under the New Entrant Safety Assurance Process without changing its qualifications or operational posture in any way. The New Entrant Safety Assurance Process, as currently designed, does little more than make information on the requirements for operating a motor carrier more readily available to new entrants by telling new applicants how to obtain such information. While it requires that new motor carriers have a safety audit within 18 months rather than possibly wait many years for a compliance review, it does not require a preoperation evaluation. As the U.S. Department of Defense found, many carriers40 with even satisfactory ratings from the FMCSA fail a prequalification compliance review and performance evaluation. To have a greater impact on new carriers’ out-of-service and accident rates and on improving their safety management, the new entrant application process needs to require that new motor carriers understand the regulations and put into place systems and processes that ensure compliance with these regulations before beginning operations. Therefore, the Safety Board believes that the FMCSA should require all new motor carriers seeking operating authority to demonstrate their safety fitness prior to obtaining new entrant operating authority by, at a minimum: (1) passing an examination demonstrating their knowledge of the FMCSRs; (2) submitting a comprehensive plan documenting that the motor carrier has management systems in place to ensure compliance with the FMCSRs; and (3) passing an FMCSA safety audit, including vehicle inspections. 40 Twenty-five percent of applicants fail the initial application process, which includes regulatory questions, and 40 percent of the remaining applicants fail the prequalification review.

39 Highway Accident Report Conclusions Findings 1. There was no evidence of drug or alcohol use by the busdriver or of busdriver fatigue. Further, the weather and the mechanical condition of the motorcoach did not contribute to the accident and the emergency response was adequate. 2. The rear lighting on the semitrailer was inoperable at the time of the accident. 3. The lack of luminance contrast between the truck and the background due to the absence of natural light and artificial highway lighting, in combination with the semitrailer’s inoperative lighting equipment, the lack of retroreflective material on the semitrailer, and the high closure rate between the vehicles, afforded the busdriver little opportunity to detect and identify the slow-moving tractor-semitrailer. 4. The tractor-semitrailer should have been able to attain a speed of approximately 34 mph as it reached the accident location, instead of the estimated speed of 15 to 18 mph, thus potentially reducing the closure rate between the tractor-semitrailer and the motorcoach and providing the busdriver with additional time to identify the semitrailer ahead and take evasive action. 5. The truckdriver’s performance was impaired due to the recent use of cocaine and his inexperience in the operation of a tractor-semitrailer, resulting in a slower acceleration of the truck onto the highway than was prudent or appropriate. 6. The lack of a restraint system for the passengers contributed to the injuries of those seated outside the area of impact. 7. The Federal Motor Carrier Safety Administration’s Form MCS-150A, Safety Certification for Application for U.S. DOT Number, does not allow the Federal Motor Carrier Safety Administration to determine a motor carrier’s level of safety fitness prior to operation because it does not require applicants to provide detailed information on operations. Further, no mechanism is in place to verify the validity of an applicant’s statements. 8. The Federal Motor Carrier Safety Administration’s New Entrant Safety Assurance Process lacks meaningful safeguards to ensure that a motor carrier is aware of, understands, and has a safety management system in place to comply with the Federal Motor Carrier Safety Regulations.

Conclusions 40 Highway Accident Report 9. The current Safety Status Measurement System (SafeStat) does not accurately reflect a new motor carrier’s safety posture because the composite score is based on areas in which a new motor carrier may not be rated and therefore is unlikely to provide Federal Motor Carrier Safety Administration inspectors enough data to determine whether a safety audit should be performed sooner rather than later.

1. By conducting safety audits up to 18 months after carriers begin operation, the

Federal Motor Carrier Safety Administration potentially allows unsafe carriers to operate without oversight and without the benefit of the educational and technical assistance that the Federal Motor Carrier Safety Administration provides during the safety audit. Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the unnecessarily slow acceleration of the unlighted semitrailer onto a high-speed interstate by an inexperienced and unsupervised driver who was impaired by cocaine. Contributing to the accident was DelCar Trucking’s failure to exercise adequate operational oversight and the Federal Motor Carrier Safety Administration’s failure to ensure the safety of and provide adequate management oversight for new entrant motor carriers.

41 Highway Accident Report Recommendations To the Federal Motor Carrier Safety Administration: Revise the Safety Status Measurement System (SafeStat) to base scores on the Driver and Vehicle safety evaluation areas for new motor carriers, so that new motor carriers with high scores in either of these areas can be identified and will receive an immediate compliance review. (H-03-01) Require all new motor carriers seeking operating authority to demonstrate their safety fitness prior to obtaining new entrant operating authority by, at a minimum: (1) passing an examination demonstrating their knowledge of the Federal Motor Carrier Safety Regulations; (2) submitting a comprehensive plan documenting that the motor carrier has management systems in place to ensure compliance with the Federal Motor Carrier Safety Regulations; and (3) passing a Federal Motor Carrier Safety Administration safety audit, including vehicle inspections. (H-03-02) BY THE NATIONAL TRANSPORTATION SAFETY BOARD JOHN A. HAMMERSCHMIDT CAROL J. CARMODY Acting Chairman Member JOHN J. GOGLIA Member Adopted: February 26, 2003

this page intentionally left blank

43 Highway Accident Report Appendix A Investigation and Public Hearing The National Transportation Safety Board was notified of the Loraine, Texas, accident on June 9, 2002. Investigative team members were dispatched from the Washington, D.C., and Fort Worth, Texas, offices. Groups were established to investigate human performance; motor carrier operations; and highway, vehicle, and survival factors. Participating in the investigation were representatives of the Federal Motor Carrier Safety Administration, the Texas Department of Transportation, the Texas Department of Public Safety, Greyhound Lines, Inc., and Consolidated Safety Services. No public hearing was held; no depositions were taken.

44 Highway Accident Report Appendix B Federal Motor Carrier Safety Administration Forms MCS-150, MCS-150A, and OP-1

C S K. DIV 2.2A (AMMONIA) B NB C S L. DIV 2.3A B NB C S M. DIV 2.3B B NB C S N. DIV 2.3C B NB C S O. DIV 2.3D B NB C S P. CLASS 3 B NB C S Q. CLASS 3A B NB C S R. CLASS 3B B NB C S S. COMB LIQ B NB C S T. DIV 4.1 B NB

1. CARGO CLASSIFICATIONS (Circle All that Apply)

IF THE SPACE ABOVE IS BLANK OR THE INFORMATION THEREIN IS INCORRECT, PLEASE IDENTIFY YOUR COMPANY’S PRINCIPAL OFFICE IN THE SPACES BELOW.

1. NAME OF MOTOR CARRIER/HM SHIPPER
2. TRADE OR D.B.A. (DOING BUSINESS AS) NAME
3. PRINCIPAL STREET ADDRESS/ROUTE NUMBER
4. MAILING ADDRESS (P O BOX)
5. CITY
6. COLONIA (MEXICO ONLY)
7. MAILING CITY
8. COLONIA (MEXICO ONLY)
9. STATE/PROVINCE
10. ZIP CODE+4
11. STATE/PROVINCE
12. ZIP CODE+4
13. PRINCIPAL PHONE NUMBER
14. USDOT NO.
15. IRS/TAX ID NO.

EIN # SSN #

1. CARRIER OPERATION (Circle One)

A. Interstate B. Intrastate Only (Hazardous Materials) C. Intrastate Only (Non-Hazardous Materials)

1. SHIPPER OF HAZARDOUS MATERIALS OPERATION (Circle One)

A. Interstate B. Intrastate

1. CARRIER MILEAGE (to nearest 10,000 miles for Last Calendar Year)
2. OPERATION CLASSIFICATION (Circle All that Apply)

A. Authorized For-Hire B. Exempt For-Hire C. Private (Property) E. Private Passengers (Non-Business) D. Private Passengers (Business) F. Migrant G. U.S. Mail H. Federal Government I. State Government J. Local Government K. Indian Tribe L. Other

1. HAZARDOUS MATERIALS CARRIED OR SHIPPED (Circle All that Apply.) C - CARRIED S - SHIPPED B(BULK) - IN CARGO TANKS NB(NON-BULK) - IN PACKAGES

C S U. DIV 4.2 B NB C S V. DIV 4.3 B NB C S W DIV 5.1 B NB C S X. DIV 5.2 B NB C S Y. DIV 6.2 B NB C S Z. DIV 6.1A B NB C S AA. DIV 6.1B B NB C S BB. DIV 6.1POISON B NB C S CC. DIV 6.1SOLID B NB C S DD. CLASS 7 B NB A. GENERAL FREIGHT B. HOUSEHOLD GOODS C. METAL: SHEETS, D. MOTOR VEHICLES E. DRIVE AWAY/TOWAWAY J. FRESH PRODUCE K. LIQUIDS/GASES L. INTERMODAL CONT. M. PASSENGERS N. OIL FIELD EQUIPMENT O. LIVESTOCK P. GRAIN, FEED, HAY Q. COAL/COKE R. MEAT S. GARBAGE, REFUSE, TRASH T. U.S. MAIL U. CHEMICALS

1. PRINCIPAL FAX NUMBER
2. MC OR MX NO.
3. DUN & BRADSTREET NO.
4. INTERNET E-MAIL ADDRESS

YEAR F. LOGS, POLES G. BUILDING MATERIALS H. MOBILE HOMES I. MACHINERY, BEAMS, LUMBER LARGE OBJECTS COILS, ROLLS V. COMMODITIES DRY BULK W. REFRIGERATED FOOD X. BEVERAGES Y. PAPER PRODUCTS Z. UTILITY AA. FARM SUPPLIES BB. CONSTRUCTION CC. WATER WELL DD. OTHER C S A. DIV 1.1 B NB C S B. DIV 1.2 B NB C S C. DIV 1.3 B NB C S D. DIV 1.4 B NB C S E. DIV 1.5 B NB C S F. DIV 1.6 B NB C S G. DIV 2.1 B NB C S H. DIV 2.1LPG B NB C S I. DIV 2.1(METHANE) B NB C S J. DIV 2.2 B NB C S EE. HRCQ B NB C S FF. CLASS 8 B NB C S GG. CLASS 8A B NB C S HH. CLASS 8B B NB C S II. CLASS 9 B NB C S JJ. ELEVATED TEMP MAT B NB C S KK. INFECTIOUS WASTE B NB C S LL. MARINE POLLUTANTS B NB C S MM. HAZARDOUS SUB(RQ) B NB C S NN. HAZARDOUS WASTE B NB C S OO. ORM B NB

1. EQUIPMENT

Straight Trucks Truck Tractors Trailers HazMat Cargo Tank Trailers HazMat Cargo Tank Trucks P A S S E N G E R S Motor coach School bus Mini-bus/Van Limousine OWNED TERM LEASED TRIP LEASED INTERSTATE

1. DRIVER INFORMATION
2. CERTIFICATION STATEMENT (to be completed by an authorized official)

Beyond 100-Mile Radius 100-Mile Radius INTRASTATE Beyond 100-Mile Radius 100-Mile Radius TOTAL CDL DRIVERS TOTAL DRIVERS (Please print Name) Title Date Signature I, , certify that I am familiar with the Federal Motor Carrier Safety Regulations and/or the Federal Hazardous Materials Regulations. Under penalties of perjury, I declare that the information entered on this report is, to the best of my knowledge and belief, true, correct, and complete. This form was electronically produced by Elite Federal Forms, Inc. U.S. Department of Transportation Federal Motor Carrier Safety Administration MOTOR CARRIER IDENTIFICATION REPORT (Application for U.S. DOT Number) OMB No. 2126-0013 Form MCS-150 (Rev. 3-2000) 0

Form MCS-150A (12-19-2002)

U.S. Department of Transportation Federal Motor Carrier Safety Administration Safety Certification for Application (Safety Certification for Application for U.S. DOT Number)

1. NAME OF MOTOR CARRIER
2. TRADE OR D.B.A. (DOING BUSINESS AS) NAME
3. PRINCIPAL STREET ADDRESS/ROUTE NUMBER

MAILING ADDRESS (P 0 BOX)

CITY

STATE/PROVINCE

ZIP CODE+4

MAILING CITY

STATE/PROVINCE

ZIP CODE+4

PRINCIPAL PHONE NUMBER

PRINCIPAL FAX NUMBER

USDOT NO.

MC OR MX NO.

DUN & BRADSTREET NO.

IRS/TAX ID NO. EIN# SSN#

INTERNET E-MAIL ADDRESS

SAFETY CERTIFICATIONS (Applicants subject to FMCSRs must complete certification item(s) 18A through 18C).

A. Applicant maintains current copies of all U.S. DOT Federal Motor Carrier Safety Regulations, Federal Motor Vehicle Safety Standards, and the Hazardous Materials Regulations (if a property carrier transporting hazardous materials), understands and will comply with such regulations, and has ensured that all company personnel are aware of the current requirements.

Yes No

B. Applicant certifies that the following tasks and measures will be fully accomplished and procedures fully implemented before it commences operations in the United States.

• Driver qualifications:

a) The carrier has in place a system and procedures for ensuring the continued qualification of drivers to operate safely, including a safety record for each driver, procedures for verification of proper licensing of each driver and procedures for identifying drivers who are not complying with the safety regulations.

Yes No

b) The carrier has procedures in place to review drivers’ employment and driving histories for at least the last 3 years to determine whether or not the individual is qualified and competent to drive safely.

Yes No

c) The carrier has established a program to review the records of each driver at least once every 12 months and will maintain a record of the review.

Yes No

d) The carrier will ensure that all of its drivers are at least 21 years of age and if applicable possess a valid Commercial Drivers License (CDL).

Yes No

• Hours of Service:

a) The carrier has in place a recordkeeping system and procedures to monitor the hours-of-service performed by drivers, including procedures for continuing review of drivers’ log books, and for ensuring compliance with all operations requirements.

Yes No

b) The carrier has ensured that all drivers are knowledgeable of the hours-of-service requirements, and has clearly and specifically instructed the drivers concerning the application to them of the 10-hour, 15-hour, and 60 and 70-hour rules as well as the requirement for preparing daily log entries in their own handwriting for each 24-hour period.

Yes No

1. Drug and alcohol testing:

a) The carrier is familiar with the alcohol and controlled substance testing requirements of 49 CFR part 382 and 49 CFR part 40 and has in place a program for systematic testing of drivers.

Yes No N/A

• Vehicle condition:

a) The carrier has established a system and procedures for inspection, repair and maintenance of its vehicles in a safe condition, and for preparation and maintenance of records of inspection, repair and maintenance in accordance with the Federal Motor Carrier Safety Regulations and the Hazardous Materials Regulations.

Yes No

b) The carrier will ensure that all violations and defects noted on inspection reports are corrected before vehicles and drivers are permitted to continue operation.

Yes No

• Accident monitoring program:

OMB No. 2126-0013

Form MCS-150A (12-19-2002)

a) The carrier has in place a program for monitoring vehicle accidents and maintains an accident register in accordance with 49 CFR 390.15.

Yes No

b) The carrier has established an accident countermeasures program and driver training program to reduce accidents.

Yes No

1. Production of records:

a) The carrier can and will produce records demonstrating compliance with the safety requirements within 48 hours of receipt of a request from a representative of the USDOT/FMCSA or other authorized Federal or State official.

Yes No

1. Hazardous Materials (to be completed by carriers of hazardous materials only).

a) The HM carrier has full knowledge of the U.S. DOT Hazardous Materials Regulations and has established programs for the thorough training of its personnel as required under 49 CFR part 172, Subpart H, and 49 CFR 177.816.

Yes No N/A

b) The carrier has established a system and procedures for inspection, repair and maintenance of its reusable hazardous materials packages (cargo tanks, portable tanks, cylinders, intermediate bulk containers, etc.) in a safe condition, and for preparation and maintenance of records of inspection, repair and maintenance in accordance with the U.S. DOT Hazardous Materials Regulations.

Yes No N/A

c) The HM carrier has established a system and procedures for filing and maintaining HM shipping documents.

Yes No N/A

d) The HM carrier has a system in place to ensure that all HM trucks are marked and placarded as required by 49 CFR part 172, Subparts D and F.

Yes No N/A

e) The carrier will register under 49 CFR part 107, Subpart G, if transporting any quantity of hazardous materials requiring the vehicle to be placarded.

Yes No N/A

For Cargo Tank (CT) Carriers of HM a) The carrier has a system in place to ensure that its cargo tanks are inspected and tested as required by 49 CFR 180 by a facility registered with the U.S. DOT under part 107, Subpart F.

Yes No N/A

By signing these certifications, the carrier official is on notice that the representations made herein are subject to verification through inspections in the United States and through the request for and examination of records and documents. Failure to support the representations contained in this application could form the basis of a proceeding to assess civil penalties and/or lead to the revocation of the authority granted.

C. All applicants must certify as follows:

• Applicant is willing and able to provide the proposed operations or service and to comply with all pertinent

statutory and regulatory requirements and regulations issued or administered by the U.S. Department of Transportation, including operational regulations, safety fitness requirements, motor vehicle safety standards, and minimum financial responsibility requirements. Yes No

• Applicant is willing and able to produce for review or inspection documents which are requested for the purpose

of determining compliance with applicable statutes and regulations administered by the U.S. Department of Transportation, including the Federal Motor Carrier Safety Regulations, Federal Motor Vehicle Safety Standards and Hazardous Materials Regulations, within 48 hours of any written request. Yes No

• Applicant is not presently disqualified from operating commercial vehicles in the United States pursuant to the

Motor Carrier Improvement Act of 1999 or any other law. Yes No

NOTE: All motor carriers must comply with all pertinent Federal, State, local and tribal statutory and regulatory requirements when operating within the United States. Such requirements include, but are not limited to, all applicable statutory and regulatory requirements administered by the U.S. Department of Labor, or by a State agency operating a plan pursuant to Section 18 of the Occupational Safety and Health Act of 1970 (“OSHA State plan agency”). Such requirements also include all applicable statutory and regulatory environmental standards and requirements administered by the U.S. Environmental Protection Agency or a State, local or tribal environmental protection agency. Compliance with these statutory and regulatory requirements may require motor carriers and/or individual operators to produce documents for review and inspection for the purpose of determining compliance with such statutes and regulations.

• Certification Statement (to be completed by an authorized official)

I, _________________________________________________ , certify that I am familiar with the Federal Motor Carrier Safety Regulations and/or the Federal Hazardous Materials Regulations. Under penalties of perjury, I declare that the information entered on this report is, to the best of my knowledge and belief, true, correct, and complete.

Signature ____________________________________ Date _________________________________ Title ____________________________________________

(Please print Name)

FEDERAL MOTOR CARRIER SAFETY ADMINISTRATION Approved by OMB

FORM OP-1 2125-0568 APPLICATION FOR MOTOR PROPERTY CARRIER AND BROKER AUTHORITY Expires 04/30/01

This application is for all individuals and businesses requesting authority to operate as motor property common or contract carriers or property brokers.

SECTION I

Do you now have authority from or an application being processed by the former ICC, FHWA, OMCS or FMCSA? G NO G YES If yes, identify the lead docket number(s) Applicant Information LEGAL BUSINESS NAME

DOING BUSINESS AS NAME

BUSINESS ADDRESS

____________________________________________________________(__) Street Name and Number

City

State Zip Code Telephone Number

MAILING ADDRESS (If different from above)

Street Name and Number

City State Zip Code

REPRESENTATIVE (Person who can respond to inquiries)

Name and

title, position, or relationship to applicant

Street

Name and Number

City State

Zip Code Telephone Number (___)___________________FAX Number (___)

U.S. DOT Number (If available; if not, see Instructions.)

FORM OF BUSINESS (Check only one.) G Corporation State of Incorporation G Sole Proprietorship Name of Individual

G Partnership

Identify Partners

FOR FMCSA USE ONLY

Docket No. MC-__________________________________

Filed ___________________________________________

Fee No._________________________________________

CC Approval No._________________________________

FEDERAL MOTOR CARRIER SAFETY ADMINISTRATION Approved by OMB

FORM OP-1 2125-0568 APPLICATION FOR MOTOR PROPERTY CARRIER AND BROKER AUTHORITY Expires 04/30/01

SECTION II

Type of Authority You must submit a filing fee of $300.00 for each type of authority requested (for each box checked).

G MOTOR COMMON CARRIER OF PROPERTY (except HOUSEHOLD GOODS) G MOTOR CONTRACT CARRIER OF PROPERTY (except HOUSEHOLD GOODS) G MOTOR COMMON CARRIER OF HOUSEHOLD GOODS G MOTOR CONTRACT CARRIER OF HOUSEHOLD GOODS G BROKER OF PROPERTY (except HOUSEHOLD GOODS) G BROKER OF HOUSEHOLD GOODS G UNITED STATES BASED ENTERPRISE OWNED OR CONTROLLED BY PERSONS OF MEXICO PROVIDING TRUCK SERVICES FOR THE TRANSPORTATION OF INTERNATIONAL CARGO (except HOUSEHOLD GOODS) G UNITED STATES BASED ENTERPRISE OWNED OR CONTROLLED BY PERSONS OF MEXICO PROVIDING TRUCK SERVICES FOR THE TRANSPORTATION OF INTERNATIONAL HOUSEHOLD GOODS

SECTION III

Insurance Information This section must be completed by ALL motor property carrier applicants. The dollar amounts in parentheses represent the minimum amount of bodily injury and property damage (liability) insurance coverage you must maintain and have on file with the FMCSA.

NOTE: Refer to the instructions for information on cargo insurance filing requirements for motor common carriers and surety bond/trust fund agreement filings for property brokers.

G Will operate vehicles having Gross Vehicle Weight Ratings (GVWR) of 10,000 pounds or more to transport:

G Non-hazardous commodities ($750,000). G Hazardous materials referenced in the FMCSA’s insurance regulations at 49 CFR 1043.2(b)(2)(c) ($1,000,000). G Hazardous materials referenced in the FMCSA’s insurance regulations at 49 CFR 1043.2(b)(2)(b) ($5,000,000).

G Will operate only vehicles having Gross Vehicle Weight Ratings (GVWR) under 10,000 pounds to transport: G Any quantity of Class A or B explosives, any quantity of poison gas (Poison A), or highway route controlled quantity of radioactive materials ($5,000,000).

G Commodities other than those listed above ($300,000).

APPLICATION FOR MOTOR PROPERTY CARRIER AND BROKER AUTHORITY - OP-1 (cont.)

SECTION IV

Safety

Certification (Motor Carrier Applicants Only)

APPLICANTS SUBJECT TO FEDERAL MOTOR CARRIER SAFETY REGULATIONS - If you will operate vehicles of more than 10,000 pounds GVWR and are, thus, subject to pertinent portions of the U.S. DOT's Federal Motor Carrier Safety Regulations at 49 CFR, Chapter 3, Subchapter B (Parts 350-399), you must certify as follows:

Applicant has access to and is familiar with all applicable U.S. DOT regulations relating to the safe operation of commercial vehicles and the safe transportation of hazardous materials and it will comply with these regulations. In so certifying, applicant is verifying that, at a minimum, it: (1) Has in place a system and an individual responsible for ensuring overall compliance with Federal Motor Carrier Safety Regulations; (2) Can produce a copy of the Federal Motor Carrier Safety Regulations and the Hazardous Materials Transportation Regulations; (3) Has in place a driver safety training/orientation program; (4) Has prepared and maintains an accident register (49 CFR 390.15); (5) Is familiar with DOT regulations governing driver qualifications and has in place a system for overseeing driver qualification requirements (49 CFR Part 391); (6) Has in place policies and procedures consistent with DOT regulations governing driving and operational safety of motor vehicles, including drivers’ hours of service and vehicle inspection, repair, and maintenance (49 CFR Parts 392, 395 and 396); (7) Is familiar with and will have in place on the appropriate effective date, a system for complying with U.S. DOT regulations governing alcohol and controlled substances testing requirements (49 CFR 382 and 49 CFR Part 40).

G YES

EXEMPT APPLICANTS - If you will operate only small vehicles (GVWR under 10,000 pounds) and will not transport hazardous materials, you are exempt from Federal Motor Carrier Safety Regulations, and must certify as follows: Applicant is familiar with and will observe general operational safety guidelines, as well as any applicable State and local laws and requirements relating to the safe operation of commercial motor vehicles and the safe transportation of hazardous materials.

G YES

SECTION V

Affiliations

AFFILIATION WITH OTHER FORMER ICC, FHWA OR OMCS, NOW FMCSA-LICENSED ENTITIES. Disclose any relationship you have or have had with any other FMCSA-regulated entity within the past 3 years. For example, this could be through a percentage of stock ownership, a loan, or a management position. If this requirement applies to you, provide the name of the company, MC- number, DOT number, and that company's latest U.S. DOT safety rating. (If you require more space, attach the information to this application form.)

_

_

_

APPLICATION FOR MOTOR PROPERTY CARRIER AND BROKER AUTHORITY - OP-1 (cont.)

SECTION VI

Household Goods Certifications

HOUSEHOLD GOODS MOTOR COMMON CARRIER APPLICANTS including United States- based enterprises owned or controlled by persons of Mexico providing truck services for the transportation of international household goods shipments must certify as follows: Applicant is fit, willing, and able to provide the specialized services necessary to transport household goods. This assessment of fitness includes applicant’s general familiarity with former ICC, FHWA, or OMCS now FMCSA regulations for household goods movements and also requires an assurance that applicant has or is willing to acquire the protective equipment and trained operators necessary to perform household goods movements and that applicant will offer arbitration as a means of settling loss and damage disputes on collect-on-delivery shipments. The proposed operations will serve a useful public purpose responsive to a public demand or need.

G YES

HOUSEHOLD GOODS MOTOR CONTRACT CARRIER APPLICANTS must certify as follows: Applicant is fit, willing, and able to provide the specialized services including United States-based enterprises owned or controlled by persons of Mexico providing truck services for the transportation of international household goods shipments necessary to transport household goods. This assessment of fitness includes applicant’s general familiarity with former ICC, FHWA, or OMCS, now FMCSA regulations for household goods movements and also requires an assurance that applicant has or is willing to acquire the protective equipment and trained operators necessary to perform household goods movements and that applicant will offer arbitration as a means of settling loss and damage disputes on collect-on-delivery shipments. The proposed service will be consistent with the public interest and the transportation policy of 49 U.S.C. 10101.

G YES

HOUSEHOLD GOODS BROKER APPLICANTS must certify as follows: Applicant is fit, willing, and able to provide household goods brokerage operations and to comply with all pertinent statutory and regulatory requirements. The involved services will be consistent with the public interest and the transportation policy of 49 U.S.C. 10101.

G YES

NOTE: Applicant may attach a supporting statement to this application to provide additional information about any of the above certifications. This evidence is optional.

APPLICATION FOR MOTOR PROPERTY CARRIER AND BROKER AUTHORITY - OP-1 (cont.)

SECTION VII

Applicants for Contract Carriage of Household Goods

SCOPE OF OPERATING AUTHORITY. Complete one or both box(es) below, as applicable.

G Contracting shippers have one or more of the distinct needs delineated in Interstate Van Lines, Inc., Extension - Household Goods, 5 I.C.C.2d 168 (1988).

Describe briefly the distinct need(s):

G Contracts provide for assignment of one or more vehicles for the exclusive use of each shipper in the manner specified in Interstate Van Lines, Inc., Extension - Household Goods, 5 I.C.C.2d 168 (1988).

SECTION VIII

Applicant's Oath

This oath applies to all supplemental filings to this application. The signature must be that of applicant, not legal representative.

I, ___________________________________________________________, verify under penalty of Name and title

perjury, under the laws of the United States of America, that all information supplied on this form or relating to this application is true and correct. Further, I certify that I am qualified and authorized to file this application. I know that willful misstatements or omissions of material facts constitute Federal criminal violations punishable under 18 U.S.C. 1001 by imprisonment up to 5 years and fines up to $10,000 for each offense. Additionally, these misstatements are punishable as perjury under 18 U.S.C. 1621, which provides for fines up to $2,000 or imprisonment up to 5 years for each offense.

I further certify under penalty of perjury, under the laws of the United States, that I have not been convicted, after September 1, 1989, of any Federal or State offense involving the distribution or possession of a controlled substance, or that if I have been so convicted, I am not ineligible to receive Federal benefits, either by court order or operation of law, pursuant to Section 5301 of the Anti-Drug Abuse Act of 1988 (21 U.S.C. 862)

Finally, I certify that applicant is not domiciled in Mexico or owned or controlled by persons of that country. (Note: This portion of Applicant’s does not pertain to applicants that are U.S.-based enterprises owned or controlled by persons of Mexico seeking to provide truck services for the transportation of international cargo.).

Signature _____________________________________________________ Date___________________

FEDERAL MOTOR CARRIER SAFETY ADMINISTRATION Approved by OMB

FORM OP-1 2125-0568 APPLICATION FOR MOTOR PROPERTY CARRIER AND BROKER AUTHORITY Expires 04/30/01

6 Filing Fee Information

All applicants must submit a filing fee for each type of authority requested. The enclosed fee schedule will show the appropriate filing fee. The total amount due is equal to the fee times the number of boxes checked in Section II. Fees for multiple authorities may be combined in a single payment.

Total number of boxes checked in Section II: _______ x filing fee $__________ = $___________

INDICATE AMOUNT $__________________________ AND METHOD OF PAYMENT

G CHECK or G MONEY ORDER, payable to: FMCSA

G VISA G MASTERCARD

Credit Card Number _____________________________________Expiration Date _______________

Signature _______________________________________________Date

Fee Policy

! Filing fees must be payable to the Federal Motor Carrier Safety Administration, by check drawn upon funds deposited in a bank in the United States or money order payable in U.S. currency or by approved credit card.

! Separate fees are required for each type of authority requested. If applicant requests multiple types of permanent authority on one application form (for example, common and contract carrier authority) or if applicant submits more than one form in the OP-1 Series in a single filing, multiple fees are required. The applicant may submit a single payment for the sum of the applicable fees.

! Filing fees must be sent, along with the original and one copy of the application, to FEDERAL MOTOR CARRIER SAFETY ADMINISTRATION, P. O. Box 100147, Atlanta, GA, 30384-0147. For express mail only: Nationsbank Wholesale Lockbox 100147, 6000 Feldwood Road, 3rd Floor East, College Park, GA 30349. For credit card only: FMCSA, Suite 600, 400 Virginia Avenue, S.W., Washington, D.C., 20024.

! After an application is received, the filing fee is not refundable.

! The FMCSA reserves the right to discontinue processing any application for which a check is returned because of insufficient funds. The application will not be processed until the fee is paid in full.

PAPERWORK BURDEN. It is estimated that an average of 2 burden hours per response are required to complete this collection of information. This estimate includes time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Comments concerning the accuracy of this burden estimate or suggestions for reducing this burden should be directed to the FEDERAL MOTOR CARRIER SAFETY ADMINISTRATION, Licensing Division, Suite 600, 400 Virginia Avenue, SW, Washington, DC 20024. This collection of information is required in order for the FMCSA to obtain data and register for-hire motor carriers of regulated commodities,property brokers, and certain U.S.-based Mexican-owned enterprise property carriers. Please note that an agency may not conduct or sponsor, a person is not required to respond to a collection of information unless it displays a currently- valid OMB control number. The OMB control number for this collection is 2121-0016.

this page intentionally left blank

FD07270 ｜ 2003_美国_HAR0303.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2003 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

15-Passenger Van Single-Vehicle Rollover Accidents, Henrietta, Texas, May 8, 2001, and Randleman, North Carolina, July 1, 2001 Highway Accident Report NTSB/HAR-03/03 PB2003-916203 Notation 7567 National Transportation Safety Board Washington, D.C.

this page intentionally left blank

Highway Accident Report 15-Passenger Van Single-Vehicle Rollover Accidents, Henrietta, Texas, May 8, 2001, and Randleman, North Carolina, July 1, 2001 NTSB/HAR-03/03 PB2003-916203 National Transportation Safety Board Notation 7567 490 L’Enfant Plaza, S.W. Adopted July 15, 2003 Washington, D.C. 20594

National Transportation Safety Board. 2003. 15-Passenger Van Single-Vehicle Rollover Accidents, Henrietta, Texas, May 8, 2001, and Randleman, North Carolina, July 1, 2001. Highway Accident Report NTSB/HAR-03/03. Washington, DC. Abstract: On May 8, 2001, a 1993 Dodge 15-passenger van was eastbound on U.S. Route 82 near Henrietta, Texas. The driver and 11 passengers, all members of the First Assembly of God Church in Burkburnett, Texas, occupied the van. As the vehicle approached milepost 538, the left rear tire experienced a tread separation and blowout; subsequently, the van departed the roadway and rolled over at least two times, ejecting seven passengers. The driver and three of the ejected passengers sustained fatal injuries, and eight passengers sustained serious injuries. On July 1, 2001, a 1989 Dodge Ram 15-passenger van was northbound in the left lane on U.S. Route 220, near Randleman, North Carolina. The van, owned by Virginia Heights Baptist Church of Roanoke, Virginia, was occupied by the driver and 13 passengers. As the vehicle approached the Level Cross, North Carolina, exit, the left rear tire experienced a tread separation and blowout; subsequently, the van overturned, ejecting four passengers. One ejected passenger was fatally injured, and three sustained serious injuries; the driver and nine passengers sustained injuries ranging from none to serious. The major safety issues discussed in this report are 15-passenger van classification, driver training, occupant protection, and tire condition, inspection, and maintenance. As a result of its investigation of these accidents, the Safety Board made recommendations to the National Highway Traffic Safety Administration, the Federal Motor Carrier Safety Administration, the 50 States and the District of Columbia, the American Driver and Traffic Safety Education Association, the American Automobile Association, the National Safety Council, the American Association of Motor Vehicle Administrators, Ford Motor Company, and General Motors Corporation. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2003-916203 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Highway Accident Report Contents Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi Factual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Henrietta, Texas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Driver Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Vehicle and Wreckage Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Highway Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Operational Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Randleman, North Carolina . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Driver Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Vehicle and Wreckage Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Highway Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Operational Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Simulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Independent Tire Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Dynamic Vehicle Handling Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Federal Regulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 NHTSA “Consumer Advisory” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Seat Belt Laws . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 State Vehicle Safety Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Previous Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Accident Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Henrietta, Texas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Randleman, North Carolina . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Vehicle Classification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Occupant Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Contents iv Highway Accident Report Interior Surfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Seat Belt Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Roof Crush . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Tires . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 Appendix A: Henrietta, Texas, Investigation Randleman, North Carolina, Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 B: Potential Occupant Motion in Simulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 C: Federal Motor Vehicle Safety Standards 201, 209, and 216 . . . . . . . . . . . . . . . . . . . . . . 67

v Highway Accident Report Acronyms and Abbreviations AAMVA American Association of Motor Vehicle Administrators CFR Code of Federal Regulations DaimlerChrysler DaimlerChrysler Corporation EDVSM Engineering Dynamics Corporation’s Simulation Model FMCSA Federal Motor Carrier Safety Administration FMVSSs Federal Motor Vehicle Safety Standards FMVSS Federal Motor Vehicle Safety Standard Ford Ford Motor Company GVWR gross vehicle weight rating GM General Motors Corporation HVE Human Vehicle Environment NHTSA National Highway Traffic Safety Administration psi pounds per square inch STL Standards Testing Laboratories, Inc. TREAD Act Transportation Recall Enhancement, Accountability, and Documentation Act of 2000

vi Highway Accident Report Executive Summary On May 8, 2001, about 8:57 a.m., central daylight time, a 1993 Dodge Ram 15- passenger van was eastbound on U.S. Route 82 near Henrietta, Texas, en route from Burkburnett, Texas, to an outlet mall in Gainesville, Texas. The driver and 11 passengers, all members of the First Assembly of God Church, occupied the van. As the vehicle approached milepost 538 in the left lane, at a calculated speed of 61 to 67 mph, the left rear tire experienced a tread separation and blowout; subsequently, the van departed the roadway and rolled over at least two times in the median, ejecting seven passengers before coming to final rest. The driver and three of the ejected passengers sustained fatal injuries, and eight passengers sustained serious injuries. On July 1, 2001, about 2:30 p.m., eastern daylight time, a 1989 Dodge Ram 15- passenger van was northbound in the left lane on U.S. Route 220, near Randleman, North Carolina, en route from Myrtle Beach, South Carolina, to Roanoke, Virginia. The van, owned by Virginia Heights Baptist Church of Roanoke, Virginia, was occupied by the driver and 13 passengers, ages 13 to 19. As the vehicle approached the Level Cross, North Carolina, exit, at a witness-estimated speed of 65 mph, the left rear tire experienced a tread separation and blowout; subsequently, the van moved from the left lane into the right lane, then back into the left lane, where it overturned and came to rest in the travel lanes. During the accident sequence, four passengers were ejected, one of whom was fatally injured and three of whom sustained serious injuries; the driver and the other nine passengers sustained injuries ranging from none to serious. The National Transportation Safety Board determines that the probable cause of the accidents was tire failure, the drivers’ response to that failure, and the drivers’ inability to maintain control of their vans. Contributing to the accidents was the deteriorated condition of the tires, as a result of the churches’ lack of tire maintenance, and the handling characteristics of the vans. Contributing to the severity of the injuries was the lack of appropriate Federal Motor Vehicle Safety Standards applicable to 15-passenger vans in the areas of restraints and occupant protection. The major safety issues discussed in this report are 15-passenger van classification, driver training, occupant protection, and tire condition, inspection, and maintenance. As a result of its investigation of these accidents, the Safety Board makes recommendations to the National Highway Traffic Safety Administration, the Federal Motor Carrier Safety Administration, the 50 States and the District of Columbia, the American Driver and Traffic Safety Education Association, the American Automobile Association, the National Safety Council, the American Association of Motor Vehicle Administrators, Ford Motor Company, and General Motors Corporation.

1 Highway Accident Report Factual Henrietta, Texas Accident Narrative On May 8, 2001, about 8:57 a.m., central daylight time, a 1993 Dodge Ram 15- passenger van was eastbound on U.S. Route 82 near Henrietta, Texas, en route from Burkburnett, Texas, to an outlet mall in Gainesville, Texas (see figure 1). Eleven passengers and a driver, all members of the First Assembly of God Church, occupied the van. As the van approached milepost 538 in the left lane, at a calculated speed1 of 61 to 67 mph, the left rear tire experienced a tread separation and blowout; subsequently, the van departed the roadway and rolled over at least two times in the median, ejecting seven passengers before coming to final rest (see figure 2). The driver and three of the ejected passengers sustained fatal injuries, and eight passengers sustained serious injuries. 1 The speed was calculated as part of the accident simulation. See Vehicle Dynamics Simulation section below. Figure 1. Henrietta accident route.

Factual 2 Highway Accident Report Figure 2. Henrietta accident scene. 0 10 20 30 40 50 60 Edge of paveme westbound lane Eastbound U.S. Route 82 Scale in feet Rim ring Tire casing debris Debris field Tire and furrow marks Ejected occupants Van Tire casing debris N Direction of travel Grass center median

Factual 3 Highway Accident Report According to the pastor of the church, a group of parishioners had scheduled a trip to the Texas Outlet Centers in Gainesville, Texas, one of about four trips the group makes each year. The church, which owned the van, provided transportation for the trips at no cost to the group members. The trip began at the church parking lot about 8:30 a.m. Gainesville is about 100 miles from Burkburnett, and the trip would have taken about 2 hours to complete. The van had traveled about 34 miles from the church when the accident occurred. According to one passenger, she heard what she said was a sound “similar to a muffled gunshot,” and she believed that it was a tire blowout. She stated that as soon as she heard the noise, the vehicle began to swerve and then departed the roadway. A witness driving in the right lane at a witness-estimated distance of about 200 yards behind the accident van said that the van swerved left off the edge of the pavement and then returned to the road, but the back end of the van slid to the right and then off the left side of the road into the median before the van began to roll. This witness thought the van rolled “four or five times at least.” Another witness, traveling in the right lane approximately three vehicles behind the van, stated that he saw rubber come out from under the van when “it had a blowout.” He said that he saw the van brake and then it “bobbled” back and forth a few times before sliding into the median. This witness stated that “the vehicle rolled onto its right side and over, then end-to-end once, and then rolled over on its side two more times.” Injuries Table 1. Injuries.2 Medical and Pathological Information Four of the van passengers, including the driver, sustained fatal injuries as a result of the accident. The driver, who was wearing a lap/shoulder belt, sustained multiple skull fractures, brain avulsion,3 bilateral lung contusions, fractured sternum, fractured right ribs Injuries Driver Passengers Total Fatal 1 3 4 Serious 0 8 8 Minor 0 0 0 None 0 0 0 Total 1 11 12 2 49 Code Federal Regulations (CFR) 830.2 defines a fatal injury as any injury that results in death within 30 days of the accident. It defines a serious injury as an injury that requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; results in a fracture of any bone (except simple fractures of the fingers, toes, or nose); causes severe hemorrhages, nerve, muscle, or tendon damage; involves any internal organ; or involves second or third degree burns, or any burns affecting more than 5 percent of the body surface. 3 An avulsion is a separation or detachment.

Factual 4 Highway Accident Report 1 through 7, fractured left clavicle, fractured left ribs 1 through 8, abraded contusions to the right hand and abrasions and lacerations of the left forearm and elbow. The fatally injured passenger in seat 3 (see figure 3) was ejected and sustained a large gaping laceration of the scalp; C1 and C2 vertebrae fractures with partial dislocation into the spinal canal and laceration of the spinal cord; spleen laceration; liver pulpification; laceration of the inferior vena cava; fractured right ribs 1 through 9; fractured left ribs 1 through 11; fractured right clavical, pelvis, left femur, left radius, and ulna; multiple abrasions; contusions; and lacerations. The fatally injured passenger in seat 9 was ejected and sustained a deep laceration to the right femoral region extending into the anterior right thigh and a large scalp laceration.4 The fatally injured passenger in seat 12 was ejected and sustained a C2 vertebra fracture with partial dislocation into the spinal canal and transection of the spinal cord and medulla, liver lacerations, fractured right posterior pelvis, dislocation of the left femur head, and multiple contusions and abrasions. 4 This passenger was not autopsied, and no further information on her injuries was available. Figure 3. Henrietta seating chart. (*ejected; shading indicates fatal injuries) 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 * * * * * * * Seat Lap/shoulder Age Belt Use Injury Fatal 1 2 3 4 5 6 8 9 11 12 14 15 62 55 59 62 63 51 59 Serious Lap/shoulder None Fatal None Serious None Serious None Serious None Serious 71 71 62 74 68 None Fatal Serious Lap None Fatal None Serious None Serious

Factual 5 Highway Accident Report The remaining eight passengers, four of whom were ejected, sustained serious injuries. The passenger in seat 2 was wearing a lap/shoulder belt. She sustained multiple right rib fractures with right pneumothorax5 and multiple contusions and abrasions to the scalp, thorax, and lower frontal abdomen. The passenger in seat 4 was ejected and sustained a splenic injury, right hip fracture, brain hemorrhage, and multiple abrasions and contusions. The passenger in seat 5 remained within the vehicle and sustained a closed fracture of the acetabulum,6 a closed fracture of the scapula, and multiple rib fractures. The passenger in seat 6 was ejected and sustained a closed C5 vertebra fracture, right rib fractures, and multiple abrasions, contusions, and lacerations. The passenger in seat 8 was ejected and sustained bilateral brain hemorrhages, multiple rib fractures, a lung contusion, radius shaft fracture, and multiple contusions and abrasions. The passenger in seat 11 was wearing a lap belt and remained within the van. She sustained a right ulna fracture, forehead and chest contusions, lacerations, and abrasions. The passenger in seat 14 remained within the vehicle and sustained a major scalp avultion, left first rib fracture with right lung contusion, laceration of the wrist, and multiple abrasions and contusions. The passenger in seat 15 was ejected and sustained liver injury, right kidney injury with hemorrhage, right rib fractures, head laceration, and right side extremity contusions. Survival Aspects The driver was wearing a lap/shoulder belt, as was the front seat passenger. The left outer seating positions on each of the four rows and the right outer seating position in the fourth row were equipped with lap/shoulder belts. All remaining seating positions were equipped with lap belts. Only the passenger in seat 11 was wearing the lap belt restraint. Of the nine unrestrained passengers, seven were ejected. Emergency Response At 8:57 a.m. the Clay County (Texas) Sheriff’s Office received a 911 call reporting the accident. Within 2 minutes, the first ambulance with emergency medical personnel was dispatched from the Clay County Memorial Hospital. Two minutes later, a Clay County Sheriff’s unit was dispatched and en route to the accident site. When the emergency medical personnel arrived on scene and reported the severity of the accident and the number of injured, the mutual aid plan was initiated for Clay County fire and medical response. A total of 14 medical personnel responded to the scene in eight emergency vehicles. Fire response included local departments from Henrietta, Dean, and Jolly, Texas. Law enforcement units from the Texas Department of Public Safety State Highway Patrol also responded. An informal critique of the emergency response was held after the accident. According to a captain with the Clay County Sheriff’s Office, who was also a volunteer firefighter with the Henrietta Fire Department, the issues addressed as a result of the response were minor and not documented. Overall, according to the captain, the response 5 Pneumothorax is a condition in which air or other gas is present in the pleural cavity; it occurs spontaneously as a result of injury to the lung tissue or puncture of the chest wall. 6 The acetebulum is the cavity at the base of the hip bone into which the head of the femur fits.

Factual 6 Highway Accident Report went well and all patients were transported from the scene within 22 minutes of the dispatch call. The only issues for improvement discussed during the critique were the initial assessment of the severity of the accident and the response resources required. As a result, a review of the mutual aid plan was conducted. Driver Information At the time of the accident, the 62-year-old driver held a Texas class C, noncommercial driver’s license, valid through July 8, 2005, with a corrective lens restriction. A review of Texas Department of Public Safety records revealed no traffic convictions or accidents. A 72-hour history of the driver’s activities was constructed based on an interview with the driver’s husband and is shown in table 2. Table 2. Henrietta van driver 72-hour history. According to the driver’s husband, the driver was familiar with the accident van; she had driven the 15-passenger van for the church for about 15 years. Her husband stated that prior to the accident, she had been driving the van at least once a week locally and drove on longer distance highway trips about six or seven times per year. Date Time Activity Sleep May 4, 2001 10:00 p.m. – 10:30 p.m. Went to bed May 5, 2001 5:30 a.m. Awoke 7 – 7.5 hours 6:15 a.m. – 8:00 a.m. Travel/shopping 8:00 a.m. – 6:00 p.m. Sales at flea market (with light lunch) 6:00 p.m. Dinner 8:00 p.m. – 8:30 p.m. Went to bed May 6, 2001 8:00 a.m. Awoke 11.5 – 12 hours 11:30 a.m. – 4:00 p.m. Shopping (lunch between 2:30 p.m. and 3:00 p.m.) 8:00 p.m. – 9:00 p.m. Went to bed May 7, 2001 8:00 a.m.– 9:00 a.m. Awoke 11 – 13 hours Daytime Shopping/worked in yard 6:00 p.m. – 7:00 p.m. Dinner 10:00 p.m. Went to bed May 8, 2001 6:30 a.m. Awoke 8.5 hours 7:30 a.m. Departed home after breakfast to pick up van 8:00 a.m. – 8:30 a.m. Departed in van

Factual 7 Highway Accident Report The driver had Crohn’s Disease,7 requiring a strict diet, as well as high cholesterol and arthritis, according to her husband. He stated that she took Tylenol for the arthritis but was not taking any other medications. She wore photoreactive prescription sunglasses when she drove. Toxicological tests of the driver’s blood by the Civil Aeromedical Institute were negative for alcohol or other drugs. Vehicle and Wreckage Information Exterior. The 1993 Dodge Ram 350 Maxi-Wagon was configured to accommodate 15 passengers, including the driver. The vehicle had a wheelbase of 127.6 inches, an overall length of 222.8 inches, and a gross vehicle weight rating (GVWR)8 of 8,510 pounds. The van was equipped with a 5.9-liter fuel-injected V-8 gasoline engine and a four-speed automatic transmission; it had an odometer reading of 44,156 miles. Inspection of the suspension system revealed no anomalies. The van was equipped with front disc brakes and rear antilock drum brakes. When the brakes were applied, both front wheel hubs remained locked without creep or slippage. The front brake friction surfaces were smooth and did not show excessive grooving or wear ridging. The friction surfaces of the rear brakes were smooth with slight wear ridging on the edges of the drums. Examination of the brake system revealed no hydraulic system leaks or restrictions. The brake pedal was intact and functional. The van was equipped with a hydraulic power-assisted steering system, a 15-inch concentric two-spoke steering wheel, and tilt steering column. The steering wheel and column were pushed rearward and to the right due to accident damage. Rotating the steering wheel resulted in a correlating movement of the steering box sector shaft, as well as the associated steering system components. No excessive play or wear was observed within the steering system components. The steering wheel could be rotated from stop to stop without restriction other than resistance due to the damaged column. All four tires were manufactured by Michelin and conformed to the size for the vehicle recommended by the manufacturer. The tread depths complied with Texas vehicle inspection criteria. Both front tires were inflated to 60 pounds per square inch (psi) and the right rear tire was inflated to 58 psi. The pressure of the left rear tire prior to the blowout could not be determined. The manufacturer recommended a tire pressure of 55 psi for the front tires and 80 psi for the rear tires. A placard containing this information was located on the inside of the driver’s doorsill. The left front and both rear tires were more than 8 years old. The left front tire exhibited extensive circumferential sidewall (see figure 4) and tread groove cracking (see figure 5). According to the manufacturer, the cracking was due to weather and is commonly referred to as weather checking, that is, surface cracks in the exterior tire rubber. Written in yellow crayon on the sidewall were the words “RE- 7 Crohn’s disease causes chronic inflammation in the gastrointestinal tract. Symptoms are typically controlled through diet, drugs, nutritional supplements, and surgery. 8 GVWR is the maximum weight of the vehicle plus passengers and any cargo the vehicle can carry.

Factual 8 Highway Accident Report INFLATE TO 60 PSI.” The right front tire had sustained a circumferential cut along the outer shoulder and tread; otherwise, examination revealed no anomalies. The right rear tire exhibited circumferential scrubbing,9 as well as soil or dirt and grass between the flange/bead seat and the tire. 9 Scrubbing is the action of rubbing the tire surface against another surface, for example, sidewall against curb or tread surface against the road. Figure 4. External tire diagram. Source: Michelin.

Factual 9 Highway Accident Report The left rear tire (see figure 6) sustained extensive damage to the inner and outer sidewalls and tread, exposing the body plies10 and inner liner (see figure 7). The tire exhibited extensive circumferential cracking and deterioration of the sidewall and bead areas, which the manufacturer attributed to weather. Radial splits and abrasions were noted on the sidewalls, as was severe weather checking. The tread and belt components were partially detached from the tire. Where the bottom belt remained attached, it was separated from the body ply along the interior edge. A nail found embedded in the detached tread and top belt piece had not penetrated all components. Another puncture hole, extending through all components, was found. The inner liner was split radially. Figure 5. Left front tire tread groove cracking. 10 Layers of fabric that make up the tire body.

Factual 10 Highway Accident Report Figure 6. Left rear tire. Figure 7. Inner tire diagram. Source: Michelin.

Factual 11 Highway Accident Report Interior. The van had driver and front passenger bucket seats, three rows with seating for three passengers each, and a fourth row with seating for four passengers. All four rows of passenger seats were intact. Lap belts were attached to the seat frame for passengers in the middle and right aisle seats of the first three rows. Lap belts for two middle seats in the fourth row were attached to the floor behind the seat frame (see figure 8). A single bolt near the right seat frame pedestal base secured the two webbing straps with buckles to the floor for these two middle seats; the two webbing straps with latch plates were bolted to the floor near the left seat frame pedestal base. DaimlerChrysler Corporation (DaimlerChrysler) engineers stated that they were unable to determine why the anchorages had been designed in such a manner. As a result of this configuration for the fourth row lap belts, the two buckles were on the right side of the seat, and the two latch plates were on the left side of the seat (see figure 9); they had to cross one another in order to buckle the belts (see figure 10). Figure 8. Fourth row lap belt attachments.

Factual 12 Highway Accident Report Figure 9. Fourth row center lap belt configuration. Figure 10. Fourth row center lap belts in use. 18” 15” 11” 64”

Factual 13 Highway Accident Report The roof of the van was deflected to the right and downward (see figures 11 and 12), damaging all the pillars that supported the roof. The pillar behind the driver was in contact with the headrest of the driver’s seat and protruded 17 inches into the passenger compartment over the second row of seats. The roof shifted to the extent that the first and second rows of seats extended 16 inches beyond the edge of the roof, the third row extended 15 inches, and the fourth row extended 8 inches. The distance between the top of the seat and the roof at the point of maximum crush was 5.5 inches in the first row, 6 inches in the second row, 4 inches in the third row, and 5 inches in the fourth row. Investigators compared these measurements to those for an undamaged, exemplar 1999 Dodge Ram van, which had a distance between the seatback and the roof of 22 inches in the first row, 20 inches in the second row, 18 inches in the third row, and 18.5 inches in the fourth row. The front windshield and rear door windows were found outside the van at the accident scene. The driver and passenger window glazing was missing, as was the glazing on the three passenger windows on the driver’s side and the glazing on the four passenger windows on the passenger side. Highway Information U.S. Route 82 in Texas is primarily a four-lane divided, controlled-access highway with exit and entrance ramps and a posted speed limit of 70 mph (daytime) and 65 mph (nighttime) at the accident location. The 12-foot-wide traffic lanes were divided by 4-inch wide pavement markings consisting of reflectorized painted white lines, approximately 12 Figure 11. Henrietta van roof crush.

Factual 14 Highway Accident Report feet long and spaced every 28 feet. Four-inch-square raised pavement markers (retroreflective delineators) were spaced 80 feet apart and were centered between every other painted white line. The lanes were separated from the shoulders by a 4-inch-wide white edgeline delineating the 10-foot-wide outside shoulder and a 4-inch-wide yellow edgeline delineating the 4-foot-wide inside shoulder. Each shoulder had milled rumble strips, 9 inches wide, 18 inches long, and 0.5 inch deep, spaced 6 inches apart and located 6 inches from the edge of the traffic lane. The eastbound and westbound traffic lanes were separated by a 120-foot-wide depressed earthen median at the accident location. The average annual traffic volume was 18,000 vehicles in 1998 and 1999. From 1997 to 2002, the Texas Department of Transportation reported a total of 63 accidents on U.S. Route 82 in an area 2.5 miles in either direction from the accident site. Of these accidents, 39, or 62 percent, were single-vehicle accidents. According to the Texas Department of Transportation, rumble strips were installed in 2000 and single-vehicle accidents decreased thereafter to 13 (7 of which were not run-off-road accidents), or 48 percent, in 2001 and 2002. The accident occurred near milepost 538 in the eastbound lanes of U.S. Route 82 in Clay County about 6 miles north of Henrietta. The van departed the left side of the asphaltic concrete road surface, crossed the asphalt shoulder, and rolled in the earthen median. Tire marks and pieces of tire casing were found on the roadway and shoulder leading up to the earthen median. Furrow marks and gouge marks continued in the median. Figure 12. Front of Henrietta van.

Factual 15 Highway Accident Report Operational Information The van was owned and operated by the First Assembly of God Church in Burkburnett and was used exclusively for church-sponsored activities, according to church officials, who also stated that these activities took place primarily in Texas and occasionally in Arkansas and Oklahoma. When not in use, the van was parked in an unprotected area of the church parking lot. The church did not maintain a qualification file for drivers, nor was it required to. The pastor of the church told investigators that he was not aware of the National Highway Traffic Safety Administration’s (NHTSA’s) “Consumer Advisory” on the risks of rollover crashes in 15-passenger vans, released April 9, 2001 (see NHTSA “Consumer Advisory” below for more information). He was also unaware of the additional training that NHTSA recommends for van operators. A review of available church records and receipts, as well as conversations with current and past pastors, did not indicate any systematic vehicle maintenance or preventive inspection activities. Several documents pertaining to vehicle maintenance were found in the van, including a tire owner’s manual and a document entitled Tire Inflation Pressures for 1993 Chrysler11 vans and trucks. The tire owner’s manual stated in several places the importance of maintaining proper tire inflation pressures, and both the manual and the vehicle tire information placard recommended seeking vehicle-specific information regarding inflation pressures. The tire owner’s manual made several references to checking inflation pressures at least once a month and noted the consequences of operating tires while underinflated. The Tire Inflation Pressures manual recommended checking the pressure once a month and inflating the tires to 55 psi for the front and 80 psi for the rear when the van was fully loaded. According to the vehicle’s inspection certificate, the van had last been inspected, in accordance with the Texas Department of Public Safety’s Texas Vehicle Inspection Act, on October 23, 2000. All passenger vehicles registered in Texas are required to be inspected annually at designated, approved, privately owned and operated garages and repair facilities. All facilities operate under the Rules and Regulations Manual for Official Vehicle Inspection Station issued by the Texas Department of Public Safety. Tires are observed for proper inflation (a tire gauge check is not required).12 In addition, tires are to be inspected for physical defects and rejected if any tire is found to have “tread or sidewall cracks, cuts, or snags (such as measured on the outside of the tire) in excess of one inch in any direction and deep enough to expose the body cords.”13 No inspection criteria address the sidewall and tread groove cracking that was observed during postaccident tire inspections. Since the accident, according to the pastor, the church has created a driver file and requires that drivers be 25 or more years old, have no accidents, and have no more than 11 Chrysler (now DaimlerChrysler) owned Dodge in 1993. 12 Inspection Item 04.20.28 (Tires), section I, paragraph 3. 13 Inspection Item 04.20.28 (Tires), section II.

Factual 16 Highway Accident Report two moving violations in the last 5 years. He also reported that the church now limits the occupancy of its 12-passenger van to no more than 9 passengers and has decided not to purchase another 15-passenger van. Meteorological Information The National Weather Service observatory at the Wichita Falls, Texas, Municipal Airport, about 20 miles north of the accident site, reported clear conditions, visibility of 10 miles, and a temperature of 70° Fahrenheit with variable winds of about 4 knots (4.6 mph) at 8:52 a.m. on May 8, 2001. Randleman, North Carolina Accident Narrative On July 1, 2001, about 2:30 p.m., eastern daylight time, a 1989 Dodge Ram 15- passenger van was northbound in the left lane on U.S. Route 220, near Randleman, North Carolina, en route from Myrtle Beach, South Carolina, to Roanoke, Virginia (see figure 13). The van, owned by Virginia Heights Baptist Church of Roanoke, Virginia, was occupied by the driver and 13 passengers, ages 13 to 19. As the van approached the Level Cross, North Carolina, exit, at a witness-estimated speed of 65 mph, the left rear tire experienced a tread separation and blowout; subsequently, the van moved from the left lane into the right lane, then back into the left lane, where it overturned and came to rest in the travel lanes (see figure 14). During the accident sequence, four passengers were ejected, one of whom was fatally injured and three of whom sustained serious injuries; the driver and the other nine passengers sustained injuries ranging from none to serious. According to the driver, the church youth group had gone to Myrtle Beach for 4 days. On the day of the accident, they left Myrtle Beach about 10:15 a.m. to return to Roanoke, a distance of about 310 miles. The driver said the group stopped for lunch about 12:40 p.m. and then continued the trip. The accident occurred about 187 miles from Myrtle Beach. The church music director stated that he was traveling in a Plymouth Grand Voyager with three youths in front of the accident vehicle, and most of the luggage was in the Grand Voyager, not in the accident vehicle. The accident van driver stated that he was “just driving” when he “heard a grinding noise and had to fight to keep the van from swerving.” One passenger reported saying he thought the tire was going flat. Another passenger said she heard what sounded like an explosion immediately thereafter. According to several passengers, the van began shaking and vibrating before changing lanes. Two passengers stated that they saw debris from the tire before the van began to roll over. Three witnesses traveling southbound on U.S. Route 220 reported that the left rear tire blew out before the van began to swerve. All three witnesses stated that they thought the van rolled sideways at least three times before coming to rest.

Factual 17 Highway Accident Report Figure 13. Randleman accident route.

Factual 18 Highway Accident Report Figure 14. Randleman accident scene. Grass center median Pavement edge Tire mark Northbound U.S. Route 220 Pavement edge N Van Paved shoulder Paved shoulder Gouge mark 0 10 20 30 40 50 60 Scale in feet Direction of travel Approximate path of travel Beginning of tire mark

Factual 19 Highway Accident Report Injuries Table 3. Injuries. Medical and Pathological Information One passenger, who was in seat 5 (see figure 15) before being ejected, died in the hospital 4 days after the accident. She sustained a left front parietal14 skin subdural hematoma, right temporal and parietal fractures, a diastic lambdoid15 fracture, left temporal fracture, left basilar skull fracture, left petrous16 fracture, left occipital fracture, and left orbital roof fracture. The driver and three of the ejected passengers sustained serious injuries. The driver sustained a concussion, a left clavicle fracture, and left scalp laceration. The passenger in seat 8 sustained a brain laceration, open finger wound, open lateral abdomen wound, large deep shoulder abrasion and contusion, and multiple contusions. The passenger in seat 11 sustained a T7 vertebra compression fracture, a T12 vertebra Chance fracture,17 an open occipital area laceration, and an elbow abrasion. The passenger in seat 15 sustained a basilar skull fracture; frontal bone fracture, including the left orbital roof into the anterior cranial fossa;18 left maxillary fracture; diffuse axonal injury; cerebral contusion; left lower posterior calcaneal (heel bone) fracture; left periorbital contusion; and abrasions. Eight passengers sustained minor injuries. The passenger in seat 2 sustained neck strain. The passenger in seat 3 sustained a left zygomatic contusion, left knee sprain, and knee abrasions. The passenger in seat 4 sustained left shoulder and left foot contusions. The passenger in seat 7 sustained abrasions to the right side of the face and right posterior shoulder and a small scalp laceration. The passenger in seat 9 sustained a right eye contusion and abrasions. The passenger in seat 10 sustained neck and back strains and multiple abrasions. The passenger in seat 12 sustained a right ulnar ligament sprain. The passenger in seat 13 sustained a scalp laceration. The passenger in seat 6 was uninjured. Injuries Driver Passengers Total Fatal 0 1 1 Serious 1 3 4 Minor 0 8 8 None 0 1 1 Total 1 13 14 14 The parietal bones form the roof of the skull. 15 The lambdoid is the suture between the occipital and parietal bones. 16 The petrous is the hard portion of the temporal bone that forms a protective case for the inner ear. 17 A Chance fracture is a horizontal fracture through the vertebra. 18 Front subdivision of the floor for the cranium.

Factual 20 Highway Accident Report Survival Aspects The driver was wearing the available lap/shoulder belt. The front-seat passenger said she was wearing the lap portion of the lap/shoulder belt and had the shoulder portion behind her back. All remaining seating positions were equipped with lap belts. None of the other passengers reported wearing their lap belts. Some of the restraints (seats 5, 7, 9, 11, and either 13 or 14) were missing or had buckles that were inaccessible because they were within the seat bights.19 Figure 15. Randleman seating chart. (*ejected; shading indicates fatal injury) 19 The seat bight is the point at which the lower edge of the seatback cushion and the rear edge of the seat bottom cushion meet. 1 2 3 4 5 6 7 8 9 11 12 14 15 10 13 * * * * Seat Lap/shoulder Age Belt Use Injury Fatal 1 2 3 4 5 6 8 9 11 12 13 15 26 24 27 13 13 12 14 Lap/shoulder None Minor None Inaccessible Serious None None Serious 15 19 17 17 15 Serious None None Serious 7 14 Missing 10 13 None Lap only of Minor None Minor Inaccessible Minor Minor Inaccessible Minor Inaccessible Minor Minor

Factual 21 Highway Accident Report Emergency Response The Randolph County (North Carolina) Communications Center received a 911 cellular call at 2:31 p.m. Because the accident occurred outside Randleman city limits, the North Carolina Highway Patrol had jurisdiction over the investigation. The Randleman Fire Department was the first responder on scene at 2:38 p.m. Nine fire, police, and rescue departments responded to the accident scene. Six ambulances responded to transport passengers to local hospitals. One passenger was transported by air ambulance to the University of North Carolina Memorial Hospital in Chapel Hill, North Carolina; the air ambulance departed the scene at 3:24 p.m. Driver Information The 26-year-old driver held a Virginia driver’s license valid through July 2005. A review of his driving history revealed a conviction for speeding in April 1998 and a personal injury accident in December 1998. The driver said he was familiar with the van and had about 5 years of experience driving a 15-passenger van for the church. He had driven the van on the same route about 2 weeks before the accident occurred. The driver provided a 72-hour history (see table 4). Table 4. Randleman van driver’s 72-hour history. No toxicological tests were performed on the driver because, according to law enforcement personnel on scene, they did not have reasonable suspicion that the driver was intoxicated or under the influence of an impairing substance. In North Carolina, law enforcement personnel are required to have “an articulable and reasonable suspicion” that a driver has operated a vehicle under the influence in order to request a toxicological test. Date Time Activity Sleep June 29, 2001 1:00 a.m. Went to bed 7:00 a.m. – 7:30 a.m. Awoke 6 – 6.5 hours June 30, 2001 1:00 a.m. Went to bed 7:00 a.m. Awoke 6 hours 12:20 p.m. Ate lunch 5:20 p.m. Ate dinner July 1, 2001 1:00 a.m. Went to bed 6:30 a.m. Awoke 5.5 hours 7:00 a.m. Attended church service 10:15 a.m. Departed 12:40 p.m. Ate lunch

Factual 22 Highway Accident Report Vehicle and Wreckage Information Exterior. The 1989 Dodge Ram Maxi-Wagon was designed to accommodate 15 passengers, including the driver. The vehicle had a wheelbase of 127.6 inches, an overall length of 222.8 inches, and a GVWR of 8,510 pounds. The van was equipped with a 5.9- liter fuel-injected V-8 gasoline engine and a three-speed automatic transmission; it had an odometer reading of 76,465 miles. The van was also equipped with front disc brakes and rear drum brakes. When the brakes were applied, both front wheel hubs remained locked without creep or slippage. The front brake friction surfaces were smooth with no significant wear ridges. The front left inside brake pad had worn to the fastener surface, which was in contact with the rotor surface. The friction surfaces of the rear brakes were smooth and showed slight wear ridging on the edges of the drums. The left rear shoe lining and drum friction surfaces were contaminated with axle gear case lubricant from a leaking left axle seal. Scrape marks were observed on the backing plates of both brake assemblies, consistent with brake drum contact due to axle shaft bending or flexing. Examination of the brake system revealed no hydraulic system leaks or restrictions. The brake pedal was intact and functional. The van was equipped with a hydraulic, power-assisted steering system. Rotating the steering wheel resulted in corresponding movement to the steering box sector shaft and associated steering system components. The steering wheel could be rotated from stop to stop without restriction other than resistance from the damaged column. Inspection of the suspension system revealed extensive cracking in the front antisway/stabilizer bar link bushings. Three of the four tires were the vehicle manufacturer-recommended Michelin tires. The right rear tire had been manufactured by Radial Medalist and was below the recommended load range E.20 All tread depths complied with Virginia vehicle inspection criteria. The left front tire was inflated to 62.5 psi, the right front tire to 60.5 psi, and the right rear to 60 psi. The pressure of the left rear tire prior to the blowout could not be determined. The manufacturer recommended a tire pressure of 50 psi for the front tires and 80 psi for the rear tires. A tire information placard containing this information was located on the inside of the driver’s doorsill. Both front tires and the left rear tire were more than 8 years old. The left front tire exhibited extensive circumferential sidewall and tread groove cracking. Weather checking was evident circumferentially along the outer sidewall extending from 1 inch above the rim flange, through the buttress, and into the tread area. A 5-inch long, 0.125-inch deep incision was located within the inner buttress area, as was chunking.21 Scrape marks were found along the outboard rim flange. 20 A load range E tire, the recommended tire for this vehicle, is rated at 2,680-pound capacity at 80 psi, whereas a load range D tire, found on the right rear wheel, is rated at 2,335-pound capacity at 65 psi. 21 Michelin defines “chunking” as the tearing off of small pieces of tread rubber while the tire is in service.

Factual 23 Highway Accident Report The right front tire exhibited extensive circumferential sidewall and tread groove cracking (see figure 16). Weather checking was evident along the outer sidewall from 1.75 inches above the rim into the tread area. Scrape marks were found on the rim flange. A 0.1875-inch deep radial split was found in the buttress, and a 0.625-inch long near-radial split was 0.75 inch from the rim flange. The body plies22 were exposed due to missing tire material that measured approximately 0.5 inch long, 0.1875 inch wide, and 0.1875 inch deep. The left rear tire sustained extensive damage to the inner and outer sidewalls, tread, belts, and body plies (see figure 17). The tire exhibited extensive circumferential cracking and weather checking of the sidewall. The inner and outer beads were unseated from the wheel flanges and a 0.5-inch deep circumferential groove was found in the bead area. In another location, the bead area was cut or torn, exposing the body cords. Some sidewall rubber was missing and bare body cords were exposed. Multiple radial splits had breached the inner liner. A radial split was found in the sidewall rubber, and the rubber was not attached to the body cords. Radial splits were also found in the tread and buttress. 22 Michelin defines body plies as the principal load-supporting component, usually reinforcing textile cords or steel cables encased in rubber, extending from bead to bead across the crown of the tire. Figure 16. Right front tire sidewall cracking.

Factual 24 Highway Accident Report Portions of the tread and all three steel belts were partially detached. Bare body cords were visible in the tread and buttress areas. The right rear tire exhibited circumferential scrubbing, as well as asphalt between the rim flange and the tire. Interior. The driver and front passenger bucket seats were equipped with lap/shoulder belts. The first three rows could seat three passengers each. The fourth row could seat four passengers. The center of the seatbacks in all rows bowed rearward (see figure 18) due to accident damage. The outboard armrest was missing on the first row and broken on the second row. The roof deflected upward near the center of the van, extending longitudinally the entire length of the vehicle (see figure 19). The fourth row center lap belts were configured similarly to those in the Henrietta accident van. The two center lap belt buckle webbing straps were attached to the floor with one bolt near the right seat frame pedestal base, and the two center latch plate webbing straps were attached to the floor with one bolt near the left seat frame pedestal base. Figure 17. Left rear tire.

Factual 25 Highway Accident Report Figure 18. Bowed Randleman seatbacks. Figure 19. Randleman van damage.

Factual 26 Highway Accident Report The windshield and rear left door window were missing; the windshield was found inside the vehicle. The glazing on the driver window, front passenger window, first window on the driver’s side, and all passenger side windows was missing. The glazing on the third window on the driver’s side was broken; that on the second window was intact. Highway Information U.S. Route 220 in North Carolina is primarily a four-lane divided, controlled- access highway. The posted speed limit is 65 mph. The 12-foot-wide traffic lanes were divided by 4-inch-wide pavement markings consisting of reflectorized painted white lines, approximately 12 feet long and spaced every 28 feet. The lanes were separated from the shoulders by a 4-inch-wide white edgeline, delineating the 10-foot-wide outside shoulder, and a 4-inch-wide yellow edgeline, delineating the 3-foot-wide inside shoulder. The northbound and southbound traffic lanes were separated by a 60-foot-wide depressed earthen median directly adjacent to the area where the collision occurred. In the roadway in the vicinity of the accident was an 800-foot-long, 1° left hand curve with a 0.5-percent downgrade and a 0.33° maximum superelevation. The average annual traffic volume was 22,000 vehicles in 1998, 24,000 vehicles in 1999, and 23,000 vehicles in 2000. From 1997 to October 2002, the North Carolina Department of Transportation reported a total of 10 accidents on U.S. Route 220 in an area 1 mile in either direction from the accident site. Four of the 10, including the subject accident, were single-vehicle accidents. The accident occurred near milepost 26.5 in the northbound lanes of U.S. Route 220 in Randolph County about 4 miles north of Randleman. The van left a series of tire marks in the right lane and across the left lane, followed by gouge marks on the left shoulder. As the van overturned, it returned to the travel lanes, where it came to rest. Operational Information The 15-passenger van was owned and operated by the Virginia Heights Baptist Church in Roanoke. The accident van was the only one operated by the church and, according to church officials, was used exclusively for church-sponsored activities; estimated use was once a week on a 20-mile trip. The van was typically parked in an unprotected location on church property, according to the church minister, who was not aware of NHTSA’s “Consumer Advisory,” or of NHTSA’s recommended training for van operators. The church did not maintain driver qualifications files, nor was it required to. It had submitted the names of van drivers to its insurance company, which required that the church do so and also required that all drivers be at least 21 years old. The church’s board of directors was responsible for operating and maintaining the van. If a driver found a problem with the van, he or she was to complete a form that was forwarded to the board for action. The board’s role was primarily financial rather than safety or operational oversight.

Factual 27 Highway Accident Report All motor vehicles registered in Virginia must be inspected annually at an approved, privately owned and operated garage or repair facility authorized by the Virginia Department of State Police. The van had most recently been inspected in December 2000. The Virginia inspection manual has a paragraph on inspection of vehicle tires, wheels, and rims (19VAC 30-70-130). The inspection procedures cover tread depth, cracks in wheels or rims, cut or worn tires if the fabric or steel cord is visible, and knots and bulges in the sidewalls. The manual addresses neither tire inflation pressure nor the sidewall and tread groove cracking that was found during postaccident inspection of the tire. Meteorological Information At 2:30 p.m. on the day of the accident, the National Weather Service Observatory at the Greensboro, North Carolina, Piedmont Triad International Airport, approximately 21 miles north of the accident site, reported clear conditions, visibility of 10 miles, and a temperature of 86° Fahrenheit; winds were out of the southwest at about 11 knots (12.7 mph). Tests and Research Simulation National Transportation Safety Board staff conducted simulations of the Henrietta accident to determine general occupant motion and injury mechanisms during the rollover sequence and to evaluate the benefits of restraint use. The simulation showed that the van most likely rolled over two or more times and that the outboard occupants had greater potential for ejection due to their proximity to the windows. The simulation predicted that unbelted occupants were more prone to ejection and received more serious injuries than the belted occupants. A more detailed description of the simulations follows. Vehicle Dynamics Simulation. The purpose of the vehicle dynamics simulation was to determine, based upon available physical evidence, the driver inputs before and after loss of control of the vehicle. Definitive physical evidence was not available to indicate the number of vehicle overturns or the contact points between the vehicle and the ground. Using Engineering Dynamics Corporation’s Vehicle Simulation Model (EDVSM) software, Safety Board staff assessed several potential overturn scenarios. To perform the simulation, the accident scene was modeled23 using three- dimensional mapping data obtained on scene. The vehicle was modeled using 23 The scene was built with AutoCAD Land Development Desktop release 2i.

Factual 28 Highway Accident Report measurements obtained from the accident van and an exemplar van,24 as well as data from the Human Vehicle Environment (HVE) software. The results of the vehicle dynamics simulation indicated that the initial speed of the van before the tire blowout was 67 mph. After the blowout, steering input to the right and then back to the left was required to match the physical evidence on the roadway. The steering toward the left and the resulting yaw would have caused the vehicle to depart the roadway at an angle of approximately 100° counterclockwise to the initial direction of travel prior to the tire failure. Simulations of the overturn sequence indicated that the vehicle completed at least two rolls before reaching final rest. For a depiction of the van at various stages of the overturn, see figure 20. 24 A 1990 Dodge Ram 350. Figure 20. Potential path of the van during the overturn; the time is based on the begin- ning of the rollover.

Factual 29 Highway Accident Report Several crash pulses25 were developed to evaluate the rollover dynamics and occupant motion. Three of the scenarios involved the vehicle overturning twice (720°).26 The fourth scenario involved the vehicle overturning three times before reaching final rest (1,080°). The simulation results were consistent with the location of the van when it first struck the ground and after it came to rest and with the damage it sustained. Occupant Kinematics Simulation. Based on the results of the vehicle dynamics simulation, occupant kinematics were modeled using the Graphical Articulated Total Body27 software program. This program calculates the unrestricted motion of a simulated occupant and the resulting forces due to occupant interaction with contact surfaces, such as the seats, roof, sidewalls, and windows. The 10 passengers seated in the rear of the van were simulated (seats 3, 4, 5, 6, 8, 9, 11, 12, 14, and 15). Because the program can simulate a maximum of four occupants at a time, each row was simulated separately and interactions between occupants in different rows were not simulated. The initial occupant kinematics simulation was based on the crash pulse generated from the original EDVSM physics module. Occupants were simulated in three conditions: actual,28 all restrained by lap belts, and all restrained by lap/shoulder belts. When the enhanced EDVSM program became available, the occupant kinematics simulations were again conducted based on the three additional crash pulses. For these three crash pulses, only the unrestrained condition was simulated in an effort to understand the effects of changes in crash pulse on occupant kinematics during rollovers. Because the restraints in the initial simulation maintained the occupants within the vehicle, similar beneficial results were assumed for the three additional pulses. In the actual restraint condition, the occupant kinematics based on the original crash pulse were evaluated for the full overturn sequence. Due to limitations in modeling the restraint systems for multiple overturns, the belted conditions were only evaluated during the first overturn and then compared to the results of the first overturn in the actual restraint condition. Similarly, only the first overturn was evaluated for the three additional crash pulses. The occupant kinematics were similar among all four crash pulses. The main difference between the runs was the roll rate of the van, which affected the distance the 25 Crash pulse is the vehicles’ change in acceleration over time. 26 Based on this simulation work and correspondence with the developers of HVE, enhancements were made to the EDVSM physics software module. Safety Board staff then reran the simulations to better understand how these enhancements would affect the rollover dynamics when the tire struck the ground at an angle parallel to the ground. The first simulation, involving two rollovers, was run using the original EDVSM physics module, while the other three simulations were run using the enhanced EDVSM physics module. 27 W.D. Grimes, “Using ATB Under the HVE Environment,” SAE 970967 (Warrendale, PA: Society of Automotive Engineers, 1997). 28 In the accident, all passengers were unrestrained except the passenger in seat 11, who was restrained by the available lap belt.

Factual 30 Highway Accident Report occupants traveled inside the van during each segment of the overturn. The series of still images in appendix B shows the path of motion for the simulated occupants in each crash pulse. Occupants in the original simulation (run one) traveled farther toward the right side of the van as the vehicle initially began to roll toward its right side. Occupants in runs three and four experienced the least travel toward the right side of the van. In all runs, occupants seated in the van’s outboard positions were more likely to be ejected as the vehicle overturned because of their proximity to the windows. These simulations revealed the potential for head, neck, and chest injuries in the actual restraint condition; one chest injury in the lap-belted condition; and no injuries in the lap/shoulder-belted condition. These results must be considered in the context that only the first overturn was simulated for the restrained conditions and intrusion was not modeled. In the actual restraint condition, simulated occupants were potentially ejected at various points during the overturn sequence. Some were predicted to be ejected during the first overturn as the van rotated from the roof onto its left side. Ejection was not predicted for others until the second overturn sequence, when the right side struck the ground. For others, ejection was not predicted until the end of the second overturn sequence. In both the lap- and lap/shoulder-belted conditions, the simulation did not predict full ejection for the passengers; the belts provided an additional level of protection that was not fully reflected in the predicted injury levels. Independent Tire Examination Standards Testing Laboratories, Inc., (STL)29 examined the failed left rear tires of both vehicles on October 24, 2001. STL staff concluded that the Henrietta tire was: …9 years old, [and] exhibits severe heat/UV aging. Evidence of run low, generating severe heat buildup causing belt/tread separation, sidewall splits and rapid air loss. STL staff concluded that the Randleman tire was: …heat/ozone/time aged. Tire exhibits prolonged run low evidence which caused excessive heat/stress resulting in belt tread separation and resulting sidewall splits and rapid air out. Dynamic Vehicle Handling Tests Tests. On November 14, 2001, STL staff and Safety Board investigators conducted a series of dynamic vehicle stability and handling tests on a 1990 Dodge Ram 350 15-passenger van at the Transportation Research Center in East Liberty, Ohio. The tests focused on the handling characteristics of a 15-passenger van in circumstances similar to those of the Henrietta accident. The test vehicle had the same dimensions as the Henrietta accident van. Safety Board investigators installed an accelerometer and monitored road speed using radar equipment. In all seven tests, the van was ballasted with 29 STL’s TransTech Division, which conducted the testing, is an independent research and testing facility specializing in product performance needs of the transportation industry.

Factual 31 Highway Accident Report sandbags to correlate with the known occupant weights and seating positions in the Henrietta accident. Measurements of the exemplar van showed that loading the van moved the center of gravity approximately 11 inches rearward, placing it about 10 inches behind of the centerline of the wheelbase. The professional driver was experienced in driving during tire blowouts. STL and Michelin determined that braking after the blowout would be dangerous, and the driver stated that he would be uncomfortable conducting the tests if he were required to brake. Table 5 summarizes the test scenarios. Table 5. Dynamic testing scenarios. *Factory-recommended. **Henrietta accident van. *The course was based on International Standards Organization standard 3888-1. For the rapid air loss scenarios, the left rear tire (was the same tire that blew out in the Henrietta accident) was prepared with a driver-controlled explosive charge to simulate a blowout. For the tread/belt detachment, the left rear tire was prepared to facilitate a tread/belt separation near 75 mph. The driver was instructed to trigger the blowout when he heard the tread and belt begin to detach. Results. Safety Board investigators determined the maximum lateral acceleration and peak speed attained during the testing. Table 6 shows these values. Test Tire pressure Test scenario Driver instruction 1a 55 psi front and 80 psi rear * 50 mph, double lane change* 1b 60 psi front and 58 psi rear ** 50 mph, double lane change 2 60 psi front and 58 psi rear 40 mph, rapid air loss 3 60 psi front and 58 psi rear 75 mph, rapid air loss and tread/belt detachment Maintain speed after blowout (the driver was unable to accelerate because the accelerator was already fully depressed to maintain 75 mph) 4 55 psi front and 80 psi rear 75 mph, rapid air loss and tread/belt detachment Maintain speed after blowout 5 55 psi front and 80 psi rear 75 mph, rapid air loss and tread/belt detachment Decelerate by removing foot from accelerator, no braking 6 60 psi front and 58 psi rear 75 mph, rapid air loss and tread/belt detachment Decelerate by removing foot from accelerator, no braking

Factual 32 Highway Accident Report Table 6. Peak lateral forces and speed for each test. One G equals 32.2 feet per second squared (9.8 meters per second squared). The professional driver stated that he did not have a problem controlling the van when executing either lane change maneuver during testing; he commented that the van seemed to “wallow” (behave in an ungainly manner) during the lane change maneuver when the tire pressures were low. During test 2, the blowout at 40 mph, the driver rated his ability to control the vehicle after the blowout as a 9 on a scale of 1 (completely out of control) to 10 (completely in control). During test 3 at 75 mph with underinflated tires, the van did not stay in its lane after the blowout, initially veering left until the driver countered by steering to the right. Safety Board staff observed side-to-side motion of the van body after the tire failure. The driver stated that “the rear of the van became loose” and said the key issue was not to oversteer, since any steering input was magnified. On a controllability scale of 1 to 10, the driver rated this test as a 5. In test 4, with the tires inflated to the recommended pressures, the van veered to the left before the driver could counter by steering to the right, but the driver was able to maintain the van within its lane. The driver stated that the handling was better than during the previous test, but the vehicle remained sensitive to steering input, and tire pressure was a “significant” factor during the tests. The driver rated this run as a 7 for controllability. In tests 5 and 6, the van also veered left initially, but the driver was able to take corrective action and maintain the lane. He stated that tests 5 and 6 were comparable to the previous tests, except that the van pulled more toward the left when he took his foot off the gas. The driver said he preferred to keep his foot on the gas, but was comfortable taking it off, even though the vehicle tended to go left. Overall, the driver stated that steering input was key and that “any time you add steering, you lose some control.” Other Information Federal Regulations Federal Motor Vehicle Safety Standards (FMVSSs) (49 CFR 571.3) define bus as a motor vehicle designed to carry more than 10 passengers. Based on this definition, a 12- or 15-passenger van is a bus and has to meet the FMVSSs applicable to buses. Test number Lateral acceleration left (G’s) Lateral acceleration right (G’s) Peak speed (mph) 1a 0.49 0.44 51.67 1b 0.38 0.55 51.73 2 0.03 0.18 41.80 3 0.30 0.26 71.29 4 0.20 0.23 73.08 5 0.17 0.25 75.18 6 0.09 0.21 74.88

Factual 33 Highway Accident Report Some FMVSSs apply only to vehicles with a GVWR less than 8,500 pounds and thus do not apply to 15-passenger vans, which have a GVWR exceeding that criterion. Federal Motor Vehicle Safety Standard (FMVSS) 201, Section 6, “Requirements for Upper Interior Components,” specifically excludes buses with a GVWR greater than 8,500 pounds. FMVSS 216, “Roof Crush Resistance” does not apply to buses with a GVWR greater than 6,000 pounds. All these sections apply to passenger cars. Title 49 CFR Part 390.5 defines a commercial motor vehicle as any self-propelled vehicle used on a highway in interstate commerce to transport passengers when the vehicle is designed or used to transport more than 8 passengers, including the driver, for compensation or is designed or used to transport more than 15 passengers, including the driver, and is not used to transport passengers for compensation. If a motor carrier operates a commercial motor vehicle designed or used to transport 9 to 15 passengers, including the driver, for compensation, the carrier must file a motor carrier identification report, mark its vehicles with a U.S. Department of Transportation identification number, and maintain an accident registry. NHTSA “Consumer Advisory” On April 9, 2001, and again on April 15, 2002, NHTSA issued a “Consumer Advisory” warning the public that “research has shown that 15-passenger vans have a rollover risk that increases dramatically as the number of occupants increases from fewer than five to more than ten.” The rollover rate for vans loaded with more than 10 passengers is three times greater than that for a van loaded with fewer than 10 passengers. NHTSA recommended that 15-passenger vans be operated by trained, experienced drivers familiar with the handling of such vehicles and that all passengers wear seat belts at all times. According to the NHTSA contact listed on the advisory, the advisory was issued to NHTSA news media contacts, newsletter subscribers, and about 40 to 50 umbrella groups30 that typically use these vehicles. The advisory was also posted on the NHTSA website (www.nhtsa.dot.gov). The advisory is not listed on NHTSA’s home page and can only be found by conducting a search for it. Seat Belt Laws Texas law requires that every person sitting in the front seat of a passenger vehicle wear a seat belt. “Passenger vehicle” includes passenger cars, light trucks, sport utility vehicles, trucks, and truck tractors. It does not include 15-passenger vans. In North Carolina, all drivers and front-seat passengers ages 16 and older must have a seat belt properly fastened about their bodies at all times when the vehicle is on a street or highway. Children under 16 must use age-appropriate child restraints or wear seat belts in all seating positions of any vehicle (including 15-passenger vans) required by Federal law to be equipped with seat belts. 30 Religious groups, Boy Scouts, Girl Scouts, senior centers, and so forth.

Factual 34 Highway Accident Report State Vehicle Safety Inspections Currently, 18 States31 and the District of Columbia conduct annual or biannual vehicle safety inspections of passenger vehicles. The States generally base their inspection criteria on guidelines found in the Passenger Vehicle and Light Truck Inspection Handbook published by the American Association of Motor Vehicle Administrators (AAMVA). The handbook sets forth recommended procedures for conducting safety inspections of vehicles weighing less than 10,000 pounds GVWR. In the chapter on tires, the AAMVA handbook recommends that inspectors measure tire pressure; check for tire condition and wear, including cuts, snags, or cracks that exceed 1 inch and are deep enough to expose cords or visible bumps, bulges or knots; measure tread depth; and inspect for tire size or type mismatching. Previous Recommendations The Safety Board has investigated several accidents and addressed the issue of passenger vehicle safety in previous reports. Below is a summary of the safety recommendations that have been issued as a result of these reports and their status. On September 20, 1996, the Safety Board adopted a safety study on The Performance and Use of Child Restraint Systems, Seat Belts, and Air Bags for Children in Passenger Vehicles (NTSB/SS-96/01). In that report, the Safety Board concluded that occupants seated in the center rear seat position should be afforded the same level of protection as other occupants of the back seat, who had lap/shoulder belts available to them since January 1, 1990. The Safety Board recommended that NHTSA: Require installation of center rear lap/shoulder belts in all newly manufactured passenger vehicles for sale in the United States. (H-96-28) NHTSA replied on August 27, 2002, that it had initiated rulemaking for lap/shoulder belts for nonoutboard seats and expected to publish a proposal to require these belts by late summer 2003. The Safety Board classified the recommendation “Open—Acceptable Response” on February 5, 2003. As a result of the same study, the Safety Board urged automobile manufacturers to: Voluntarily install center rear lap/shoulder belts in all newly manufactured passenger vehicles for sale in the United States. (H-96-33) Ford Motor Company (Ford) responded on February 3, 1999, that nearly half of the 1998 model year vehicles were equipped with rear lap/shoulder belts and they planned to expand installation to newly designed passenger vehicles and light trucks. The Safety Board classified the recommendation “Closed—Acceptable Action” on May 11, 1999. General Motors Corporation (GM) responded to this recommendation on November 20, 2002, stating that it currently offers center rear lap/shoulder belts on 60 percent of its 31 Delaware, Hawaii, Louisiana, Maine, Massachusetts, Mississippi, Missouri, New Hampshire, New Jersey, New York, North Carolina, Pennsylvania, Rhode Island, Texas, Utah, Vermont, Virginia, and West Virginia.

Factual 35 Highway Accident Report vehicles and would install them on the balance of the fleet by 2007. The Safety Board classified the recommendation to GM “Closed—Acceptable Action” on February 27,

1. DaimlerChrysler responded to this recommendation on June 21, 1999, stating that

all passenger cars would be equipped with center lap/shoulder belts by 2002 and that light truck vehicles (including sport utility vehicles, pick-up trucks, and vans) would be equipped with center lap/shoulder belts as they are redesigned over the next several years. The Safety Board classified the recommendation to DaimlerChrysler “Closed— Acceptable Action” on October 27, 1999. On March 17 to 20, 1997, the Safety Board convened a public hearing to discuss concerns related to the effectiveness of air bags, passenger vulnerability to injuries from air bag deployment, other countries’ experience with air bags, and ways to increase seat belt and child restraint use. As a result of issues identified in the hearing, the Safety Board recommended that the States, the U.S. territories, and the District of Columbia: Enact legislation that provides for primary enforcement of mandatory seat belt use laws, including provisions such as the imposition of driver license penalty points and appropriate fines. Existing legal provisions that insulate people from the financial consequences of not wearing a seat belt should be repealed. (H-97-2) The intent of the recommendation is that seat belt laws should apply to all motor vehicle occupants, not just those in the front seat. The recommendation was classified “Open—Acceptable Response” for Texas on December 30, 2002, since Texas has a primary enforcement law, although it only requires those in the front seat to be restrained. The Safety Board has not received a written response from North Carolina, but is aware North Carolina has a primary enforcement law that only requires those in the front seat to be restrained. In 1998 and 1999, the Safety Board investigated four accidents involving vehicles used to transport children to or from school that were not built to school bus occupant protection standards. Three of these accidents involved 15-passenger vans. The Safety Board adopted a report and issued recommendations in 1999.32 Most of the recommendations pertained to the transportation of children to or from school or school- related activities, including day care and Head Start. The Safety Board recommended that the States, U.S. Territories, and the District of Columbia: Review your State and local laws and, if applicable, revise to eliminate any exclusions or exemptions pertaining to the use of age appropriate restraints in all seat belt-equipped vehicles carrying more than 10 passengers (buses) and transporting school children. (H-99-23) The Safety Board sent a letter to the Governor of North Carolina on November 16, 2000, requesting action on this recommendation, since at the time North Carolina exempted vehicles carrying more than 10 passengers from child restraint laws. In that same letter, the Board classified this recommendation “Open—Await Response.” North 32 National Transportation Safety Board, Pupil Transportation in Vehicles Not Meeting Federal School Bus Standards, Special Investigation Report NTSB/SIR-99/02 (Washington, DC: NTSB, 1999).

Factual 36 Highway Accident Report Carolina now requires that all passengers under the age of 16 be properly secured in a child passenger seat or a seat belt in any vehicle required by Federal law to be equipped with seat belts. The Safety Board also recommended that various associations and churches: Inform their members about the circumstances of the accidents discussed in this special investigation report and urge that they use school buses or buses having equivalent occupant protection to school buses to transport children. (H-99-25) The Safety Board has not received a response from the Southern Baptist Convention, of which Virginia Heights Baptist Church is a member. The First Assembly of God church in Burkburnett was not a member of a national organization. The Safety Board received few responses to this recommendation, and on March 11, 2003, prepared an article about the circumstances of these accidents, urging the use of school buses or the equivalent to transport children; the Board asked that the associations and churches distribute the article in their newsletters or by other means of communication. In 2002, the Safety Board issued a safety report, Evaluation of the Rollover Propensity of Fifteen Passenger Vans (NTSB/SR-02/03), based on rollover accidents the Safety Board had investigated to date and fatality data involving 15-passenger vans. In it, the Safety Board recommended that NHTSA: Include 15-passenger vans in the National Highway Traffic Safety Administration dynamic testing program. The dynamic testing should test the performance of 15-passenger vans under various load conditions. (H-02-26) Extend the New Car Assessment Program rollover resistance program to 15- passenger vans, especially for various load conditions, and use the dynamic testing results of 15-passenger vans, as described in Safety Recommendation H- 02-26, to supplement the static measures of stability in the New Car Assessment Program rollover resistance program. (H-02-27) Evaluate, in conjunction with the manufacturers of 15-passenger vans, and test, as appropriate, the potential of technological systems, particularly electronic stability control systems, to assist drivers in maintaining control of 15-passenger vans. (H- 02-28) The Safety Board received a response from NHTSA on December 23, 2002, stating that the agency will consider how best to accomplish these recommendations. While the New Car Assessment Program (NCAP) rating system remains under review, NHTSA indicated that it cannot state whether 15-passenger vans will be part of this testing and rating system. The Safety Board classified these recommendations “Open— Acceptable Response” on June 30, 2003. The Safety Board issued a companion recommendation to Ford and GM (H- 02-29). Dodge no longer manufactures 15-passenger vans effective model year 2002. Ford responded on February 21, 2003, that it is researching electronic stability systems on various Ford products and evaluating the feasibility of adapting the technology for

Factual 37 Highway Accident Report different vehicle lines. The Safety Board classified the recommendation to Ford “Open— Acceptable Response” on June 30, 2003. GM responded on February 14, 2003, that it will implement an electronic stability system, called a Vehicle Stability Enhancement System, in the near future for its 15-passenger vans. Because GM had evaluated the potential of Vehicle Stability Enhancement System before the Board issued its recommendation, the Safety Board classified Safety Recommendation H-02-29 to GM “Closed— Reconsidered” on May 6, 2003.

38 Highway Accident Report Analysis Accident Discussion In both the Henrietta and Randleman accidents, a tire blowout precipitated the events leading to the rollover. The Safety Board, which addressed the propensity of 15- passenger vans to roll over in its 2002 safety report, Evaluation of the Rollover Propensity of Fifteen Passenger Vans, found that 15-passenger vans with 10 or more occupants had a rollover ratio33 of 85 percent compared with a ratio of 28.3 percent for vans with fewer than 5 occupants. In other words, 15-passenger vans that were loaded with 10 or more occupants were three times more likely to roll over in single-vehicle accidents than lightly loaded vans. NHTSA conducted simulations of the effects that loading can have on the handling of 15-passenger vans and concluded that the computer simulations illustrated the adverse effects that a fully loaded passenger van can have on its handling properties.34 Manufacturers of electronic stability control systems maintain that the systems will activate in a blowout situation. Given the extreme nature of the Henrietta and Randleman accidents and the drivers’ steering and braking reactions to the blowouts, the Safety Board cannot definitively state that an electronic stability control system would have prevented the accidents. Nonetheless, such a system would probably have provided the drivers with greater opportunity to regain control of their vehicles. Because the Safety Board has already considered and made recommendations on dynamic rollover testing and electronic stability control for 15-passenger vans, the rollover propensity of these vehicles will not be the subject of further discussion in this analysis. The issues identified as a result of the Henrietta and Randleman accident investigations are similar. Throughout the report, the vehicles discussed are 15-passenger vans; the same issues also apply to 12-passenger vans. Following a discussion of each accident scenario, the analysis will present issues related to vehicle classification, driver training, occupant protection, and tire condition, inspection, and maintenance, which are relevant to both accidents. Henrietta, Texas The failure of the left rear tire initiated the Henrietta accident sequence. The tire experienced a separation of the tread and belt and rapid air loss, causing a change in the vehicle’s handling characteristics. The failed tire created more rolling resistance on the roadway than the other tires did, and the driver would have felt the van begin to rotate counterclockwise. When a driver feels his or her vehicle start to rotate, the instinctual 33 Rollover ratio is the number of single-vehicle rollover accidents divided by the number of all single- vehicle accidents. 34 W.R. Garrott, B. Rhea, R. Subramanian, and G.J. Heydinger, The Rollover Propensity of Fifteen- Passenger Vans, Research Note (Washington, DC: NHTSA, April 2001).

Analysis 39 Highway Accident Report reaction is to turn the vehicle in the opposite direction to stop the rotation and then to brake. Physical evidence and witness statements indicate that the Henrietta driver did try to correct the van’s orientation by steering toward the right and braking. Application of the brakes would have increased the lateral force created by the left rear tire, requiring more driver input. Physical evidence indicated that as greater steering force was applied, the van started rotating toward the right. In an effort to correct the clockwise rotation, the driver probably steered left; that input, coupled with the drag of the left rear tire, would have caused further vehicle instability as the van rotated back toward the left. The van departed the roadway, rolling over twice toward the right, and seven passengers were ejected during the rollover sequence. Compensatory steering and braking are natural driver reactions when a vehicle begins to lose control. In an automobile, the effects of such steering and braking are not necessarily disabling, but because a loaded 15-passenger van has a high, rearward center of gravity, driver input is magnified and quickly leads to instability. During the dynamic stability testing with underinflated tires, the test driver reported that he experienced reduced steering control following the blowout. Neither the highway design, nor pavement conditions, nor the weather contributed to the Henrietta accident. The driver had not used alcohol or other performance-degrading drugs before the accident, and she had no known health problems that would have affected her ability to drive a vehicle. The driver had obtained sufficient rest in the 72 hours prior to the accident. On the day of the accident, she did get at least 2.5 hours less sleep than on the previous 2 days, and small reductions in sleep (as little as 2 hours) can result in measurable changes in vigilance.35 However, the circumstances of the accident do not indicate that the driver’s performance was degraded due to lack of sleep nor do they suggest that she was less than vigilant in her driving behavior and reaction to the tire blowout. The emergency response to the accident was timely and adequate. Randleman, North Carolina The failure of the left rear tire also initiated the Randleman accident sequence. Again, the tire experienced separation of the tread and belt and rapid air loss, causing a change in the vehicle’s handling characteristics. The failed tire created more rolling resistance on the roadway than the other tires did, and the driver, as in the case of the Henrietta accident, would have felt the van rotating counterclockwise. The van was in the left lane when the tire blew out. Physical evidence indicated that the driver quite likely steered to the right to counteract the counterclockwise rotation, causing the van to move into the right lane. The driver then probably overcorrected back to the left and possibly applied the brakes as the van returned to the left lane in an arc and toward the median, hitting the shoulder. At this point, the driver may have steered back to the right to return to the roadway, when the van rotated clockwise and then overturned toward the driver’s side. 35 R.T. Wilkinson, R.S. Edwards, and E. Haines, “Performance Following a Night of Reduced Sleep,” Psychonomic Science Vol. 5 (1966): 471-472.

Analysis 40 Highway Accident Report Neither the highway design, nor pavement conditions, nor the weather contributed to the accident. Law enforcement personnel on scene stated that they did not believe that the van driver was under the influence of alcohol or other drugs, and they did not request a test of the driver for these substances. Although a toxicology test was not available, the driver’s performance during the accident and his behavior afterward do not indicate that he was under the influence of alcohol or other drugs. The driver stated that he did not have any chronic medical conditions. While the driver had only obtained an average of 6 hours of sleep per night in the previous 72 hours, he was not necessarily sleep-deprived at the time of the accident. The average sleep requirement is about 7.5 to 8 hours per night; given the variability and individual differences in sleep needs, 6 hours of uninterrupted sleep may have been sufficient for this driver. Furthermore, the driver’s performance and reaction to the tire blowout do not indicate that he was operating in a fatigued state. The emergency response in this accident was timely and adequate. The Safety Board concludes that following the tire blowouts, both accident drivers instinctively, but inappropriately, applied the brakes and oversteered in an attempt to regain control of their vans; however, these actions led to further vehicle instability, resulting in loss of control and subsequent rollover. The Safety Board further concludes that there is no evidence of alcohol use, other drug use, or fatigue on the part of either driver. Weather and roadway conditions did not contribute to the Henrietta and Randleman accidents, and the emergency response to both was adequate. Vehicle Classification According to NHTSA’s FMVSSs, 12- and 15- passenger vans, which can carry more than 10 passengers, are buses and therefore not required to meet the same safety and occupant protection requirements as passenger vehicles. Yet these vans are built neither to the standards for school buses nor to the industry standards for motorcoaches. Moreover, vans are often used in the same manner as passenger vehicles, even though they have different safety requirements and are required to meet different safety standards in some areas. Vans have a higher center of gravity and can accommodate more occupants than passenger vehicles, but are currently held to less stringent occupant protection and roof crush requirements than passenger vehicles (see occupant protection section below). Even though these vans are used in a manner similar to passenger cars, the occupants are not afforded the same level of safety as those occupants riding in passenger cars. Although NHTSA classifies 12- and 15-passenger vans as buses, the Federal Motor Carrier Safety Administration (FMCSA) considers them commercial vehicles only if they are used for compensation, in which case a van designed to carry 8 or more passengers is considered a commercial vehicle. Therefore, any individual who has a driver’s license and is not operating the vehicle for compensation can operate a 12- or 15- passenger van without additional training, despite NHTSA’s statement in its consumer advisory that they have different operating characteristics from passenger cars. Because the vans in the Henrietta and Randleman accidents were not used for compensation, the FMCSA did not consider them commercial vehicles; therefore, the operators were not

Analysis 41 Highway Accident Report required to have a commercial driver’s license. The FMCSA regards 12- and 15-passenger vans as commercial vehicles based solely on their intended use (for compensation), not on their handling characteristics. Yet the van’s handling characteristics are the same, regardless of whether the driver is being paid. These vans are the only type of vehicle that may or may not be classified as commercial, depending on use; all other vehicles, such as trucks over 26,000 pounds or buses carrying more than 15 passengers, are always defined as commercial vehicles. Despite NHTSA’s consumer advisory, the general public may not be aware that 12- and 15-passenger vans, which are not sold or used differently from passenger vehicles, have unique operating characteristics. Church officials in the Henrietta and Randleman accidents did not know that the vans differed from passenger cars in any way except size, even though the accident vans were not required to meet the same safety standards as passenger vehicles. Additionally, the vans may or may not be defined as commercial vehicles, depending on their use, leading to further confusion on the part of the public and a lack of consistent requirements for training and licensure. The Safety Board concludes that NHTSA’s and the FMCSA’s inadequate and inconsistent vehicle classification of 12- and 15-passenger vans leaves a gap that adversely affects regulations pertaining to the manufacture and safe operation of these vehicles. The Safety Board believes that NHTSA and the FMCSA should revise their definitions of buses and commercial motor vehicles to apply consistently to 12- and 15- passenger vans, taking into account the unique operating characteristics and multiple functions of these vans. Training NHTSA’s study on The Rollover Propensity of Fifteen-passenger Vans demonstrated that 15-passenger vans are inherently unstable when loaded to the level for which they are designed—carrying more than 10 passengers. NHTSA therefore advises all van drivers to obtain specific training on the handling and operation of these vehicles. However, as investigators found during the Henrietta and Randleman accident investigations, the van owners were not aware of the information provided by NHTSA in its consumer advisory. The advisory has not reached all 15-passenger van operators, even those within the target group, such as churches, and the Henrietta and Randleman operators did not know that they should have specific training to operate the vans safely. Both accident drivers had experience operating 15-passenger vans, but no specialized training on the handling and driving characteristics of these vehicles; neither driver was able to control the van in an emergency. As shown in testing, the van was controllable during an anticipated blowout, and the test driver thought that the effort required to control the vehicle was within the range of an unimpaired driver. However, even the professional test driver was unable to maintain the lane of travel in test 3 when the tires were inflated below the manufacturer’s recommended inflation pressures, which were similar to those in the Henrietta accident;

Analysis 42 Highway Accident Report the van swayed from side to side as the test driver brought it under control. The professional test driver also stated that the van was more difficult to control at higher speeds, particularly with lower tire inflation pressures, and that steering inputs were magnified after the blowout. The test driver had experience operating unloaded 15- passenger vans during a blowout, and he triggered the tire blowout himself, so the situation was not unexpected, as it was during the accidents. Further, an experiment on driver reaction to tread separation that was conducted in the National Advanced Driving Simulator found that findings from test track studies in which test drivers were aware of an imminent tread separation may underestimate the extent to which tread separation occurring in the real world leads to instability and loss of vehicle control.36 Thus, even though the test van was configured similarly to the Henrietta van, the test did not replicate either accident in the critical area of operator behavior. While both accident drivers were familiar with their respective vans and had driven them previously, investigators did not find evidence that either driver had experienced an emergency situation, such as tire failure, while operating the van. Both drivers are likely to have overcorrected and braked following the blowout because they did not know how to respond appropriately to the vehicle dynamics that occurred after the blowout and did not understand the potential instability problems associated with 15- passenger vans. The drivers are likely to have reacted instinctively by attempting to correct the rotation of the van while braking to slow it. Had the two drivers maintained their speed, not applied the brakes, and exerted more controlled steering, as the professional driver did during the tests, they may have been able to control their vans. Braking, the likely response on the part of both drivers, can lead to further vehicle instability during a tire failure, particularly in a fully loaded 15-passenger van with a high, rearward center of gravity. The drivers’ lack of training on their vehicles’ operating and handling characteristics, particularly in emergency situations, put them at a disadvantage in reacting to the blowout. As the National Safety Council, the American Automobile Association, and most driver education programs recognize, acceleration is the appropriate response to a blowout, but that response is counterintuitive to the general public. Therefore, such groups emphasize that drivers need to refrain from braking and to decelerate slowly in the event of a tire blowout. This strategy requires that the driver provide steering input to counteract the lateral dragging force created by the blown tire. If a driver brakes, the lateral steering force experienced by the vehicle is greater and the driver must provide more steering input to maintain control of the vehicle. If the driver provides too much steering input, he or she will have to try to correct the direction of the vehicle and may oversteer. When the vehicle has a high, rearward center of gravity, as a loaded 15-passenger van does, the rapid changes in steering direction can lead to instability and rollover. A similar driver reaction 36 T.A. Ranney, G. Heydinger, G. Watson, K Salaani, E.N. Mazzae, and P. Grygier, Investigation of Driver Reactions to Tread Separation Scenarios in the National Advanced Driving Simulator (NADS), DOT HS 809 523 (Washington, DC: National Highway Traffic Safety Administration, 2002).

Analysis 43 Highway Accident Report to a blowout in a passenger car is unlikely to have such severe consequences because the passenger car’s lower center of gravity makes it more forgiving of inappropriate driver inputs. Impressing upon 15-passenger van drivers the inherent dangers of operating these vehicles, particularly when fully loaded, and educating them about proper handling and control, particularly during emergency situations, can reduce the risk of rollover. Such training can also help dispel the expectation that these vans operate like large passenger cars. While the accident drivers had experience operating the vans, they did not have experience with how the vehicles would respond in this type of emergency situation or other emergency situations or the consequences of their instinctive reactions to such situations. Educating drivers on how such vehicles respond to, and on the consequences of, different driver input could help operators approach 15-passenger van driving more cautiously. In addition, training would provide a forum for educating drivers about the tire pressures and maintenance required for 15-passenger vans. The rear tires on a fully loaded van, for instance, must be inflated to 80 psi, which is much higher than the rear tire pressure for most passenger cars. Stressing the importance of proper tire inflation during training will help drivers avoid potential problems. Drivers should also be taught to check the tires and tire pressure before driving the vehicle. In both these accidents, the tires were in very poor condition, which should have been readily apparent to someone who knew to look for cracks and rotting rubber. Although NHTSA recommends that 15-passenger van drivers be trained to operate the vehicles, the agency does not provide information on the source of such training. The National Safety Council offers computer-based training, “Coaching the Van Driver,” and many colleges and universities use this program to train their employees who drive vans. But this course does not educate drivers about emergency handling of the vans, nor does it discuss tire pressure and maintenance. To ensure that drivers have the necessary skills to operate vehicles other than passenger vehicles, States have established classes of driver’s licenses, for example, a commercial driver’s license, a motorcycle license, or a chauffeur’s endorsement, that require specialized training and testing. No such class of license exists for 15-passenger vans. Yet, as NHTSA has acknowledged, 15-passenger van operators need training in the handling of those vehicles, and testing has demonstrated that controlling 15-passenger vans in a blowout is possible, albeit difficult, for a trained driver. The Safety Board concludes that safe operation of 15-passenger vans requires a knowledge and skill level different from and above that for passenger vehicles, particularly when the vans are fully loaded or drivers experience an emergency situation. Therefore, the Safety Board believes that the American Driver and Traffic Safety Education Association,37 in conjunction with NHTSA, the National Safety Council, the American Automobile Association, GM, and Ford, should develop a training program that incorporates the skills required for safe 37 The American Driver and Traffic Safety Education Association establishes and publishes policies and guidelines for traffic safety education.

Analysis 44 Highway Accident Report operation of 12- and 15-passenger vans and addresses the consequences of unsafe operation, including, but not limited to, operating in a fully loaded condition, emergency braking, high-speed lane changes, tire blowouts, and tire pressure and maintenance. The Safety Board further believes that the States and the District of Columbia should establish a driver’s license endorsement for 12- and 15-passenger vans that adopts the standards established by the American Driver and Traffic Safety Education Association; to obtain the endorsement, drivers should have to complete a training program on the operation of 12- and 15-passenger vans and pass a written and skills test. While training will help 15-passenger van drivers understand the vehicles’ unique handling and operating characteristics, it will not prevent all accidents involving such vehicles. The Safety Board realizes that tire blowouts require split-second, instinctual reactions that are not easily trained. For this reason, the Safety Board has recommended that 15-passenger vans be equipped with electronic stability control systems to assist drivers in maintaining control of the vehicle during emergencies (Safety Recommendations H-02-28 and -29). Occupant Protection Research into rollover crashes shows that a systems approach to occupant protection, involving seat belts, seats, the roof, and interior structures, is necessary to minimize occupant exposure to injury-causing mechanisms.38 While much of this research was performed on passenger cars, it applies equally to 15-passenger vans, whose occupants also need to be protected during accidents. In a rollover accident, the accelerations experienced by occupants at the vehicle’s center of gravity can be low compared to the accelerations experienced by occupants in frontal or side impact collisions. Nonetheless, the severity of rollovers can still be significant. Researchers have found that the acceleration at a roof rail can be three times that at the center of gravity,39 posing risks for occupants located near the accelerating roof rail. In the Henrietta simulation, the unbelted occupants sustained severe injuries, even though maximum accelerations experienced by the passengers at the van’s center of gravity were less than 10 times the acceleration of gravity in the first rollover. The Henrietta, Randleman, and other accidents, as well as the simulations conducted for this investigation, demonstrate that when a 15-passenger van is involved in a rollover accident, occupant protection needs to be improved in order to save lives and reduce injuries. Specifically, changes are needed in interior surfaces, seat belts, and roof crush protection. 38 M.W. Arndt, G.A. Mowry, C.P. Dickerson, and S.M. Arndt, “Evaluation of Experimental Restraints in Rollover Conditions,” SAE Paper 95712 (Warrendale, PA: Society of Automotive Engineers, 1995). 39 J.W. Carter, J.L. Habberstad, and J. Croteau, “A Comparison of the Controller Rollover Impact System (CRIS) with the J2114 Rollover Dolly,” SAE Paper 2002-01-0694 (Warrendale, PA: Society of Automotive Engineers, 2002).

Analysis 45 Highway Accident Report Interior Surfaces FMVSS 201, “Occupant Protection in Interior Impact,” specifies requirements for protecting occupants inside passenger cars, multipurpose vehicles, trucks, and buses that have a GVWR less than 4,536 kg (10,000 pounds); the requirements for upper interior components do not apply to buses, including 15-passenger vans, that have a GVWR greater than 3,860 kg (8,510 pounds). The requirements that apply to 15-passenger vans include those for instrument panels, seatbacks, interior compartment doors, sun visors, and armrests. Fifteen-passenger vans do not have to meet the phased-in requirement for upper interior components in passenger vehicles manufactured after September 1, 1998, which mandates that vehicles meet head injury criteria for impacts with the front header, rear header, side rails, sliding door track, all pillars, roof braces or stiffeners, and seat belt anchorages. In both the Henrietta and Randleman accidents, occupants contacted and sustained injuries from one or more interior surfaces that are required to be protected in passenger vehicles but not in 15-passenger vans. The front passenger in the Henrietta accident was restrained by a lap/shoulder belt but sustained injuries due to contact with the interior roof and B-pillar during the rollover sequence. Four passengers in the Henrietta accident were seated on the left side of the vehicle (seats 3, 6, 9, and 12). A possible source of their injuries prior to ejection was deceleration into the noncrash-protected interior surfaces, including the roof, exposed window frame, and collapsed sidewalls, during the initial rollover and subsequent roof crush. Two passengers in the Henrietta van (seats 5 and 14) were unbelted but remained inside the vehicle, and both sustained serious injuries. The passenger in seat 14, for example, sustained a first rib fracture, which is rare unless extreme force is applied to the upper torso.40 The injuries to these passengers most likely resulted from contact with interior vehicle components, roof crush deformation into the survivable space of the vehicle compartment, or striking or being struck by other occupants during the rollover. While restraint use in rollovers increases an occupant’s chance of survival by preventing ejections, seat belts cannot prevent head contact with the adjacent roof or window.41 The most frequent harmful contact points for nonejected occupants are the roof, pillars, rails, and headers (28.1 percent combined).42 Therefore, vehicles need to be designed with impact protection to minimize injuries when an individual’s head strikes the roof or windows. The Henrietta and Randleman accident vans did not afford passengers the occupant-protected surfaces that passenger cars would have provided. The Safety Board concludes that during the rollover sequences in the Henrietta and Randleman accidents, 40 David Viano, Chest: Anatomy, Types and Mechanisms of Injury, Tolerance Criteria and Limits, and Injury Factors, AAM and IRCOBI Biomechanics of Trauma Course Book, October 1997, p. 9. 41 G.S. Bahling, R.T. Bundorf, G.S. Kaspzyk, E.A. Moffatt, K.O. Orlowski, and J.E. Stocke, “Rollover and Drop Tests – The Influence of Roof Strength on Injury Mechanics Using Belted Dummies,” Stapp Car Crash Conference 34th Proceedings, Orlando, Florida (Warrendale, PA: Society of Automotive Engineers, 1990) 101-112. 42 M.W. Arndt, G.A., Mowry, C.P. Dickerson, and S.M. Arndt.

Analysis 46 Highway Accident Report passengers remaining inside the vehicles, as well as some ejected occupants, sustained injuries as a result of contact with interior surfaces, which were not required to be protected from occupant impact. Even if these accidents had occurred in vans manufactured today, those passengers who remained within the vehicles or struck surfaces before being ejected may still have sustained injuries, since parts of FMVSS 201 do not apply to 15-passenger vans. FMVSS 201 reduces fatal injuries because it mandates use of technologies such as side airbags, curtain airbags, or energy-absorbing materials. Passenger cars today incorporate these technologies, but occupants of 15-passenger vans do not benefit from such protection. The Safety Board believes that NHTSA should include 12- and 15-passenger vans in Federal Motor Vehicle Safety Standard 201, Section 6, “Requirements for Upper Interior Component Protection.” Further, the Safety Board believes that Ford and GM should voluntarily develop and install technologies, to provide upper interior component protection within 12- and 15-passenger vans by model year

1. DaimlerChrysler no longer manufactures 15-passenger vans.

Seat Belt Usage Lap/Shoulder Belts. In the Henrietta accident, 7 of the 12 occupants were ejected from the van during the rollover, and 3 of the 7 ejected occupants sustained fatal injuries; none of the 3 belted occupants were ejected. In the Randleman accident, 4 of 14 occupants were ejected from the van during the rollover, 1 of whom sustained fatal injuries. None of the ejected Randleman occupants was wearing his or her seat belt, and at least five of the vehicle’s lap belts were unusable. When a passenger is ejected from a vehicle during an accident, he or she is exposed to rapid deceleration into injury-causing surfaces outside the vehicle. The orientation and speed of the passenger and the kind of surface struck are important factors in determining the nature and extent of the injuries sustained. In the Henrietta accident, the ejected passengers’ injuries included traumatic head injuries, spinal injury, skeletal fractures, blunt force trauma to the internal organs, and severe lacerations. Seven passengers were ejected during the accident sequence, five of whom had lap/shoulder belts available, although none wore the restraint. Had they been restrained, the vehicle would have given them some protection during the overturn sequence; instead they struck the ground at the same speed at which they were ejected from the vehicle, exacerbating the injuries they sustained inside the vehicle. The accident simulation showed that during the first overturn, head, neck, and thorax injuries were not predicted for simulated occupants wearing lap/shoulder belts. In the Randleman accident, the three ejected passengers experienced traumatic head injuries, spinal injury, and lacerations. The injuries sustained by those who remained in the van were minor because these passengers did not experience rapid decelerations into injury-causing surfaces outside the vehicle. The ejected passengers were seated on the right side of the van and were unrestrained. Thus, during the accident sequence, they did not remain within their seating area, but moved about the compartment before being ejected. Had they been wearing their lap belts, as two of them were required to do by

Analysis 47 Highway Accident Report North Carolina law (because they were less than 16 years old), they may have benefited from the protection provided by the vehicle. In both accidents, the ejected passengers’ injuries were significantly more severe than those sustained by passengers who remained in the vehicles. The one exception was the Henrietta driver, whose injuries were due to roof crush and the loss of survivable space (see roof crush section below). One of the five occupants who remained within the vehicle (seat 11) in the Henrietta accident was restrained by a lap belt only and sustained injuries when her upper body struck the interior surfaces or when she contacted other unrestrained passengers during the accident sequence. A lap belt does not prevent movement of the upper body and acts as a fulcrum for flailing of the upper body and lower extremities.43 However, the lap belt did prevent ejection, giving the passenger some protection as the van overturned and deformed. She did not experience the rapid deceleration into injury- causing surfaces inside or outside the vehicle that the ejected passengers did. Additionally, this passenger’s injuries were not as severe as those of the unbelted passengers seated around her who also remained within the van, probably because she did not strike injury- causing surfaces within the vehicle or other passengers at as great a velocity. The simulation of lap-belted occupants within the van predicted a thorax injury for the simulated occupant in seat 15 during the first rollover sequence, further indicating that lap belts alone are not the most effective restraint. The Henrietta simulations showed that the amount of movement for unrestrained occupants was significantly greater than that of their restrained counterparts, resulting in far more serious predicted injuries and exposing them to the serious injuries associated with ejection. These predicted injuries occurred because the simulated occupants struck parts of the van during the accident sequence. Additionally, several simulated occupants in the unrestrained conditions were either partially or fully ejected, whereas neither of the restrained conditions resulted in predicted ejections during the first overturn. The Safety Board concludes that had the passengers in the accident vans been wearing lap/shoulder belts, their injuries may have been less severe because of fewer and less forceful impacts with nonoccupant-protected interior components and other occupants and because those who were ejected would have remained in the vehicles. The Safety Board has advocated use of lap/shoulder belts for many years because they greatly reduce a passenger’s risk of injury during a collision. Restrained by lap belts only, passengers sometimes sustain abdominal injuries as a result of pivoting about the lap belt or as the upper body flails about. Yet the Ford and GM vans being manufactured today are equipped with lap/shoulder belts only at the outboard locations, rather than at all seating locations. NHTSA is developing a rulemaking to require that all center seats be equipped with lap/shoulder belts but has not disclosed whether the rulemaking will apply to 15-passenger vans. Ford and GM have begun to equip the passenger vehicles in their fleets with center lap/shoulder belts but have not indicated whether they will so equip their 15-passenger vans, which are not classified as passenger vehicles. The Safety Board believes that NHTSA should include 12- and 15-passenger vans in its upcoming 43 J.K. Mason, The Pathology of Violent Injury (London: Edward Arnold, 1978) 28.

Analysis 48 Highway Accident Report rulemaking that will require lap/shoulder belts at all center seats. The Safety Board also believes that Ford and GM should voluntarily install lap/shoulder belts at all center seating positions in 12- and 15-passenger vans and make all lap/shoulder belts in outboard and center seating positions adjustable by model year 2006. The fatally injured occupant in the Randleman accident was seated in a position that had a seat belt that was completely unusable; the buckle was wedged so tightly inside the seat bight that investigators could not even remove the buckle for inspection. In four other seats in the van, the seat belts were unusable either because of missing components or because the seat belt was stuck in the seat bight or under the seat frame. Children, who are required to be restrained by North Carolina law, occupied four of the five seating positions with unusable belts. Thus, even if these passengers had wanted to wear their seat belts, they would have been unable to do so. In an informal survey of other 15-passenger vans, investigators found that the vehicles lacked any mechanism to ensure that seat belt latches and buckles remain accessible in the seat bight. The Safety Board believes that Ford and GM should redesign the seat belts in their 12- and 15-passenger vans to ensure that the buckle and latch components remain readily accessible to occupants at all times by model year 2006. The Safety Board plans to inform 12- and 15-passenger van owners and operators about the importance of maintaining seat belt accessibility. Lap Belt Configuration. The purpose of seat belts is to reduce the likelihood of injury in the event of a crash. The two lap belts in the center of row 4 in both accident vehicles were configured so that one of the webbing straps for each passenger would have to pass behind the adjacent passenger if both occupants were to be lap belted at the same time. In the event of a forward deceleration, the webbing of the belt passing behind a passenger would compress his or her abdomen, potentially causing abdominal injuries. In the event of a lateral collision, because one webbing strap for each passenger (the buckle for one and the latch plate for the other) would have to extend quite far from its anchor position, the lack of a properly fitting restraint at the two positions would permit lateral movement of the passengers, thereby increasing the risk of injury to all four passengers in the fourth row. Also, because of the distance between the two anchorages, two people could conceivably share one lap belt, leaving the other latch and buckle unused. FMVSS 209, “Seat Belt Assemblies,” requires that such assemblies be designed for use by one, and only one, person at a time. Thus, the current configuration of the lap belt anchorages does not conform to FMVSS 209 and provides users with an opportunity to use the seat belts in an unsafe manner. The Safety Board concludes that the lap belt assemblies and anchorages in the center of the fourth row of both accident vans were configured in a manner that had potential to increase the risk of injury to passengers in the event of an accident. On July 10, 2003, staff met with DaimlerChrysler representatives, who demonstrated that, even though a potential hazard exists, no actual occurrence has been reported in more that 30 years of fleet operations. Although Dodge no longer manufactures these vans, DaimlerChrysler committed to monitoring the issue of the fourth row center lap belts through its defect investigation system and will report to the Safety Board any relevant complaints identified.

Analysis 49 Highway Accident Report Roof Crush One of the impact points between the Henrietta van and the ground during the rollover was the left front corner of the roof; the resulting roof crush at that location was so severe that it brought the roof in contact with the top of the driver’s seatback. The driver was belted but sustained fatal head injuries as a result of the roof intrusion. After the Henrietta accident, roof crush left 4 to 6 inches of space above each row of passenger seats; originally, the vehicle had 18 to 21 inches of space between the roof and the seats. Passengers probably sustained more serious injuries due to contact with the roof during the rollover and the resulting lack of interior space. The Safety Board concludes that roof crush to the Henrietta accident van contributed to the severity of the driver’s injuries and diminished survivable space for the passengers. The roof in the Randleman accident did not sustain similar crush damage, probably due to the vehicle dynamics during the rollover sequence. The lack of roof crush damage may be one reason the injuries to those passengers who remained within the vehicle were less severe than in the case of the Henrietta accident. Other factors that may have contributed to the differing severity of injuries in these two accidents were the age of the occupants, the points of impact during the rolls, and the crash pulse experienced as the vehicles rolled over. The Safety Board investigated another accident involving roof crush in a 15- passenger van that occurred on March 12, 2000, near San Antonio, Texas.44 The driver, who had attempted to change lanes, left the roadway; when she tried to correct her path of travel, the vehicle rolled over, landed on a guardrail, and the rear of the vehicle straddled the guardrail on its roof. A lap/shoulder-belted 15-year-old female passenger was fatally injured; a lap/shoulder-belted 15-year-old male passenger and an unrestrained 15-year-old female passenger were seriously injured. All three were seated in the area of roof crush damage. The driver and the other 10 passengers, also belted, were outside the roof crush area and did not sustain serious injuries. Studies have shown that the initial roof crush usually does not increase injuries to unrestrained occupants; passengers generally sustain serious injuries during contact with the roof and upper door window areas and when the head is adjacent to these areas during contact the ground.45 However, the reduction in survivable space due to roof crush for those who remain within the vehicle can lead to injuries, particularly during subsequent rollovers. NHTSA, which evaluated 1988-1999 National Automotive Sampling System and Fatality Analysis Reporting System data, found that, on average, 26,376 occupants sustain serious or fatal injuries in light-vehicle rollovers annually. Roof crush intrusion is estimated to occur and possibly contribute to serious or fatal injury in about 26 percent of rollover crashes.46 If the roof does not crush, belted occupants may benefit because they 44 Docket No. HWY-00-IH-032. 45 K.F. Orlowski, R.T. Bundorf, and E.A. Moffatt, “Rollover Crash Tests—The Influence of Roof Strength on Injury Mechanics,” SAE Paper 851734 (Warrendale, PA: Society of Automotive Engineers, 1985). 46 National Highway Traffic Safety Administration, Federal Motor Vehicle Safety Standards; Roof Crush Resistance, NHTSA-1999-5572; Notice 2 (Washington, DC: NHTSA, October 2001).

Analysis 50 Highway Accident Report have less chance of contacting the roof and being subjected to the forces of roof-to-ground contact during the rollover sequence.47 The purpose of FMVSS 216, “Roof Crush Resistance,” which establishes strength requirements for passenger compartment roofs, is to reduce death and injury due to roof crush in rollover crashes. The standard applies only to passenger cars, multipurpose vehicles, and buses with a GVWR of 2,722 kilograms (6,000 pounds) or less. The GVWRs of 15-passenger vans exceed 8,500 pounds and, therefore, the vans are not required to meet FMVSS 216. Yet statistics show that 15-passenger vans are involved in a higher percentage of rollover accidents than are passenger cars and smaller vans. About 52 percent of the 15-passenger vans involved in fatal single-vehicle accidents experience a rollover, while 33 percent of passenger cars involved in such accidents do.48 NHTSA requested comments on its proposed amendments to FMVSS 216 on October 22, 2001. In the request, NHTSA stated that it is considering whether to extend FMVSS 216 to vehicles weighing up to 10,000 pounds, because the composition of the vehicle fleet has changed since the previous rulemaking was issued; in particular, the number of vehicles weighing more than 6,000 pounds has increased. The Safety Board believes that NHTSA should include 12- and 15-passenger vans in FMVSS 216, “Roof Crush Resistance,” to minimize the extent to which survivable space is compromised in the event of a rollover accident. Further, the Safety Board believes that Ford and GM should voluntarily redesign 12- and 15-passenger vans to minimize the extent to which survivable space is compromised in the event of a rollover accident by model year 2006. Tires Two of the Henrietta van’s four tires, including the tire that suffered the tread/belt separation, were original tires (8 years old). Three of the four tires on the Randleman van were more than 8 years old. When not in use, both vans had been parked in the unprotected parking lots of their respective churches since purchase. The tires were subject to the ozone and ultraviolet light present outdoors, which can degrade the tire rubber, leading to dry rot and weather checking. These phenomena are typical of a sedentary vehicle; during normal use, anti-degradants introduced during the tire manufacturing process are released and brought to the surface of the tire. When a vehicle is not driven extensively (the Henrietta van averaged 5,500 miles per year and the Randleman van averaged about 7,000 miles per year), this release does not occur. Visual inspection of the two original tires on the Henrietta van and all the tires on the Randleman van revealed that the tires were drying out and that the rubber was rotting and cracking. 47 G.S. Bahling, R.T. Bundorf, G.S. Kaspzyk, E.A. Moffatt, K.O. Orlowski, and J.E. Stocke. 48 National Transportation Safety Board, Evaluation of the Rollover Propensity of 15-passenger Vans, Safety Report NTSB/SR-02/03 (Washington, DC: NTSB, 2002).

Analysis 51 Highway Accident Report These conditions can lead to tire failure. The sidewall and tread groove cracking on the tires of both vans was evidence of this degradation due to weather. None of the Henrietta or Randleman tires were inflated to the recommended pressure, even though the manufacturer-recommended pressures were specified on a label inside the driver’s doorsill. The two front tires on the Henrietta van were inflated to 60 psi; the recommended pressure was 55 psi. The right rear tire on the Henrietta van was inflated to 58 psi; the preaccident pressure of the left rear tire could not be determined. However, given that three of the four tires on the Henrietta van were inflated to or near 60 psi and the words “reinflate to 60 psi” were written on the right front tire in yellow crayon, the left rear tire was also probably inflated to about 60 psi. Thus, the two rear tires were significantly under the manufacturer’s recommended pressure of 80 psi. On the Randleman van, the left and right front tires were inflated to 62.5 psi and 60.5 psi, respectively, and the right rear tire was inflated to 60 psi. Again, the preaccident pressure on the left rear tire could not be determined but is likely to have been about 60 psi, as was true of the other three tires. The manufacturer-recommended tire pressures for the Randleman van were 50 psi49 for the front tires and 80 psi for the rear tires. Overinflated tires can result in excessive tire wear to the center of the tread. Underinflation can shorten a tire’s life and lead to premature tire failure. According to NHTSA, “When a tire is used while significantly underinflated, its sidewalls flex more and the air temperature inside the tire increases, increasing stress and the risk of failure. In addition, a significantly underinflated tire loses lateral traction, making handling more difficult.”50 Underinflated tires are also able to carry less weight. In the case of the tires on the accident vehicles, when inflated to a pressure of 60 psi, each rear tire could carry almost 500 pounds less than it was designed to carry had it been inflated to the manufacturer’s recommended pressure of 80 psi. Neither the degradation of the tires from weather nor the underinflated pressure of the left rear tire by itself is likely to have caused the tire failure on either van. Nonetheless, they were contributory factors. Also, a small hole extending through all the tire components of the Henrietta tire may have allowed air to penetrate the tire, thereby degrading its structural integrity. The Safety Board concludes that a combination of underinflation, degradation from weather, and, in the case of the Henrietta van tire, a possible infiltration of air through a small puncture, is likely to have led to the rapid air loss and tread/belt separation on both the Henrietta and the Randleman left rear tires. In addition, the right rear tire on the Randleman van was underrated for the accident vehicle, that is, the tire could not carry the maximum load required for the vehicle. An underrated tire flexes too much and can lead to failure. The required tire rating is printed in the owner’s manual and can also be found on the tire. A replacement tire 49 The recommended front tire pressures for the two vans were probably different because of a 1992 design change to the van. 50 Docket No. NHTSA 2000-8572.

Analysis 52 Highway Accident Report should always have the same or greater load rating as the original. The owner could provide no information on why an underrated tire had been placed on the Randleman van. Tires may be not be inflated to the proper pressure or an underrated tire may be placed on a vehicle because drivers are unaware of the proper pressure or load rating. As part of the Transportation Recall Enhancement, Accountability, and Documentation (TREAD) Act of 2000, NHTSA issued a final rulemaking that requires manufacturers to place a prominent label stating the manufacturer-recommended tire pressures and tire load ratings on all vehicles weighing less than 10,000 pounds; the label is to be printed in yellow, red, black, and white and is to be affixed to the vehicle’s B-pillar (the pillar behind the driver). By requiring placement of the label in a prominent location and providing consistent information, NHTSA seeks to ensure that consumers have the necessary information to maintain their tires. As required by the TREAD Act, NHTSA also issued a rulemaking on June 5, 2002, directing that all vehicles be equipped with a tire pressure monitoring system that will alert the driver when a tire is significantly underinflated. During the period from November 1, 2003, through October 31, 2006, manufacturers must begin phasing in tire pressuring monitoring systems on their vehicles. To allow itself sufficient time to consider additional data on the effect and performance of tire pressure monitoring systems, NHTSA plans to defer a decision on long-term performance requirements for such systems on vehicles manufactured after October 31, 2006. It intends to publish these requirements by March 1, 2005, to give manufacturers sufficient lead time to comply with the final rule. In its rulemaking, NHTSA requires manufacturers to employ a system that alerts drivers if the tire pressure of one or more tires is at least 25 or 30 percent51 below the vehicle manufacturer’s recommended cold inflation pressure for the tires. Based on this criterion, a tire pressure monitoring system on the accident vans would only have been required to warn the drivers when the pressure in the rear tires reached 25 or 30 percent of the recommended pressure of 80 psi, that is, 56 or 60 psi. At the time of the accidents, the rear tires of the vans were quite likely inflated to 58 or 60 psi and thus may not have been beyond the threshold that today’s tire pressure monitoring systems were designed to detect. The Safety Board concludes that because low tire pressure in fully loaded 15- passenger vans contributes to vehicle instability, the current tire pressure monitoring standard of 25 or 30 percent below manufacturer’s recommended pressure is insufficient to warn van drivers of potentially unsafe low pressures. As was seen during the vehicle dynamics testing, the van became more unstable and difficult to control when the tire pressures were inflated to 58 psi for the rear tires. The test driver stated that in the lane change maneuver, the vehicle “wallowed” when the tire pressures were low. During the blowout testing, the driver reported that the van handled better when the tires were inflated to their recommended pressure and that tire pressure significantly affected the handling of the van. 51 Manufacturers have two options, 25 percent or 30 percent, based on the capabilities of currently available technologies.

Analysis 53 Highway Accident Report The Safety Board understands that tire pressure monitoring systems are a new technology and that detecting pressure differentials below 20 percent is currently difficult. However, as these accidents and the dynamic testing demonstrate, tire pressures that are 25 or 30 percent below the manufacturer’s recommended pressure can have significant negative effects on the handling of 15-passenger vans. Therefore, the Safety Board believes that NHTSA, in developing long-term performance requirements for tire pressure monitoring systems, should adopt more stringent detection standards than 25 or 30 percent below manufacturer-recommended levels, since pressures at those levels can have an adverse effect on safe handling of vehicles, such as 12- and 15-passenger vans. Both accident vehicles had undergone recent State safety inspections; the Henrietta van passed a Texas inspection on October 23, 2000, and the Randleman van passed a Virginia inspection in December 2000. The Texas criteria included visual inspection of tire pressure, as well as identification of tread or sidewall cracks and cuts or snags of more than 1 inch that were deep enough to expose the body cords. The Virginia criteria included checking for cuts in tire fabric, for wear so extensive that the fabric or steel cord is visible, and for knots or bulges in the sidewalls, broken belts, or tread separation from the fabric. Neither State’s criteria included excessive cracking and weather checking, a defect on five of the eight tires on the two accident vehicles. Nor did either State require inspectors to make sure that proper load-rated tires were on the vehicle or that tires were inflated to the manufacturer-recommended pressure. While none of these conditions alone was responsible for the tire failures in these accidents, the weather checking and underinflation were contributory factors, and the improperly rated tire on the Randleman accident van could have created an unsafe condition. The AAMVA inspection handbook recommends that vehicle inspections include measuring tire pressure and, as necessary, correcting deficiencies if the owner agrees. The guidelines do not address weather checking and cracking as criteria for rejection during an inspection. The Safety Board concludes that the Texas and Virginia safety inspection criteria, which do not adequately address tire pressure, overlook an important factor in vehicle safety inspection and that the Texas, Virginia, and AAMVA guidelines for vehicle safety inspections are not thorough enough because they exclude factors such as weather checking and tire rating. The Safety Board believes that Texas and Virginia should require that all passenger vehicle inspections include (1) tire pressure measurement and correction of any inflation deficiencies detected and (2) identification and failure of those tires that exhibit extensive weather checking and deterioration or that are not properly load-rated. The Safety Board believes that AAMVA should revise its Passenger Vehicles and Light Trucks Inspection Handbook to provide guidance on inspecting and failing tires for extensive weather checking or deterioration and on examining tires to ensure that they have the proper load rating. The tires on both accident vans were in poor condition because neither church had a comprehensive maintenance program for its vehicle. No one was responsible for making sure the tires were in sound condition and inflated properly. The Safety Board will inform various users of 12- and 15-passenger vans about the need to inspect the tires frequently and to maintain proper tire pressure.

54 Highway Accident Report Conclusions Findings 1. Following the tire blowouts, both accident drivers instinctively, but inappropriately, applied the brakes and oversteered in an attempt to regain control of their vans; however, these actions led to further vehicle instability, resulting in loss of control and subsequent rollover. 2. There is no evidence of alcohol use, other drug use, or fatigue on the part of either driver. Weather and roadway conditions did not contribute to either the Henrietta, Texas, or Randleman, North Carolina, accidents and the emergency response to both was adequate. 3. The National Highway Traffic Safety Administration’s and the Federal Motor Carrier Safety Administration’s inadequate and inconsistent vehicle classification of 12- and 15-passenger vans leaves a gap that adversely affects regulations pertaining to the manufacture and safe operation of these vehicles. 4. Safe operation of 15-passenger vans requires a knowledge and skill level different from and above that for passenger vehicles, particularly when the vans are fully loaded or drivers experience an emergency situation. 5. During the rollover sequences in the Henrietta, Texas, and Randleman, North Carolina, accidents, passengers remaining inside the vehicles, as well as some ejected occupants, sustained injuries as a result of contact with interior surfaces, which were not required to be protected from occupant impact. 6. Had the passengers in the accident vans been wearing lap/shoulder belts, their injuries may have been less severe because of fewer and less forceful impacts with nonoccupant-protected interior components and other occupants and because those who were ejected would have remained in the vehicles. 7. The lap belt assemblies and anchorages in the center of the fourth row of both accident vans were configured in a manner that had potential to increase the risk of injury to passengers in the event of an accident. 8. The roof crush to the Henrietta, Texas, accident van contributed to the severity of the driver’s injuries and diminished survivable space for the passengers. 9. A combination of underinflation, degradation from weather, and, in the case of the Henrietta, Texas, van tire, a possible infiltration of air through a small puncture, is likely to have led to the rapid air loss and tread/belt separation on both the Henrietta, Texas, and the Randleman, North Carolina, left rear tires.

Conclusions 55 Highway Accident Report

1. Because low tire pressure in fully loaded 15-passenger vans contributes to vehicle

instability, the current tire pressure monitoring standard of 25 or 30 percent below manufacturer’s recommended pressure is insufficient to warn van drivers of potentially unsafe low pressures.

1. The Texas and Virginia safety inspection criteria, which do not adequately address

tire pressure, overlook an important factor in vehicle safety inspection and that the Texas, Virginia, and American Association of Motor Vehicle Administrators guidelines for vehicle safety inspections are not thorough enough because they exclude factors such as weather checking and tire rating. Probable Cause The National Transportation Safety Board determines that the probable cause of the accidents was tire failure, the drivers’ response to that failure, and the drivers’ inability to maintain control of their vans. Contributing to the accidents was the deteriorated condition of the tires, as a result of the churches’ lack of tire maintenance, and the handling characteristics of the vans. Contributing to the severity of the injuries was the lack of appropriate Federal Motor Vehicle Safety Standards applicable to 15-passenger vans in the areas of restraints and occupant protection.

56 Highway Accident Report Recommendations To the National Highway Traffic Safety Administration: In cooperation with the Federal Motor Carrier Safety Administration, revise your definitions of buses and commercial motor vehicles to apply consistently to 12- and 15-passenger vans, taking into account the unique operating characteristics and multiple functions of these vans. (H-03-12) In cooperation with the American Driver and Traffic Safety Education Association, the National Safety Council, the American Automobile Association, General Motors Corporation, and Ford Motor Company, develop a training program that incorporates the skills required for safe operation of 12- and 15-passenger vans and addresses the consequences of unsafe operation, including, but not limited to, operating in a fully loaded condition, emergency braking, high-speed lane changes, tire blowouts, and tire pressure and maintenance. (H-03-13) Include 12- and 15-passenger vans in Federal Motor Vehicle Safety Standard 201, Section 6, “Requirements for Upper Interior Component Protection.” (H-03-14) Include 12- and 15-passenger vans in your upcoming rulemaking that will require lap/shoulder belts at all center seats. (H-03-15) Include 12- and 15-passenger vans in Federal Motor Vehicle Safety Standard 216, “Roof Crush Resistance,” to minimize the extent to which survivable space is compromised in the event of a rollover accident. (H- 03-16) In developing long-term performance requirements for tire pressure monitoring systems, adopt more stringent detection standards than 25 or 30 percent below manufacturer-recommended levels, since pressures at those levels can have an adverse effect on the handling of vehicles, such as 12- and 15-passenger vans. (H-03-17) To Federal Motor Carrier Safety Administration: In cooperation with the National Highway Traffic Safety Administration, revise your definitions of buses and commercial motor vehicles to apply consistently to 12- and 15-passenger vans, taking into account the unique operating characteristics and multiple functions of these vans. (H-03-18)

Recommendations 57 Highway Accident Report To the 50 States and the District of Columbia: Establish a driver’s license endorsement for 12- and 15-passenger vans that adopts the standards established by the American Driver and Traffic Safety Education Association; to obtain the endorsement, drivers should have to complete a training program on the operation of 12- and 15-passenger vans and pass a written and skills test. (H-03-19) To Texas and Virginia: Require that all passenger vehicle inspections include (1) tire pressure measurement and correction of any inflation deficiencies detected and (2) identification and failure of those tires that exhibit extensive weather checking and deterioration or that are not properly load-rated. (H-03-20) To the American Driver and Traffic Safety Education Association: In cooperation with the National Highway Traffic Safety Administration, the National Safety Council, the American Automobile Association, General Motors Corporation, and Ford Motor Company, develop a training program that incorporates the skills required for safe operation of 12- and 15-passenger vans and addresses the consequences of unsafe operation, including, but not limited to, operating in a fully loaded condition, emergency braking, high-speed lane changes, tire blowouts, and tire pressure and maintenance. (H-03-21) To the American Automobile Association and the National Safety Council: In cooperation with the American Driver and Traffic Safety Association, the National Highway Traffic Safety Administration, General Motors Corporation, Ford Motor Company, and each other, develop a training program that incorporates the skills required for safe operation of 12- and 15-passenger vans and addresses the consequences of unsafe operation, including, but not limited to, operating in a fully loaded condition, emergency braking, high-speed lane changes, tire blowouts, and tire pressure and maintenance. (H-03-22) To American Association of Motor Vehicle Administrators: Revise your Passenger Vehicles and Light Trucks Inspection Handbook to provide guidance on inspecting and failing tires for extensive weather checking or deterioration and on examining tires to ensure that they have the proper load rating. (H-03-23)

Recommendations 58 Highway Accident Report To Ford Motor Company and General Motors Corporation: In cooperation with the American Driver and Traffic Safety Association, the National Highway Traffic Safety Administration, the National Safety Council, the American Automobile Association, and each other, develop a training program that incorporates the skills required for safe operation of 12- and 15-passenger vans and addresses the consequences of unsafe operation, including, but not limited to, operating in a fully loaded condition, emergency braking, high-speed lane changes, tire blowouts, and tire pressure and maintenance. (H-03-22) Voluntarily develop and install technologies to provide upper interior component protection within 12- and 15-passenger vans by model year

1. (H-03-24)

Voluntarily install lap/shoulder belts at all center seating positions in 12- and 15-passenger vans and make all lap/shoulder belts in outboard and center seating positions adjustable by model year 2006. (H-03-25) Redesign the seat belts in your 12- and 15-passenger vans to ensure that the buckle and latch components remain readily accessible to occupants at all times by model year 2006. (H-03-26) Voluntarily redesign 12- and 15-passenger vans to minimize the extent to which survivable space is compromised in the event of a rollover accident by model year 2006. (H-03-27) BY THE NATIONAL TRANSPORTATION SAFETY BOARD ELLEN G. ENGLEMAN JOHN J. GOGLIA Chairman Member MARK V. ROSENKER CAROL J. CARMODY Vice Chairman Member RICHARD F. HEALING Member Adopted: July 15, 2003

59 Highway Accident Report Appendix A Henrietta, Texas, Investigation The National Transportation Safety Board was notified of the Henrietta, Texas, accident on May 8, 2001. The Safety Board dispatched an investigative team consisting of members from the Washington, D.C.; Atlanta, Georgia; Fort Worth, Texas; and Parsippany, New Jersey, offices. Groups were established to investigate human performance; motor carrier operations; and highway, vehicle, and survival factors and to conduct on-scene documentation. Representatives of Michelin, North America, Inc., participated in the investigation. No public hearing was held; no depositions were taken. Randleman, North Carolina, Investigation The National Transportation Safety Board was notified of the Randleman, North Carolina, accident on July 1, 2001. The Safety Board dispatched an investigative team consisting of members from the Washington, D.C.; Atlanta, Georgia; Fort Worth, Texas; and Parsippany, New Jersey, offices. Groups were established to investigate human performance; motor carrier operations; and highway, vehicle, and survival factors. Representatives of Michelin, North America, Inc., participated in the investigation. No public hearing was held; no depositions were taken.

60 Highway Accident Report Appendix B Potential Occupant Motion in Simulations

Time = 0.0 seconds (~13° rotation)

Time = 0.4 seconds (~40° rotation)

Time = 0.8 seconds (~110° rotation)

Time = 1.3 seconds (~220° rotation)

Time = 2.0 seconds (~380° rotation)

Time = 3.05 seconds (~420° rotation)

Figure 1. A series of still images illustrating the occupant kinematics for Run One in the actual restraint condition at various stages of the rollover.

Time = 0.0 seconds (13° rotation)

Time = 0.4 seconds (46° rotation)

Time = 0.8 seconds (146° rotation)

Time = 1.3 seconds (327° rotation)

Time = 2.0 seconds (463° rotation)

Figure 2. A series of still images illustrating the occupant kinematics for Run Two in the actual restraint condition at various stages of the rollover.

Time = 0.0 seconds (13° rotation)

Time = 0.4 seconds (82° rotation)

Time = 0.8 seconds (203° rotation)

Time = 1.3 seconds (382° rotation)

Time = 2.0 seconds (450° rotation) Figure 3. A series of still images illustrating the occupant kinematics for Run Three in the actual restraint condition at various stages of the rollover.

Time = 0.0 seconds (13° rotation)

Time = 0.4 seconds (84° rotation)

Time = 0.8 seconds (205° rotation)

Time = 1.3 seconds (390° rotation)

Time = 2.0 seconds (529° rotation)

Figure 4. A series of still images illustrating the occupant kinematics for Run Four in the actual restraint condition at various stages of the rollover.

Time = 0.0 seconds (~13° rotation)

Time = 0.4 seconds (~40° rotation)

Time = 0.8 seconds (~110° rotation)

Time = 1.3 seconds (~220° rotation)

Time = 2.0 seconds (~380° rotation)

Figure 5. A series of still images illustrating the occupant kinematics in the lap-belted condition at various stages of the rollover.

Time = 0.0 seconds (~13° rotation)

Time = 0.4 seconds (~40° rotation)

Time = 0.8 seconds (~110° rotation)

Time = 1.3 seconds (~220° rotation)

Time = 2.0 seconds (~380° rotation)

Figure 6. A series of still images illustrating the occupant kinematics in the lap/shoulder- belted condition at various stages of the rollover.

67 Highway Accident Report Appendix C Federal Motor Vehicle Safety Standards 201, 209, and 216

446 49 CFR Ch. V (10–1–02 Edition) § 571.201 [67 FR 38746, June 5, 2002] § 571.201 Standard No. 201; Occupant protection in interior impact. S1. Purpose and scope. This standard specifies requirements to afford impact protection for occupants. S2. Application. This standard applies to passenger cars and to multipurpose passenger vehicles, trucks, and buses with a GVWR of 4,536 kilograms or less, except that the requirements of S6 do not apply to buses with a GVWR of more than 3,860 kilograms. S3. Definitions. A-pillar means any pillar that is en- tirely forward of a transverse vertical plane passing through the seating ref- erence point of the driver’s seat. Ambulance means a motor vehicle de- signed exclusively for the purpose of emergency medical care, as evidenced by the presence of a passenger com- partment to accommodate emergency medical personnel, one or more pa- tients on litters or cots, and equipment and supplies for emergency care at a location or during transport. B-pillar means the forwardmost pillar on each side of the vehicle that is, in whole or part, rearward of a transverse vertical plane passing through the seating reference point of the driver’s seat, unless there is only one pillar rearward of that plane and it is also a rearmost pillar. Brace means a fixed diagonal struc- tural member in an open body vehicle that is used to brace the roll-bar and that connects the roll-bar to the main body of the vehicle structure. Convertible means a vehicle whose A- pillars are not joined with the B-pillars (or rearmost pillars) by a fixed, rigid structural member. Convertible roof frame means the frame of a convertible roof. Convertible roof linkage mechanism means any anchorage, fastener, or de- vice necessary to deploy a convertible roof frame. Daylight opening means, for openings on the side of the vehicle, other than a door opening, the locus of all points where a horizontal line, perpendicular to the vehicle longitudinal centerline, is tangent to the periphery of the open- ing. For openings on the front and rear of the vehicle, other than a door open- ing, daylight opening means the locus of all points where a horizontal line, par- allel to the vehicle longitudinal center- line, is tangent to the periphery of the opening. If the horizontal line is tan- gent to the periphery at more than one point at any location, the most inboard point is used to determine the daylight opening. Door opening means, for door open- ings on the side of the vehicle, the locus of all points where a horizontal line, perpendicular to the vehicle longi- tudinal centerline, is tangent to the pe- riphery of the side door opening. For door openings on the back end of the vehicle, door opening means the locus of all points where a horizontal line, parallel to the vehicle longitudinal centerline, is tangent to the periphery of the back door opening. If the hori- zontal line is tangent to the periphery at more than one point at any location, the most inboard point is the door opening. Dynamically deployed upper interior head protection system means a protec- tive device or devices which are inte- grated into a vehicle and which, when activated by an impact, provide, through means requiring no action from occupants, protection against head impacts with upper interior struc- tures and components of the vehicle in crashes. Forehead impact zone means the part of the free motion headform surface area that is determined in accordance with the procedure set forth in S8.10. Free motion headform means a test de- vice which conforms to the specifica- tions of part 572, subpart L of this chapter. Mid-sagittal plane of a dummy means a longitudinal vertical plane passing through the seating reference point of a designated seating position. Motor Home means a motor vehicle with motive power that is designed to provide temporary residential accom- modations, as evidenced by the pres- ence of at least four of the following fa- cilities: Cooking; refrigeration or ice box; self-contained toilet; heating and/ or air conditioning; a potable water supply system including a faucet and a sink; and a separate 110–125 volt elec- trical power supply and/or an LP gas supply. VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00446 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

447 Nat’l Highway Traffic Safety Admin., DOT § 571.201 Other pillar means any pillar which is not an A-pillar, a B-pillar, or a rear- most pillar. Pillar means any structure, excluding glazing and the vertical portion of door window frames, but including accom- panying moldings, attached compo- nents such as safety belt anchorages and coat hooks, which: (1) Supports either a roof or any other structure (such as a roll-bar) that is above the driver’s head, or (2) Is located along the side edge of a window. Roll-bar means a fixed overhead structural member, including its vertical support structure, that ex- tends from the left to the right side of the passenger compartment of any open body vehicles and convertibles. It does not include a header. Seat belt anchorage means any compo- nent involved in transferring seat belt loads to the vehicle structure, includ- ing, but not limited to, the attachment hardware, but excluding webbing or straps, seat frames, seat pedestals, and the vehicle structure itself, whose fail- ure causes separation of the belt from the vehicle structure. Sliding door track means a track structure along the upper edge of a side door opening that secures the door in the closed position and guides the door when moving to and from the open po- sition. Stiffener means a fixed overhead structural member that connects one roll-bar to another roll-bar or to a header of any open body vehicle or con- vertible. Upper roof means the area of the ve- hicle interior that is determined in ac- cordance with the procedure set forth in S8.15. Windshield trim means molding of any material between the windshield glaz- ing and the exterior roof surface, in- cluding material that covers a part of either the windshield glazing or exte- rior roof surface. S4 Requirements S4.1 Except as provided in S4.2, each vehicle shall comply with either: (a) The requirements specified in S5, or, (b) The requirements specified in S5 and S6. S4.2 Vehicles manufactured on or after September 1, 1998 shall comply with the requirements of S5 and S6. S5 Requirements for instrument pan- els, seat backs, interior compartment doors, sun visors, and armrests. Each ve- hicle shall comply with the require- ments specified in S5.1 through S5.5.2. S5.1 Instrument panels. Except as provided in S5.1.1, when that area of the instrument panel that is within the head impact area is impacted in ac- cordance with S5.1.2 by a 6.8 kilogram, 165 mm diameter head form at— (a) A relative velocity of 24 kilo- meters per hour for all vehicles except those specified in paragraph (b) of this section, (b) A relative velocity of 19 kilo- meters per hour for vehicles that meet the occupant crash protection require- ments of S5.1 of 49 CFR 571.208 by means of inflatable restraint systems and meet the requirements of S4.1.5.1(a)(3) by means of a Type 2 seat belt assembly at the right front des- ignated seating position, the decelera- tion of the head form shall not exceed 80 g continuously for more than 3 milli- seconds. S5.1.1 The requirements of S5.1 do not apply to: (a) Console assemblies; (b) Areas less than 125 mm inboard from the juncture of the instrument panel attachment to the body side inner structure; (c) Areas closer to the windshield juncture than those statically contactable by the head form with the windshield in place; (d) Areas outboard of any point of tangency on the instrument panel of a 165 mm diameter head form tangent to and inboard of a vertical longitudinal plane tangent to the inboard edge of the steering wheel; or (e) Areas below any point at which a vertical line is tangent to the rearmost surface of the panel. S5.1.2 Demonstration procedures. Tests shall be performed as described in Society of Automotive Engineers Recommended Practice J921, ‘‘Instrument Panel Laboratory Impact Test Procedure,’’ June 1965, using the specified instrumentation or instru- mentation that meets the performance requirements specified in Society of VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00447 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

448 49 CFR Ch. V (10–1–02 Edition) § 571.201 Automotive Engineers Recommended Practice J977, ‘‘Instrumentation for Laboratory Impact Tests,’’ November 1966, except that: (a) The origin of the line tangent to the instrument panel surface shall be a point on a transverse horizontal line through a point 125 mm horizontally forward of the seating reference point of the front outboard passenger des- ignated seating position, displaced vertically an amount equal to the rise which results from a 125 mm forward adjustment of the seat or 19 mm; and (b) Direction of impact shall be ei- ther: (1) In a vertical plane parallel to the vehicle longitudinal axis; or (2) In a plane normal to the surface at the point of contact. S5.2 Seat Backs. Except as provided in S5.2.1, when that area of the seat back that is within the head impact area is impacted in accordance with S5.2.2 by a 6.8 kilogram, 165 mm diame- ter head form at a relative velocity of 24 kilometers per hour, the decelera- tion of the head form shall not exceed 80g continuously for more than 3 milli- seconds. S5.2.1 The requirements of S5.2 do not apply to seats installed in school buses which comply with the require- ments of Standard No. 222, School Bus Passenger Seating and Occupant Protec- tion (49 CFR 571.222) or to rearmost side-facing, back-to-back, folding aux- iliary jump, and temporary seats. S5.2.2 Demonstration procedures. Tests shall be performed as described in Society of Automotive Engineers Recommended Practice J921, ‘‘Instrument Panel Laboratory Impact Test Procedure,’’ June 1965, using the specified instrumentation or instru- mentation that meets the performance requirements specified in Society of Automotive Engineers Recommended Practice J977, ‘‘Instrumentation for Laboratory Impact Tests,’’ November 1966, except that: (a) The origin of the line tangent to the uppermost seat back frame compo- nent shall be a point on a transverse horizontal line through the seating ref- erence point of the right rear des- ignated seating position, with adjust- able forward seats in their rearmost de- sign driving position and reclinable forward seat backs in their nominal de- sign driving position; (b) Direction of impact shall be ei- ther: (1) In a vertical plane parallel to the vehicle longitudinal axis; or (2) In a plane normal to the surface at the point of contact. (c) For seats without head restraints installed, tests shall be performed for each individual split or bucket seat back at points within 100 mm left and right of its centerline, and for each bench seat back between points 100 mm outboard of the centerline of each out- board designated seating position; (d) For seats having head restraints installed, each test shall be conducted with the head restraints in place at its lowest adjusted position, at a point on the head restraint centerline; and (e) For a seat that is installed in more than one body style, tests con- ducted at the fore and aft extremes identified by application of subpara- graph (a) shall be deemed to have dem- onstrated all intermediate conditions. S5.3 Interior compartment doors. Each interior compartment door assembly located in an instrument panel, console assembly, seat back, or side panel adja- cent to a designated seating position shall remain closed when tested in ac- cordance with either S5.3.1(a) and S5.3.1(b) or S5.3.1(a) and S5.3.1(c). Addi- tionally, any interior compartment door located in an instrument panel or seat back shall remain closed when the instrument panel or seat back is tested in accordance with S5.1 and S5.2. All interior compartment door assemblies with a locking device must be tested with the locking device in an unlocked position. S5.3.1 Demonstration procedures. (a) Subject the interior compartment door latch system to an inertia load of 10g in a horizontal transverse direction and an inertia load of 10g in a vertical direction in accordance with the proce- dure described in section 5 of SAE Rec- ommended Practice J839b, ‘‘Passenger Car Side Door Latch Systems,’’ May 1965, or an approved equivalent. (b) Impact the vehicle perpendicu- larly into a fixed collision barrier at a forward longitudinal velocity of 48 kil- ometers per hour. VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00448 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

449 Nat’l Highway Traffic Safety Admin., DOT § 571.201 (c) Subject the interior compartment door latch system to a horizontal iner- tia load of 30g in a longitudinal direc- tion in accordance with the procedure described in section 5 of SAE Rec- ommended Practice J839b, ‘‘Passenger Car Side Door Latch Systems,’’ May 1965, or an approved equivalent. S5.4 Sun visors. S5.4.1 A sun visor that is con- structed of or covered with energy-ab- sorbing material shall be provided for each front outboard designated seating position. S5.4.2 Each sun visor mounting shall present no rigid material edge ra- dius of less than 3.2 mm that is stati- cally contactable by a spherical 165 mm diameter head form. S5.5 Armrests. S5.5.1 General. Each installed arm- rest shall conform to at least one of the following: (a) It shall be constructed with en- ergy-absorbing material and shall de- flect or collapse laterally at least 50 mm without permitting contact with any underlying rigid material. (b) It shall be constructed with en- ergy-absorbing material that deflects or collapses to within 32 mm of a rigid test panel surface without permitting contact with any rigid material. Any rigid material between 13 and 32 mm from the panel surface shall have a minimum vertical height of not less than 25 mm. (c) Along not less than 50 continuous mm of its length, the armrest shall, when measured vertically in side ele- vation, provide at least 50 mm of cov- erage within the pelvic impact area. S5.5.2 Folding armrests. Each armrest that folds into the seat back or be- tween two seat backs shall either: (a) Meet the requirements of S5.5.1; or (b) Be constructed of or covered with energy-absorbing material. S6 Requirements for upper interior components. S6.1 Vehicles manufactured on or after September 1, 1998 and before September 1,

1. Except as provided in S6.3, for ve-

hicles manufactured on or after Sep- tember 1, 1998 and before September 1, 2002, a percentage of the manufactur- er’s production, as specified in S6.1.1, S6.1.2, S6.1.3, or S6.1.4, shall conform, at the manufacturer’s option, to either S6.1(a) or S6.1(b). The manufacturer shall select the option by the time it certifies the vehicle and may not there- after select a different option for the vehicle. (a) When tested under the conditions of S8, comply with the requirements specified in S7 at the target locations specified in S10 when impacted by the free motion headform specified in S8.9 at any speed up to and including 24 km/ h (15 mph). The requirements do not apply to any target that cannot be lo- cated using the procedures of S10. (b) When equipped with a dynami- cally deployed upper interior head pro- tection system and tested under the conditions of S8, comply with the re- quirements specified in S7 at the target locations specified in S10 as follows: (1) Targets that are not located over any point inside the area measured along the contour of the vehicle sur- face within 50 mm (2.0 inch) of the pe- riphery of the stowed system projected perpendicularly onto the vehicle inte- rior surface, including mounting and inflation components but exclusive of any cover or covers, shall be impacted by the free motion headform specified in S8.9 at any speed up to and including 24 km/h (15 mph). The requirements do not apply to any targets that can not be located by using the procedures of S10. (2) Targets that are over any point inside the area measured along the contour of the vehicle interior within 50 mm (2.0 inch) of the periphery of the stowed system projected perpendicu- larly onto the vehicle interior surface, including mounting and inflation com- ponents but exclusive of any cover or covers, when the dynamically deployed upper interior head protection system is not deployed, shall be impacted by the free motion headform specified in S8.9 at any speed up to and including 19 km/h (12 mph) with the system undeployed. The requirements do not apply to any target that can not be lo- cated using the procedures of S10. (3) Each vehicle shall, when equipped with a dummy test device specified in Part 572, Subpart M, and tested as specified in S8.16 through S8.28, comply with the requirements specified in S7 when crashed into a fixed, rigid pole of VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00449 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

450 49 CFR Ch. V (10–1–02 Edition) § 571.201 254 mm in diameter, at any velocity be- tween 24 kilometers per hour (15 mph) and 29 kilometers per hour (18 mph). S6.1.1 Phase-in Schedule #1 S6.1.1.1 Vehicles manufactured on or after September 1, 1998 and before Sep- tember 1, 1999. Subject to S6.1.5(a), for vehicles manufactured by a manufac- turer on or after September 1, 1998 and before September 1, 1999, the amount of vehicles complying with S7 shall be not less than 10 percent of: (a) The manufacturer’s average an- nual production of vehicles manufac- tured on or after September 1, 1996 and before September 1, 1999, or (b) The manufacturer’s production on or after September 1, 1998 and before September 1, 1999. S6.1.1.2 Vehicles manufactured on or after September 1, 1999 and before Sep- tember 1, 2000. Subject to S6.1.5(b), for vehicles manufactured by a manufac- turer on or after September 1, 1999 and before September 1, 2000, the amount of vehicles complying with S7 shall be not less than 25 percent of: (a) The manufacturer’s average an- nual production of vehicles manufac- tured on or after September 1, 1997 and before September 1, 2000, or (b) The manufacturer’s production on or after September 1, 1999 and before September 1, 2000. S6.1.1.3 Vehicles manufactured on or after September 1, 2000 and before Sep- tember 1, 2001. Subject to S6.1.5(c), for vehicles manufactured by a manufac- turer on or after September 1, 2000 and before September 1, 2001, the amount of vehicles complying with S7 shall be not less than 40 percent of: (a) The manufacturer’s average an- nual production of vehicles manufac- tured on or after September 1, 1998 and before September 1, 2001, or (b) The manufacturer’s production on or after September 1, 2000 and before September 1, 2001. S6.1.1.4 Vehicles manufactured on or after September 1, 2001 and before Sep- tember 1, 2002. Subject to S6.1.5(d), for vehicles manufactured by a manufac- turer on or after September 1, 2001 and before September 1, 2002, the amount of vehicles complying with S7 shall be not less than 70 percent of: (a) The manufacturer’s average an- nual production of vehicles manufac- tured on or after September 1, 1999 and before September 1, 2002, or (b) The manufacturer’s production on or after September 1, 2001 and before September 1, 2002. S6.1.2 Phase-in Schedule #2 S6.1.2.1 Vehicles manufactured on or after September 1, 1998 and before Sep- tember 1, 1999. Subject to S6.1.5(a), for vehicles manufactured by a manufac- turer on or after September 1, 1998 and before September 1, 1999, the amount of vehicles complying with S7 shall be not less than seven percent of: (a) The manufacturer’s average an- nual production of vehicles manufac- tured on or after September 1, 1996 and before September 1, 1999, or (b) The manufacturer’s production on or after September 1, 1998 and before September 1, 1999. S6.1.2.2 Vehicles manufactured on or after September 1, 1999 and before Sep- tember 1, 2000. Subject to S6.1.5(b), for vehicles manufactured by a manufac- turer on or after September 1, 1999 and before September 1, 2000, the amount of vehicles complying with S7 shall be not less than 31 percent of: (a) The manufacturer’s average an- nual production of vehicles manufac- tured on or after September 1, 1997 and before September 1, 2000, or (b) The manufacturer’s production on or after September 1, 1999 and before September 1, 2000. S6.1.2.3 Vehicles manufactured on or after September 1, 2000 and before Sep- tember 1, 2001. Subject to S6.1.5(c), for vehicles manufactured by a manufac- turer on or after September 1, 2000 and before September 1, 2001, the amount of vehicles complying with S7 shall be not less than 40 percent of: (a) The manufacturer’s average an- nual production of vehicles manufac- tured on or after September 1, 1998 and before September 1, 2001, or (b) The manufacturer’s production on or after September 1, 2000 and before September 1, 2001. S6.1.2.4 Vehicles manufactured on or after September 1, 2001 and before Sep- tember 1, 2002. Subject to S6.1.5(d), for vehicles manufactured by a manufac- turer on or after September 1, 2001 and before September 1, 2002, the amount of vehicles complying with S7 shall be not less than 70 percent of: VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00450 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

451 Nat’l Highway Traffic Safety Admin., DOT § 571.201 (a) The manufacturer’s average an- nual production of vehicles manufac- tured on or after September 1, 1999 and before September 1, 2002, or (b) The manufacturer’s production on or after September 1, 2001 and before September 1, 2002. S6.1.3 Phase-in Schedule #3 S6.1.3.1 Vehicles manufactured on or after September 1, 1998 and before Sep- tember 1, 1999 are not required to com- ply with the requirements specified in S7. S6.1.3.2 Vehicles manufactured on or after September 1, 1999 shall comply with the requirements specified in S7. S6.1.4 Phase-in Schedule #4 A final stage manufacturer or alterer may, at its option, comply with the require- ments set forth in S6.1.4.1 and S6.1.4.2. S6.1.4.1 Vehicles manufactured on or after September 1, 1998 and before Sep- tember 1, 2003 are not required to com- ply with the requirements specified in S7. S6.1.4.2 Vehicles manufactured on or after September 1, 2003 shall comply with the requirements specified in S7. S6.1.5 Calculation of complying vehi- cles. (a) For the purposes of complying with S6.1.1.1 or S6.1.2.1, a manufacturer may count a vehicle if it is manufac- tured on or after May 8, 1997, but before September 1, 1999. (b) For the purposes of complying with S6.1.1.2 or S6.1.2.2, a manufacturer may count a vehicle if it: (1) Is manufactured on or after May 8, 1997, but before September 1, 2000, and (2) Is not counted toward compliance with S6.1.1.1 or S6.1.2.1, as appropriate. (c) For the purposes of complying with S6.1.1.3 or S6.1.2.3, a manufacturer may count a vehicle if it: (1) Is manufactured on or after May 8, 1997, but before September 1, 2001, and (2) Is not counted toward compliance with S6.1.1.1, S6.1.1.2, S6.1.2.1, or S6.1.2.2, as appropriate. (d) For the purposes of complying with S6.1.1.4 or S6.1.2.4, a manufacturer may count a vehicle if it: (1) Is manufactured on or after May 8, 1997, but before September 1, 2002, and (2) Is not counted toward compliance with S6.1.1.1, S6.1.1.2, S6.1.1.3, S6.1.2.1, S6.1.2.2, or S6.1.2.3, as appropriate. S6.1.6 Vehicles produced by more than one manufacturer. S6.1.6.1 For the purpose of calcu- lating average annual production of ve- hicles for each manufacturer and the number of vehicles manufactured by each manufacturer under S6.1.1 through S6.1.4, a vehicle produced by more than one manufacturer shall be attributed to a single manufacturer as follows, subject to S6.1.6.2. (a) A vehicle which is imported shall be attributed to the importer. (b) A vehicle manufactured in the United States by more than one manu- facturer, one of which also markets the vehicle, shall be attributed to the man- ufacturer which markets the vehicle. S6.1.6.2 A vehicle produced by more than one manufacturer shall be attrib- uted to any one of the vehicle’s manu- facturers specified by an express writ- ten contract, reported to the National Highway Traffic Safety Administration under 49 CFR part 589, between the manufacturer so specified and the man- ufacturer to which the vehicle would otherwise be attributed under S6.1.6.1. S6.2 Vehicles manufactured on or after September 1, 2002. Except as provided in S6.3, vehicles manufactured on or after September 1, 2002 shall, when tested under the conditions of S8, conform, at the manufacturer’s option, to either S6.2(a) or S6.2(b). The manufacturer shall select the option by the time it certifies the vehicle and may not there- after select a different option for the vehicle. (a) When tested under the conditions of S8, comply with the requirements specified in S7 at the target locations specified in S10 when impacted by the free motion headform specified in S8.9 at any speed up to and including 24 km/ h (15 mph). The requirements do not apply to any target that cannot be lo- cated using the procedures of S10. (b) When equipped with a dynami- cally deployed upper interior head pro- tection system and tested under the conditions of S8, comply with the re- quirements specified in S7 at the target locations specified in S10 as follows: (1) Targets that are not located over any point inside the area measured VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00451 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

452 49 CFR Ch. V (10–1–02 Edition) § 571.201 along the contour of the vehicle sur- face within 50 mm (2.0 inch) of the pe- riphery of the stowed system projected perpendicularly onto the vehicle inte- rior surface, including mounting and inflation components but exclusive of any cover or covers, shall be impacted by the free motion headform specified in S8.9 at any speed up to and including 24 km/h (15 mph). The requirements do not apply to any targets that cannot be located by using the procedures of S10. (2) Targets that are over any point inside the area measured along the contour of the vehicle interior within 50 mm (2.0 inch) of the periphery of the stowed system projected perpendicu- larly onto the vehicle interior surface, including mounting and inflation com- ponents but exclusive of any cover or covers, when the dynamically deployed upper interior head protection system is not deployed, shall be impacted by the free motion headform specified in S8.9 at any speed up to and including 19 km/h (12 mph) with the system undeployed. The requirements do not apply to any target that cannot be lo- cated using the procedures of S10. (3) Each vehicle shall, when equipped with a dummy test device specified in Part 572, Subpart M, and tested as specified in S8.16 through S8.28, comply with the requirements specified in S7 when crashed into a fixed, rigid pole of 254 mm in diameter, at any velocity be- tween 24 kilometers per hour (15 mph) and 29 kilometers per hour (18 mph). S6.3 A vehicle need not meet the re- quirements of S6.1 through S6.2 for: (a) Any target located on a convert- ible roof frame or a convertible roof linkage mechanism. (b) Any target located rearward of a vertical plane 600 mm behind the seat- ing reference point of the rearmost des- ignated seating position. (c) Any target located rearward of a vertical plane 600 mm behind the seat- ing reference point of the driver’s seat- ing position in an ambulance or a motor home. (d) Any target in a walk-in van-type vehicles. S7 Performance Criterion. The HIC(d) shall not exceed 1000 when calculated in accordance with the following for- mula: HIC t t adt t t t

t

− ( )         − ( ) ∫ 1 2 1 2 5 2 1 1 2 . Where the term a is the resultant head acceleration expressed as a multiple of g (the acceleration of gravity), and t1 and t2 are any two points in time dur- ing the impact which are separated by not more than a 36 millisecond time in- terval. (a) For the free motion headform; HIC(d)=0.75446 (free motion headform HIC)+166.4. (b) For the part 572, subpart M, anthropomorphic test dummy; HIC(d)=HIC. S8 Target location and test conditions. The vehicle shall be tested and the tar- gets specified in S10 located under the following conditions. S8.1 Vehicle test attitude. (a) The vehicle is supported off its suspension at an attitude determined in accordance with S8.1(b). (b) Directly above each wheel open- ing, determine the vertical distance be- tween a level surface and a standard reference point on the test vehicle’s body under the conditions of S8.1(b)(1) through S8.1(b)(3). (1) The vehicle is loaded to its un- loaded vehicle weight, plus its rated cargo and luggage capacity or 136 kg, whichever is less, secured in the lug- gage area. The load placed in the cargo area is centered over the longitudinal centerline of the vehicle. (2) The vehicle is filled to 100 percent of all fluid capacities. (3) All tires are inflated to the manu- facturer’s specifications listed on the vehicle’s tire placard. S8.2 Windows and Sunroofs. (a) Movable vehicle windows are placed in the fully open position. (b) For testing, any window on the opposite side of the longitudinal cen- terline of the vehicle from the target to be impacted may be removed. (c) For testing, movable sunroofs are placed in the fully open position. S8.3 Convertible tops. The top, if any, of convertibles and open-body type ve- hicles is in the closed passenger com- partment configuration. S8.4 Doors. VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00452 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T ER04AU98.002

453 Nat’l Highway Traffic Safety Admin., DOT § 571.201 (a) Except as provided in S8.4(b) or S8.4(c), doors, including any rear hatchback or tailgate, are fully closed and latched but not locked. (b) During testing, any side door on the opposite side of the longitudinal centerline of the vehicle from the tar- get to be impacted may be open or re- moved. (c) During testing, any rear hatchback or tailgate may be open or removed for testing any target except targets on the rear header, rearmost pillars, or the rearmost other side rail on either side of the vehicle. S8.5 Sun visors. Each sun visor shall be placed in any position where one side of the visor is in contact with the vehicle interior surface (windshield, side rail, front header, roof, etc.). S8.6 Steering wheel and seats. (a) During targeting, the steering wheel and seats may be placed in any position intended for use while the ve- hicle is in motion. (b) During testing, the steering wheel and seats may be removed from the ve- hicle. S8.7 Seat belt anchorages. If a target is on a seat belt anchorage, and if the seat belt anchorage is adjustable, tests are conducted with the anchorage ad- justed to a point midway between the two extreme adjustment positions. If the anchorage has distinct adjustment positions, none of which is midway be- tween the two extreme positions, tests are conducted with the anchorage ad- justed to the nearest position above the midpoint of the two extreme posi- tions. S8.8 Temperature and humidity. (a) The ambient temperature is be- tween 19 degrees C. and 26 degrees C., at any relative humidity between 10 percent and 70 percent. (b) Tests are not conducted unless the headform specified in S8.9 is ex- posed to the conditions specified in S8.8(a) for a period not less than four hours. S8.9 Headform. The headform used for testing conforms to the specifica- tions of part 572, subpart L of this chapter. S8.10 Forehead impact zone. The fore- head impact zone of the headform is de- termined according to the procedure specified in (a) through (f). (a) Position the headform so that the baseplate of the skull is horizontal. The midsagittal plane of the headform is designated as Plane S. (b) From the center of the threaded hole on top of the headform, draw a 69 mm line forward toward the forehead, coincident with Plane S, along the con- tour of the outer skin of the headform. The front end of the line is designated as Point P. From Point P, draw a 100 mm line forward toward the forehead, coincident with Plane S, along the con- tour of the outer skin of the headform. The front end of the line is designated as Point O. (c) Draw a 125 mm line which is coin- cident with a horizontal plane along the contour of the outer skin of the forehead from left to right through Point O so that the line is bisected at Point O. The end of the line on the left side of the headform is designated as Point a and the end on the right as Point b. (d) Draw another 125 mm line which is coincident with a vertical plane along the contour of the outer skin of the forehead through Point P so that the line is bisected at Point P. The end of the line on the left side of the headform is designated as Point c and the end on the right as Point d. (e) Draw a line from Point a to Point c along the contour of the outer skin of the headform using a flexible steel tape. Using the same method, draw a line from Point b to Point d. (f) The forehead impact zone is the surface area on the FMH forehead bounded by lines a-O-b and c-P-d, and a-c and b-d. S8.11 Target circle. The area of the vehicle to be impacted by the headform is marked with a solid circle 12.7 mm in diameter, centered on the targets spec- ified in S10, using any transferable opaque coloring medium. S8.12 Location of head center of grav- ity. (a) Location of head center of gravity for front outboard designated seating po- sitions (CG–F). For determination of head center of gravity, all directions are in reference to the seat orientation. (1) Location of rearmost CG–F (CG–F2). For front outboard designated seating positions, the head center of gravity with the seat in its rearmost normal VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00453 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

454 49 CFR Ch. V (10–1–02 Edition) § 571.201 design driving or riding position (CG– F2) is located 160 mm rearward and 660 mm upward from the seating reference point. (2) Location of forwardmost CG–F (CG– F1). For front outboard designated seating positions, the head center of gravity with the seat in its forwardmost adjustment position (CG– F1) is located horizontally forward of CG–F2 by the distance equal to the fore-aft distance of the seat track. (b) Location of head center of gravity for rear outboard designated seating posi- tions (CG–R). For rear outboard des- ignated seating positions, the head cen- ter of gravity (CG–R) is located 160 mm rearward, relative to the seat orienta- tion, and 660 mm upward from the seat- ing reference point. S8.13 Impact configuration. S8.13.1 The headform is launched from any location inside the vehicle which meets the conditions of S8.13.4. At the time of launch, the midsagittal plane of the headform is vertical and the headform is upright. S8.13.2 The headform travels freely through the air, along a velocity vector that is perpendicular to the headform’s skull cap plate, not less than 25 mm be- fore making any contact with the vehi- cle. S8.13.3 At the time of initial contact between the headform and the vehicle interior surface, some portion of the forehead impact zone of the headform must contact some portion of the tar- get circle. S8.13.4 Approach Angles. The headform launching angle is as speci- fied in Table 1. For components for which Table 1 specifies a range of an- gles, the headform launching angle is within the limits determined using the procedures specified in S8.13.4.1 and S8.13.4.2, and within the range specified in Table I, using the orthogonal ref- erence system specified in S9. TABLE 1.—APPROACH ANGLE LIMITS [In degrees] Target component Horizontal angle Vertical angle Front Header ............................... 180 0–50 Rear Header ................................ 0 or 360 0–50 Left Side Rail ............................... 270 0–50 Right Side Rail ............................. 90 0–50 Left Sliding Door Track ................ 270 0–50 Right Sliding Door Track ............. 90 0–50 TABLE 1.—APPROACH ANGLE LIMITS— Continued [In degrees] Target component Horizontal angle Vertical angle Left A-Pillar .................................. 195–255 ¥5–50 Right A-Pillar ................................ 105–165 ¥5–50 Left B-Pillar .................................. 195–345 ¥10–50 Right B-Pillar ................................ 15–165 ¥10–50 Other Left Pillars .......................... 270 ¥10–50 Other Right Pillars ....................... 90 ¥10–50 Left Rearmost Pillar ..................... 270–345 ¥10–50 Right Rearmost Pillar .................. 15–90 ¥10–50 Upper Roof .................................. Any 0–50 Overhead Rollbar ........................ 0 or 180 0–50 Brace or Stiffener ........................ 90 or 270 0–50 Seat Belt Anchorages .................. Any 0–50 S8.13.4.1 Horizontal Approach Angles for Headform Impacts. (a) Left A-Pillar Horizontal Approach Angles. (1) Locate a line formed by the short- est horizontal distance between CG–F1 for the left seat and the right A-pillar. The maximum horizontal approach angle for the left A-pillar equals 360 de- grees minus the angle formed by that line and the X-axis of the vehicle, measured counterclockwise. (2) Locate a line formed by the short- est horizontal distance between CG–F2 for the left seat and the left A-pillar. The minimum horizontal approach angle for the left A-pillar impact equals the angle formed by that line and the X-axis of the vehicle, measured counterclockwise. (b) Right A-Pillar Horizontal Approach Angles. (1) Locate a line formed by the short- est horizontal distance between CG–F1 for the right seat and the left A-pillar. The minimum horizontal approach angle for the right A-pillar equals 360 degrees minus the angle formed by that line and the X-axis of the vehicle, measured counterclockwise. (2) Locate a line formed by the short- est horizontal distance between CG–F2 for the right seat and the right A-pil- lar. The maximum horizontal approach angle for the right A-pillar impact equals the angle formed by that line and the X-axis of the vehicle measured counterclockwise. (c) Left B-Pillar Horizontal Approach Angles. (1) Locate a line formed by the short- est horizontal distance between CG–F2 for the left seat and the left B-pillar. VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00454 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

455 Nat’l Highway Traffic Safety Admin., DOT § 571.201 The maximum horizontal approach angle for the left B-pillar equals the angle formed by that line and the X- axis of the vehicle measured counter- clockwise, or 270 degrees, whichever is greater. (2) Locate a line formed by the short- est horizontal distance between CG–R for the left seat and the left B-pillar. The minimum horizontal approach angle for the left B-pillar equals the angle formed by that line and the X- axis of the vehicle measured counter- clockwise. (d) Right B-Pillar Horizontal Approach Angles. (1) Locate a line formed by the short- est horizontal distance between CG–F2 for the right seat and the right B-pil- lar. The minimum horizontal approach angle for the right B-pillar equals the angle formed by that line and the X- axis of the vehicle measured counter- clockwise, or 90 degrees, whichever is less. (2) Locate a line formed by the short- est horizontal distance between CG–R for the right seat and the right B-pil- lar. The maximum horizontal approach angle for the right B-pillar equals the angle between that line and the X-axis of the vehicle measured counter- clockwise. S8.13.4.2 Vertical Approach Angles (a) Position the forehead impact zone in contact with the selected target at the prescribed horizontal approach angle. If a range of horizontal approach angles is prescribed, position the fore- head impact zone in contact with the selected target at any horizontal ap- proach angle within the range which may be used for testing. (b) Keeping the forehead impact zone in contact with the target, rotate the FMH upward until the lip, chin or other part of the FMH contacts the component or other portion of the ve- hicle interior. (1) Except as provided in S8.13.4.2(b)(2), keeping the forehead im- pact zone in contact with the target, rotate the FMH downward by 5 degrees for each target to determine the max- imum vertical angle. (2) For all pillars except A-Pillars, keeping the forehead impact zone in contact with the target, rotate the FMH downward by 10 degrees for each target to determine the maximum vertical angle. S8.14 Multiple impacts. (a) A vehicle being tested may be im- pacted multiple times, subject to the limitations in S8.14 (b) and (c). (b) As measured as provided in S8.14(d), impacts within 300 mm of each other may not occur less than 30 min- utes apart. (c) As measured as provided in S8.14(d), no impact may occur within 150 mm of any other impact. (d) For S8.14(b) and S8.14(c), the dis- tance between impacts is the distance between the centers of the target circle specified in S8.11 for each impact, measured along the vehicle interior. S8.15 Upper Roof. The upper roof of a vehicle is determined according to the procedure specified in S8.15 (a) through (h). (a) Locate the transverse vertical plane A at the forwardmost point where it contacts the interior roof (including trim) at the vehicle center- line. (b) Locate the transverse vertical plane B at the rearmost point where it contacts the interior roof (including trim) at the vehicle centerline. (c) Measure the horizontal distance (D1) between Plane A and Plane B. (d) Locate the vertical longitudinal plane C at the leftmost point at which a vertical transverse plane, located 300 mm rearward of the A-pillar reference point described in S10.1(a), contacts the interior roof (including trim). (e) Locate the vertical longitudinal plane D at the rightmost point at which a vertical transverse plane, lo- cated 300 mm rearward of the A-pillar reference point described in S10.1(a), contacts the interior roof (including trim). (f) Measure the horizontal distance (D2) between Plane C and Plane D. (g) Locate a point (Point M) on the interior roof surface, midway between Plane A and Plane B along the vehicle longitudinal centerline. (h) The upper roof zone is the area of the vehicle upper interior surface bounded by the four planes described in S8.15(h)(1) and S8.15(h)(2): (1) A transverse vertical plane E lo- cated at a distance of (.35 D1) forward of Point M and a transverse vertical VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00455 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

456 49 CFR Ch. V (10–1–02 Edition) § 571.201 plane F located at a distance of (.35 D1) rearward of Point M, measured hori- zontally. (2) A longitudinal vertical plane G lo- cated at a distance of (.35 D2) to the left of Point M and a longitudinal vertical plane H located at a distance of (.35 D2) to the right of Point M, measured horizontally. S8.16 Test weight—vehicle to pole test. Each vehicle shall be loaded to its un- loaded vehicle weight, plus 136 kilo- grams (300 pounds) or its rated cargo and luggage capacity (whichever is less), secured in the luggage or load- carrying area, plus the weight of the necessary anthropomorphic test dummy. Any added test equipment shall be located away from impact areas in secure places in the vehicle. S8.17 Vehicle test attitude—vehicle to pole test. Determine the distance be- tween a level surface and a standard reference point on the test vehicle’s body, directly above each wheel open- ing, when the vehicle is in its ‘‘as deliv- ered’’ condition. The ‘‘as delivered’’ condition is the vehicle as received at the test site, filled to 100 percent of all fluid capacities and with all tires in- flated to the manufacturer’s specifica- tions listed on the vehicle’s tire placard. Determine the distance be- tween the same level surface and the same standard reference points in the vehicle’s ‘‘fully loaded condition.’’ The ‘‘fully loaded condition’’ is the test ve- hicle loaded in accordance with S8.16. The load placed in the cargo area shall be centered over the longitudinal cen- terline of the vehicle. The pretest vehi- cle attitude shall be the same as either the ‘‘as delivered’’ or ‘‘fully loaded’’ at- titude or is between the ‘‘as delivered’’ attitude and the ‘‘fully loaded’’ atti- tude. If the test configuration requires that the vehicle be elevated off the ground, the pretest vehicle attitude must be maintained. S8.18 Adjustable seats—vehicle to pole test. Initially, adjustable seats shall be adjusted as specified in S6.3 of Stand- ard 214 (49 CFR 571.214). S8.19 Adjustable seat back place- ment—vehicle to pole test. Initially, posi- tion adjustable seat backs in the man- ner specified in S6.4 of Standard 214 (49 CFR 571.214). S8.20 Adjustable steering wheels—ve- hicle to pole test. Adjustable steering controls shall be adjusted so that the steering wheel hub is at the geometric center of the locus it describes when it is moved through its full range of driv- ing positions. S8.21 Windows and sunroof—vehicle to pole test. Movable windows and vents shall be placed in the fully open posi- tion. Any sunroof shall be placed in the fully closed position. S8.22 Convertible tops—vehicle to pole test. The top, if any, of convertibles and open-body type vehicles shall be in the closed passenger compartment configu- ration. S8.23 Doors—vehicle to pole test. Doors, including any rear hatchback or tailgate, shall be fully closed and latched but not locked. S8.24 Impact reference line—vehicle to pole test. On the striking side of the ve- hicle, place an impact reference line at the intersection of the vehicle exterior and a transverse vertical plane passing through the center of gravity of the head of the dummy seated in accord- ance with S8.28, in the front outboard designated seating position. S8.25 Rigid Pole—vehicle to pole test. The rigid pole is a vertical metal struc- ture beginning no more than 102 milli- meters (4 inches) above the lowest point of the tires on the striking side of the test vehicle when the vehicle is loaded as specified in S8.16 and extend- ing above the highest point of the roof of the test vehicle. The pole is 254 mm ±3 mm (10 inches) in diameter and set off from any mounting surface, such as a barrier or other structure, so that the test vehicle will not contact such a mount or support at any time within 100 milliseconds of the initiation of ve- hicle to pole contact. S8.26 Impact configuration—vehicle to pole test. The rigid pole shall be sta- tionary. The test vehicle shall be pro- pelled sideways so that its line of for- ward motion forms an angle of 90 de- grees (±3 degrees) with the vehicle’s longitudinal center line. The impact reference line shall be aligned with the center line of the rigid pole so that, when the vehicle-to-pole contact oc- curs, the center line of the pole con- tacts the vehicle area bounded by two transverse vertical planes 38 mm (1.5 VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00456 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

457 Nat’l Highway Traffic Safety Admin., DOT § 571.201 inches) forward and aft of the impact reference line. S8.27 Anthropomorphic test dummy— vehicle to pole test. S8.27.1 The anthropomorphic test dummy used for evaluation of a vehi- cle’s head impact protection shall con- form to the requirements of subpart M of part 572 of this chapter (49 CFR part 572, subpart M). In a test in which the test vehicle is striking its left side, the dummy is to be configured and instru- mented to strike on its left side, in ac- cordance with subpart M of part 572. In a test in which the test vehicle is strik- ing its right side, the dummy is to be configured and instrumented to strike its right side, in accordance with sub- part M of part 572. S8.27.2 The part 572, subpart M, test dummy specified is clothed in form fit- ting cotton stretch garments with short sleeves and midcalf length pants. Each foot of the test dummy is equipped with a size 11EEE shoe, which meets the configuration size, sole, and heel thickness specifications of MIL–S– 13192 (1976) and weighs 0.57 ±0.09 kilo- grams (1.25 ±0.2 pounds). S8.27.3 Limb joints shall be set at between 1 and 2 g’s. Leg joints are ad- justed with the torso in the supine po- sition. S8.27.4 The stabilized temperature of the test dummy at the time of the side impact test shall be at any tempera- ture between 20.6 degrees C. and 22.2 de- grees C. S8.27.5 The acceleration data from the accelerometers installed inside the skull cavity of the test dummy are processed according to the practices set forth in SAE Recommended Prac- tice J211, March 1995, ‘‘Instrumentation for Impact Tests,’’ Class 1000. S8.28 Positioning procedure for the Part 572 Subpart M Test Dummy—vehicle to pole test. The part 572, subpart M, test dummy shall be initially posi- tioned in the front outboard seating position on the struck side of the vehi- cle in accordance with the provisions of S7 of Standard 214, 49 CFR 571.214, and the vehicle seat shall be positioned as specified in S6.3 and S6.4 of that stand- ard. The position of the dummy shall then be measured as follows. Locate the horizontal plane passing through the dummy head center of gravity. Identify the rearmost point on the dummy head in that plane. Construct a line in the plane that contains the rearward point of the front door day- light opening and is perpendicular to the longitudinal vehicle centerline. Measure the longitudinal distance be- tween the rearmost point on the dummy head and this line. If this dis- tance is less than 50 mm (2 inches) or the point is not forward of the line, then the seat and/or dummy positions shall be adjusted as follows. First, the seat back angle is adjusted, a max- imum of 5 degrees, until a 50 mm (2 inches) distance is achieved. If this is not sufficient to produce the 50 mm (2 inches) distance, the seat is moved for- ward until the 50 mm (2 inches) dis- tance is achieved or until the knees of the dummy contact the dashboard or knee bolster, whichever comes first. If the required distance cannot be achieved through movement of the seat, the seat back angle shall be ad- justed even further forward until the 50mm (2 inches) distance is obtained or until the seat back is in its full upright locking position. S9. Orthogonal Reference System. The approach angles specified in S8.13.4 are determined using the reference system specified in S9.1 through S9.4. S9.1 An orthogonal reference system consisting of a longitudinal X axis and a transverse Y axis in the same hori- zontal plane and a vertical Z axis through the intersection of X and Y is used to define the horizontal direction of approach of the headform. The X–Z plane is the vertical longitudinal zero plane and is parallel to the longitu- dinal centerline of the vehicle. The X– Y plane is the horizontal zero plane parallel to the ground. The Y–Z plane is the vertical transverse zero plane that is perpendicular to the X–Y and X– Z planes. The X coordinate is negative forward of the Y–Z plane and positive to the rear. The Y coordinate is nega- tive to the left of the X–Z plane and positive to the right. The Z coordinate is negative below the X–Y plane and positive above it. (See Figure 1.) S9.2 The origin of the reference sys- tem is the center of gravity of the headform at the time immediately prior to launch for each test. VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00457 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

458 49 CFR Ch. V (10–1–02 Edition) § 571.201 S9.3 The horizontal approach angle is the angle between the X axis and the headform impact velocity vector pro- jected onto the horizontal zero plane, measured in the horizontal zero plane in the counter-clockwise direction. A 0 degree horizontal vector and a 360 de- gree horizontal vector point in the positive X direction; a 90 degree hori- zontal vector points in the positive Y direction; a 180 degree horizontal vec- tor points in the negative X direction; and a 270 horizontal degree vector points in the negative Y direction. (See Figure 2.) S9.4 The vertical approach angle is the angle between the horizontal plane and the velocity vector, measured in the midsagittal plane of the headform. A 0 degree vertical vector in Table I co- incides with the horizontal plane and a vertical vector of greater than 0 de- grees in Table I makes a upward angle of the same number of degrees with that plane. S10 Target Locations. (a) The target locations specified in S10.1 through S10.13 are located on both sides of the vehicle and, except as specified in S10(b), are determined using the procedures specified in those paragraphs. (b) Except as specified in S10(c), in instances in which there is no combina- tion of horizontal and vertical angles specified in S8.13.4 at which the fore- head impact zone of the free motion headform can contact one of the tar- gets located using the procedures in S10.1 through S10.13, the center of that target is moved to any location that is within a sphere with a radius of 25 mm, centered on the center of the original target, and that can be contacted by the forehead impact zone at one or more combination of angles. (c) If there is no point within the sphere specified in S10(b) which the forehead impact zone of the free mo- tion headform can contact at one or more combination of horizontal and vertical angles specified in S8.13.4, the radius of the sphere is increased by 25 mm increments until the sphere con- tains at least one point that can be contacted at one or more combination of angles. S10.1 A-pillar targets (a) A-pillar reference point and target AP1. On the vehicle exterior, locate a transverse vertical plane (Plane 1) which contacts the rearmost point of the windshield trim. The intersection of Plane 1 and the vehicle exterior sur- face is Line 1. Measuring along the ve- hicle exterior surface, locate a point (Point 1) on Line 1 that is 125 mm in- board of the intersection of Line 1 and a vertical plane tangent to the vehicle at the outboardmost point on Line 1 with the vehicle side door open. Meas- uring along the vehicle exterior surface in a longitudinal vertical plane (Plane 2) passing through Point 1, locate a point (Point 2) 50 mm rearward of Point 1. Locate the A-pillar reference point (Point APR) at the intersection of the interior roof surface and a line that is perpendicular to the vehicle ex- terior surface at Point 2. Target AP1 is located at point APR. (b) Target AP2. Locate the horizontal plane (Plane 3) which intersects point APR. Locate the horizontal plane (Plane 4) which is 88 mm below Plane 3. Target AP2 is the point in Plane 4 and on the A-pillar which is closest to CG– F2 for the nearest seating position. (c) Target AP3. Locate the horizontal plane (Plane 5) containing the highest point at the intersection of the dash- board and the A-pillar. Locate a hori- zontal plane (Plane 6) half-way between Plane 3 and Plane 5. Target AP3 is the point on Plane 6 and the A-pillar which is closest to CG–F1 for the nearest seating position. S10.2 B-pillar targets. (a) B-pillar reference point and target BP1. Locate the point (Point 3) on the vehicle interior at the intersection of the horizontal plane passing through the highest point of the forwardmost door opening and the centerline of the width of the B-pillar, as viewed lat- erally. Locate a transverse vertical plane (Plane 7) which passes through Point 3. Locate the point (Point 4) at the intersection of the interior roof surface, Plane 7, and the plane, de- scribed in S8.15(h), defining the nearest edge of the upper roof. The B-pillar ref- erence point (Point BPR) is the point located at the middle of the line from Point 3 to Point 4 in Plane 7, measured along the vehicle interior surface. Tar- get BP1 is located at Point BPR. VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00458 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

459 Nat’l Highway Traffic Safety Admin., DOT § 571.201 (b) Target BP2. If a seat belt anchor- age is located on the B-pillar, Target BP2 is located at any point on the an- chorage. (c) Target BP3. Target BP3 is located in accordance with this paragraph. Lo- cate a horizontal plane (Plane 8) which intersects Point BPR. Locate a hori- zontal plane (Plane 9) which passes through the lowest point of the day- light opening forward of the pillar. Lo- cate a horizontal plane (Plane 10) half- way between Plane 8 and Plane 9. Tar- get BP3 is the point located in Plane 10 and on the interior surface of the B-pil- lar, which is closest to CG–F(2) for the nearest seating position. (d) Target BP4. Locate a horizontal plane (Plane 11) half-way between Plane 9 and Plane 10. Target BP4 is the point located in Plane 11 and on the in- terior surface of the B-pillar which is closest to CG–R for the nearest seating position. S10.3 Other pillar targets. (a) Target OP1. (1) Except as provided in S10.3(a)(2), target OP1 is located in accordance with this paragraph. Locate the point (Point 5), on the vehicle interior, at the intersection of the horizontal plane through the highest point of the high- est adjacent door opening or daylight opening (if no adjacent door opening) and the centerline of the width of the other pillar, as viewed laterally. Lo- cate a transverse vertical plane (Plane 12) passing through Point 5. Locate the point (Point 6) at the intersection of the interior roof surface, Plane 12 and the plane, described in S8.15(h), defin- ing the nearest edge of the upper roof. The other pillar reference point (Point OPR) is the point located at the middle of the line between Point 5 and Point 6 in Plane 12, measured along the vehicle interior surface. Target OP1 is located at Point OPR. (2) If a seat belt anchorage is located on the pillar, Target OP1 is any point on the anchorage. (b) Target OP2. Locate the horizontal plane (Plane 13) intersecting Point OPR. Locate a horizontal plane (Plane 14) passing through the lowest point of the daylight opening forward of the pil- lar. Locate a horizontal plane (Plane 15) half-way between Plane 13 and Plane 14. Target OP2 is the point lo- cated on the interior surface of the pil- lar at the intersection of Plane 15 and the centerline of the width of the pil- lar, as viewed laterally. S10.4 Rearmost pillar targets (a) Rearmost pillar reference point and target RP1. Locate the point (Point 7) at the corner of the upper roof nearest to the pillar. The distance between Point M, as described in S8.15(g), and Point 7, as measured along the vehicle interior surface, is D. Extend the line from Point M to Point 7 along the vehi- cle interior surface in the same vertical plane by (3*D/7) beyond Point 7 or until the edge of a daylight opening, whichever comes first, to locate Point

1. The rearmost pillar reference point

(Point RPR) is at the midpoint of the line between Point 7 and Point 8, meas- ured along the vehicle interior. Target RP1 is located at Point RPR. (b) Target RP2. (1) Except as provided in S10.4(b)(2), target RP2 is located in accordance with this paragraph. Locate the hori- zontal plane (Plane 16) through Point RPR. Locate the horizontal plane (Plane 17) 150 mm below Plane 16. Tar- get RP2 is located in Plane 17 and on the pillar at the location closest to CG– R for the nearest designated seating position. (2) If a seat belt anchorage is located on the pillar, Target RP2 is any point on the anchorage. S10.5 Front header targets. (a) Target FH1. Locate the contour line (Line 2) on the vehicle interior trim which passes through the APR and is parallel to the contour line (Line 3) at the upper edge of the windshield on the vehicle interior. Locate the point (Point 9) on Line 2 that is 125 mm inboard of the APR, measured along that line. Locate a longitudinal vertical plane (Plane 18) that passes through Point 9. Target FH1 is located at the intersection of Plane 18 and the upper vehicle interior, halfway be- tween a transverse vertical plane (Plane 19) through Point 9 and a trans- verse vertical plane (Plane 20) through the intersection of Plane 18 and Line 3. (b) Target FH2. (1) Except as provided in S10.5(b)(2), target FH2 is located in accordance with this paragraph. Locate a point (Point 10) 275 mm inboard of Point VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00459 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

460 49 CFR Ch. V (10–1–02 Edition) § 571.201 APR, along Line 2. Locate a longitu- dinal vertical plane (Plane 21) that passes through Point 10. Target FH2 is located at the intersection of Plane 21 and the upper vehicle interior, halfway between a transverse vertical plane (Plane 22) through Point 10 and a trans- verse vertical plane (Plane 23) through the intersection of Plane 21 and Line 3. (2) If a sun roof opening is located forward of the front edge of the upper roof and intersects the mid-sagittal plane of a dummy seated in either front outboard seating position, target FH2 is the nearest point that is forward of a transverse vertical plane (Plane 24) through CG–F(2) and on the intersec- tion of the mid-sagittal plane and the interior sunroof opening. S10.6 Targets on the side rail between the A-pillar and the B-pillar or rearmost pillar in vehicles with only two pillars on each side of the vehicle. (a) Target SR1. Locate a transverse vertical plane (Plane 25) 150 mm rear- ward of Point APR. Locate the point (Point 11) at the intersection of Plane 25 and the upper edge of the forwardmost door opening. Locate the point (Point 12) at the intersection of the interior roof surface, Plane 25 and the plane, described in S8.15(h), defin- ing the nearest edge of the upper roof. Target SR1 is located at the middle of the line between Point 11 and Point 12 in Plane 25, measured along the vehicle interior. (b) Target SR2. Locate a transverse vertical plane (Plane 26) 300 mm rear- ward of the APR or 300 mm forward of the BPR (or the RPR in vehicles with no B-pillar). Locate the point (Point 13) at the intersection of Plane 26 and the upper edge of the forwardmost door opening. Locate the point (Point 14) at the intersection of the interior roof surface, Plane 26 and the plane, de- scribed in S8.15(h), defining the nearest edge of the upper roof. Target SR2 is located at the middle of the line be- tween Point 13 and Point 14 in Plane 26, measured along the vehicle interior. S10.7 Other side rail target (target SR3). (a) Except as provided in S10.7(b), target SR3 is located in accordance with this paragraph. Locate a trans- verse vertical plane (Plane 27) 150 mm rearward of either Point BPR or Point OPR. Locate the point (Point 15) as provided in either S10.7(a)(1) or S10.7(a)(2), as appropriate. Locate the point (Point 16) at the intersection of the interior roof surface, Plane 27 and the plane, described in S8.15(h), defin- ing the nearest edge of the upper roof. Target SR3 is located at the middle of the line between Point 15 and Point 16 in Plane 27, measured along the vehicle interior surface. (1) If Plane 27 intersects a door or daylight opening, the Point 15 is lo- cated at the intersection of Plane 27 and the upper edge of the door opening or daylight opening. (2) If Plane 27 does not intersect a door or daylight opening, the Point 15 is located on the vehicle interior at the intersection of Plane 27 and the hori- zontal plane through the highest point of the door or daylight opening nearest Plane 27. If the adjacent door(s) or day- light opening(s) are equidistant to Plane 27, Point 15 is located on the ve- hicle interior at the intersection of Plane 27 and either horizontal plane through the highest point of each door or daylight opening. (b) Except as provided in S10.7(c), if a grab handle is located on the side rail, target SR3 is located at any point on the anchorage of the grab-handle. Fold- ing grab-handles are in their stowed position for testing. (c) If a seat belt anchorage is located on the side rail, target SR3 is located at any point on the anchorage. S10.8 Rear header target (target RH). Locate the point (Point 17) at the intersection of the surface of the upper vehicle interior, the mid-sagittal plane (Plane 28) of the outboard rearmost dummy and the plane, described in S8.15(h), defining the rear edge of the upper roof. Locate the point (Point 18) as provided in S10.8(a) or S10.8(b), as appropriate. Except as provided in S10.8(c), Target RH is located at the mid-point of the line that is between Point 17 and Point 18 and is in Plane 28, as measured along the surface of the vehicle interior. (a) If Plane 28 intersects a rear door opening or daylight opening, then Point 18 is located at the intersection of Plane 28 and the upper edge of the door opening or the daylight opening (if no door opening). VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00460 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

461 Nat’l Highway Traffic Safety Admin., DOT § 571.201 (b) If Plane 28 does not intersect a rear door opening or daylight opening, then Point 18 is located on the vehicle interior at the intersection of Plane 28 and a horizontal plane through the highest point of the door or daylight opening nearest to Plane 28. If the ad- jacent door(s) or daylight opening(s) are equidistant to Plane 28, Point 18 is located on the vehicle interior at the intersection of Plane 28 and either hor- izontal plane through the highest point of each door or daylight opening. (c) If Target RH is more than 112 mm from Point 18 on the line that is be- tween Point 17 and Point 18 and is in Plane 28, as measured along the surface of the vehicle interior, then Target RH is the point on that line which is 112 mm from Point 18. S10.9 Upper roof target (target UR). Target UR is any point on the upper roof. S10.10 Sliding door track target (target SD). Locate the transverse vertical plane (Plane 29) passing through the middle of the widest opening of the sliding door, measured horizontally and parallel to the vehicle longitudinal centerline. Locate the point (Point 19) at the intersection of the surface of the upper vehicle interior, Plane 29 and the plane, described in S8.15(h), defining the nearest edge of the upper roof. Lo- cate the point (Point 20) at the inter- section of Plane 29 and the upper edge of the sliding door opening. Target SD is located at the middle of the line be- tween Point 19 and Point 20 in Plane 29, measured along the vehicle interior. S10.11 Roll-bar targets. (a) Target RB1. Locate a longitudinal vertical plane (Plane 30) at the mid- sagittal plane of a dummy seated in any outboard designated seating posi- tion. Target RB1 is located on the roll- bar and in Plane 30 at the location closest to either CG–F2 or CG–R, as ap- propriate, for the same dummy. (b) Target RB2. If a seat belt anchor- age is located on the roll-bar, Target RB2 is any point on the anchorage. S10.12 Stiffener targets. (a) Target ST1. Locate a transverse vertical plane (Plane 31) containing ei- ther CG–F2 or CG–R, as appropriate, for any outboard designated seating posi- tion. Target ST1 is located on the stiff- ener and in Plane 31 at the location closest to either CG–F2 or CG–R, as ap- propriate. (b) Target ST2. If a seat belt anchor- age is located on the stiffener, Target ST2 is any point on the anchorage. S10.13 Brace target (target BT) Target BT is any point on the width of the brace as viewed laterally from inside the passenger compartment. VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00461 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

462 49 CFR Ch. V (10–1–02 Edition) § 571.201 VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00462 Fmt 8010 Sfmt 8006 Y:\SGML\197204T.XXX 197204T ER08AP97.008

463 Nat’l Highway Traffic Safety Admin., DOT § 571.202 [62 FR 16725, Apr. 8, 1997; 63 FR 28, Jan. 2, 1998; 63 FR 41464, Aug. 4, 1998; 63 FR 45965, Aug. 28, 1998; 64 FR 7140, Feb. 12, 1999; 64 FR 69671, Dec. 14, 1999; 67 FR 41354, June 18, 2002] § 571.202 Standard No. 202; Head re- straints. S1. Purpose and scope. This standard specifies requirements for head re- straints to reduce the frequency and severity of neck injury in rear-end and other collisions. S2. Application. This standard ap- plies to passenger cars, and to multi- purpose passenger vehicles, trucks and buses with a GVWR of 4,536 kg or less. S3. Definitions. Head restraint means a device that limits rearward angular displacement of the occupant’s head relative to his torso line. S4. Requirements. S4.1 Each passenger car shall com- ply with S4.3. VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00463 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T ER08AP97.009

559 Nat’l Highway Traffic Safety Admin., DOT § 571.209 December 1, 1999, may be used by the Na- tional Highway Traffic Safety Administra- tion to test the suppression system of a vehi- cle that has been certified as being in com- pliance with 49 CFR 571.208 S19. When the re- straint system comes equipped with a remov- able base, the test may be run either with the base attached or without the base. Britax Handle with Care 191 Century Assura 4553 Century Avanta SE 41530 Century Smart Fit 4543 Cosco Arriva 02727 Cosco Opus 35 02603 Evenflo Discovery Adjust Right 212 Evenflo First Choice 204 Evenflo On My Way Position Right V 282 Graco Infant 8457 C. Any of the following forward-facing con- vertible child restraint systems, manufac- tured on or after December 1, 1999, may be used by the National Highway Traffic Safety Administration to test the suppression sys- tem of a vehicle that has been certified as being in compliance with 49 CFR 571.208 S19, or S21: Britax Roundabout 161 Century Encore 4612 Century STE 1000 4416 Cosco Olympian 02803 Cosco Touriva 02519 Evenflo Horizon V 425 Evenflo Medallion 254 D. Any of the following forward-facing tod- dler/belt positioning booster systems, manu- factured on or after December 1, 1999, may be used by the National Highway Traffic Safety Administration as test devices to test the suppression system of a vehicle that has been certified as being in compliance with 49 CFR 571.208 S21 or S23: Britax Roadster 9004 Century Next Step 4920 Cosco High Back Booster 02–442 Evenflo Right Fit 245 [36 FR 22902, Dec. 2, 1971] EDITORIAL NOTE: For FEDERAL REGISTER ci- tations affecting § 571.208, see the List of CFR Sections Affected, which appears in the Finding Aids section of the printed volume and on GPO Access. § 571.209 Standard No. 209; Seat belt assemblies. S1. Purpose and scope. This standard specifies requirements for seat belt as- semblies. S2. Application. This standard applies to seat belt assemblies for use in pas- senger cars, multipurpose passenger ve- hicles, trucks, and buses. S3. Definitions. Adjustment hardware means any or all hardware designed for adjusting the size of a seat belt assem- bly to fit the user, including such hard- ware that may be integral with a buck- le, attachment hardware, or retractor. Attachment hardware means any or all hardware designed for securing the webbing of a seat belt assembly to a motor vehicle. Automatic-locking retractor means a retractor incorporating adjustment hardware by means of a positive self- locking mechanism which is capable when locked of withstanding restraint forces. Buckle means a quick release con- nector which fastens a person in a seat belt assembly. Emergency-locking retractor means a retractor incorporating adjustment hardware by means of a locking mecha- nism that is activated by vehicle accel- eration, webbing movement relative to the vehicle, or other automatic action during an emergency and is capable when locked of withstanding restraint forces. Hardware means any metal or rigid plastic part of a seat belt assembly. Load-limiter means a seat belt assem- bly component or feature that controls tension on the seat belt to modulate the forces that are imparted to occu- pants restrained by the belt assembly during a crash. Nonlocking retractor means a retrac- tor from which the webbing is extended to essentially its full length by a small external force, which provides no ad- justment for assembly length, and which may or may not be capable of sustaining restraint forces at max- imum webbing extension. Pelvic restraint means a seat belt as- sembly or portion thereof intended to restrain movement of the pelvis. Retractor means a device for storing part or all of the webbing in a seat belt assembly. Seat back retainer means the portion of some seat belt assemblies designed to restrict forward movement of a seat back. Seat belt assembly means any strap, webbing, or similar device designed to secure a person in a motor vehicle in order to mitigate the results of any ac- cident, including all necessary buckles and other fasteners, and all hardware VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00559 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

560 49 CFR Ch. V (10– 1– 02 Edition) § 571.209 designed for installing such seat belt assembly in a motor vehicle. Strap means a narrow nonwoven ma- terial used in a seat belt assembly in place of webbing. Type 1 seat belt assembly is a lap belt for pelvic restraint. Type 2 seat belt assembly is a combina- tion of pelvic and upper torso re- straints. Type 2a shoulder belt is an upper torso restraint for use only in conjunction with a lap belt as a Type 2 seat belt as- sembly. Upper torso restraint means a portion of a seat belt assembly intended to re- strain movement of the chest and shoulder regions. Webbing means a narrow fabric woven with continuous filling yarns and fin- ished selvages. S4. Requirements. S4.1 (a) Single occupancy. A seat belt assembly shall be designed for use by one, and only one, person at any one time. (b) Reserved Upper torso restraint. A Type 2 seat belt assembly shall provide upper torso restraint without shifting the pelvic restraint into the abdominal region. An upper torso restraint shall be de- signed to minimize vertical forces on the shoulders and spine. Hardware for upper torso restraint shall be so de- signed and located in the seat belt as- sembly that the possibility of injury to the occupant is minimized. A Type 2a shoulder belt shall comply with applicable requirements for a Type 2 seat belt assembly in S4.1 to S4.4, inclusive. (d) Hardware. All hardware parts which contact under normal usage a person, clothing, or webbing shall be free from burrs and sharp edges. (e) Release. A Type 1 or Type 2 seat belt assembly shall be provided with a buckle or buckles readily accessible to the occupant to permit his easy and rapid removal from the assembly. Buckle release mechanism shall be de- signed to minimize the possibility of accidental release. A buckle with re- lease mechanism in the latched posi- tion shall have only one opening in which the tongue can be inserted on the end of the buckle designed to re- ceive and latch the tongue. (f) Attachment hardware. A seat belt assembly shall include all hardware necessary for installation in a motor vehicle in accordance with Society of Automotive Engineers Recommended Practice J800c, ‘‘Motor Vehicle Seat Belt Installation,’’ November 1973. However, seat belt assemblies designed for installation in motor vehicles equipped with seat belt assembly an- chorages that do not require anchorage nuts, plates, or washers, need not have such hardware, but shall have 7⁄16–20 UNF–2A or 1⁄2–13UNC–2A attachment bolts or equivalent metric hardware. The hardware shall be designed to pre- vent attachment bolts and other parts from becoming disengaged from the ve- hicle while in service. Reinforcing plates or washers furnished for uni- versal floor, installations shall be of steel, free from burrs and sharp edges on the peripheral edges adjacent to the vehicle, at least 1.5 mm in thickness and at least 2580 mm2 in projected area. The distance between any edge of the plate and the edge of the bolt hole shall be at least 15 mm. Any corner shall be rounded to a radius of not less than 6 mm or cut so that no corner angle is less than 135° and no side is less than 6 mm in length. (g) Adjustment. (1) A Type 1 or Type 2 seat belt assembly shall be capable of adjustment to fit occupants whose di- mensions and weight range from those of a 5th-percentile adult female to those of a 95th-percentile adult male. The seat belt assembly shall have ei- ther an automatic-locking retractor, an emergency-locking retractor, or an adjusting device that is within the reach of the occupant. (2) A Type 1 or Type 2 seat belt as- sembly for use in a vehicle having seats that are adjustable shall conform to the requirements of S4.1(g)(1) regard- less of seat position. However, if a seat has a back that is separately adjust- able, the requirements of S4.1(g)(1) need be met only with the seat back in the manufacturer’s nominal design riding position. (3) The adult occupants referred to in S4.1(g)(1) shall have the following measurements: VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00560 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

561 Nat’l Highway Traffic Safety Admin., DOT § 571.209 5th percen- tile adult female 95th percentile adult male Weight ........................... 46.3 kg ............... 97.5 kg. Erect sitting height ........ 785 mm .............. 965 mm. Hip breadth (sitting) ...... 325 mm .............. 419 mm. Hip circumference (sitting). 925 mm .............. 1199 mm. Waist circumference (sitting). 599 mm .............. 1080 mm. Chest depth .................. 190 mm .............. 267 mm. Chest circumference: Nipple ........................ 775 mm .............. 1130 mm. Upper ......................... 757 mm .............. 1130 mm. Lower ......................... 676 mm .............. 1130 mm. (h) Webbing. The ends of webbing in a seat belt assembly shall be protected or treated to prevent raveling. The end of webbing in a seat belt assembly having a metal-to-metal buckle that is used by the occupant to adjust the size of the assembly shall not pull out of the ad- justment hardware at maximum size adjustment. Provision shall be made for essentially unimpeded movement of webbing routed between a seat back and seat cushion and attached to a re- tractor located behind the seat. (i) Strap. A strap used in a seat belt assembly to sustain restraint forces shall comply with the requirements for webbing in S4.2, and if the strap is made from a rigid material, it shall comply with applicable requirements in S4.2, S4.3, and S4.4. (j) Marking. Each seat belt assembly shall be permanently and legibly marked or labeled with year of manu- facture, model, and name or trademark of manufacturer or distributor, or of importer if manufactured outside the United States. A model shall consist of a single combination of webbing having a specific type of fiber weave and con- struction, and hardware having a spe- cific design. Webbings of various colors may be included under the same model, but webbing of each color shall comply with the requirements for webbing in S4.2. (k) Installation instructions. A seat belt assembly, other than a seat belt assembly installed in a motor vehicle by an automobile manufacturer, shall be accompanied by an instruction sheet providing sufficient information for in- stalling the assembly in a motor vehi- cle. The installation instructions shall state whether the assembly is for uni- versal installation or for installation only in specifically stated motor vehi- cles, and shall include at least those items specified in SAE Recommended Practice J800c, ‘‘Motor Vehicle Seat Belt Installations,’’ November 1973. If the assembly is for use only in specifi- cally stated motor vehicles, the assem- bly shall either be permanently and legibly marked or labeled with the fol- lowing statement, or the instruction sheet shall include the following state- ment: This seat belt assembly is for use only in [insert specific seating position(s), e.g., ‘‘front right’’] in [insert specific vehicle make(s) and model(s)]. (l) Usage and maintenance instructions. A seat belt assembly or retractor shall be accompanied by written instruc- tions for the proper use of the assem- bly, stressing particularly the impor- tance of wearing the assembly snugly and properly located on the body, and on the maintenance f the assembly and periodic inspection of all components. The instructions shall show the proper manner of threading webbing in the hardware of seat belt assemblies in which the webbing is not permanently fastened. Instructions for a nonlocking retractor shall include a caution that the webbing must be fully extended from the retractor during use of the seat belt assembly unless the retractor is attached to the free end of webbing which is not subjected to any tension during restraint of an occupant by the assembly. Instructions for Type 2a shoulder belt shall include a warning that the shoulder belt is not to be used without a lap belt. (m) Workmanship. Seat belt assem- blies shall have good workmanship in accordance with good commercial prac- tice. S4.2 Requirements for webbing. (a) Width. The width of the webbing in a seat belt assembly shall be not less than 46 mm, except for portions that do not touch a 95th percentile adult male with the seat in any adjustment posi- tion and the seat back in the manufac- turer’s nominal design riding position when measured under the conditions prescribed in S5.1(a). (b) Breaking strength. The webbing in a seat belt assembly shall have not less than the following breaking strength when tested by the procedures specified in S5.1(b): Type 1 seat belt assembly— 26,689 N; Type 2 seat belt assembly— VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00561 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

562 49 CFR Ch. V (10– 1– 02 Edition) § 571.209 22,241 N for webbing in pelvic restraint and 17,793 N for webbing in upper torso restraint. (c) Elongation. Except as provided in S4.5, the webbing in a seat belt assem- bly shall not extend to more than the following elongation when subjected to the specified forces in accordance with the procedure specified in S5.1(c): Type 1 seat belt assembly—20 percent at 11,120 N; Type 2 seat belt assembly 30 percent at 11,120 N for webbing in pel- vic restraint and 40 percent at 11,120 N for webbing in upper torso restraint. (d) Resistance to abrasion. The web- bing of a seat belt assembly, after being subjected to abrasion as specified in S5.1(d) or S5.3(c), shall have a break- ing strength of not less than 75 percent of the breaking strength listed in S4.2(b) for that type of belt assembly. (e) Resistance to light. The webbing in a seat belt assembly after exposure to the light of a carbon arc and tested by the procedure specified in S5.1(e) shall have a breaking strength not less than 60 percent of the strength before expo- sure to the carbon arc and shall have a color retention not less than No. 2 on the Geometric Gray Scale published by the American Association of Textile Chemists and Colorists, Post Office Box 886, Durham, NC. (f) Resistance to micro-organisms. The webbing in a seat belt assembly after being subjected to micro-organisms and tested by the procedures specified in S5.1(f) shall have a breaking strength not less than 85 percent of the strength before subjection to micro-or- ganisms. S4.3 Requirements for hardware. (a) Corrosion resistance. (1) Attach- ment hardware of a seat belt assembly after being subjected to the conditions specified in S5.2(a) shall be free of fer- rous corrosion on significant surfaces except for permissible ferrous corro- sion at peripheral edges or edges of holes on underfloor reinforcing plates and washers. Alternatively, such hard- ware at or near the floor shall be pro- tected against corrosion by at least an electrodeposited coating of nickel, or copper and nickel with at least a serv- ice condition number of SC2, and other attachment hardware shall be pro- tected by an electrodeposited coating of nickel, or copper and nickel with a service condition number of SC1, in ac- cordance with American Society for Testing and Materials B456–79, ‘‘Standard Specification for Electrodeposited Coatings of Copper Plus Nickel Plus Chromium and Nickel Plus Chromium,’’ but such hardware shall not be racked for electroplating in locations subjected to maximum stress. (2) Surfaces of buckles, retractors and metallic parts, other than attach- ment hardware, of a seat belt assembly after subjection to the conditions spec- ified in S5.2(a) shall be free of ferrous or nonferrous corrosion which may be transferred, either directly or by means of the webbing, to the occupant or his clothing when the assembly is worn. After test, buckles shall conform to applicable requirements in para- graphs (d) to (g) of this section. (b) Temperature resistance. Plastic or other nonmetallic hardware parts of a seat belt assembly when subjected to the conditions specified in S5.2(b) shall not warp or otherwise deteriorate to cause the assembly to operate improp- erly or fail to comply with applicable requirements in this section and S4.4. (c) Attachment hardware. (1) Eye bolts, shoulder bolts, or other bolt used to secure the pelvic restraint of seat belt assembly to a motor vehicle shall withstand a force of 40,034 N when test- ed by the procedure specified in S5.2(c)(1), except that attachment bolts of a seat belt assembly designed for in- stallation in specific models of motor vehicles in which the ends of two or more seat belt assemblies cannot be at- tached to the vehicle by a single bolt shall have breaking strength of not less than 22,241 N. (2) Other attachment hardware de- signed to receive the ends of two seat belt assemblies shall withstand a ten- sile force of at least 26,689 N without fracture of a section when tested by the procedure specified in S5.2(c)(2). (3) A seat belt assembly having single attachment hooks of the quick-dis- connect type for connecting webbing to an eye bolt shall be provided with a re- taining latch or keeper which shall not move more than 2 mm in either the vertical or horizontal direction when tested by the procedure specified in S5.2(c)(3). VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00562 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

563 Nat’l Highway Traffic Safety Admin., DOT § 571.209 (d) Buckle release. (1) The buckle of a Type 1 or Type 2 seat belt assembly shall release when a force of not more than 133 N is applied. (2) A buckle designed for pushbutton application of buckle release force shall have a minimum area of 452 mm2 with a minimum linear dimension of 10 mm for applying the release force, or a buckle designed for lever application of buckle release force shall permit the insertion of a cylinder 10 mm in diame- ter and 38 mm in length to at least the midpoint of the cylinder along the cyl- inder’s entire length in the actuation portion of the buckle release. A buckle having other design for release shall have adequate access for two or more fingers to actuate release. (3) The buckle of a Type 1 or Type 2 seat belt assembly shall not release under a compressive force of 1779 N ap- plied as prescribed in paragraph S5.2(d)(3). The buckle shall be operable and shall meet the applicable require- ment of paragraph S4.4 after the com- pressive force has been removed. (e) Adjustment force. The force re- quired to decrease the size of a seat belt assembly shall not exceed 49 N when measured by the procedure speci- fied in S5.2(e). (f) Tilt-lock adjustment. The buckle of a seat belt assembly having tilt-lock adjustment shall lock the webbing when tested by the procedure specified in S5.2(f) at an angle of not less than 30 degrees between the base of the buckle and the anchor webbing. (g) Buckle latch. The buckle latch of a seat belt assembly when tested by the procedure specified in S5.2(g) shall not fail, nor gall or wear to an extent that normal latching and unlatching is im- paired, and a metal-to-metal buckle shall separate when in any position of partial engagement by a force of not more than 22 N. (h) Nonlocking retractor. The webbing of a seat belt assembly shall extend from a nonlocking retractor within 6 mm of maximum length when a tension is applied as prescribed in S5.2(h). A nonlocking retractor on upper torso re- straint shall be attached to the non- adjustable end of the assembly, the reel of the retractor shall be easily visible to an occupant while wearing the as- sembly, and the maximum retraction force shall not exceed 5 N in any strap or webbing that contacts the shoulder when measured by the procedure speci- fied in S5.2(h), unless the retractor is attached to the free end of webbing which is not subjected to any tension during restraint of an occupant by the assembly. (i) Automatic-locking retractor. The webbing of a seat belt assembly equipped with an automatic locking re- tractor, when tested by the procedure specified in S5.2(i), shall not move more than 25 mm between locking posi- tions of the retractor, and shall be re- tracted with a force under zero accel- eration of not less than 3 N when at- tached to pelvic restraint, and not less that 2 N nor more than 5 N in any strap or webbing that contacts the shoulders of an occupant when the retractor is attached to upper torso restraint. An automatic locking retractor attached to upper torso restraint shall not in- crease the restraint on the occupant of the seat belt assembly during use in a vehicle traveling over rough roads as prescribed in S5.2(i). (j) Emergency-locking retractor. An emergency-locking retractor of a Type 1 or Type 2 seat belt assembly, when tested in accordance with the proce- dures specified in paragraph S5.2(j)— (1) Shall lock before the webbing ex- tends 25 mm when the retractor is sub- jected to an acceleration of 7 m/s2 (0.7 g); (2) Shall not lock, if the retractor is sensitive to webbing withdrawal, before the webbing extends 51 mm when the retractor is subjected to an accelera- tion of 3 m/s2 (0.3 g) or less. (3) Shall not lock, if the retractor is sensitive to vehicle acceleration, when the retractor is rotated in any direc- tion to any angle of 15° or less from its orientation in the vehicle; (4) Shall exert a retractive force of at least 3 N under zero acceleration when attached only to the pelvic restraint; (5) Shall exert a retractive force of not less than 1 N and not more than 5 N under zero acceleration when at- tached only to an upper torso re- straint; (6) Shall exert a retractive force of not less than 1 N and not more than 7 VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00563 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

564 49 CFR Ch. V (10– 1– 02 Edition) § 571.209 N under zero acceleration when at- tached to a strap or webbing that re- strains both the upper torso and the pelvis. (k) Performance of retractor. A retrac- tor used on a seat belt assembly after subjection to the tests specified in S5.2(k) shall comply with applicable re- quirements in paragraphs (h) to (j) of this section and S4.4, except that the retraction force shall be not less than 50 percent of its original retraction force. S4.4 Requirements for assembly per- formance. (a) Type I seat belt assembly. Except as provided in S4.5, the complete seat belt assembly including webbing, straps, buckles, adjustment and attachment hardware, and retractors shall comply with the following requirements when tested by the procedures specified in S5.3(a): (1) The assembly loop shall withstand a force of not less than 22,241 N; that is, each structural component of the as- sembly shall withstand a force of not less than 11,120 N. (2) The assembly loop shall extend not more than 7 inches or 178 mm when subjected to a force of 22,241 N; that is, the length of the assembly between an- chorages shall not increase more than 356 mm. (3) Any webbing cut by the hardware during test shall have a breaking strength at the cut of not less than 18,683 N. (4) Complete fracture through any solid section of metal attachment hardware shall not occur during test. (b) Type 2 seat belt assembly. Except as provided in S4.5, the components of a Type 2 seat belt assembly including webbing, straps, buckles, adjustment and attachment hardware, and retrac- tors shall comply with the following requirements when tested by the proce- dure specified in S5.3(b): (1) The structural components in the pelvic restraint shall withstand a force of not less than 11,120 N. (2) The structural components in the upper torso restraint shall withstand a force of not less than 6,672 N. (3) The structural components in the assembly that are common to pelvic and upper torso restraints shall with- stand a force of not less than 13,345 N. (4) The length of the pelvic restraint between anchorages shall not increase more than 508 mm when subjected to a force of 11,120 N. (5) The length of the upper torso re- straint between anchorages shall not increase more than 508 mm when sub- jected to a force of 6,672 N. (6) Any webbing cut by the hardware during test shall have a breaking strength of not less than 15,569 N at a cut in webbing of the pelvic restraint, or not less than 12,455 N at a cut in webbing of the upper torso restraint. (7) Complete fracture through any solid section of metal attachment hardware shall not occur during test. S4.5 Load-limiter. (a) A Type 1 or Type 2 seat belt assembly that includes a load-limiter is not required to comply with the elongation requirements of S4.2(c), S4.4(a)(2), S4.4(b)(4) or S4.4(b)(5). (b) A seat belt assembly that includes a load limiter and that does not com- ply with the elongation requirements of this standard may be installed in motor vehicles at any designated seat- ing position that is subject to the re- quirements of S5.1 of Standard No. 208 (§ 571.208). S4.6 Manual belts subject to crash pro- tection requirements of Standard No. 208. (a)(1) A manual seat belt assembly, which is subject to the requirements of S5.1 of Standard No. 208 (49 CFR 571.208) by virtue of any provision of Standard No. 208 other than S4.1.2.1(c)(2) of that standard, does not have to meet the re- quirements of S4.2(a)–(f) and S4.4 of this standard. (2) A manual seat belt assembly sub- ject to the requirements of S5.1 of Standard No. 208 (49 CFR 571.208) by virtue of S4.1.2.1(c)(2) of Standard No. 208 does not have to meet the elon- gation requirements of S4.2(c), S4.4(a)(2), S4.4(b)(4), and S4.4(b)(5) of this standard. S5. Demonstration procedures. S5.1 Webbing—(a) Width. The width of webbing from three seat belt assem- blies shall be measured after condi- tioning for at least 24 hours in an at- mosphere having relative humidity be- tween 48 and 67 percent and a tempera- ture of 23° ±2 °C. The tension during measurement of width shall be not more than 22 N on webbing from a Type VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00564 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

565 Nat’l Highway Traffic Safety Admin., DOT § 571.209 1 seat belt assembly, and 9786 N ± 450 N on webbing from a Type 2 seat belt as- sembly. The width of webbing from a Type 2 seat belt assembly may be measured during the breaking strength test described in paragraph (b) of this section. (b) Breaking strength. Webbing from three seat belt assemblies shall be con- ditioned in accordance with paragraph (a) of this section and tested for break- ing strength in a testing machine of ca- pacity verified to have an error of not more than one percent in the range of the breaking strength of the webbing in accordance with American Society for Testing and Materials E4–79 ‘‘Standard Methods of Load Verification of Testing Machines.’’ The machine shall be equipped with split drum grips illustrated in Figure 1, hav- ing a diameter between 51 and 102 mm. The rate of grip separation shall be be- tween 51 and 102 mm per minute. The distance between the centers of the grips at the start of the test shall be between 102 and 254 mm. After placing the specimen in the grips, the webbing shall be stretched continuously at a uniform rate to failure. Each value shall be not less than the applicable breaking strength requirement in S4.2(b), but the median value shall be used for determining the retention of breaking strength in paragraphs (d), (e) and (f) of this section. (c) Elongation. Elongation shall be measured during the breaking strength test described in paragraph (b) of this section by the following procedure: A preload between 196 N and 245 N shall be placed on the webbing mounted in the grips of the testing machine and the needle points of an extensometer, in which the points remain parallel during test, are inserted in the center of the specimen. Initially the points shall be set at a known distance apart between 102 and 203 mm. When the force on the webbing reaches the value specified in S4.2(c), the increase in sep- aration of the points of the exten- someter shall be measured and the per- cent elongation shall be calculated to the nearest 0.5 percent. Each value shall be not more than the appropriate elongation requirement in S4.2(c). (d) Resistance to abrasion. The web- bing from three seat belt assemblies shall be tested for resistance to abra- sion by rubbing over the hexagon bar prescribed in Figure 2 in the following manner: The webbing shall be mounted in the apparatus shown schematically in Figure 2. One end of the webbing (A) shall be attached to a mass (B) of 2.35 kg ± .05 kg, except that a mass of 1.5 kg ± .05 kg shall be used for webbing in pelvic and upper torso restraints of a belt assembly used in a child restraint system. The webbing shall be passed over the two new abrading edges of the hexagon bar (C) and the other end at- tached to an oscillating drum (D) which has a stroke of 330 mm. Suitable guides shall be used to prevent move- ment of the webbing along the axis of hexagonal bar C. Drum D shall be oscil- lated for 5,000 strokes or 2,500 cycles at a rate of 60 ± 2 strokes per minute or 30 ± 1 cycles per minute. The abraded web- bing shall be conditioned as prescribed in paragraph (a) of this section and tested for breaking strength by the procedure described in paragraph (b) of this section. The median values for the breaking strengths determined on ab- raded and unabraded specimens shall be used to calculate the percentage of breaking strength retained. (e) Resistance to light. Webbing at least 508 mm in length from three seat belt assemblies shall be suspended vertically on the inside of the specimen track in a Type E carbon-arc light ex- posure apparatus described in Standard Practice for Generating Light-Expo- sure Apparatus (Carbon-Arc Type) With and Without Water for Exposure of Nonmetallic Materials, ASTM Des- ignation: G23 81, published by the American Society for Testing and Ma- terials, except that the filter used for 100 percent polyester yarns shall be chemically strengthened soda-lime glass with a transmittance of less than 5 percent for wave lengths equal to or less than 305 nanometers and 90 percent or greater transmittance for wave lengths of 375 to 800 nanometers. The apparatus shall be operated without water spray at an air temperature of 60° ± 2 °Celsius ( °C) measured at a point 25 ± 5 mm outside the specimen rack and midway in height. The tem- perature sensing element shall be shielded from radiation. The specimens VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00565 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

566 49 CFR Ch. V (10– 1– 02 Edition) § 571.209 shall be exposed to light from the car- bon-arc for 100 hours and then condi- tioned as prescribed in paragraph (a) of this section. The colorfastness of the exposed and conditioned specimens shall be determined on the Geometric Gray Scale issued by the American As- sociation of Textile Chemists and Colorists. The breaking strength of the specimens shall be determined by the procedure prescribed in paragraph (b) of this section. The median values for the breaking strengths determined on exposed and unexposed specimens shall be used to calculate the percentage of breaking strength retained. (f) Resistance to micro-organisms. Web- bing at least 508 millimeters (mm) in length from three seat belt assemblies shall first be preconditioned in accord- ance with Appendix A(1) and (2) of American Association of Textile Chem- ists and Colorists Test Method 381, ‘‘Fungicides Evaluation on Textiles; Mildew and Rot Resistance of Tex- tiles,’’ and then subjected to Test I, ‘‘Soil Burial Test’’ of that test method. After soil-burial for a period of 2 weeks, the specimen shall be washed in water, dried and conditioned as pre- scribed in paragraph (a) of this section. The breaking strengths of the speci- mens shall be determined by the proce- dure prescribed in paragraph (b) of this section. The median values for the breaking strengths determined on ex- posed and unexposed specimens shall be used to calculate the percentage of breaking strength retained. NOTE: This test shall not be required on webbing made from material which is inher- ently resistant to micro-organisms. S5.2 Hardware. (a) Corrosion resistance. Three seat belt assemblies shall be tested in ac- cordance with American Society for Testing and Materials B11773, ‘‘Standard Method of Salt Spray (Fog) Testing.’’ Any surface coating or mate- rial not intended for permanent reten- tion on the metal parts during service life shall be removed prior to prepara- tion of the test specimens for testing. The period of test shall be 50 hours for all attachment hardware at or near the floor, consisting of two periods of 24 hours exposure to salt spray followed by 1 hour drying and 25 hours for all other hardware, consisting of one pe- riod of 24 hours exposure to salt spray followed by 1 hour drying. In the salt spray test chamber, the parts from the three assemblies shall be oriented dif- ferently, selecting those orientations most likely to develop corrosion on the larger areas. At the end of test, the seat belt assembly shall be washed thoroughly with water to remove the salt. After drying for at least 24 hours under standard laboratory conditions specified in S5.1(a) attachment hard- ware shall be examined for ferrous cor- rosion on significant surfaces, that is, all surfaces that can be contacted by a sphere 19 mm in diameter, and other hardware shall be examined for ferrous and nonferrous corrosion which may be transferred, either directly or by means of the webbing, to a person or his clothing during use of a seat belt assembly incorporating the hardware. NOTE: When attachment and other hard- ware are permanently fastened, by sewing or other means, to the same piece of webbing, separate assemblies shall be used to test the two types of hardware. The test for corrosion resistance shall not be required for attach- ment hardware made from corrosion-resist- ant steel containing at least 11.5 percent chromium or for attachment hardware pro- tected with an electrodeposited coating of nickel, or copper and nickel, as prescribed in S4.3(a). The assembly that has been used to test the corrosion resistance of the buckle shall be used to measure adjustment force, tilt-lock adjustment, and buckle latch in paragraphs (e), (f), and (g), respectively, of this section, assembly performance in S5.3 and buckle release force in paragraph (d) of this section. (b) Temperature resistance. Three seat belt assemblies having plastic or non- metallic hardware or having retractors shall be subjected to the conditions prescribed in Procedure D of American Society for Testing and Materials D756–78, ‘‘Standard Practice for Deter- mination of Weight and Shape Changes of Plastics under Accelerated Service Conditions.’’ The dimension and weight measurement shall be omitted. Buckles shall be unlatched and retractors shall be fully retracted during conditioning. The hardware parts after conditioning shall be used for all applicable tests in S4.3 and S4.4. (c) Attachment hardware. (1) Attach- ment bolts used to secure the pelvic re- straint of a seat belt assembly to a VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00566 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

567 Nat’l Highway Traffic Safety Admin., DOT § 571.209 motor vehicle shall be tested in a man- ner similar to that shown in Figure 3. The load shall be applied at an angle of 45° to the axis of the bolt through at- tachment hardware from the seat belt assembly, or through a special fixture which simulates the loading applied by the attachment hardware. The attach- ment hardware or simulated fixture shall be fastened by the bolt to the an- chorage shown in Figure 3, which has a standard 7⁄16–20UNF–2B or 1⁄2-UNF–2B or metric equivalent threaded hole in a hardened steel plate at least 10 mm in thickness. The bolt shall be installed with two full threads exposed from the fully seated position. The appropriate force required by S4.3(c) shall be ap- plied. A bolt from each of three seat belt assemblies shall be tested. (2) Attachment hardware, other than bolts, designed to receive the ends of two seat belt assemblies shall be sub- jected to a tensile force of 26,689 N in a manner simulating use. The hardware shall be examined for fracture after the force is released. Attachment hardware from three seat belt assemblies shall be tested. (3) Single attachment hook for con- necting webbing to any eye bolt shall be tested in the following manner: The hook shall be held rigidly so that the retainer latch or keeper, with cotter pin or other locking device in place, is in a horizontal position as shown in Figure 4. A force of 667 N ± 9 N shall be applied vertically as near as possible to the free end of the retainer latch, and the movement of the latch by this force at the point of application shall be measured. The vertical force shall be released, and a force of 667 N ± 9 N shall be applied horizontally as near as possible to the free end of the retainer latch. The movement of the latch by this force at the point of load applica- tion shall be measured. Alternatively, the hook may be held in other posi- tions, provided the forces are applied and the movements of the latch are measured at the points indicated in Figure 4. A single attachment hook from each of three seat belt assemblies shall be tested. (d) Buckle release. (1) Three seat belt assemblies shall be tested to determine compliance with the maximum buckle release force requirements, following the assembly test in S5.3. After subjec- tion to the force applicable for the as- sembly being tested, the force shall be reduced and maintained at 667 N on the assembly loop of a Type 1 seat belt as- sembly, 334 N on the components of a Type 2 seat belt assembly. The buckle release force shall be measured by ap- plying a force on the buckle in a man- ner and direction typical of those which would be employed by a seat belt occupant. For push button-release buckles, the force shall be applied at least 3 mm from the edge of the push button access opening of the buckle in a direction that produces maximum re- leasing effect. For lever-release buck- les, the force shall be applied on the centerline of the buckle lever or finger tab in a direction that produces max- imum releasing effect. (2) The area for application of release force on pushbutton actuated buckle shall be measured to the nearest 30 mm2. The cylinder specified in S4.3(d) shall be inserted in the actuation por- tion of a lever released buckle for de- termination of compliance with the re- quirement. A buckle with other release actuation shall be examined for access of release by fingers. (3) The buckle of a Type 1 or Type 2 seat belt assembly shall be subjected to a compressive force of 1779 N applied anywhere on a test line that is coinci- dent with the center line of the belt ex- tended through the buckle or on any line that extends over the center of the release mechanism and intersects the extended centerline of the belt at an angle of 60°. The load shall be applied by using a curved cylindrical bar hav- ing a cross section diameter of 19 mm and a radius of curvature of 152 mm, placed with its longitudinal center line along the test line and its center di- rectly above the point or the buckle to which the load will be applied. The buckle shall be latched, and a tensile force of 334 N shall be applied to the connected webbing during the applica- tion of the compressive force. Buckles from three seat belt assemblies shall be tested to determine compliance with paragraph S4.3(d)(3). (e) Adjustment Force. Three seat belt assemblies shall be tested for adjust- ment force on the webbing at the buck- le, or other manual adjusting device VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00567 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

568 49 CFR Ch. V (10– 1– 02 Edition) § 571.209 normally used to adjust the size of the assembly. With no load on the anchor end, the webbing shall be drawn through the adjusting device at a rate of 508 mm ±50 mm per minute and the maximum force shall be measured to the nearest 1 N after the first 25 mm of webbing movement. The webbing shall be precycled 10 times prior to measure- ment. (f) Tilt-lock adjustment. This test shall be made on buckles or other manual adjusting devices having tilt-lock ad- justment normally used to adjust the size of the assembly. Three buckles or devices shall be tested. The base of the adjustment mechanism and the anchor end of the webbing shall be oriented in planes normal to each other. The web- bing shall be drawn through the adjust- ment mechanism in a direction to in- crease belt length at a rate of 508 mm ±50 mm per minute while the plane of the base is slowly rotated in a direc- tion to lock the webbing. Rotation shall be stopped when the webbing locks, but the pull on the webbing shall be continued until there is a resistance of at least 89 N. The locking angle be- tween the anchor end of the webbing and the base of the adjustment mecha- nism shall be measured to the nearest degree. The webbing shall be precycled 10 times prior to measurement. (g) Buckle latch. The buckles from three seat belt assemblies shall be opened fully and closed at least 10 times. Then the buckles shall be clamped or firmly held against a flat surface so as to permit normal move- ment of buckle part, but with the metal mating plate (metal-to-metal buckles) or of webbing end (metal-to- webbing buckles) withdrawn from the buckle. The release mechanism shall be moved 200 times through the maximum possible travel against its stop with a force of 133 N ±13 N at a rate not to ex- ceed 30 cycles per minute. The buckle shall be examined to determine compli- ance with the performance require- ments of S4.3(g). A metal-to-metal buckle shall be examined to determine whether partial engagement is possible by means of any technique representa- tive of actual use. If partial engage- ment is possible, the maximum force of separation when in such partial en- gagement shall be determined. (h) Nonlocking retractor. After the re- tractor is cycled 10 times by full exten- sion and retraction of the webbing, the retractor and webbing shall be sus- pended vertically and a force of 18 N shall be applied to extend the webbing from the retractor. The force shall be reduced to 13 N when attached to a pel- vic restraint, or to 5 N per strap or webbing that contacts the shoulder of an occupant when retractor is attached to an upper torso restraint. The resid- ual extension of the webbing shall be measured by manual rotation of the re- tractor drum or by disengaging the re- traction mechanism. Measurements shall be made on three retractors. The location of the retractor attached to upper torso restraint shall be examined for visibility of reel during use of seat belt assembly in a vehicle. NOTE: This test shall not be required on a nonlocking retractor attached to the free end of webbing which is not subjected to any tension during restraint of an occupant by the assembly. (i) Automatic-locking retractor. Three retractors shall be tested in a manner to permit the retraction force to be de- termined exclusive of the gravitational forces on hardware or webbing being retracted. The webbing shall be fully extended from the retractor. While the webbing is being retracted, the average force or retraction within plus or minus 51 mm of 75 percent extension (25 percent retraction) shall be deter- mined and the webbing movement be- tween adjacent locking segments shall be measured in the same region of ex- tension. A seat belt assembly with automatic locking retractor in upper torso restraint shall be tested in a ve- hicle in a manner prescribed by the in- stallation and usage instructions. The retraction force on the occupant of the seat belt assembly shall be determined before and after traveling for 10 min- utes at a speed of 24 kilometers per hour (km/h) or more over a rough road (e.g., Belgian block road) where the oc- cupant is subjected to displacement with respect to the vehicle in both hor- izontal and vertical directions. Meas- urements shall be made with the vehi- cle stopped and the occupant in the normal seated position. (j) Emergency-locking retractor. A re- tractor shall be tested in a manner VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00568 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

569 Nat’l Highway Traffic Safety Admin., DOT § 571.209 that permits the retraction force to be determined exclusive of the gravita- tional forces on hardware or webbing being retracted. The webbing shall be fully extended from the retractor, pass- ing over or through any hardware or other material specified in the installa- tion instructions. While the webbing is being retracted, the lowest force of re- traction within plus or minus 51 mm of 75 percent extension shall be deter- mined. A retractor that is sensitive to webbing withdrawal shall be subjected to an acceleration of 3 m/s2 (0.3 g) with- in a period of 50 milliseconds (ms) while the webbing is at 75 percent ex- tension, to determine compliance with S4.3(j)(2). The retractor shall be sub- jected to an acceleration of 7 m/s2 (0.7 g) within a period of 50 milliseconds (ms), while the webbing is at 75 percent extension, and the webbing movement before locking shall be measured under the following conditions: For a retrac- tor sensitive to webbing withdrawal, the retractor shall be accelerated in the direction of webbing retraction while the retractor drum’s central axis is oriented horizontally and at angles of 45°, 90°, 135°, and 180° to the hori- zontal plane. For a retractor sensitive to vehicle acceleration, the retractor shall be: (1) Accelerated in the horizontal plane in two directions normal to each other, while the retractor drum’s cen- tral axis is oriented at the angle at which it is installed in the vehicle; and, (2) Accelerated in three directions normal to each other while the retrac- tor drum’s central axis is oriented at angles of 45°, 90°, 135°, and 180° from the angle at which it is installed in the ve- hicle, unless the retractor locks by gravitational force when tilted in any direction to any angle greater than 45° from the angle at which it is installed in the vehicle. (k) Performance of retractor. After completion of the corrosion-resistance test described in paragraph (a) of this section, the webbing shall be fully ex- tended and allowed to dry for at least 24 hours under standard laboratory conditions specified in S5.1(a). The re- tractor shall be examined for ferrous and nonferrous corrosion which may be transferred, either directly or by means of the webbing, to a person or his clothing during use of a seat belt assembly incorporating the retractor, and for ferrous corrosion on significant surfaces if the retractor is part of the attachment hardware. The webbing shall be withdrawn manually and al- lowed to retract for 25 cycles. The re- tractor shall be mounted in an appa- ratus capable of extending the webbing fully, applying a force of 89 N at full extension, and allowing the webbing to retract freely and completely. The webbing shall be withdrawn from the retractor and allowed to retract re- peatedly in this apparatus until 2,500 cycles are completed. The retractor and webbing shall then be subjected to the temperature resistance test pre- scribed in paragraph (b) of this section. The retractor shall be subjected to 2,500 additional cycles of webbing with- drawal and retraction. Then, the re- tractor and webbing shall be subjected to dust in a chamber similar to one il- lustrated in Figure 8 containing about 0.9 kg of coarse grade dust conforming to the specification given in Society of Automotive Engineering Rec- ommended Practice J726, ‘‘Air Cleaner Test Code’’ Sept. 1979. The dust shall be agitated every 20 minutes for 5 seconds by compressed air, free of oil and mois- ture, at a gage pressure of 550 ±55 kPa entering through an orifice 1.5 ± 0.1 mm in diameter. The webbing shall be ex- tended to the top of the chamber and kept extended at all times except that the webbing shall be subjected to 10 cy- cles of complete retraction and exten- sion within 1 to 2 minutes after each agitation of the dust. At the end of 5 hours, the assembly shall be removed from the chamber. The webbing shall be fully withdrawn from the retractor manually and allowed to retract com- pletely for 25 cycles. An automatic- locking retractor or a nonlocking re- tractor attached to pelvic restraint shall be subjected to 5,000 additional cycles of webbing withdrawal and re- traction. An emergency locking retrac- tor or a nonlocking retractor attached to upper torso restraint shall be sub- jected to 45,000 additional cycles of webbing withdrawal and retraction be- tween 50 and 100 per cent extension. The locking mechanism of an emer- gency locking retractor shall be actu- ated at least 10,000 times within 50 to VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00569 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

570 49 CFR Ch. V (10– 1– 02 Edition) § 571.209 100 percent extension of webbing during the 50,000 cycles. At the end of test, compliance of the retractors with ap- plicable requirements in S4.3 (h), (i), and (j) shall be determined. Three re- tractors shall be tested for perform- ance. S5.3 Assembly performance— (a) Type 1 seat belt assembly. Three complete seat belt assemblies, including webbing, straps, buckles, adjustment and at- tachment hardware, and retractors, ar- ranged in the form of a loop as shown in Figure 5, shall be tested in the fol- lowing manner: (1) The testing machine shall con- form to the requirements specified in S5.1(b). A double-roller block shall be attached to one head of the testing ma- chine. This block shall consist of two rollers 102 mm in diameter and suffi- ciently long so that no part of the seat belt assembly touches parts of the block other than the rollers during test. The rollers shall be mounted on antifriction bearings and spaced 305 mm between centers, and shall have sufficient capacity so that there is no brinelling, bending or other distortion of parts which may affect the results. An anchorage bar shall be fastened to the other head of the testing machine. (2) The attachment hardware fur- nished with the seat belt assembly shall be attached to the anchorage bar. The anchor points shall be spaced so that the webbing is parallel in the two sides of the loop. The attaching bolts shall be parallel to, or at an angle of 45° or 90° to the webbing, whichever re- sults in an angle nearest to 90° between webbing and attachment hardware ex- cept that eye bolts shall be vertical, and attaching bolts or nonthreaded an- chorages of a seat belt assembly de- signed for use in specific models of motor vehicles shall be installed to produce the maximum angle in use in- dicated by the installation instruc- tions, utilizing special fixtures if nec- essary to simulate installation in the motor vehicle. Rigid adapters between anchorage bar and attachment hard- ware shall be used if necessary to lo- cate and orient the adjustment hard- ware. The adapters shall have a flat support face perpendicular to the threaded hole for the attaching bolt and adequate in area to provide full support for the base of the attachment hardware connected to the webbing. If necessary, a washer shall be used under a swivel plate or other attachment hardware to prevent the webbing from being damaged as the attaching bolt is tightened. (3) The length of the assembly loop from attaching bolt to attaching bolt shall be adjusted to about 1295 mm, or as near thereto as possible. A force of 245 N shall be applied to the loop to re- move any slack in webbing at hard- ware. The force shall be removed and the heads of the testing machine shall be adjusted for an assembly loop be- tween 1220 and 1270 mm in length. The length of the assembly loop shall then be adjusted by applying a force be- tween 89 and 98 N to the free end of the webbing at the buckle, or by the re- traction force of an automatic-locking or emergency-locking retractor. A seat belt assembly that cannot be adjusted to this length shall be adjusted as closely as possible. An automatic-lock- ing or emergency locking retractor when included in a seat belt assembly shall be locked at the start of the test with a tension on the webbing slightly in excess of the retractive force in order to keep the retractor locked. The buckle shall be in a location so that it does not touch the rollers during test, but to facilitate making the buckle re- lease test in S5.2(d) the buckle should be between the rollers or near a roller in one leg. (4) The heads of the testing machine shall be separated at a rate between 51 and 102 mm per minute until a force of 22,241 ± 222 N is applied to the assembly loop. The extension of the loop shall be determined from measurements of head separation before and after the force is applied. The force shall be decreased to 667 ± 45 N and the buckle release force measured as prescribed in S5.2(d). (5) After the buckle is released, the webbing shall be examined for cutting by the hardware. If the yarns are par- tially or completely severed in a line for a distance of 10 percent or more of the webbing width, the cut webbing shall be tested for breaking strength as specified in S5.1(b) locating the cut in the free length between grips. If there is insufficient webbing on either side of VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00570 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

571 Nat’l Highway Traffic Safety Admin., DOT § 571.209 the cut to make such a test for break- ing strength, another seat belt assem- bly shall be used with the webbing repositioned in the hardware. A tensile force of 11,120 ± 111 N shall be applied to the components or a force of 22,241 ± 222 N shall be applied to the assembly loop. After the force is removed, the breaking strength of the cut webbing shall be determined as prescribed above. (6) If a Type 1 seat belt assembly in- cludes an automatic-locking retractor or an emergency-locking retractor, the webbing and retractor shall be sub- jected to a tensile force of 11,120 ± 111 N with the webbing fully extended from the retractor. (7) If a seat belt assembly has a buck- le in which the tongue is capable of in- verted insertion, one of the three as- semblies shall be tested with the tongue inverted. (b) Type 2 seat belt assembly. Compo- nents of three seat belt assemblies shall be tested in the following man- ner: (1) The pelvic restraint between an- chorages shall be adjusted to a length between 1220 and 1270 mm, or as near this length as possible if the design of the pelvic restraint does not permit its adjustment to this length. An auto- matic-locking or emergency-locking retractor when included in a seat belt assembly shall be locked at the start of the test with a tension on the webbing slightly in excess of the retractive force in order to keep the retractor locked. The attachment hardware shall be oriented to the webbing as specified in paragraph (a)(2) of this section and illustrated in Figure 5. A tensile force 11,120 ± 111 N shall be applied on the components in any convenient manner and the extension between anchorages under this force shall be measured. The force shall be reduced to 334 ± 22 N and the buckle release force measured as prescribed in S5.2(d). (2) The components of the upper torso restraint shall be subjected to a tensile force of 6,672 ± 67 N following the procedure prescribed above for test- ing pelvic restraint and the extension between anchorages under this force shall be measured. If the testing appa- ratus permits, the pelvic and upper torso restraints may be tested simulta- neously. The force shall be reduced to 334 ± 22 N and the buckle release force measured as prescribed in S5.2(d). (3) Any component of the seat belt assembly common to both pelvic and upper torso restraint shall be subjected to a tensile force of 13,344 ± 134 N. (4) After the buckle is released in tests of pelvic and upper torso re- straints, the webbing shall be examined for cutting by the hardware. If the yarns are partially or completely sev- ered in a line for a distance of 10 per- cent or more of the webbing width, the cut webbing shall be tested for break- ing strength as specified in S5.1(b) lo- cating the cut in the free length be- tween grips. If there is insufficient webbing on either side of the cut to make such a test for breaking strength, another seat belt assembly shall be used with the webbing reposi- tioned in the hardware. The force ap- plied shall be 11,120 ± 111 N for compo- nents of pelvic restraint, and 6,672 ± 67 N for components of upper torso re- straint. After the force is removed, the breaking strength of the cut webbing shall be determined as prescribed above. (5) If a Type 2 seat belt assembly in- cludes an automatic-locking retractor or an emergency-locking retractor the webbing and retractor shall be sub- jected to a tensile force of 11,120 ± 111 N with the webbing fully extended from the retractor, or to a tensile force of 6,672 ± 67 N with the webbing fully ex- tended from the retractor if the design of the assembly permits only upper torso restraint forces on the retractor. (6) If a seat belt assembly has a buck- le in which the tongue is capable of in- verted insertion, one of the three as- semblies shall be tested with the tongue inverted. (c) Resistance to buckle abrasion. Seat belt assemblies shall be tested for re- sistance to abrasion by each buckle or manual adjusting device normally used to adjust the size of the assembly. The webbing of the assembly to be used in this test shall be exposed for 4 hours to an atmosphere having relative humid- ity of 65 per cent and temperature of 18 °C. The webbing shall be pulled back and forth through the buckle or man- ual adjusting device as shown sche- matically in Figure 7. The anchor end VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00571 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

572 49 CFR Ch. V (10– 1– 02 Edition) § 571.209 of the webbing (A) shall be attached to a mass (B) of 1.4 kg. The webbing shall pass through the buckle (C), and the other end (D) shall be attached to a re- ciprocating device so that the webbing forms an angle of 8° with the hinge stop (E). The reciprocating device shall be operated for 2,500 cycles at a rate of 18 cycles per minute with a stroke length of 203 mm. The abraded webbing shall be tested for breaking strength by the procedure described in paragraph S5.1(b). VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00572 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

573 Nat’l Highway Traffic Safety Admin., DOT § 571.209 VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00573 Fmt 8010 Sfmt 8006 Y:\SGML\197204T.XXX 197204T EC01AU91.090

574 49 CFR Ch. V (10– 1– 02 Edition) § 571.209 VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00574 Fmt 8010 Sfmt 8006 Y:\SGML\197204T.XXX 197204T EC01AU91.091

575 Nat’l Highway Traffic Safety Admin., DOT § 571.209 [44 FR 72139, Dec. 13, 1979, as amended at 45 FR 29048, May 1, 1980; 46 FR 2620, Jan. 12, 1981; 48 FR 30140, June 30, 1983; 49 FR 36508, Sept. 18, 1984; 51 FR 9813, Mar. 21, 1986; 51 FR 31774, Sept. 5, 1986; 52 FR 44912, Nov. 23, 1987; 56 FR 15299, Apr. 16, 1991; 56 FR 56325, Nov. 4, 1991; 59 VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00575 Fmt 8010 Sfmt 8006 Y:\SGML\197204T.XXX 197204T EC01AU91.092 EC01AU91.093

576 49 CFR Ch. V (10– 1– 02 Edition) § 571.210 FR 17994, Apr. 15, 1994; 61 FR 20171, May 6, 1996; 63 FR 28936, May 27, 1998; 63 FR 51003, Sept. 24, 1998; 64 FR 27206, May 19, 1999] § 571.210 Standard No. 210; Seat belt assembly anchorages. S1. Purpose and scope. This standard establishes requirements for seat belt assembly anchorages to insure their proper location for effective occupant restraint and to reduce the likelihood of their failure. S2. Application. This standard applies to passenger cars, multipurpose pas- senger vehicles, trucks, and buses. S3. Definition. Seat belt anchorage means any component, other than the webbing or straps, involved in transfer- ring seat belt loads to the vehicle structure, including, but not limited to, the attachment hardware, seat frames, seat pedestals, the vehicle structure itself, and any part of the ve- hicle whose failure causes separation of the belt from the vehicle structure. S4. Requirements. S4.1 Type. S4.1.1 Seat belt anchorages for a Type 1 or a Type 2 seat belt assembly shall be installed for each designated seating position for which a Type 1 or a Type 2 seat belt assembly is required by Standard No. 208 (49 CFR 571.208). Seat belt anchorages for a Type 2 seat belt assembly shall be installed for each designated seating position for which a Type 2 seat belt assembly is re- quired by Standard No. 208 (49 CFR 571.208). S4.1.2 (a) Notwithstanding the re- quirement of S4.1.1, each vehicle manu- factured on or after September 1, 1987 that is equipped with an automatic re- straint at the front right outboard des- ignated seating position, which auto- matic restraint cannot be used for se- curing a child restraint system or can- not be adjusted by the vehicle owner to secure a child restraint system solely through the use of attachment hard- ware installed as an item of original equipment by the vehicle manufac- turer, shall have, at the manufactur- er’s option, either anchorages for a Type 1 seat belt assembly installed at that position or a Type 1 or Type 2 seat belt assembly installed at that po- sition. If a manufacturer elects to in- stall anchorages for a Type 1 seat belt assembly to comply with this require- ment, those anchorages shall consist of, at a minimum, holes threaded to ac- cept bolts that comply with S4.1(f) of Standard No. 209 (49 CFR 571.209). (b) The requirement in S4.1.1 of this standard that seat belt anchorages for a Type 1 or a Type 2 seat belt assembly shall be installed for certain des- ignated seating positions does not apply to any such seating positions that are equipped with a seat belt as- sembly that meets the frontal crash protection requirements of S5.1 of Standard No. 208 (49 CFR 571.208). S4.2 Strength. S4.2.1 Except as provided in S4.2.5, and except for side-facing seats, the an- chorages, attachment hardware, and attachment bolts for any of the fol- lowing seat belt assemblies shall with- stand a 5,000 pound force when tested in accordance with S5.1 of this standard: (a) Type 1 seat belt assembly; and (b) Lap belt portion of either a Type 2 or automatic seat belt assembly, if such seat belt assembly is equipped with a detachable upper torso belt. S4.2.2 Except as provided in S4.2.5, and except for side facing seats, the an- chorages, attachment hardware, and attachment bolts for any of the fol- lowing seat belt assemblies shall with- stand a 3,000 pound force applied to the lap belt portion of the seat belt assem- bly simultaneously with a 3,000 pound force applied to the shoulder belt por- tion of the seat belt assembly, when tested in accordance with S5.2 of this standard: (a) Type 2 and automatic seat belt as- semblies that are installed to comply with Standard No. 208 (49 CFR 571.208); and (b) Type 2 and automatic seat belt as- semblies that are installed at a seating position required to have a Type 1 or Type 2 seat belt assembly by Standard No. 208 (49 CFR 571.208). S4.2.3 Permanent deformation or rupture of a seat belt anchorage or its surrounding area is not considered to be a failure, if the required force is sus- tained for the specified time. S4.2.4 Anchorages, attachment hardware, and attachment bolts shall VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00576 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

632 49 CFR Ch. V (10– 1– 02 Edition) § 571.215 plane is six inches. To the extent prac- ticable, the left leg of the test dummy is in a vertical longitudinal plane. S7.3.2 For a test dummy in the out- board passenger positions. The upper legs of each test dummy rest against the seat cushion to the extent permitted by placement of the feet. The initial distance between the outboard knee clevis flange surfaces is 11.5 inches. To the extent practicable, both legs of the test dummies in outboard passenger positions are in vertical longitudinal planes. Final adjustment to accommo- date placement of feet in accordance with S7.4 for various passenger com- partment configurations is permitted. S7.4 Feet. S7.4.1 For a test dummy in the driver position. The right foot of the test dummy rests on the undepressed accel- erator with the heel resting as far for- ward as possible on the floorpan. The left foot is set perpendicular to the lower leg with the heel resting on the floorpan in the same lateral line as the right heel. S7.4.2 For a test dummy in the front outboard passenger position. The feet of the test dummy are placed on the vehi- cle’s toeboard with the heels resting on the floorpan as close as possible to the intersection of the toeboard and floorpan. If the feet cannot be placed flat on the toeboard, they are set per- pendicular to the lower legs and placed as far forward as possible so that the heels rest on the floorpan. S7.4.3 For a test dummy in either of the rear outboard passenger positions. The feet of the test dummy are placed flat on the floorpan and beneath the front seat as far as possible without front seat interference. If necessary, the distance between the knees can be changed in order to place the feet be- neath the seat. S8. Phase-in of dynamic test and per- formance requirements. S8.1–S8.2 [Reserved] S8.3 Passenger cars manufactured on or after September 1, 1995 and before Sep- tember 1, 1996. S8.3.1 The number of passenger cars complying with the requirements of S3(c) shall be not less than 40 percent of: (a) The average annual production of passenger cars manufactured on or after September 1, 1992, and before Sep- tember 1, 1995, by each manufacturer, or (b) The manufacturer’s annual pro- duction of passenger cars during the period specified in S8.3. S8.4 Passenger cars produced by more than one manufacturer. S8.4.1 For the purposes of calcu- lating average annual production of passenger cars for each manufacturer and the number of passenger cars man- ufactured by each manufacturer under S8.1, S8.2, and S8.3, a passenger car pro- duced by more than one manufacturer shall be attributed to a single manufac- turer as follows, subject to S8.4.2: (a) A passenger car which is imported shall be attributed to the importer. (b) A passenger car manufactured in the United States by more than one manufacturer, one of which also mar- kets the vehicle, shall be attributed to the manufacturer which markets the vehicle. S8.4.2 A passenger car produced by more than one manufacturer shall be attributed to any one of the vehicle’s manufacturers specified by an express written contract, reported to the Na- tional Highway Traffic Safety Admin- istration under 49 CFR part 586, be- tween the manufacturer so specified and the manufacturer to which the ve- hicle would otherwise be attributed under S8.4.1. [36 FR 22902, Dec. 2, 1971, as amended at 45 FR 17018, Mar. 17, 1980; 55 FR 45752, Oct. 30, 1990; 56 FR 27437, June 14, 1991; 56 FR 47011, Sept. 17, 1991; 57 FR 21615, May 21, 1992; 57 FR 30921 and 30922, July 13, 1992; 58 FR 14169, Mar. 16, 1993; 60 FR 38761, July 28, 1995; 60 FR 57839, Nov. 22, 1995; 63 FR 16140, Apr. 2, 1998] § 571.215 [Reserved] § 571.216 Standard No. 216; Roof crush resistance. S1. Scope. This standard establishes strength requirements for the pas- senger compartment roof. S2. Purpose. The purpose of this standard is to reduce deaths and inju- ries due to the crushing of the roof into the occupant compartment in rollover crashes. S3. Application. This standard applies to passenger cars, and to multipurpose passenger vehicles, trucks and buses VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00632 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

633 Nat’l Highway Traffic Safety Admin., DOT § 571.216 with a GVWR of 2722 kilograms or less. However, it does not apply to— (a) School buses; (b) Vehicles that conform to the roll- over test requirements (S5.3) of Stand- ard No. 208 (§ 571.208) by means that re- quire no action by vehicle occupants; or (c) Convertibles, except for optional compliance with the standard as an al- ternative to the rollover test require- ments in S5.3 of Standard No. 208. S4. Definitions. Altered roof means the replacement roof on a motor vehicle whose original roof has been removed, in part or in total, and replaced by a roof that is higher than the original roof. The re- placement roof on a motor vehicle whose original roof has been replaced, in whole or in part, by a roof that con- sists of glazing materials, such as those in T-tops and sunroofs, and is located at the level of the original roof, is not considered to be an altered roof. Raised roof means, with respect to a roof which includes an area that pro- trudes above the surrounding exterior roof structure, that protruding area of the roof. Roof over the front seat area means the portion of the roof, including wind- shield trim, forward of a transverse vertical plane passing through a point 162 mm rearward of the SgRP of the rearmost front outboard seating posi- tion. Windshield trim means molding of any material between the windshield glaz- ing and the exterior roof surface, in- cluding material that covers a part of either the windshield glazing or exte- rior roof surface. S5. Requirements. Subject to S5.1, when the test device described in S6 is used to apply a force to either side of the forward edge of a vehicle’s roof in accordance with the procedures of S7, the lower surface of the test device must not move more than 127 millime- ters. The applied force in Newtons is equal to 1.5 times the unloaded vehicle weight of the vehicle, measured in kilograms and multiplied by 9.8, but does not exceed 22,240 Newtons for pas- senger cars. Both the left and right front portions of the vehicle’s roof structure must be capable of meeting the requirements. A particular vehicle need not meet further requirements after being tested at one location. S5.1 For multipurpose passenger ve- hicles, trucks and buses that have a raised roof or altered roof, manufactur- ers have the option of using the test procedures of S8 instead of the proce- dures of S7 until October 25, 2000. The option of using the test procedures of S8 ceases to be available on that date. S6. Test device. The test device is a rigid unyielding block whose lower sur- face is a flat rectangle measuring 762 millimeters by 1,829 millimeters. S7. Test procedure. Each vehicle must be capable of meeting the requirements of S5 when tested in accordance with the procedure in S7.1 through 7.6. S7.1 Place the sills or the chassis frame of the vehicle on a rigid hori- zontal surface, fix the vehicle rigidly in position, close all windows, close and lock all doors, and secure any convert- ible top or removable roof structure in place over the occupant compartment. Remove roof racks or other non-struc- tural components. S7.2 Orient the test device as shown in Figure 1 of this section, so that— (a) Its longitudinal axis is at a for- ward angle (in side view) of 5 degrees below the horizontal, and is parallel to the vertical plane through the vehicle’s longitudinal centerline; (b) Its transverse axis is at an out- board angle, in the front view projec- tion, of 25 degrees below the horizontal. S7.3 Maintaining the orientation specified in S7.2— (a) Lower the test device until it ini- tially makes contact with the roof of the vehicle. (b) Position the test device so that— (1) The longitudinal centerline on its lower surface is on the initial point of contact, or on the center of the initial contact area, with the roof; and (2) Except as specified in S7.4, the midpoint of the forward edge of the lower surface of the test device is with- in 10 mm of the transverse vertical plane 254 mm forward of the forwardmost point on the exterior sur- face of the roof, including windshield trim, that lies in the longitudinal vertical plane passing through the ve- hicle’s longitudinal centerline. S7.4 If the vehicle being tested is a multipurpose passenger vehicle, truck, VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00633 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

634 49 CFR Ch. V (10– 1– 02 Edition) § 571.216 or bus that has a raised roof or altered roof, and the initial contact point of the test device is on the raised roof or altered roof to the rear of the roof over the front seat area, the plate is posi- tioned so that the midpoint of the rear- ward edge of the lower surface of the test device is within 10 mm of the transverse vertical plane located at the rear of the roof over the front seat area. S7.5 Apply force so that the test de- vice moves in a downward direction perpendicular to the lower surface of the test device at a rate of not more than 13 millimeters per second until reaching the force level specified in S5. Guide the test device so that through- out the test it moves, without rotation, in a straight line with its lower surface oriented as specified in S7.2(a) and S7.2(b). Complete the test within 120 seconds. S7.6 Measure the distance that the test device moved, i.e., the distance be- tween the original location of the lower surface of the test device and its location as the force level specified in S5 is reached. S8 Alternate test procedure for multi- purpose passenger vehicles, trucks and buses that have a raised roof or altered roof manufactured until October 25, 2000 (see S5.1). Each vehicle shall be capable of meeting the requirements of S5 when tested in accordance with the fol- lowing procedure. S8.1 Place the sills or the chassis frame of the vehicle on a rigid hori- zontal surface, fix the vehicle rigidly in position, close all windows, close and lock all doors, and secure any convert- ible top or removable roof structure in place over the passenger compartment. S8.2 Orient the test device as shown in Figure 2, so that— (a) Its longitudinal axis is at a for- ward angle (side view) of 5° below the horizontal, and is parallel to the vertical plane through the vehicle’s longitudinal centerline; (b) Its lateral axis is at a lateral out- board angle, in the front view projec- tion, of 25° below the horizontal; (c) Its lower surface is tangent to the surface of the vehicle; and (d) The initial contact point, or cen- ter of the initial contact area, is on the longitudinal centerline of the lower surface of the test device and 254 milli- meters from the forwardmost point of that centerline. S8.3 Apply force in a downward di- rection perpendicular to the lower sur- face of the test device at a rate of not more than 13 millimeters per second until reaching a force in Newtons of 11⁄2 times the unloaded vehicle weight of the tested vehicle, measured in kilo- grams and multiplied by 9.8. Complete the test within 120 seconds. Guide the test device so that throughout the test it moves, without rotation, in a straight line with its lower surface ori- ented as specified in S8.2(a) through S8.2(d). S8.4 Measure the distance that the test device moves, i.e., the distance be- tween the original location of the lower surface of the test device and its location as the force level specified in S8.3 is reached. FIGURE 1 TO § 571.216 VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00634 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T

635 Nat’l Highway Traffic Safety Admin., DOT § 571.216 FIGURE 2 TO § 571.216 VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00635 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T ER27AP99.032

636 49 CFR Ch. V (10– 1– 02 Edition) § 571.217 [36 FR 23300, Dec. 8, 1971, as amended at 38 FR 21930, Aug. 14, 1973; 56 FR 15517, Apr. 17, 1991; 58 FR 5633, Jan. 22, 1993; 60 FR 13647, Mar. 14, 1995; 64 FR 22578, Apr. 27, 1999; 65 FR 4581, Jan. 31, 2000] § 571.217 Standard No. 217; Bus emer- gency exits and window retention and release. S1. Scope. This standard establishes requirements for the retention of win- dows other than windshields in buses, and establishes operating forces, open- ing dimensions, and markings for bus emergency exits. S2. Purpose. The purpose of this standard is to minimize the likelihood of occupants being thrown from the bus and to provide a means of readily ac- cessible emergency egress. S3. Application. This standard applies to buses, except buses manufactured for the purpose of transporting persons under physical restraint. S4. Definitions. Adjacent seat means a designated seating position located so that some portion of its occupant space is not more than 10 inches from an emergency exit, for a distance of at least 15 inches measured horizontally and parallel to the exit. Daylight opening means the maximum unobstructed opening of an emergency exit when viewed from a direction per- pendicular to the plane of the opening. Mid-point of the passenger compartment means any point on a vertical trans- verse plane bisecting the vehicle longi- tudinal centerline that extends be- tween the two vertical transverse planes which define the foremost and rearmost limits of the passenger com- partment. Occupant space means the space di- rectly above the seat and footwell, bounded vertically by the ceiling and horizontally by the normally posi- tioned seat back and the nearest ob- struction of occupant motion in the di- rection the seat faces. Passenger compartment means space within the school bus interior that is between a vertical transverse plane lo- cated 76 centimeters in front of the forwardmost passenger seating ref- erence point and a vertical transverse plane tangent to the rear interior wall of the bus at the vehicle centerline. Post and roof bow panel space means the area between two adjacent post and roof bows. Push-out window means a vehicle window designed to open outward to provide for emergency egress. VerDate 0ct2002 14:20 Dec 13, 2002 Jkt 197204 PO 00000 Frm 00636 Fmt 8010 Sfmt 8010 Y:\SGML\197204T.XXX 197204T ER31JA00.089

FD07271 ｜ 2003_美国_HAR2003.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2003 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Stretch Limousine Run-Off-Road Crash Near Schoharie, New York October 6, 2018

Accident Report NTSB/HAR-20/03 PB2020-101008

National Transportation Safety Board

NTSB/HAR-20/03 PB2020-101008 Notation 64871 Adopted September 29, 2020

Highway Accident Report Stretch Limousine Run-Off-Road Crash Near Schoharie, New York October 6, 2018

National Transportation Safety Board

490 L’Enfant Plaza, S.W. Washington, D.C. 20594

National Transportation Safety Board. 2020. Stretch Limousine Run-Off-Road Crash, Near Schoharie, New York, October 6, 2018. Highway Accident Report NTSB/HAR-20/03. Washington, DC: NTSB.

Abstract: On October 6, 2018, about 1:55 p.m., a 2001 Ford Excursion XLT stretch limousine, operated by Prestige Limousine and Chauffeur Service, was traveling south on New York State Route 30 (NY-30) near Schoharie, New York. The limousine, occupied by a driver and 17 passengers, was descending a grade that began 1.81 miles north of a T-intersection with New York State Route 30A (NY-30A). The posted speed limit was 55 mph. Although the driver likely applied the brakes while descending the hill, the brake system failed to effectively slow the limousine, and its speed increased to over 100 mph. The driver steered to avoid a car stopped at the NY-30/NY-30A intersection, proceeded past a stop sign, crossed the intersection, and entered the driveway of a restaurant parking lot. The limousine struck an unoccupied sport utility vehicle (SUV) parked in a field adjacent to the driveway. Two pedestrians standing near the SUV were struck by it when the SUV was forced forward by the limousine. The limousine continued into a ravine, where it struck an earthen embankment and several trees. As a result of the crash, 20 people died, including all 18 limousine occupants and the 2 pedestrians

The National Transportation Safety Board (NTSB) identified the following safety issues: inadequate brake system maintenance, vehicle alteration affecting compliance with applicable Federal Motor Vehicle Safety Standards, drivers falsifying medical histories in medical certification examinations for commercial driver’s licenses, ineffective state oversight of intrastate motor carrier operations, and insufficient occupant protection for limousine passengers. On the basis of its findings, the NTSB makes safety recommendations to the Federal Motor Carrier Safety Administration, the State of New York, the New York State Department of Motor Vehicles, and the National Limousine Association.

The NTSB is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties … and are not conducted for the purpose of determining the rights or liabilities of any person” (Title 49 Code of Federal Regulations section 831.4). Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report (Title 49 United States Code section 1154(b)).

For more detailed background information on this report, visit the NTSB investigations website and search for NTSB accident ID HWY19MH001. Recent publications are available in their entirety on the NTSB website. Other information about available publications also may be obtained from the website or by contacting—National Transportation Safety Board; Records Management Division, CIO-40; 490 L’Enfant Plaza, SW; Washington, DC 20594; (800) 877-6799 or (202) 314-6551.

Copies of NTSB publications may be downloaded at no cost from the National Technical Information Service, at the National Technical Reports Library search page, using product number PB2020-101008. For additional assistance, contact—National Technical Information Service; 5301 Shawnee Rd. Alexandria, VA 22312; (800) 553-6847 or (703) 605-6000 or the NTIS website.

NTSB

Highway Accident Report i Contents Figures and Tables ....................................................................................................................... iii Acronyms and Abbreviations .......................................................................................................v Executive Summary .................................................................................................................... vii 1 Factual Information ....................................................................................................................1 1.1 Crash Narrative ..........................................................................................................................1 1.2 Injuries .......................................................................................................................................3 1.3 Emergency Response .................................................................................................................3 1.4 Highway Factors ........................................................................................................................4 1.4.1 General Characteristics ....................................................................................................4 1.4.2 Intersection Crash Location .............................................................................................6 1.4.3 Highway Alignment.........................................................................................................7 1.4.4 Signage ............................................................................................................................9 1.4.5 Crash History .................................................................................................................10 1.4.6 Weather and Illumination ..............................................................................................10 1.5 Vehicle Factors ........................................................................................................................10 1.5.1 Damage ..........................................................................................................................10 1.5.2 Alteration of Ford SUV into Limousine ........................................................................14 1.5.3 Limousine Mechanical Condition ..................................................................................20 1.5.4 Limousine Maintenance .................................................................................................27 1.5.5 Prestige Limousine Fleet Inspection ..............................................................................27 1.5.6 Brake Performance Study ..............................................................................................28 1.6 Limousine Driver Factors ........................................................................................................32 1.6.1 Licensing and Experience ..............................................................................................32 1.6.2 Health, Toxicology, and Medical Certification .............................................................33 1.6.3 Precrash Activities .........................................................................................................35 1.7 Motor Carrier Factors ..............................................................................................................38 1.7.1 New York Operating Authority to Transport Passengers ..............................................38 1.7.2 New York State Department of Motor Vehicles Oversight...........................................39 1.7.3 New York State Department of Transportation Oversight ............................................42 1.7.4 Federal Oversight ...........................................................................................................47 1.8 Occupant Protection .................................................................................................................47 1.8.1 Seat Belts and Seat Integrity ..........................................................................................47 1.8.2 Providing Occupant Protection for Limousine Passengers ...........................................48 1.9 New York State Postcrash Legislative Actions .......................................................................49 2 Analysis ......................................................................................................................................51 2.1 Introduction ..............................................................................................................................51 2.2 Crash Discussion ......................................................................................................................53

NTSB

Highway Accident Report ii 2.2.1 Crash Sequence ..............................................................................................................53 2.2.2 Inadequate Brake System Maintenance .........................................................................54 2.2.3 Vehicle Alteration Affecting Compliance with Applicable FMVSSs ...........................55 2.2.4 Limousine Driver Medical Factors ................................................................................57 2.3 Ineffective State Oversight of Intrastate Motor Carrier Operations ........................................59 2.3.1 Prestige Limousine ........................................................................................................59 2.3.2 New York State Department of Motor Vehicles Oversight...........................................62 2.3.3 New York State Department of Transportation Oversight ............................................64 2.3.4 Federal Oversight ...........................................................................................................66 2.4 Insufficient Occupant Protection for Limousine Passengers ...................................................67 3 Conclusions ................................................................................................................................70 3.1 Findings....................................................................................................................................70 3.2 Probable Cause.........................................................................................................................72 4 Recommendations .....................................................................................................................73 4.1 New Recommendations ...........................................................................................................73 4.2 Previously Issued Recommendations ......................................................................................74 Board Member Statement ...........................................................................................................76 Appendix A: Investigation ..........................................................................................................79 Appendix B: Consolidated Recommendation Information......................................................80 Appendix C: Highway Signage Map ..........................................................................................82 Appendix D: NYSDOT Interactions with Prestige Limousine ................................................83 References .....................................................................................................................................86

NTSB

Highway Accident Report iii Figures and Tables Figure 1. Map showing route of travel from charter group pick-up location to crash site ........... 1 Figure 2. Aerial view of crash scene showing initial area of impact and vehicle areas of rest .................................................................................................................................................. 2 Figure 3. A map showing NY-30 between NY-7 and crash location ........................................... 4 Figure 4. Southbound view of crash scene, showing limousine’s direction of travel and area of initial impact ...................................................................................................................... 5 Figure 5. Southbound approach view of NY-30/NY-30A intersection about 660 feet before intersection ..................................................................................................................................... 6 Figure 6. Southbound view of soil furrows leading to limousine area of rest .............................. 7 Figure 7. Southbound view of downhill grade on NY-30 about 0.56 miles north of the crash location ................................................................................................................................. 8 Figure 8. Highway profile graph showing altitude measurements taken along limousine’s charter trip from Amsterdam, New York, to crash location .......................................................... 9 Figure 9. Postcrash front view of limousine ............................................................................... 11 Figure 10. Postcrash passenger side view of limousine .............................................................. 11 Figure 11. Diagrams of limousine crash damage ........................................................................ 12 Figure 12. Front overhead view of Toyota SUV depicting damage to hood, windshield, and roof ........................................................................................................................................ 13 Figure 13. Precrash photograph of crash limousine .................................................................... 15 Figure 14. Diagram of limousine exterior and interior ............................................................... 15 Figure 15. Photograph of limousine’s interior, looking from rear of passenger compartment toward driver’s compartment ...................................................................................................... 16 Figure 16. Photograph of limousine’s interior, looking from front of vehicle toward rear of passenger compartment ........................................................................................................... 17 Figure 17. Diagram of hydraulic brake system and components ................................................ 22 Figure 18. Photographs of brake components, postcrash............................................................ 24 Figure 19. Photographs of brake line segments, postcrash ......................................................... 25 Figure 20. Photographs of brake calipers, postcrash .................................................................. 26 Figure 21. Photographs of right front disk brake rotor and inner right front brake pad surface. 26 Figure 22. Sections of MV-82 form ............................................................................................ 40

Table 1. Summary of vertical alignment data approaching intersection ....................................... 8 Table 2. Recorded maintenance on limousine, July 2016—September 2018 ............................. 27

NTSB

Highway Accident Report iv Table 3. Results of FMVSS 105 testing of exemplar Ford Excursion SUV ............................... 30 Table 4. Comparison of stopping distances for Ford Excursion weighing 8,600 pounds with one weighing 13,565 pounds ....................................................................................................... 31 Table 5. Prescription medications filled by driver in 2018 ......................................................... 34 Table 6. Precrash activities of limousine driver, October 4–6, 2018 .......................................... 36 Table 7. Registration history of crash-involved limousine ......................................................... 39 Table 8. NYSDOT bus inspection program history for 2001 Ford Excursion stretch limousine, 2010 to 2018 ............................................................................................................... 43 Table 9. NYSDOT inspection history for crash limousine and driver ........................................ 44 Table 10. NYSDOT Notice of Violation history for Prestige Limousine ................................... 45

NTSB

Highway Accident Report v Acronyms and Abbreviations AAMVA American Association of Motor Vehicle Administrators AASHTO American Association of State Highway and Transportation Officials ABS

antilock brake system ADHD

attention deficit hyperactivity disorder BUSNET Bus Safety Information Network CDL

commercial driver’s license CFR

Code of Federal Regulations CVSA

Commercial Vehicle Safety Alliance CVSP

Commercial Vehicle Safety Plan DMV

Department of Motor Vehicles EMS

emergency medical services ETA

Emergency Temporary Authority FMCSA

Federal Motor Carrier Safety Administration FMVSSs Federal Motor Vehicle Safety Standards Ford

Ford Motor Company GPS

global positioning system GVW

gross vehicle weight GVWR

gross vehicle weight rating NATC

Nevada Automotive Test Center NHTSA

National Highway Traffic Safety Administration NLA

National Limousine Association NOV

Notice of Violation NTSB

National Transportation Safety Board NYCRR

Codes, Rules, and Regulations of the State of New York NYS

New York State NYSDMV New York State Department of Motor Vehicles NYSDOT New York State Department of Transportation NYSP

New York State Police NY-7

New York State Route 7 NY-30

New York State Route 30 NY-30A New York State Route 30A

NTSB

Highway Accident Report vi OEM

original equipment manufacturer OOS

out-of-service Prestige

Prestige Limousine and Chauffeur Service (also Prestige Limousine) QVM

qualified vehicle modifier RCM

restraint control module rpm

revolutions per minute SCVFD

Schoharie County Volunteer Fire Department SMS

Safety Measurement System SUV

sport utility vehicle THC

delta-9-tetrahydrocannabinol [marijuana] USDOT

US Department of Transportation VIN

vehicle identification number

NTSB

Highway Accident Report vii Executive Summary Crash Summary On October 6, 2018, about 1:55 p.m. (local time), a 2001 Ford Excursion XLT stretch limousine, operated by Prestige Limousine and Chauffeur Service, was traveling south on New York State Route 30 (NY-30) near Schoharie, Schoharie County, New York. The limousine, occupied by a 53-year-old driver and 17 passengers, was descending a downhill grade that began about 1.81 miles north of a T-intersection with New York State Route 30A (NY-30A). The posted speed limit was 55 mph. Although the driver likely applied the brakes while descending the hill, the brake system failed to effectively slow the limousine down the grade, and the vehicle’s speed increased to over 100 mph. The driver steered the vehicle over the double pavement striping to avoid a car stopped at the NY-30/NY-30A intersection, proceeded past a stop sign, crossed the intersection, and entered the driveway of a restaurant parking lot. The limousine struck an unoccupied 2015 Toyota Highlander sport utility vehicle (SUV) that was parked in a grassy field adjacent to the driveway. Two pedestrians who were standing near the SUV were struck by it when the SUV was forced forward by the limousine. The limousine continued across the edge of the driveway and into a ravine, where it struck an earthen embankment and several trees. As a result of the crash, 20 people died, including all 18 limousine occupants and the 2 pedestrians.1 Probable Cause The National Transportation Safety Board determines that the probable cause of the Schoharie, New York, crash was Prestige Limousine and Chauffeur Service’s egregious disregard for safety, in dispatching a stretch limousine with an out-of-service order for a passenger charter trip, resulting in the failure of its brake system while descending the steep grade of New York State Route 30. Contributing to the crash was the New York State Department of Transportation’s ineffective oversight of Prestige Limousine, despite its knowledge of the carrier’s multiple out-of-service violations and lack of operating authority, as well as the department’s inadequate repair verification process. Further contributing to the crash was the New York State Department of Motor Vehicles’ inadequate oversight of state-licensed inspection stations and its failure to properly register the limousine, which enabled Prestige Limousine to circumvent the state’s safety regulations and more rigorous inspection requirements. Safety Issues The safety issues identified in this crash include the following: • Inadequate brake system maintenance. The limousine’s brake system was poorly maintained. While descending a downhill grade, the brake system failed to effectively slow the vehicle and stop it at the bottom of the hill.

1 Additional information about this investigation can be found in the NTSB public docket for this crash (NTSB accident HWY19MH001) at www.ntsb.gov.

NTSB

Highway Accident Report viii • Vehicle alteration affecting compliance with applicable Federal Motor Vehicle Safety Standards. The vehicle involved in this crash had originally been a Ford Excursion SUV; it was altered to become a stretch limousine. There is no evidence that, when the SUV was altered, the alterer, 21st Century Coachworks, conducted the required testing and engineering analyses to ensure that the altered vehicle conformed to required federal safety standards. As a consequence of the increase in vehicle weight and seating capacity, the classification of the vehicle changed from an SUV to a “bus,” as defined by the National Highway Traffic Safety Administration, which affected how certain federal safety standards applied to the vehicle. The report discusses the vehicle alteration and certification processes for stretch limousines, the results of a brake performance test that evaluated the effect of increased weight on a properly maintained vehicle, and the steps that limousine operators should take to ensure the safety of altered or stretched vehicles being purchased or operated as limousines in passenger transportation. • Drivers falsifying medical histories in medical certification examinations for commercial driver’s licenses. The limousine driver was required to be medically certified to operate a commercial vehicle. During the medical examination process, the driver failed to disclose pertinent information about his medical history, which prevented an accurate assessment of his physical qualifications to operate a stretch limousine. Based on the driver’s marijuana use, he would not have been medically certified to drive the limousine. • Ineffective state oversight of intrastate motor carrier operations. The New York State Department of Motor Vehicles (NYSDMV) and Department of Transportation (NYSDOT) were responsible for the oversight of the limousine operator, Prestige Limousine and Chauffeur Service, and its commercial stretch limousines. The NYSDMV was responsible for properly registering limousines. The report discusses deficiencies in the NYSDMV registration process, which allowed Prestige Limousine to circumvent more rigorous state bus safety and inspection requirements by improperly registering its vehicles. The report also discusses the NYSDOT’s ineffective safety enforcement efforts, which failed to prevent the unauthorized operator Prestige Limousine from operating. Although the NYSDOT was aware that Prestige Limousine was operating, it failed to verify whether Prestige Limousine had made vehicle safety repairs, required due to out-of-service vehicle inspection violations, which enabled the carrier to continue transporting passengers in limousines that had serious safety deficiencies. The report addresses the need for additional efforts at the state and national levels to prevent motor carriers from operating with active out-of-service violations. • Insufficient occupant protection for limousine passengers. As part of the Schoharie crash investigation, the National Transportation Safety Board (NTSB) adopted a safety recommendation report on September 13, 2019, on providing occupant protection for limousine passengers. This report briefly summarizes the 2019 safety report and describes the insufficient occupant protection systems in the limousine at the time of the crash.

NTSB

Highway Accident Report ix Investigative Constraints The New York State Police and the Schoharie County District Attorney’s Office are conducting a criminal investigation of this crash. These state entities (particularly the District Attorney’s Office) denied the NTSB timely access to the crash vehicles and related information that would have allowed the NTSB to follow its usual investigative protocols. The involved motor carrier, Prestige Limousine, would not permit access to its records, maintenance history, some witnesses, and other investigative material. These impediments delayed and complicated the NTSB’s investigation, but they did not affect its quality, as investigators used the factual information collected and developed alternative methodologies to complete an accurate investigation. In particular, to compensate for the District Attorney and state police denying our timely access to vehicle and braking components for any actions other than a visual inspection, the NTSB contracted an independent testing firm to conduct performance-based testing to examine the braking performance of a Ford Excursion SUV at the original manufacture gross vehicle weight rating and at the weight of the stretch limousine at the time of the crash. The testing included brake dynamometer testing to simulate braking performance over the route the crash vehicle traveled. The testing was instrumental to understanding factors relevant to the crash. Findings

1. None of the following were factors in this crash: (1) the driver’s experience or familiarity

with the limousine, (2) roadway signage, (3) alcohol impairment or fatigue, (4) cell phone use, (5) weather conditions, or (6) visibility and stopping sight distance at the intersection where the crash occurred.

1. The emergency response to the crash was timely and adequate.
2. The limousine was unable to slow on the downhill grade approaching the intersection due

to a failure within the poorly maintained brake system.

1. Although 21st Century Coachworks, the company that altered the Ford Excursion sport

utility vehicle into a stretch limousine, does not appear to have certified that the altered vehicle met the applicable Federal Motor Vehicle Safety Standards, the results of a brake system performance study show that, had the brake system been properly maintained, the limousine should have been capable of stopping safely at the bottom of the New York State Route 30 downgrade.

1. Limousine operators can help ensure the safety of altered vehicles being acquired for use

in passenger transportation service by (1) obtaining an engineer’s certification that the altered vehicle meets the Federal Motor Vehicle Safety Standards and (2) ensuring that a secondary certification label is affixed to the limousine before purchase.

1. The limousine driver failed to disclose pertinent information about his medical history as

required on the examination form for commercial driver’s license medical certification, which prevented accurate assessment of his fitness to drive a vehicle transporting passengers.

NTSB

Highway Accident Report x

1. Based on the limousine driver’s medical conditions, it cannot be determined whether he

would have been granted medical certification to drive a limousine had he fully disclosed his medical history on the examination form for commercial driver’s license medical certification; however, had he disclosed his use of marijuana, he would not have been medically certified.

1. Although toxicology tests detected evidence of marijuana and prescription drug use by the

limousine driver, insufficient information was available to determine whether the drugs in his system were at levels that would have impaired his ability to respond to the emergency situation.

1. Despite numerous warnings and Notices of Violation issued by the New York State

Department of Transportation, Prestige Limousine and Chauffeur Service violated the law by transporting passengers in its limousines without having operating authority.

1. On the day of the crash, Prestige Limousine and Chauffeur Service was knowingly

operating a limousine in poor mechanical condition that had recently been placed out of service for safety deficiencies, including brake equipment violations.

1. Prestige Limousine and Chauffeur Service did not have an effective maintenance program

in place to ensure the safety of its passenger-carrying vehicles.

1. Despite knowing that the crash limousine driver was not properly licensed, Prestige

Limousine and Chauffeur Service repeatedly assigned him to transport passengers, in direct violation of a New York State Department of Transportation out-of-service order, which indicates deficiencies in driver-related safety controls at the motor carrier.

1. The New York State Department of Motor Vehicles’ failure to verify information in its

vehicle registration program allowed the crash limousine to be incorrectly classified and improperly registered, which enabled Prestige Limousine and Chauffeur Service to circumvent the more thorough state safety and inspection requirements that might have prevented the crash.

1. The state inspection stations Mavis Discount Tire and Wilton Truck Center knowingly

inspected and certified the crash limousine, which was clearly an altered vehicle, in contravention of the New York State Department of Motor Vehicles’ policy that prohibited stations from inspecting modified or altered vehicles, including stretch limousines.

1. By not ensuring that state inspection stations adhered to the policy that prohibited them

from inspecting altered vehicles, the New York State Department of Motor Vehicles enabled the crash limousine to undergo annual vehicle inspections instead of the more rigorous semiannual New York State Department of Transportation bus safety inspections, as required.

1. The New York State Department of Motor Vehicles did not provide effective oversight of

state inspection stations, allowing Mavis Discount Tire and Wilton Truck Center to perform inadequate inspections of the crash limousine that failed to detect serious safety deficiencies before the crash.

NTSB

Highway Accident Report xi

1. The New York State Department of Transportation’s ineffective enforcement and lack of

repair verification processes allowed Prestige Limousine and Chauffeur Service to continue to transport passengers in the crash limousine despite the carrier’s (1) not having operating authority and (2) failing to repair out-of-service vehicle violations that compromised the limousine’s safety.

1. The State of New York’s implementation of Assembly Bill A.9056 should help resolve the

safety problem of stretch limousines continuing in commercial operation without having their out-of-service violations repaired.

1. The New York State Department of Transportation’s enforcement efforts directed toward

motor carriers that continue operating after being cited for serious out-of-service violations have been inadequate, and additional strategies and repair verification processes are needed.

1. Making the definition of what constitutes a “bus” consistent between the New York State

agencies responsible for registering and inspecting higher occupancy passenger-carrying vehicles would reduce the likelihood of miscommunication between these safety oversight agencies and of motor carriers exploiting administrative loopholes to avoid safety scrutiny.

1. Although the extent of the problem is unknown, some motor carriers across the nation are

likely continuing to operate without correcting out-of-service violations, placing the motoring public at risk.

Recommendations New Recommendations To the Federal Motor Carrier Safety Administration: Provide guidance and best practices to states to enforce carrier compliance with state-issued out-of-service orders, based on available information on state efforts to prevent vehicles and drivers from continuing to operate without authority or after being cited for out-of-service violations. (H-20-24) To the State of New York: Require the New York State Department of Transportation to implement the “key recommendations” in the 2014 New York Office of the State Comptroller Report 2012-S-13 addressing vehicle repair certification requirements, strategies to improve carrier compliance with out-of-service violations, and progressive enforcement actions for continued operation of out-of-service vehicles. (H-20-25) Require the New York State Department of Motor Vehicles to adopt the New York State Department of Transportation’s definition of a bus as a passenger vehicle for hire with a seating capacity of 10 or more. (H-20-26)

NTSB

Highway Accident Report xii To the New York State Department of Motor Vehicles: Review your policies and protocols on the inspection of stretch limousines, and establish stricter safeguards and more rigorous enforcement protocols to ensure that state-contracted inspection stations do not inspect stretch limousines that have a seating capacity of 10 or more. (H-20-27) Renotify state-contracted inspection stations that they may not inspect stretch limousines that have a seating capacity of 10 or more. (H-20-28) To the National Limousine Association: Inform your member limousine operators of the importance of verifying the safety of altered vehicles planned for passenger transportation by ensuring that the altered vehicle passes a structural and mechanical safety inspection, obtaining from the alterer an engineer’s certification that the altered vehicle meets the Federal Motor Vehicle Safety Standards affected by the alteration, and checking that a secondary certification label is affixed to the limousine before purchase. (H-20-29) Previously Issued Recommendations In September 2019, the NTSB issued a safety recommendation report titled Providing Occupant Protection for Limousine Passengers, which issued and reiterated the following safety recommendations addressing occupant protection safety issues identified during the Schoharie crash investigation (NTSB 2019a): To the National Highway Traffic Safety Administration: Require lap/shoulder belts for each passenger seating position on all new vehicles modified to be used as limousines. (H-19-14) Require that seating systems installed in new vehicles modified to be used as limousines meet minimum performance standards to ensure their integrity during a crash. (H-19-15) The status of Safety Recommendations H-19-14 and -15 is “Open—Unacceptable Response.” To the New York State Department of Transportation: As an addition to your regular state inspection process, ensure that seat belts are functional and accessible in all limousines in the state equipped with passenger seat belts. (H-19-16) The status of Safety Recommendation H-19-16 is “Closed—Acceptable Alternate Action.”

NTSB

Highway Accident Report xiii To the National Limousine Association: Educate member limousine operators on the life-saving benefits of proper seat belt use, and recommend that they develop methods to (1) ensure that seat belts are functional and accessible to the passengers and (2) encourage passengers to use them. (H-19-17) The status of Safety Recommendation H-19-17 is “Open—Acceptable Response.” In the Safety Recommendation Report, the NTSB reiterated Safety Recommendation H-15-42 to the State of New York: Enact legislation that provides for primary enforcement of a mandatory seat belt use law for all vehicle seating positions equipped with a passenger restraint system. (H-15-42) The status of Safety Recommendation H-15-42 to the State of New York is “Open— Acceptable Response.”

NTSB

Highway Accident Report 1 1 Factual Information 1.1 Crash Narrative On Saturday, October 6, 2018, about 1:55 p.m. (local time), a 2001 Ford Excursion XLT stretch limousine, operated by Prestige Limousine and Chauffeur Service, was traveling from Amsterdam, New York, to Cooperstown, New York, occupied by a 53-year-old driver and 17 passengers on a charter trip.1 The trip route was through a rural environment, consisting of rolling terrain with frequent changes in vertical grade and numerous curves. After making a right turn from New York State Route 7 (NY-7) onto New York State Route 30 (NY-30) near Schoharie, Schoharie County, New York, the limousine began a 1.81-mile descent to a stop sign-controlled T-intersection with New York State Route 30A (NY-30A) (see figure 1). The posted speed limit on this section of NY-30 was 55 mph. Shortly after the limousine made the right turn onto NY-30, witnesses reported seeing it move toward the right shoulder with its hazard lights activated.2 Subsequently, the limousine returned to the travel lane, continued south on NY-30, and began to accelerate down the descent to the T-intersection with NY-30A. The limousine did not stop at the intersection.

Figure 1. Map showing route of travel from charter group pick-up location to crash site.

1 Throughout the report, Prestige Limousine and Chauffeur Service is referred to as Prestige Limousine or Prestige. 2 The reason for the limousine’s move to the shoulder (and whether the limousine came to a complete stop on the shoulder) could not be determined. Refer to the Human Performance Factors Attachment titled “New York State Police Supporting Depositions” in the NTSB public docket for this investigation; search for NTSB accident HWY19MH001.

NTSB

Highway Accident Report 2 As the limousine neared the bottom of the grade, it approached the rear of a 2016 Jeep Patriot sport utility vehicle (SUV) in the same lane, which was stopped at the stop sign for NY-30 at the T-intersection with NY-30A. The two SUV occupants reported hearing the limousine— which they said sounded like a “jet engine”—and seeing it approach the SUV from behind at a high rate of speed. The limousine driver steered left to avoid the SUV, proceeded past the stop sign and through the intersection without slowing, and crossed the east- and westbound travel lanes of NY-30A (traffic on NY-30A did not have a stop sign for the intersection). The limousine entered the driveway of the parking lot of the Apple Barrel Country Store restaurant and struck an unoccupied 2015 Toyota Highlander SUV parked in a grassy field adjacent to the driveway. The limousine was traveling an estimated 101–118 mph when it collided with the Toyota SUV.3 The SUV was propelled in a southerly direction and struck two pedestrians who were standing near the SUV. The speed of the limousine was reduced to about 80 mph as it continued about 55 feet south, entered a ravine, and then struck an earthen embankment and several trees. At final rest, the limousine was in a streambed at the bottom of the ravine facing west with the driver’s side against the backslope of the ravine. The SUV came to rest facing south on the opposite side of the ravine (see figure 2).4

Figure 2. Aerial view of crash scene showing initial area of impact and vehicle areas of rest. (Source: New York State Police with National Transportation Safety Board annotations)

3 The estimated impact speed was derived from the change in velocity recorded by the limousine’s restraint control module (RCM) and an analysis of the SUV’s postimpact travel. Refer to the Technical Reconstruction Group Factual Report in the NTSB public docket for additional information regarding the electronic event data recorded by the RCM. (Search for NTSB accident HWY19MH001.) 4 Scene photographs show the areas of rest for the vehicles.

NTSB

Highway Accident Report 3 1.2 Injuries As a result of the crash, 20 people died, including the limousine driver, 17 passengers, and 2 pedestrians. The 17 passengers were 9 females and 8 males, ranging in age from 24 to 34 years old. The two pedestrians were 70- and 46-year-old males, respectively. The New York State Police (NYSP) forensic team coordinated the autopsies of all 20 victims with the Albany Medical Center. The medical examinations indicated that all victims died of blunt force trauma. The high death rate in this crash raised immediate questions of occupant protection in stretch limousines. The National Transportation Safety Board (NTSB) issued a focused safety recommendation report on this topic, titled Providing Occupant Protection for Limousine Passengers, in September 2019 (NTSB 2019a). The issue of occupant protection and the recommendations made in this safety recommendation report are discussed in section 1.8. 1.3 Emergency Response A multiagency response consisted of the NYSP; Schoharie County Sheriff’s Office; Schoharie County Volunteer Fire Department (SCVFD); and a variety of public, volunteer, and private emergency medical services (EMS). The first 911 call was received by the Schoharie County Office of Emergency Services at 1:55 p.m. Units from the Schoharie County Sheriff’s Office, SCVFD fire/rescue, and EMS were dispatched to the scene at 1:56 p.m. The first units arrived at the crash location at 1:59 p.m. The SCVFD had primary jurisdiction for the fire/rescue services. At 2:00 p.m., the severity of the incident was upgraded to a level D mass casualty incident, which invoked mutual aid response from other agencies.5 EMS responded to the scene, including resources from the Central Bridge Fire District, Esperance Volunteer Fire Department, Scho-Wright Ambulance Service, and Life Net of NY Glen, as well as several medical helicopters. Of the 20 crash victims, only 2 limousine passengers initially survived the impacts and were transported by ambulance from the scene to Cobleskill Regional Hospital. One of the patients was pronounced dead on arrival at the hospital. The other patient was transferred from the hospital via medical helicopter to Albany Medical Center (an advanced trauma center). The patient was later pronounced dead at Albany Medical Center.

5 The Schoharie County Office of Emergency Services defines events from level A (lowest) to level E (highest). Levels A and B invoke a basic life support response. Levels C and higher require both basic and advanced life support EMS units. The term “mass casualty incident” refers to an incident within the United States in which EMS resources, such as personnel and equipment, are overwhelmed by the number and severity of casualties.

NTSB

Highway Accident Report 4 1.4 Highway Factors 1.4.1 General Characteristics The highway factors investigation focused on the limousine’s final 1.81 miles of travel on NY-30, on a descending grade toward the T-intersection with NY-30A (see figure 3).6

Figure 3. Map showing NY-30 between NY-7 and crash location. (Source: Google Earth) NY-30 is configured as a two-lane highway with one lane of travel in each direction. The 5,300-foot segment of NY-30 south of NY-7 features 12-foot-wide travel lanes and 10-foot-wide paved shoulders. South of this segment, over a distance of 3,568 feet, shoulder widths decrease to between 17 inches and 46 inches and then widen to about 9 feet about 670 feet before the intersection. The northbound and southbound travel lanes of NY-30 are delineated by yellow pavement striping, with supplemental striping designating when passing is not permitted. The shoulder areas are delineated by solid white pavement striping. The intersection is generally oriented such that NY-30 approaches it at a heading of 204º south–southwest. NY-30A approaches the intersection from the west and, after it, continues as NY-30 in a southeasterly direction from

6 The highway is operated and maintained by the New York State Department of Transportation. See the Highway Factors Group Factual Report in the NTSB public docket for this investigation (NTSB accident HWY19MH001) for an in-depth description of the highway operating environment.

NTSB

Highway Accident Report 5 the intersection. The NY-30/NY-30A intersection bisects the highway into NY-30 and NY-30A (see figure 4).

Figure 4. Southbound view of crash scene, showing limousine’s direction of travel and area of initial impact. (Source: NYSP) The speed limit on NY-30 is 55 mph, and the speed limit on NY-30A is 50 mph. The sole regulatory speed limit sign (55 mph) on southbound NY-30 is posted 5,039 feet north of the NY-30/30A intersection.7 While headed down the hill on NY-30, the limousine driver would have encountered an advisory 50 mph speed limit sign posted 914 feet from the intersection stop sign. A 2018 speed study conducted on NY-30 just north of the NY-30A intersection reported the 85th percentile speed as 58 mph.8 A 2016 New York State Department of Transportation (NYSDOT) traffic study reported that the average daily traffic for this segment of NY-30 was 650 northbound and 707 southbound vehicles per day.

7 This speed reduction advisory is for the segment of NY-30 south of the intersection. It does not pertain to traffic on NY-30 before the NY-30A intersection. 8 The 85th percentile speed is the speed that 85 percent of the traffic did not exceed. The 2018 speed study comprised a 1-hour observation period. A 2016 study based on a 72-hour observation period at the top of the grade just south of NY-7 identified an 85th percentile speed of 45.3 mph.

NTSB

Highway Accident Report 6 1.4.2 Intersection Crash Location NY-30 intersects NY-30A at a near right angle from the north. The approach from NY-30 to the intersection with NY-30A is controlled by a stop sign and a painted stop line. There is a stop ahead warning sign about 481 feet before the stop sign on NY-30. The stop ahead warning sign and intersection stop sign on NY-30 southbound came into the southbound driver’s view simultaneously about 1,125 feet before the intersection stop sign. The available sight distance on the approach to the intersection with NY-30A exceeded the minimum standards for stopping sight distance outlined in the American Association of State Highway and Transportation Officials (AASHTO) Policy on Geometric Design of Highways and Streets. (See figure 5.)

Figure 5. Southbound approach view of NY-30/NY-30A intersection about 660 feet before intersection. (Stop ahead warning sign and intersection stop sign are circled in yellow.) After the limousine maneuvered around the stopped vehicle at the intersection, passed through the intersection, and left the southern edge of NY-30A, it collided with the rear of the SUV that was parked in the grassy field adjacent to the arced driveway for the Apple Barrel Country

NTSB

Highway Accident Report 7 Store restaurant. The initial area of impact was identified by linear soil furrows beginning about 38 feet south of the highway edge.9 (See figure 6.)

Figure 6. Southbound view of soil furrows leading to limousine area of rest. About 18 feet south of the impact area, the terrain slopes and begins to define a ravine and streambed. At final rest, the limousine was in the streambed with its driver’s side against the backslope of the ravine. 1.4.3 Highway Alignment The final 1.81-mile descending grade consists of four discernable curves—one rightward curve and three leftward curves with long tangent sections separating them.10 Vertical alignment involves 13 changes in grade that range from less than 1 percent to 11.35 percent (see table 1). The total change in elevation during the 1.81-mile descent is about 573 feet. Figure 7 shows an example of the downhill grade (9.64 percent) about 0.56 miles north of the intersection.

9 Furrow characteristics were insufficient to identify precisely where the SUV was initially positioned or whether the SUV or the limousine created each specific furrow. The furrows appeared to be essentially perpendicular to the highway and were offset from the NY-30 centerline by 12–13 feet. 10 (1) The first horizontal curve is a 1,432-foot-radius rightward curve that begins 117 feet south of NY-7 and continues for 2,358 feet. The curve is followed by a 2,077-foot-long tangent segment. (2) The second curve is a 2,004- foot-radius leftward curve, 784 feet in length. The curve is followed by a 1,861-foot-long tangent segment. (3) The third curve is a 1,641-foot-radius leftward curve, 458 feet in length. The curve is followed by a 1,119-foot-long tangent segment. (4) The fourth curve is a 3,000-foot-radius leftward curve, 626 feet in length. This curve is followed by a 168-foot-long tangent segment that meets the NY-30A intersection.

NTSB

Highway Accident Report 8 Table 1. Summary of vertical alignment data in the final 1.81 miles approaching the intersection. Vertical Alignment % Grade Length of Downgrade Segment Distance from Intersection

Figure 7. Southbound view of downhill grade on NY-30 about 0.56 miles north of the crash location. In addition to examining the horizontal and vertical alignment of the NY-30 roadway on the final 1.81-mile downgrade from NY-7 to the NY-30/NY-30A intersection, investigators examined the highway topography. The topography consisted of rolling terrain with frequent -2.95% 478 feet 1.81 miles -1.34% 800 feet 1.72 miles -5.00% 1,200 feet 1.57 miles -0.93% 1,670 feet 1.34 miles -9.80% 1,421 feet 1.03 miles -7.20% 570 feet 0.76 miles -11.28% 498 feet 0.65 miles -9.64% 439 feet 0.56 miles -7.71% 262 feet 0.47 miles -11.35% 281 feet 0.42 miles -8.63% 814 feet 0.37 miles -5.92% 961 feet 1,135 feet -1.82% 174 feet 174 feet

NTSB

Highway Accident Report 9 changes in vertical grade, although the overall grade was ascending.11 Figure 8 depicts the vertical profile of the trip along the route.12 These data were used to examine the brake system’s performance under different operating and loading characteristics (see section 1.5.6).

Figure 8. Highway profile graph showing altitude measurements taken along limousine’s charter trip from Amsterdam, New York, to crash location. 1.4.4 Signage Three hill warning signs are posted in advance of the descending grade on which the crash limousine traveled before reaching the NY-30/NY-30A intersection. Each warning sign is posted with an advisory plaque indicating the approximate length of the grade section. The placement of regulatory and warning signs on NY-30 between NY-7 and NY-30A is depicted on a map in

11 During the trip from Amsterdam, the limousine encountered multiple changes in vertical alignment, including one descending grade on NY-30 that covered 2.3 miles, with an elevation decrease of more than 700 feet. The route also included multiple stop signs, traffic signals, and curves that would require speed reductions for safe navigation. 12 Altitude measurements are based on the height (in feet) above sea level.

NTSB

Highway Accident Report 10 appendix C. The mounting height of each sign ranges between 6.2 feet and 7.0 feet, and the signs are located 10–12 feet off the right side of the travel lane. 1.4.5 Crash History During the 5-year period 2013–2018, four crashes were reported at the NY-30/NY-30A intersection; one was coded as an intersection crash. Of the four crashes, one involved a multiple-vehicle collision and included a citation for stop sign violation. A second crash was coded as “failure to yield while executing a left turn.” 1.4.6 Weather and Illumination Weather station data for Schoharie on October 6, 2018, at 1:55 p.m. showed conditions as no precipitation, a temperature of 66.8°F, and winds from the west–northwest at 3.4 mph. The roadway was dry. According to the US Naval Observatory Astronomical Applications Department, at the location and time of the crash, the sun altitude was 39.5º (angle up from the horizon) and the azimuth was 202.7º (angle east of true north).13 Based on the limousine’s headway angle (204º east of north), the sun at the time of the crash was about 1.3º to the left of the driver and 39.5º above the horizon.14 1.5 Vehicle Factors 1.5.1 Damage 1.5.1.1 Limousine. The limousine sustained severe damage to its front end, with greater deformation to the driver’s side (see figures 9 and 10). Overall, the left front of the vehicle was displaced rearward about 60 inches, and the left wheel was displaced rearward about 49 inches. The engine was pushed down and rearward into the driver’s footwell, and the steering wheel was pushed rearward and up toward the vehicle roofline.

13 The altitude and azimuth values are for the center of the apparent disk of the sun. 14 At the time of the crash, the sky was overcast, which would have reduced sun glare.

NTSB

Highway Accident Report 11

Figure 9. Postcrash front view of limousine (not in final rest position).

Figure 10. Postcrash passenger side view of limousine (not in the crash final rest position).

NTSB

Highway Accident Report 12 There was a complete loss of occupant survival space for the driver and front passenger seating positions, and partial intrusion into the left front corner of the rear passenger compartment. Figure 11 shows a driver-side and overhead view of the limousine created by 3D scans of the vehicle. Portions of both views have a yellow outline that roughly represents the original structure of the limousine before the crash. The red-shaded areas represent the approximate regions of intrusion and compromised survival space. The green-shaded areas highlight the portions of the limousine that remained relatively intact and where survival space was maintained in the vehicle structure.

Figure 11. Diagrams of limousine crash damage. Top image shows side view postcrash 3D image of limousine with overlaid reconstruction of vehicle’s precrash structure. Bottom image shows overhead view of postcrash 3D image of limousine with overlaid reconstruction of vehicle’s precrash structure.

NTSB

Highway Accident Report 13 1.5.1.2 Toyota Highlander SUV. The unoccupied, parked SUV sustained extensive rear-end impact damage. The rear axle and body structure were pushed forward, decreasing the vehicle’s length by about 48 inches.15 Additional contact damage and rearward displacement was observed to the SUV’s hood (see figure 12). The leading edge and upper surface of the hood showed distinct areas of direct contact. The upper radiator support and surrounding features also showed rearward displacement. The front windshield was fractured, with the cracks showing characteristics of direct contact damage.

Figure 12. Front overhead view of Toyota SUV depicting damage to hood, windshield, and roof. (Windshield shows evidence of impact with the ground during crash event.)

15 Manufacturer data show that the precrash overall length of the SUV was 15.92 feet. Depending on the reference source, the SUV’s curb weight was in the range of 4,300–4,500 pounds. Curb weight is the actual weight of the vehicle with a full tank of fuel and other fluids needed for travel but no occupants or cargo on board.

NTSB

Highway Accident Report 14 1.5.2 Alteration of Ford SUV into Limousine 1.5.2.1 Limousine design. The 2001 Ford Excursion SUV was manufactured by Ford Motor Company (Ford) in October 2000, making Ford the original equipment manufacturer (OEM). The Ford Excursion SUV had been built with a 137.1-inch (11.4-foot) wheelbase and a designated gross vehicle weight rating (GVWR) of 8,600 pounds.16 The SUV had three rows of seats with a seating capacity of eight persons; the vehicle measured 226.7 inches long. The original SUV was certified by Ford as compliant with all Federal Motor Vehicle Safety Standards (FMVSSs) applicable at the time of manufacture.17 In January 2001, the vehicle alterer 21st Century Coachworks in Springfield, Missouri, purchased the Ford SUV from a Ford dealer. The New York motor carrier Royale Limousine selected the Ford SUV for alteration from the vehicles displayed in the 21st Century parking lot. After 21st Century Coachworks had altered it into a stretch limousine, Royale purchased the vehicle from 21st Century.18 Royale Limousine owned the vehicle until 2006, when the company was purchased by Advantage Transit Group, doing business as RLS Limousines of Albany, New York. RLS Limousines operated the altered vehicle until it was sold to Prestige Limousine on July 21, 2016. The alteration in 2001 entailed cutting the SUV’s factory frame and welding an additional 144 inches of frame rail to extend the factory frame rail. The alteration increased the vehicle’s wheelbase to 281.1 inches (23.4 feet) and its overall length to 370.7 inches (30.9 feet). (See figures 13 and 14.) Once it had been altered to this design, the vehicle met the definition of a “bus,” per 49 CFR 571.3(b) of the FMVSSs, as follows: “A motor vehicle with motive power, except a trailer, designed for carrying more than 10 persons.”

16 The GVWR is the maximum operating weight of a vehicle as specified by the manufacturer. Title 49 Code of Federal Regulations (CFR) 567.4 states that the GVWR “shall not be less than the sum of the unloaded vehicle weight, rated cargo load, and 150 pounds times the vehicle’s designated seating capacity.” The GVWR guides the vehicle design. (The GVWR cited above includes the tow package for the Ford Excursion SUV.) 17 The FMVSSs are federal regulations that specify the design, construction, performance, and durability requirements for motor vehicles and regulated automobile safety-related components, systems, and design features. The FMVSSs are currently codified in 49 CFR Part 571. Compliance with the FMVSSs is a self-certification process. 18 The vehicle alterer 21st Century Coachworks is no longer in business.

NTSB

Highway Accident Report 15

Figure 13. Precrash photograph of crash limousine. (Source: Times Union newspaper [James Goolsby photographer])

Figure 14. Diagram of limousine exterior and interior. Letters A–H denote positions of structural pillars from front to rear. Pillars C–F were added during alteration from SUV to limousine.

NTSB

Highway Accident Report 16 In the alteration, the driver and front passenger seats installed by the OEM were retained. A privacy divider was added between the driver/front passenger seating compartment and the (rear) passenger compartment. A rear-facing bench seat was added, with its back to the privacy divider, facing aft into the passenger compartment (see figure 15). Non-OEM side-facing bench seats were installed along each side of the passenger compartment, forming a perimeter seating layout (see figure 16).19 A refreshments bar was installed next to the passenger-side bench seat, forward of the rear door. A small table was added next to the driver-side side-facing bench seat. At the back of the passenger compartment were five OEM rear seats that faced forward into the compartment. The sixth OEM seat, originally located next to the passenger-side rear door, was removed to allow access into the rear of the passenger compartment.

Figure 15. Photograph of limousine’s interior, looking from rear of passenger compartment toward driver’s compartment. (Source: Advantage Transportation Group, 2010)

19 The side-facing bench seat on the passenger side of the vehicle was shorter than the one on the driver side.

NTSB

Highway Accident Report 17

Figure 16. Photograph of limousine’s interior, looking from front of vehicle toward rear of passenger compartment. (Source: Advantage Transportation Group, 2010) The three non-OEM bench seats (two side-facing and one rear-facing) were equipped with passenger lap belts for each seating position; the OEM seats retained their original lap/shoulder belts on the outboard seats and lap belts on the middle seats. The NTSB postcrash inspection of seat belt anchor points indicated 21 potential belted seating positions in the vehicle. The seating positions available in the vehicle could range from 18 to 22, depending on how “seating position” is defined.20 After the crash, the NYSP weighed the limousine, vehicle components, and debris using certified portable scales. The overall limousine weight was determined to be about 10,000 pounds. With the additional weight of the 18 limousine occupants, the total weight of the limousine at the time of the crash was estimated to total about 13,565 pounds.21 (As has been noted, the GVWR of the original SUV was 8,600 pounds.)

20 Somewhat different criteria may be used for determining what constitutes a seating position, which accounts for the range of possible seating capacity numbers There was no clear definition of the total number of seat positions because the capacity of the bench seats in the perimeter seating area could differ, depending on the source of the information. The sources included the following: an NYSDOT commercial motor vehicle inspections Driver/Vehicle Examination Report, obtained from a previous owner of the limousine; the number of people sitting in the limousine on the subject charter trip; the National Highway Traffic Safety Administration’s definition of seat placements; and the number of installed seat belts. Depending on the source used, the limousine could have a capacity ranging from 18 to 22 people. 21 Limousine occupant weights were obtained from individual autopsy reports.

NTSB

Highway Accident Report 18 The brake system components examined by NTSB investigators exhibited no obvious modifications or alterations from the design and configuration of the original system installed on the Ford Excursion. 1.5.2.2 Vehicle alteration requirements. The vehicle alterer, 21st Century Coachworks, was required to register as a manufacturer in the National Highway Traffic Safety Administration (NHTSA) vehicle manufacturer database (known as vPIC); however, investigators found no listing for the company.22 As a vehicle alterer, 21st Century was responsible for ensuring that the vehicles it altered conformed with all federal safety standards for vehicle features affected by any alterations.23 Additionally, the alterer was required to affix an additional or secondary certification label to the vehicle affirming that the vehicle conformed with the applicable FMVSSs as well as reporting certain post-alteration vehicle parameters.24 In addition to indicating the identity of the alterer, the secondary label should have reported a change to the vehicle’s GVWR and type classification. NTSB investigators found no secondary certification label on the limousine during the postcrash inspection.25 1.5.2.3 Compliance with FMVSSs. At the time the Excursion was altered, 49 CFR 567.7 and 568.8 required a vehicle alterer to ensure that the vehicle, as altered, conformed to the FMVSSs affected by the alteration(s) and to certify FMVSS conformance. In the case of the crash limousine, the vehicle as altered exceeded its loaded weight at the time of original brake system certification

22 Registration with NHTSA is required by 49 CFR Part 566, with the registration information comprising the Manufacturer Information Database. This database is accessible through the NHTSA Product Information Catalog and Vehicle Listing (vPIC) online portal (see NHTSA vPIC webpage, accessed August 23, 2020). The portal supports features such as online manufacturer registration and lookup. 23 Before the 2006 printing of the CFR, this requirement appeared in 49 CFR 568.8. In 2006, this section was moved to 49 CFR 567.7. 24 The additional label is required by 49 CFR 567.7 and is to be affixed in addition to the certification label that affirms the original certification, required from Ford under 49 CFR 567.4. The original certification label must contain the name of the manufacturer assuming responsibility for conformance with standards; the month and year of manufacture; the vehicle’s GVWR; the gross axle weight rating; a text statement that “this vehicle conforms to all applicable FMVSSs in effect on the date of manufacture shown above”; the vehicle identification number; and the type classification of the vehicle as defined in 49 CFR 571.3 (for example, truck, bus, etc.). The additional label must include the name of the individual or corporation that altered the vehicle; the month and year the alteration was completed; a statement that “as altered this vehicle conforms to all applicable Federal Motor Vehicle Safety Standards affected by the alteration and in effect in (month, year)”; the revised GVWR and/or the gross axle weight rating, if different from the original manufacture; and a statement of any revision in the vehicle type classification if different from the original manufacture. 25 Investigators interviewed the proprietor of Royale Limousines, the original owner of the limousine, and he reported that no Part 567 certification label was affixed to the vehicle at the time of purchase. He said that an identification label was later sent to him by 21st Century Coachworks; however, it is unknown whether that label was a Part 567 certification label. In February 2010, an NYSDOT inspector notified the then-owner of the vehicle, RLS Limousines, that the secondary label was unreadable, and that the vehicle was required to be “recertified.” RLS Limousines took the limousine to A1 Limo Depot, a licensed NYSDOT facility in Massapequa, New York, for repairs and a follow-up inspection. On February 24, 2010, the NYSDOT inspected the limousine at A1 Limo Depot and verified the presence of a new identification label. The NYSDOT inspections of the limousine in July 2014, January 2015, and June 2015 verified the presence of an identification label and recorded the vehicle’s GVWR as 13,080 pounds with a seating capacity of 18. It was not disclosed whether the secondary label issued after February 2010 was Part 567-compliant or one authorized under New York code; see 17 Codes, Rules, and Regulations of the State of New York (NYCRR) 720.

NTSB

Highway Accident Report 19 specified by Ford for the Excursion SUV under 49 CFR Part 571.105 (FMVSS 105).26 As such, 21st Century Coachworks, the alterer, was required to ensure that the altered vehicle met the applicable FMVSS 105 brake system performance standards, which prescribed a series of performance-based tests, some conducted at the vehicle GVWR, to demonstrate compliance.27 To recertify the vehicle, given its higher GVWR due to the alterations, 21st Century Coachworks should have performed compliance testing or engineering analyses to confirm compliance with the safety standards. NTSB investigators found no evidence that 21st Century Coachworks performed such tests.28 1.5.2.4 OEM guidance. Since 1989, Ford has provided guidance to vehicle alterers who work with selected Ford vehicles. The program is called the Qualified Vehicle Modifier (QVM) program. The program is voluntary for alterers; however, following the QVM program ensures that the final altered vehicle meets Ford’s engineering parameters.29 Other manufacturers maintain similar programs. For example, Cadillac has a Master Coachbuilder program. Most of the major companies that perform vehicle alterations are involved in such programs. There is no record that 21st Century Coachworks participated in Ford’s QVM program. When 21st Century purchased the Ford Excursion SUV in January 2001, Ford had not yet published formal guidance on the alteration of Excursion model vehicles. In March 2001, the altered limousine was transferred from 21st Century to its first owner. On July 13, 2001, Ford’s engineering office issued guidance to all voluntary QVM builders regarding the alteration of Excursion SUVs. The guidance limited the vehicle stretch to a maximum length of 120 inches. It also limited the seating capacity to 10 occupants, including the driver. Ford set the maximum gross vehicle weight (GVW) of the stretched vehicles to 9,900 pounds. Additionally, Ford’s guidance called for the installation of a chassis upgrade kit, which included a brake Hydro-Boost® kit, higher load capacity tires, and a new rear spring assembly.30 Front springs were to be upgraded based on the length of stretch and weight added. On December 3, 2002, Ford issued updated guidance to its voluntary QVM builders in a memorandum regarding the stretching of Excursion SUVs. The updated guidance increased the

26 As previously noted, the GVWR for each vehicle is the maximum weight a vehicle is designed to carry when loaded, including the weight of the vehicle itself plus fuel, passengers, and cargo (49 CFR 571.3). The passenger portion of the GVWR includes the calculation of 150 pounds multiplied by the number of the vehicle’s designated seating positions. 27 Other FMVSS requirements could have been affected by the vehicle alterations; this report focuses on the braking, due to the circumstances of this crash. 28 Alterers make such certification by affixing a permanent label to the altered vehicle identifying the alterer and the date of alteration. The label must also include a statement that the vehicle, as altered, continues to comply with all applicable FMVSSs. Finally, the alterer must allow the original manufacturer’s certification label to remain fixed to the vehicle. 29 To qualify as a QVM, an alterer must be successfully evaluated by Ford Motor Company on criteria such as engineering, manufacturing process, quality control, and adherence to Ford QVM guidelines. The QVM program requires that the builders are capable of performing weight and FMVSS compliance analysis and be subject to an initial inspection and follow-up annual inspections of manufacturing facilities. They must also be registered with NHTSA. 30 The kit uses fluid pressure from the existing power steering pump to power the brake master cylinder and assist in providing greater braking force.

NTSB

Highway Accident Report 20 acceptable stretch vehicle length from 120 to 140 inches, raised the allowable passenger capacity from 10 to 15 passengers, and increased the maximum acceptable GVW from 9,900 pounds to 11,000 pounds. Ford included additional safety elements in this guidance, such as roof and side emergency exits. Current 2020 Ford QVM guidance states that only Lincoln MKT Town Cars are approved for conversion into stretch limousines.31 In addition, the QVM guidance specifies that an MKT Town Car can only be stretched to 120 inches.32 1.5.3 Limousine Mechanical Condition 1.5.3.1. Vehicle investigation challenges. Based on the circumstances of the crash and the lack of physical evidence on the roadway indicating precrash braking, the focus of the mechanical inspection was on the brake system (see section 1.5.3.8). However, the NYSP and the Schoharie County District Attorney’s Office repeatedly denied the NTSB timely access to the vehicle and its components, removing investigators’ opportunity to perform functional testing of vehicle systems.33 As a result, investigators could not collect—as would be done normally—critical information regarding the operating condition of mechanical components on the crash limousine, such as the brake system, steering, and transmission.34 Although this delayed the progress of the investigation and required the NTSB to develop and use alternative methods of investigation, including use of a contractor to conduct braking simulations (see section 1.5.6 “Brake Performance Study”), NTSB investigators developed an accurate assessment of the crash limousine’s braking system and its capacity. In short, the challenges posed by the denial of timely access to the vehicle did not compromise the results of the investigation, but they did significantly extend the length of our investigation and delayed our release of critical safety information to the public. 1.5.3.2 Background. The 2001 Ford Excursion was equipped with a 6.8-liter, electronically controlled, fuel-injected, 10-cylinder gasoline engine and a four-speed automatic transmission. At the time of the crash, the mileage on the vehicle was about 194,000 miles. 1.5.3.3 Body, frame, and suspension. The visual-only examination of the limousine’s body conducted on October 8–9, 2018, revealed numerous and significant areas of sheet metal rust.35 The exterior floorboard showed severe deterioration and rust that had come through the underbody, exposing interior carpeting. The entire frame was substantially corroded and rusted,

31 Ford has not manufactured Excursion SUVs since 2006. 32 For more information, see Ford QVM webpage, accessed August 23, 2020. 33 The NYSP and the Schoharie County District Attorney’s Office have been conducting a criminal investigation of this crash concurrent with the NTSB crash investigation, for which reason they denied the NTSB timely access to investigation materials, including the crash limousine and its components. 34 NTSB investigators were permitted to conduct a visual-only inspection of the vehicle on October 8–9, 2018 (2 days after the crash). Investigators were permitted to conduct another visual-only inspection on January 29–31,

1. The NYSP disassembled vehicle components from the limousine on October 14 and 15, 2018, at the NYSP

Troop G impound area. NTSB investigators were not allowed to participate in the inspection and disassembly of components. The NYSP contracted for an outside consultant firm, Comprehensive Motor Vehicle Services and Consulting of Concord, New Hampshire, to perform a mechanical inspection of the components. On May 23, 2019 (7 months after the crash), the NTSB was permitted to conduct a visual-only inspection of the vehicle components. 35 Postcrash, the crash limousine was first housed under a fully enclosed tent; later, it was sheltered in a rigid enclosure/shed.

NTSB

Highway Accident Report 21 including the underbody structural supports and chassis support gussets.36 Frame welds and underbody structural supports were inspected, and the welds appeared intact. The front suspension and components were displaced rearward by the crash forces, but they showed no evidence of precrash component failure. The rear seven-leaf spring suspension assemblies showed evidence of corrosion, but the structural integrity appeared intact. 1.5.3.4 Driver controls and steering. The steering column and wheel were displaced rearward against the driver’s seatback. Damage prevented rotation of the steering wheel or column. The steering gearbox remained mounted to the frame, but functional testing was not possible.37 A thorough inspection and functional tests of the accelerator pedal assembly would have been limited, due to the extensive damage to the driver compartment. 1.5.3.5 Tires and wheels. The limousine was equipped with three different brands of tires, and the left front tire was over 10 years old and not the size recommended by the OEM. Nevertheless, the tires and wheels revealed no evidence of a precrash failure. Damage to the front wheels was consistent with impacts during the collision sequence and resulted in deflation of both front tires. 1.5.3.6 Transmission. The automatic transmission was damaged and had fractured into several pieces. The output shaft separated from the transmission case during the crash. There was significant wear to the transmission bushings, and the forward clutch friction disc showed very little friction material remaining. The four-speed automatic transmission had six gearshift positions (park, reverse, neutral, drive, 2, and 1). The first and second gears are sometimes used to provide additional engine braking on steep downgrades, which uses the drivetrain to slow the vehicle.38 1.5.3.7 Brake system description. The limousine’s brake system consisted of a hydraulic, vacuum power-assisted, dual circuit, front-rear split, four-wheel disc brake system with antilock brakes on all axles. Before describing the mechanical condition of the individual brake components on the limousine, this section provides a brief overview of how a hydraulic disc brake system operates. Figure 17 depicts some key brake system components.

36 Rust was noted in both the March 21, 2018, and September 4, 2018, roadside inspections conducted on the crash limousine. Notes from the March 21 inspection state: “Inspection, repair and maintenance of parts and accessories: Deterioration of ‘B’ post left side at frame (rusted through).” The September 4 inspection recorded similar findings. 37 Because the limousine driver was able to steer and navigate multiple curves and initiate an evasive steering maneuver immediately before the crash, the functionality of the steering system was not investigated further. 38 The mechanical examination did not reveal the gearshift position; however, engine speed limits the transmission gear selection. Published data indicate that the 6.8-liter engine had a maximum operating limit of 5,200 revolutions per minute (rpm) as measured at the crankshaft. Using transmission gear ratios, rear differential ratio, and tire circumference, a maximum speed for a given gear position can be calculated. At the maximum engine rpm, the maximum speed for the first and second gears was calculated at 48 mph and 84 mph, respectively. If the vehicle were traveling above those speeds, the transmission’s electronic controller most likely would not have allowed a downshift and would have maintained the higher gear position.

NTSB

Highway Accident Report 22

Figure 17. Diagram of hydraulic brake system and components. (Source: AA1 Car [NTSB added to and adjusted fonts of item labels]) In a hydraulic brake system, when the brake pedal is pressed, a pushrod exerts force on pistons in the master cylinder, pushing fluid from the brake fluid reservoir into a pressure chamber. The increased pressure of the hydraulic system forces fluid through the brake line into the brake calipers at each wheel assembly. The hydraulic fluid at the brake calipers pushes the pistons, which apply force to the brake pads, pushing them against the spinning rotor. The friction between the pads and the rotor generates a braking torque that slows the vehicle. Heat generated by this friction is dissipated through cooling vents in the rotor and through the brake pads, which are made of heat-resistant materials. More information on the individual components of a hydraulic brake system, as well as details specific to the crash limousine’s hydraulic brake system, is provided below: • Vacuum booster. The vacuum booster is attached between the brake pedal and the master cylinder and is used to multiply the braking force applied by the driver. The booster receives its power via a vacuum system attached to the engine’s intake manifold. The vacuum created within the booster’s dual diaphragm creates a pushing force against the pistons in the master cylinder, which increases the hydraulic pressure being applied throughout the brake system. • Master cylinder. The master cylinder pumps brake fluid from a reservoir to the brake line. On the crash limousine, the master cylinder was a dual-circuit system divided into two

NTSB

Highway Accident Report 23 sections, each of which pressurized a separate hydraulic circuit. The limousine had a front/rear split brake system that used one master cylinder section to pressurize the front wheel brake calipers and the other section to pressurize the rear brakes. • Brake calipers. Brake calipers house the brake pads and pistons. Each brake caliper on the limousine had a two-piston sliding design. When pressurized brake fluid reached the caliper, it applied pressure against the back of two pistons seated within their bores. The pistons then moved outward from the bores and pushed against a brake pad on the inboard side of the rotor. The caliper slid on pins and squeezed the outboard pad against the rotor, which initiated braking action. • Brake pads. Brake pads apply pressure and friction to the brake rotors. The limousine’s brake pads consisted of a friction material (lining) and a backing plate for the lining. The limousine’s brake pads were of a bonded design with a semi-metallic composition.39 • Brake discs (rotors). Brake rotors receive the force applied by the brake pads. On the crash limousine, the rotors were mounted on the hub and rotated with the wheel and tire. As the caliper clamped the brake pads against the rotor, a substantial friction was created between the pads and the rotors.40 This friction slowed the wheel and caused intense heat. Each rotor was made of cast iron with two friction surfaces separated by cooling vents. As the rotor spun, air was pulled through the cooling vents to remove heat from the friction surfaces and cool the rotor. 1.5.3.8 Brake system mechanical condition. On May 23, 2019, NTSB investigators were given access to perform a visual-only inspection of the individual brake components. The following summarizes the brake system inspection: • Master cylinder and vacuum booster. The master cylinder appeared to be new, but it was damaged in the crash, and the fluid reservoir was detached from the body. The vacuum booster and brake fluid reservoir sustained impact-related damage (see figure 18).

39 Semi-metallic pads contain iron, steel, copper, and graphite, which are mixed into a friction compound. 40 On the rotor, the “swept area” would be the disc area in direct contact with the pads.

NTSB

Highway Accident Report 24

Figure 18. Photographs of brake components, postcrash. Left photo shows damaged power brake vacuum booster. Right photo shows damaged plastic brake fluid reservoir. (Source: NYSP) • Steel brake line. The steel brake line (tubing) attached to the right of the rear differential housing was corroded, as evidenced by spalling and flaking of the surface corrosion scaling.41 The brake tubing was coated in oil consistent with brake fluid, which indicated that, at some point, this area of the brake line experienced a leak. Although NTSB investigators did not have the opportunity to conduct a laboratory examination of the brake line, they observed more fluid near the section of the line with the greatest corrosion damage. On this basis, it appeared likely that the leak from the brake line was a preexisting condition rather than crash damage.42 In addition to the corrosion, the tubing exhibited a crimp near the connection to the right rear flexible rubber brake hose.43 The crimp was downstream of the oil flow, which would have reduced the amount of brake fluid that could flow to the rear brakes, potentially affecting braking performance (see figure 19). No service records or vehicle inspection notes indicated a crimp; however, the uniform corrosion on the crimped region is consistent with the crimp having been present before the corrosion occurred—a preexisiting condition.

41 A differential is part of the axle assembly and is designed to transfer the vehicle’s engine power to the rear wheels. 42 A loss of integrity of the brake tubing near the right rear brake assembly could result in overall brake failure at both the left and right rear wheel locations due to loss of hydraulic pressure. Because the brake system had a front-rear split design, the front brakes would continue to function if there was a failure of the rear brake line. 43 The left rear inner and outer brake pads were in good condition, with little-to-no evident wear. (This may have been a result of inadequate hydraulic brake pressure being supplied to the rear brake line over an extended period due to the corrosion and the crimp in the line.) The right rear brake pads were worn and deteriorated.

NTSB

Highway Accident Report 25

Figure 19. Photographs of brake line segments, postcrash. Left top photo shows crimp in brake line (downstream of oil flow) that was attached near right rear brake assembly. Right top photo shows corroded steel brake tubing with an area of brake fluid coating. Bottom photograph shows locations of both brake line segments. (Source: NYSP, with NTSB labels added) • Rear brakes. Both the right and left rear brake calipers and slide pins showed evidence of corrosion across all surfaces. The two pistons on the right rear caliper appeared to be seized (frozen) in place.44 One of the pistons on the left rear caliper was extruding from the piston bore and appeared to be binding within the bore (see figure 20). NTSB investigators did not have the opportunity to examine the brake components further to determine whether the corrosion resulted in the seized pistons or whether the pistons seized due to lack of the movement from a loss of brake fluid. The thicknesses of the rear brake pads and rotors were within federal commercial vehicle regulatory specifications. Both rear rotors were corroded and had scoring to the inner and outer swept brake rotor surfaces. The left rear disc brake pads, both inner and outer, were in good condition, with little to no evident wear. The right rear disc pads were corroded, and the friction material showed uneven wear.

44 The right rear caliper was of an older design, and its pistons were composed of steel rather than having the phenolic (plastic) composition of the pistons in the left rear, right front, and left front calipers. Assuming that both pistons for the right rear caliper were seized in place before the crash, there would have been no braking at the right rear brake assembly. Functional testing would be required to determine the extent to which the pistons were seized in place.

NTSB

Highway Accident Report 26

Figure 20. Photographs of brake calipers, postcrash. Left photo shows left rear brake caliper with one piston extruding from piston bore. Right photograph shows right rear brake caliper with both pistons seated within piston bores. • Front brakes. When examining both the left and right front brake components, NTSB investigators detected an odor of burned materials.45 The brake pads were corroded and displayed uneven wear patterns, glazing, and deterioration of the friction surfaces (see figure 21). The brake rotors were corroded across all areas except the swept surfaces, which appeared to contain embedded friction material from the pads. All brake component measurements (pads and rotors) were within commercial vehicle regulatory specifications.

Figure 21. Photographs of right front disk brake rotor and inner right front brake pad surface. Left photo shows right front disc brake rotor with corrosion and swept surfaces. Right photo shows the inner right front brake pad surface with corrosion and uneven wear patterns, glazing, and deterioration.

45 The NYSP troopers who responded to the crash told NTSB investigators (recorded in investigators’ field notes) that they had detected a strong odor of overheated brakes at the crash scene.

NTSB

Highway Accident Report 27 • Antilock brake system (ABS). The limousine was equipped with a four-wheel ABS.46 The ABS operates by detecting the onset of wheel lockup during brake applications and compensates by preventing wheels from locking. Records of the NYSDOT inspections of the limousine conducted on March 21, 2018, and September 4, 2018, noted that the ABS warning light for the limousine remained on when the vehicle was in motion. The 2001 Ford Excursion owner’s manual states that, when the ABS light is on, the ABS is disabled and service is needed. Normal braking remains effective when the ABS is disabled. 1.5.4 Limousine Maintenance On July 21, 2016, the limousine was sold to Prestige Limousine. Between July 2016 and September 2018, the limousine was driven 11,212 miles—an average of 431 miles per month. Mavis Discount Tire, in Saratoga Springs, New York, was the auto repair shop that serviced the limousine. Table 2 shows the maintenance performed by Mavis Discount Tire during the 2 years preceding the crash. No records were found for any repairs to the front brakes on the limousine. Table 2. Recorded maintenance on limousine, July 2016—September 2018. 1.5.5 Prestige Limousine Fleet Inspection At the time of the crash, Prestige Limousine maintained a fleet of four limousines. In addition to the Ford Excursion stretch limousine, Prestige owned three Lincoln Town Car stretch limousines. After the crash, the NYSP inspected the three Lincoln limousines to assess company maintenance standards. NTSB investigators were present during the NYSP inspections but were

46 The purpose of ABS is to help maintain directional stability and control during braking and possibly to reduce stopping distances on some road surfaces, especially wet roads. ABS may prevent crashes involving loss of control. FMVSS 105, effective March 1, 1999, requires buses with a GVWR greater than 10,000 pounds to be equipped with ABS and to meet additional stopping distance requirements. Date Items Repaired 9/10/2016 Right rear brakes repaired. Replaced brake caliper, brake pads, and rotor. Brake system flushed. 6/9/2017 Replaced alternator. 9/28/2017 Changed oil and checked tire pressure. 1/25/2018 Repaired exhaust system. Windshield wipers replaced. Power steering flushed. 5/11/2018 Repaired left rear brakes. Replaced brake caliper with factory-rebuilt caliper and installed new brake pads. Replaced brake hose. Replaced oil filter and changed oil. Conducted New York State safety and emissions inspections. Mavis Discount Tire passed vehicle on both inspections.*

• See section 1.7.2. for more information on New York State Department of Motor Vehicle oversight of state inspection facilities.

NTSB

Highway Accident Report 28 only allowed to photograph the vehicles and components.47 The visual inspection revealed that all three limousines were poorly maintained and had extensive corrosion throughout. The floorboards in all the vehicles had disintegrated through to the carpet in multiple locations. The NYSP inspections of the limousines revealed numerous safety violations for each vehicle (including three out-of-service [OOS] violations).48 1.5.6 Brake Performance Study 1.5.6.1 Background. When the crash occurred, the weight of the altered vehicle exceeded the manufacturer’s GVWR (8,600 pounds) for the original vehicle (SUV) by about 4,965 pounds. No evidence was found that the limousine or brake system had ever been certified as meeting the FMVSS 105 brake system requirements for the new weight. To determine how the additional weight, assuming proper maintenance, would have affected the performance of the OEM brake system, the NTSB contracted with Greening Testing Laboratories in Detroit, Michigan, to conduct performance-based testing to examine the braking performance of a Ford Excursion SUV at the manufacturer’s GVWR and at the weight of the limousine at the time of the crash.49 The testing also included brake dynamometer testing to simulate braking performance over the route the vehicle traveled.50 The purpose of the testing was to assess what braking would have been possible had the limousine been properly functioning and maintained (independent of whatever brake or suspension upfitting should have been undertaken at the time of vehicle alteration).51

47 The NTSB investigator would have obtained maintenance records for those limousines and compared the records with the components to verify repairs performed. Additionally, the investigator would have taken brake fluid samples from each vehicle to compare them with the samples obtained from the crash-involved limousine. Investigators were unable to take either action because Prestige Limousine would not make the records or vehicles available for inspection. 48 One vehicle had two OOS violations: “(1) Tire-flat and/or audible air leak: Axle #1 left side tire is flat and (2) Brakes (general) Explain: Hydraulic fluid reservoir for brake system below the minimum marking level.” For one vehicle, the OOS violation was “Tire-other tread depth less than 2/32 of inch measured in a major tread groove: Axle #2 left side tire measure at less than 1/32 of an inch in more than two major tread grooves more than 8 inches apart.” 49 Greening Testing Laboratories, Detroit, Michigan, is an ISO 17025-certified testing laboratory that provides performance testing of commercial vehicle, light truck, and passenger car brakes. 50 During braking, the brakes generate torque, which slows the rotation of the tires. A brake dynamometer is a machine used to measure the relationship between brake torque, speed, pressure, and temperature. 51 The brake performance tests were conducted to address the question of whether the alteration process played a role in the crash. The tests were designed to determine whether an altered Ford Excursion SUV with functional brakes would have met the Federal Motor Vehicles Safety Standards for brake requirements. See the Brake Performance Study in the NTSB public docket for this investigation (NTSB accident HWY19MH001) for study details.

NTSB

Highway Accident Report 29 1.5.6.2 FMVSS 105 baseline testing. The purpose of the testing was to determine whether the exemplar Ford Excursion vehicle (1) loaded to the crash weight of 13,565 pounds and (2) with properly functioning braking would meet certain performance criteria (stopping distance, burnishing, brake fade and recovery, and pedal force) described in FMVSS 105.52 The NTSB established a test objective, and Greening Testing Laboratories managed and conducted the testing using an exemplar Ford Excursion. The exemplar testing was conducted by the Nevada Automotive Test Center (NATC) in Carson City, Nevada.53 The brake components used in the testing were Ford-recommended original equipment parts specified for the unmodified accident vehicle.54 The original equipment brake parts were selected for the study because they best represented the level of performance the original manufacturer intended for the Ford Excursion SUV.55 The FMVSS 105 procedures included the regulatory sections covering minimum stopping distance, partial system failure, brake booster failure, and brake fade and recovery. The test objective did not cover the entire FMVSS 105 protocol, as the results were intended to represent an exemplar performance baseline and not to establish regulatory compliance. Exemplar testing was also used to identify brake cooling and coast-down (drag) curves for use in the route simulations. The FMVSS 105 test maneuvers performed as part of the evaluation included stopping distance effectiveness, partial brake system failure (front and rear), ABS failure, and inoperable brake power assist unit, as well as brake fade and recovery.56 As summarized in table 3, the results of the testing indicate that the limousine, at a weight of 13,565 pounds, with a properly functioning brake system, would have been capable of meeting the parameters of the FMVSS 105 stopping distance requirements, with the exception of the heavy load test for inoperable brake power assist (indicated in table 3 by the blue-shaded cell). In addition, the testing indicated that the limousine, weighing 13,565 pounds with a properly functioning brake system, would have had sufficient braking capacity to meet the FMVSS 105 brake fade and recovery test requirements.

52 (a) Brake fade is the reduction in stopping power that can occur after repeated or sustained application of the brakes. Brake fade is caused by a build-up of heat on the braking surfaces. (b) For more information on FMVSS 105, see 49 CFR 571.105 at Standard No. 105; Hydraulic and electric brake systems, accessed August 23, 2020. 53 The vehicle used in the evaluation was a 2000 Ford Excursion SUV. 54 The exemplar testing was used to determine vehicle-specific parameters that were then incorporated into route situations with a dual-end dynamometer (testing conducted by Greening) to evaluate braking performance along the known route traveled by the crash limousine, with the vehicle loaded to the crash weight. 55 Because FMVSS 105 testing is designed to evaluate the brake system performance of a newly manufactured vehicle, new brake components were used. These brake components were not meant to reflect the brake components that were on the limousine at the time of the crash. Poorly maintained brakes and aftermarket brake pads and rotors would negatively affect the overall brake system performance and result in longer stopping distances. 56 In reference to the “inoperable brake power assist unit” element, the test requires that the vehicle stop within a defined distance with the power assist unit being disabled or depleted of all reserve capacity.

NTSB

Highway Accident Report 30 Table 3. Results of FMVSS 105 testing of exemplar Ford Excursion SUV.

As part of the testing, the NTSB compared the stopping distances for a Ford Excursion SUV with a GVWR of 8,600 pounds with those of one weighing 13,565 pounds (see table 4). Although the data indicate that the stopping distances were significantly greater for the heavier vehicle, the test results were still within the FMVSS 105 stopping distance requirements, with the exception of the inoperable power assist test (indicated in table 4 by the blue-shaded cell). Evaluation FMVSS 105 Requirement for Vehicle ≥ 8,000 lbs. and ≤ 10,000 lbs. GVWR FMVSS 105 Requirement for Vehicle

10,000 lbs.

GVWR Measured Stopping Distance of Exemplar Vehicle 1st effectiveness test, 6 stops, 30 mph Heavy test load (13,565 lbs.) 72 feet 88 feet 84.2 feet 1st effectiveness test, 6 stops, 60 mph Heavy test load (13,565 lbs.) 267 feet 388 feet 337.4 feet 2nd effectiveness test, 6 stops, 30 mph Heavy test load (13,565 lbs.) 57 feet 78 feet 65.2 feet 2nd effectiveness test, 6 stops, 60 mph Light test load (10,145 lbs.) 216 feet 310 feet 268.8 feet 3rd effectiveness test, 6 stops, 60 mph Light test load (10,145 lbs.) 242 feet 335 feet 208.5 feet Partial systems failure (front), 60 mph Light test load (10,145 lbs.) 517 feet 613 feet 445.2 feet Partial systems failure (rear), 60 mph Light test load (10,145 lbs.) 517 feet 613 feet 361.7 feet Partial systems failure (front), 60 mph Heavy test load (13,565 lbs.) 517 feet 613 feet 594.1 feet Partial systems failure (rear), 60 mph Heavy test load (13,565 lbs.) 517 feet 613 feet 466.9 feet ABS failure, 60 mph Heavy test load (13,565 lbs.) 517 feet 613 feet 269.7 feet Inoperable power assist Heavy test load (13,565 lbs.) 517 feet 613 feet 718.5 feet

NTSB

Highway Accident Report 31 Table 4. Comparison of stopping distances for Ford Excursion weighing 8,600 pounds with one weighing 13,565 pounds.

1. 5.6.3 Brake dynamometer testing. To evaluate the braking characteristics of the

limousine along the 35.4-mile route of travel from when it entered I-90 to the crash location, a series of simulations were performed using a brake dynamometer at Greening Testing Laboratories. The road profile along the route was simulated, and the effects of road grades were modeled by adding or subtracting energy by applying torque through the drive motor in the dynamometer (refer to figure 8 for the road profile). The dynamometer testing evaluated four vehicle conditions: • Condition 1: Vehicle weight = 8,600 pounds, all brakes functioning properly. • Condition 2: Vehicle weight = 13,565 pounds, all brakes functioning properly. • Condition 3: Vehicle weight = 13,565 pounds, front brakes functioning properly, no rear brakes functioning. • Condition 4: Vehicle weight = 13,565 pounds, front brakes functioning properly, 1 rear brake functioning.

Test 2000 Ford Excursion GVWR 8,600 lbs. Stopping Distance (Ford Testing) 2000 Ford Excursion Weight 13,565 lbs. Stopping Distance (NATC Testing) 1st effectiveness test, 6 stops, 30 mph 49.5 feet 84.2 feet 1st effectiveness test, 6 stops, 60 mph 192 feet 337.4 feet 2nd effectiveness test, 6 stops, 30 mph 47.6 feet 65.2 feet 2nd effectiveness test, 6 stops, 60 mph 174.3 feet 268.8 feet 3rd effectiveness test, 6 stops, 60 mph 170.3 feet 208.5 feet Partial systems failure (front), 60 mph 364 feet 445.2 feet Partial systems failure (rear), 60 mph 241 feet 361.7 feet Partial systems failure (front), 60 mph 352.1 feet 594.1 feet Partial systems failure (rear), 60 mph 289.5 feet 466.9 feet ABS failure, 60 mph 174.1 feet 269.7 feet Inoperable power assist 416.8 feet 718.5 feet

NTSB

Highway Accident Report 32 Some of the key findings of the brake dynamometer simulation testing included the following: • The simulated limousine with a weight of 13,565 pounds with properly functioning brakes would have had sufficient braking capacity to safely negotiate the simulated route at the posted speed limit in any of conditions 2–4 listed above.57 • With all brakes functioning, increasing the weight of the limousine from 8,600 pounds to 13,565 pounds increased the maximum measured brake rotor temperatures by 23–24 percent for the front and rear brakes. • The maximum brake temperatures during all four weight/brake system conditions occurred at the bottom of the descent to the stop sign at the NY-30/NY-30A intersection. The highest brake rotor temperatures were measured at the front brakes when the rear brakes were disabled (no rear brakes functioning simulation). This simulated condition resulted in a temperature increase of approximately 34 percent when comparing the 13,565-pound vehicle with all brakes functioning to the vehicle with only front brakes functioning. • The simulations corroborated the anticipated rise in brake rotor temperatures as one or more conditions changed. Those conditions included increasing the vehicle weight, disabling the rear brakes, and continuing application of the brakes to control speed along the downgrade. Although brake fade can be a consequence of higher brake temperatures, a complete loss of braking due to brake fade was not encountered during the simulations. • Under all simulated conditions, the vehicle was able to stop at the bottom of the downgrade. 1.6 Limousine Driver Factors 1.6.1 Licensing and Experience 1.6.1.1 Licensing. The limousine driver, a 53-year-old male, held a New York class A commercial driver’s license (CDL) with double and triple trailer and tank endorsements.58 He had held a CDL since 1991. The driver did not possess a passenger transport (P) endorsement, which is required to operate a vehicle designed to transport 15 or more passengers.59

57 The condition 1 simulated limousine, at the lower weight of 8,600 pounds with all brakes functioning, would also have had sufficient braking capacity to safely negotiate the route. 58 A class A CDL permits the holder to operate a vehicle with a GVWR exceeding 26,000 pounds. 59 To obtain a P endorsement, the driver would have to demonstrate specific knowledge pertaining to section 4 of the New York State Commercial Driver’s Manual. Section 4 addresses issues such as pre- and post-trip vehicle inspections, loading of passengers, on-the-road safety, use of brake-door interlocks, and prohibited practices.

NTSB

Highway Accident Report 33 During a roadside NYSP inspection conducted on August 25, 2018, the inspector noted that the driver was operating a limousine without a P endorsement. When the inspection took place, the driver was operating the 2001 Ford Excursion limousine involved in the Schoharie crash. A notice was sent to Prestige Limousine stating that “pursuant to the authority contained in NYS [New York State] Transportation Law, I hereby declare the driver [driver’s name] out-of-service. No motor carrier shall permit or require this driver to operate any motor vehicle until the driver has proper CDL endorsement.” The driver did not obtain an endorsement to operate the limousine before the October 6, 2018, crash. 1.6.1.2 Traffic violations and accidents. The driver’s New York driving record shows two traffic citations, one license suspension, and one accident (failure to yield right-of-way while operating a private vehicle in November 2015). The traffic citations, which were issued in March and May 2018, were for operating an uninspected private vehicle and for operating an unregistered private vehicle. His personal driver’s license was suspended on September 6, 2018, for failing to pay the fine related to the March 2018 traffic citation. His license was reinstated on September 7, 2018, after he paid the fine. 1.6.1.3 Experience. Prestige Limousine refused to provide NTSB investigators access to driver qualification, training, and other records, due to the ongoing criminal investigation of the crash. According to the driver’s wife, her husband began work at Prestige Limousine in 2017, a year before the crash. She said that before 2017, the driver had only operated trucks. The driver was employed part-time by the limousine company, primarily operating limousines on weekends on an on-call basis. The driver also drove for a commercial ride-sharing service during the week.60 1.6.2 Health, Toxicology, and Medical Certification 1.6.2.1 Health and prescribed medication. The limousine driver was reported by his wife to have been in good health. When asked about life stressors, the driver’s wife said that he was worried about family finances and the death of his younger brother (who had died a year earlier). She described her husband as being in good spirits when he left for work on the day of the crash. Regarding drug and alcohol use, the wife reported that her husband “drank a beer every now and then, nothing heavy,” and “smoked weed.” She did not provide information regarding when he last used marijuana or when he last took his prescribed medications. NTSB investigators reviewed the driver’s medical records from January 2016 through January 2018. Records show that the driver had a total right hip replacement in July 2017 and was being treated for elevated cholesterol and gastric reflux. The driver’s medical condition at the time of the crash included attention deficit hyperactivity disorder (ADHD).61 ADHD is associated with deficits in attention and susceptibility to distraction as well as with impulsivity and impairments in motor inhibition, reaction time, visual-motor coordination, executive functioning,

60 The driver worked for Uber for about 3 months before the crash. He drove his personal vehicle and typically worked 4 days a week, between Monday and Friday, usually about 5 hours a day. 61 Detailed psychiatric records were requested but, due to state statutes, the records were not released to investigators.

NTSB

Highway Accident Report 34 decision-making, and rule-governed behavior that interfere with functioning (American Psychiatric Association 2013). A limited psychiatric examination conducted during the driver’s latest physical, performed by his primary care provider on December 18, 2017, documented that the driver had a normal mood with good judgment. The treating physician documented that the driver received monthly evaluations for bipolar disorder. The driver’s prescribed medications are listed in table 5. Table 5. Prescription medications filled by driver in 2018. Drug/Strength/#Filled First Filled Last Filled Indications

1. 6.2.2 Toxicology. The Schoharie County Coroner’s Office had responsibility for victim

autopsies, including the one conducted on the limousine driver; the coroner’s office outsourced the autopsies to an independent medical examiner, who performed them at the Albany Medical Center morgue. At the request of the NTSB, the medical examiner sent biological samples from the driver to the Federal Aviation Administration Forensic Sciences Laboratory for additional testing.62 No ethanol was detected in the tissue samples. The tests detected the antidepressant bupropion, the anti-epileptic/bipolar disorder medication oxcarbazepine, and the heartburn medication famotidine. Testing also detected marijuana’s primary psychoactive chemical, delta-9-tetrahydrocannabinol (THC), in the driver’s bile, gastric, kidney, brain, spleen, muscle, lung, liver, and heart samples. THC’s most prominent psychoactive metabolite, 11-hyroxy-delta-9-THC (11-OH-THC), and the inactive metabolite carboxy-delta-9-THC (THC-COOH) were also detected in tissue samples from the driver.63 THC has multiple effects on the central nervous system; it may alter perception, create euphoria, make thinking difficult, impair psychomotor performance, and cause depression. Specific performance effects include a decreased ability to concentrate and maintain attention. Impairment in reaction time and tracking, subjective sleepiness, distortion of time and distance, changes in vigilance, and loss of coordination in divided attention tasks have been reported (Compton 2017). Although researchers have consistently found impairment of driving-related measures (such as tracking, attention, and vigilance), when conducting driving simulator,

62 Due to the circumstances of the crash, little blood was available for testing. Various tissue samples were tested instead. The drug concentrations found in the tissue samples are not reported, as the levels do not correlate with the actual level in the driver’s bloodstream at the time of the crash. As such, the concentration levels cannot be used to determine impairment. 63 Drug concentrations from tissue samples can be used to infer drug presence; they cannot be used to determine impairment. Aripiprazole 10 mg #30 12/2016 09/18/2018 Psychoactive medication Bupropion SR 200 mg #30 05/2018 09/14/2018 Antidepressant medication Oxcarbazepine 300 mg #60 10/2016 10/02/2018 Anti-epileptic drug Famotidine 20 mg #60 10/2016 09/07/2018 Gastroesophageal reflux medication Atorvastatin 10 mg #30 10/2016 06/12/2018 High-cholesterol medication

NTSB

Highway Accident Report 35 closed-course, and open-course testing, results have shown THC to have minor to moderate effects on driving performance (Robbe 1998). Commercial drivers are prohibited from using THC.64 1.6.2.3 Medical certification. The limousine driver was required to be medically certified to operate a commercial vehicle. The driver’s most recent CDL medical examination was performed on September 6, 2017. In that examination, the driver omitted information and indicated no medical conditions or health history issues. He stated that he was not taking any prescription or over-the-counter medications. He did tell the examiner that he had had a hip replacement but marked “NO” on the examination form to the following questions: “Do you have or have you ever had anxiety, depression, nervousness, or other mental health problems?”; “Have you ever spent the night in a hospital?”; and “Have you used an illegal substance in the past two years?” He also responded “NO” to having high blood pressure, high cholesterol, or stomach problems. The examining certified medical examiner, an advanced practice registered nurse, determined that the driver met the requirements established by 49 CFR 391.41 and qualified him for 2 years. 1.6.3 Precrash Activities 1.6.3.1 General information. The limousine driver’s activities preceding the crash, which were developed based on interviews with the driver’s wife, an NYSP deposition statement from the driver’s manager at the limousine company, information from the driver’s ride-sharing employer, witness statements, and the driver’s cell phone records, are shown in table 6. The driver had about 10.5 hours of sleep opportunity the night before the crash. His wife said that he “slept like a log,” and indicated that he had no problem falling asleep. She said that the driver would sometimes wake in the middle of the night due to stress over family finances but would easily fall back to sleep. She said that the driver snored occasionally, but medical records showed that he had never been diagnosed with a sleep disorder, such as obstructive sleep apnea.65

64 Title 49 CFR 382.213(a) states in part that “no driver shall report for duty or remain on duty requiring the performance of safety functions when the driver uses any drug or substance identified as a Schedule 1 substance.” Additionally, 49 CFR 392.4(a) states in part that “No driver shall be on duty and possess, be under the influence of, or use, any of the following drugs or other substances: (1) Any 21 CFR 1308.11 Schedule I substance.” 65 During his CDL medical exam on September 6, 2017, the driver reported his height as 5 feet 10 inches and weight as 188 pounds. His body mass index was calculated at 27.

NTSB

Highway Accident Report 36 Table 6. Precrash activities of limousine driver, October 4–6, 2018. Time Activity Source Thursday, October 4* ~7:00 a.m.‒7:30 a.m. Awakens Driver’s wife 10:32 a.m. Makes outgoing cell phone call Cell phone records 1:35 p.m.‒1:59 p.m. Ride-share pick up and drop off of passenger(s) Ride-sharing records 3:01 p.m.‒3:21 p.m. Ride-share pick up and drop off of passenger(s) Ride-sharing records 9:08 p.m.‒9:37 p.m. Ride-share pick up and drop off of passenger(s) Ride-sharing records 9:41 p.m.‒10:00 p.m. Ride-share pick up and drop off of passenger(s) Ride-sharing records 10:06 p.m.‒10:26 p.m. Ride-share pick up and drop off of passenger(s) Ride-sharing records 10:35 p.m.‒10:52 p.m. Ride-share pick up and drop off of passenger(s) Ride-sharing records 11:16 p.m.‒11:28 p.m. Ride-share pick up and drop off of passenger(s) Ride-sharing records 11:38 p.m.‒12:17 a.m. Ride-share pick up and drop off of passenger(s) Ride-sharing records 12:45 a.m.‒1:00 a.m. Ride-share pick up and drop off of passenger(s) Ride-sharing records 1:19 a.m.‒1:53 a.m. Ride-share pick up and drop off of passenger(s) Ride-sharing records 1:53 a.m.‒2:00 a.m. Ride-share pick up and drop off of passenger(s) Ride-sharing records 2:09 a.m.‒2:15 a.m. Ride-share pick up and drop off of passenger(s) Ride-sharing records Unknown Goes to bed after final ride-share trip Not applicable Friday, October 5 ~7:00 a.m.‒7:30 a.m. Awakens Driver’s wife 8:20 a.m. Makes outgoing cell phone call Cell phone records 8:20 a.m.‒8:07 p.m. Activity unknown Not applicable 8:07 p.m. Checks voicemail on cell phone Cell phone records ~ 9:00 p.m. Goes to bed Driver’s wife Saturday, October 6 ~7:00 a.m.‒7:30 a.m. Awakens Driver’s wife 9:09 a.m. Receives incoming cell phone call Cell phone records 9:21 a.m. Receives incoming text Cell phone records ~10:00 a.m. Leaves home to get limousine Driver’s wife 1:05 p.m. Receives incoming call from wife Cell phone records ~1:50 p.m. Turns limousine onto NY-30 from NY-7 Witness 1:55 p.m. Crash – Schoharie Dispatch logs

• Although specific clock times are provided, each calendar “day” in this table begins at the driver’s time of arising and

ends with his last action of that day.

NTSB

Highway Accident Report 37 1.6.3.2 Pretrip activities. On October 6, 2018, about 10:00 a.m., the driver left his residence in Lake George, New York, to drive to Saratoga Springs, New York, where the limousine was parked.66 Prestige Limousine had four vehicles in its fleet, but only the 2001 Ford Excursion stretch limousine had the seating capacity to accommodate the charter group that hired it. It is unknown whether the driver performed a pretrip inspection of the limousine.67 The New York State CDL manual contains several pages of information regarding how drivers should perform a seven- step pretrip inspection.68 Inspection elements include an evaluation of the engine compartment; an examination of gauges; a check of the condition of controls; an inspection of brakes, tires, and lighting system; and a functionality test of service and parking brakes. If the limousine driver had followed the inspection guidelines, he might have noticed that (1) the ABS was inoperative, as indicated by a warning light on the dash, and (2) the left front tire did not match the size of the other tires on the vehicle. After obtaining the limousine, the driver drove to Amsterdam, New York, to pick up a charter group consisting of 17 passengers. 1.6.3.3 Trip activities. About 1:00 p.m. on October 6, the driver arrived in Amsterdam to pick up the charter passengers.69 Shortly thereafter, the limousine departed. For unknown reasons, the driver did not take a direct route to the destination of Cooperstown, New York. Cell phone records show that the driver was not using his cell phone for calls or text messaging during the trip, but he may have been using the global positioning system (GPS) function on his phone for navigation purposes.70 The route taken (refer to figure 1) involved traveling through rural, hilly terrain rather than taking major highways. About 1:50 p.m., witnesses observed the driver turn right from NY-7 onto NY-30 south. Shortly after making the turn, the limousine was seen moving toward the right shoulder with its hazard lights activated. The reason for the limousine’s moving toward the shoulder could not be determined. Before the crash, a passenger in the limousine expressed concern about the vehicle’s mechanical condition in text messages to a friend.71 The text messages included statements that “the limo sounds like it’s going to explode”; “yes haha it’s a junker literally”; “the motor is making everyone deaf”; and “when we get to [destination] we will all b deaf.” 1.6.3.4 Driver’s actions immediately preceding crash. Information is lacking about the driver’s actions after the limousine was seen moving to the right shoulder at the top of the steep grade until the vehicle reached the intersection and crash location 1.81 miles farther south on

66 The driving distance from Lake George to Saratoga Springs, New York, is about 28 miles. 67 As indicated earlier, the driver did not have a passenger endorsement as required. A passenger endorsement would have required him to have demonstrated knowledge of pre- and post-trip vehicle inspections. 68 The inspection guidelines apply to all commercial drivers; however, some of the information regarding the inspection of air brakes and other components found on trucks does not apply to the inspection of a limousine. 69 The NTSB does not know the route of travel the driver took from the Prestige Limousine parking location to Amsterdam. Considering transit times and the time necessary to check out the limousine, NTSB investigators cannot account for about 1 hour 50 minutes of the driver’s time before he arrived to pick up the charter group. His activities during this period are unknown. 70 The driver’s wife said that there was no GPS unit in the limousine and that her husband would use the navigation applications on his phone. The NTSB was not permitted access to the driver’s phone to perform a forensic analysis. 71 The text message was sent by the limousine passenger at 1:37 p.m., about 18 minutes before the crash. See the Human Performance Factors Attachment titled “New York State Police Supporting Depositions” in the NTSB public docket for this investigation (NTSB accident HWY19MH001).

NTSB

Highway Accident Report 38 NY-30. The vehicle was traveling at a high rate of speed at the bottom of the grade; however, no evidence was found indicating that the driver was applying the accelerator instead of the brakes.72 Although it is not possible to determine what actions the driver may have taken to maintain a reasonable/safe speed while descending the downgrade, substantial guidance is available to commercial drivers on what actions to take to properly traverse a grade and respond to an emergency involving loss of braking. The postcrash mechanical inspection of the limousine did not yield sufficient information to determine whether the driver took such actions, such as attempting to put the vehicle into a lower gear or trying to apply the parking brake. The only known action taken by the driver was an evasive steering maneuver to avoid the SUV that was stopped at the stop sign at the NY-30/NY-30A intersection. 1.7 Motor Carrier Factors Prestige Limousine operated out of Gansevoort, New York, and provided intrastate passenger carrier services in the state of New York.73 Before beginning passenger-carrying operations in the state, a motor carrier is required to obtain operating authority from the NYSDOT. Investigators’ review of records showed that Prestige Limousine had been providing charter and group passenger transportation without such authority from 2016 until the crash. 1.7.1 New York Operating Authority to Transport Passengers In the state of New York, a motor carrier must apply to the NYSDOT for authority to transport passengers.74 The application process can take 6 to 16 weeks, and it requires that the applicant carrier certify that it will operate only vehicles that have passed an NYSDOT vehicle safety inspection. The process further requires that the NYSDOT complete safety inspections of all vehicles the carrier plans to use in passenger service and that it issue a finding on whether the motor carrier applicant is fit, willing, and able to provide passenger transportation service. Applicants are required to complete an Application for Authority to Transport Passengers (RA 52-1 form) providing specific details about the carrier, the owner or company officials, and its commercial vehicles. The applicant must also provide proof of an active US Department of Transportation (USDOT) number obtained from the Federal Motor Carrier Safety Administration (FMCSA).

72 No evidence was found indicating that the driver intended to crash the vehicle. 73 Prestige Limousine had operated under other business names, including “Hasy Limousine” and “Saratoga Luxury Limousine.” For detailed information regarding Prestige operations, see the Motor Carrier Factual Report in the NTSB public docket for this investigation (NTSB accident HWY19MH001). Due to the ongoing criminal investigation, legal counsel for Prestige did not permit access to company business records or documents such as the limousine driver’s qualification file, training records, or any information concerning the existence or absence of a company drug and alcohol testing program. 74 For more information, see NYSDOT passenger authority, accessed August 23, 2020.

NTSB

Highway Accident Report 39 1.7.2 New York State Department of Motor Vehicles Oversight 1.7.2.1 Registration of stretch limousines. The New York State Department of Motor Vehicles (NYSDMV) is the state agency responsible for vehicle registration and licensing, as well as annual inspections of vehicles operating in the state. In 2011, the State of New York began requiring that any passenger vehicle that has been “stretched” or “modified,” regardless of seating capacity, be inspected by the NYSDOT before it can be used in for-hire passenger service and that it be registered in the state. When application is made to the NYSDMV for a New York vehicle title, license plates, and registration (new or renewal), if the vehicle has a seating capacity of 15 or more passengers, the NYSDMV classifies it as a “bus.” The NYSDMV requires that a bus be inspected by the NYSDOT as part of the NYSDOT bus inspection program.75 Prestige Limousine purchased the crash limousine on July 21, 2016. While it had been under previous ownership in the state of New York from 2001 through 2015, the limousine had been inspected twice a year by the NYSDOT as part of the bus inspection program. The NYSDOT listed the vehicle as a “bus” with a seating capacity of 18.76 On the NYSDMV application for title and registration form MV-82, dated July 21, 2016, Prestige listed the purchased vehicle’s seating capacity as 11, checked the box stating that the vehicle was a passenger car, and did not report that the vehicle had been altered (which would have changed its registration class). On October 12, 2017, Prestige renewed the registration for the stretch limousine with most of the same information but reduced the vehicle’s listed seating capacity to eight. On May 11, 2018, Prestige again renewed the vehicle registration but again changed the vehicle’s listed seating capacity, this time to 10.77 Table 7 provides an overview of the NYSDMV registration history for the limousine. Table 7. Registration history of crash-involved limousine.

75 There are inconsistencies in the definition of what constitutes a “bus.” Both the NYSDOT and federal safety standards (49 CFR 571.3[b]) define as a bus any vehicle used in for-hire service that seats 10 or more passengers. 76 The previous owners of the limousine, Royale Limousine and RLS Limousines of Albany, New York, registered the stretch limousine as a “bus,” which automatically put the oversight and inspection of the vehicle under the authority of the NYSDOT. Due to this registration classification, the limousine was required to submit to more rigorous semiannual inspections. 77 On October 4, 2018, Prestige Limousine management advertised the 2001 Ford Excursion limousine for sale. The limousine was advertised as having an 18-passenger seating capacity. Registration Date Reported Seating Capacity Vehicle Owner NYSDMV Classification Safety InspectionType 2001–2006 18 Royale Limousine Bus Semiannual NYSDOT – bus 2006–2016 18 RLS Limousine Bus Semiannual NYSDOT – bus July 21, 2016 11 Prestige Limousine Passenger vehicle Annual NYSDMV October 12, 2017 8 Prestige Limousine Passenger vehicle Annual NYSDMV May 11, 2018 10 Prestige Limousine Passenger vehicle Annual NYSDMV

NTSB

Highway Accident Report 40 All vehicles are titled and registered at state DMVs with the vehicle identification number (VIN). The VIN is issued by the manufacturer (in this case, Ford) and is specific to each vehicle. The NYSDMV had access to the crash limousine’s registrations from previous owners, from 2001 to 2016, which showed the vehicle’s seating capacity and its vehicle classification as a “bus.” The NYSDMV did not use this information to verify Prestige’s registration. The NYSDMV also had access to the “Abstract of Title Record,” which showed the vehicle registered as a “bus” by previous owners in the state of New York. Additionally, when in 2018 Prestige applied for registration renewal, it provided the NYSDMV (as required) with the insurance certificate for the vehicle, which showed that the vehicle had a seating capacity of 16, inconsistent with the seating capacity of 10 listed by Prestige on the MV-82 registration form. As of 2019, the NYSDMV updated its form MV-82, application for title and registration, and included additional required fields for vehicle details. (An additional form, MV-82 NPSUP, must be filled out if the vehicle is used in for-hire operations.) Figure 22 is the May 2020 version of the MV-82 form, with red outlining the new areas (sections 2 and 5) that would apply to the crash limousine.

Figure 22. Sections of MV-82 form.

NTSB

Highway Accident Report 41 1.7.2.2 NYSDMV inspection station protocol and oversight. In 2016 and 2018, Prestige Limousine brought the crash limousine for annual inspection (as required by NYSDMV for cars and similar passenger vehicles) to state-certified inspection stations.78 These inspection stations, which are operated by contractors, did not follow NYSDMV policy-based instructions not to inspect a modified or “stretch” limousine; instead, stations were to require the vehicle’s owner to contact the NYSDOT to undergo a semiannual bus safety inspection.79 The most recent NYSDMV annual inspection of the crash limousine was performed by Mavis Discount Tire on May 11, 2018. Mavis Discount Tire was a state-certified inspection station, and Prestige also used it to perform maintenance on its fleet of limousines. The NYSDMV inspection process must follow the state’s Regulations of the Commissioner of Motor Vehicles, “Part 79, Motor Vehicle Inspections.” This 103-page regulation details all the requirements of the NYSDMV inspection program.80 It is unknown whether Mavis Discount Tire inspected the crash limousine in accordance with all inspection criteria.81 For example, the criteria require that inspectors check seat belt function by buckling the belts, tugging on them, and unbuckling them. Postcrash, many of the non-OEM seat belts were found inaccessible and tucked under the bench seat. The inspection guidelines state that vehicles shall not pass inspection if any of the brake components are broken, frozen, or seized in place or if there is a break or crimp in any brake hose or line. The postcrash inspection of the limousine (refer to section 1.5.3) found deficiencies with individual brake components and a corroded and crimped steel brake line. Criteria also stated that vehicles shall not pass inspection if any brake line is not properly secured. The NYSDOT roadside inspection of the limousine on March 21, 2018, found the hydraulic brake line not secured and hanging near the left front wheel. The September 4, 2018, roadside inspection found that an ABS line was not secure and was able to make contact with the left front wheel.82 On May 11, 2018, after conducting repair work on the crash limousine’s left rear brake assembly and brake master cylinder, Mavis Discount Tire performed an emissions and safety inspection. Mavis Discount Tire passed the limousine in both areas.

78 Wilton Truck Center, of Wilton, New York, performed the first inspection on July 22, 2016, and issued a certificate of inspection decal. NTSB investigators found no evidence of an annual safety inspection on the crash limousine in 2017. 79 See Regulations of the Commissioner of Motor Vehicles, “Part 79, Motor Vehicle Inspections,” Section 79.20 “Inspection procedure generally,” F(2). 80 The regulations include 17 pages of inspection protocols that cover all the areas to be inspected, including the service brakes, parking brake, tires, steering, suspension, chassis/frame, lighting and reflectors, windshield and other glass, mirrors, windshield wipers, horn, seat belts, and fuel leaks. 81 The NYSDMV has the authority to suspend, revoke, or not renew the license of an official New York inspection station if the facility fails to conduct inspections in accordance with regulations. 82 These statements are from the written findings of the NYSDOT inspectors. An NYSDOT inspector indicated that both findings (from the March 21 and September 4 inspections) were referring to the same brake line fault.

NTSB

Highway Accident Report 42 1.7.3 New York State Department of Transportation Oversight The NYSDOT conducts two types of vehicle safety inspections: (1) standard vehicle safety inspections, in this case, under the bus inspection program—which occur every 6 months on a regular and scheduled basis—and (2) inspections that are conducted at the discretion of an NYSDOT inspector or law enforcement officer. Inspections of the second type include both roadside and terminal inspections of vehicles operating in the state. 1.7.3.1 NYSDOT bus inspection program. Participation in the NYSDOT bus inspection program is required for all for-hire passenger-carrying vehicles with a seating capacity of 10 or more, and for all “stretch vehicles,” regardless of the seating capacity, subject to NYSDOT operating authority. The NYSDOT bus inspection program requires that a certified NYSDOT inspector inspect passenger-carrying vehicles every 6 months. The NYSDOT bus (or limousine) safety inspection is different from the annual inspection program overseen by the NYSDMV for passenger vehicles. The NYSDOT bus inspection program is more rigorous and is modeled after the Commercial Vehicle Safety Alliance (CVSA) North American Standard Inspection Program.83 NYSDOT inspectors are CVSA-certified to conduct level 1 through level 8 inspections.84 A bus (or limousine), as well as its motor carrier, is to undergo inspections semiannually. NYSDOT inspectors maintain inspection records for each inspected vehicle and any required vehicle repairs completed as a result of each inspection. If a vehicle fails an inspection, the NYSDOT places the vehicle in OOS status and puts an “Out-of-Service” sticker on the windshield. Such a vehicle cannot be operated until it has been repaired and reinspected by a department inspector.85 Table 8 show the history of NYSDOT semiannual inspections and reinspections of the crash limousine from 2010 through 2015, when it was owned by RLS Limousine and properly registered with the NYSDMV as having a seating capacity of 18, which made it a bus. (The vehicle was not inspected in the NYSDOT bus inspection program between 2016 and 2018.)

83 The NYSDOT inspection program was adopted into New York State regulations 17 NYCRR Parts 720–723 and Part 820. 84 A level 1 inspection is a full North American Standard inspection encompassing both driver and vehicle issues; level 2 is a walkaround driver/vehicle inspection; level 3 is a driver-only inspection; level 4 is a special inspection to look at specific problem areas; level 5 is a vehicle-only inspection; level 6 relates to transport of radioactive materials; level 7 is a jurisdictional-mandated inspection (that is, for hotel shuttles, school buses, taxis, etc.); and level 8 is an electronic inspection. 85 See New York State regulations 17 NYCRR Part 720.2 (d).

NTSB

Highway Accident Report 43 Table 8. NYSDOT bus inspection program history for 2001 Ford Excursion stretch limousine, 2010 to 2018. Year Date Inspection Type Seats FMVSS Code 2010 February 24 Initial 18 Bus September 2 Regular Reinspected September 16 18 Bus 2011 March 17 Regular Reinspected April 7 18 Bus September 29 Regular 18 Bus 2012 March 29 Regular 18 Bus September 14 Regular 18 Bus 2013 February 28 Regular 18 Bus August 22 Regular 18 Bus 2014 February 5 Random 18 Bus July 30 Regular 18 Bus 2015 January 8 Regular 18 Bus June 25 Regular Reinspected June 26 18 Bus December 4 Placed out of use by owner 18 Bus 2016- 2017 None Reported variously to NYSDMV as 11, 8, and 10 Passenger car 2018 See section 1.7.3.2 below for details

All NYSDOT inspections are recorded in the Bus Safety Information Network (BUSNET) computer system, which the state uses to perform targeted inspections of problem carriers.86 Because Prestige Limousine never received state operating authority to transport passengers, state inspection information for the limousine was not entered into BUSNET. 1.7.3.2 NYSDOT roadside and terminal inspections. Unlike the NYSDOT bus inspection program, the NYSDOT roadside and terminal inspections are not conducted at regularly scheduled intervals. Instead, the subjects of these inspections are systematically selected using nationwide OOS criteria.87 Roadside and terminal inspections occur when a Motor Carrier Safety Assistance Program inspector examines individual commercial motor vehicles and drivers to determine whether they are in compliance with the Federal Motor Carrier Safety Regulations

86 BUSNET contains a carrier profile that includes the number of inspections (passed and percentage) as well as the average number of defects found and OOS defects per inspection. 87 The Inspection Selection System recommends vehicles for inspection based on one or both of the following: (1) poor prior safety performance evidenced by an unsatisfactory safety compliance fitness rating and/or higher than average driver/vehicle OOS rates; (2) very few or no roadside inspections in the previous 2 years relative to the carrier’s size.

NTSB

Highway Accident Report 44 and/or Hazardous Materials Regulations.88 These inspections constitute on-the-spot safety checks of the driver and the vehicle. Roadside inspections are typically conducted at weigh stations and ports of entry; however, the inspection can be conducted anywhere deemed safe by the inspector. Terminal inspections are conducted where the vehicle is regularly garaged or maintained, or from which it is operated or dispatched, including a private business or residence. Prestige Limousine received six NYSDOT inspections from March 21 to September 4, 2018; five were conducted by the NYSDOT, one by the NYSP. Three of the inspections were performed on the crash limousine and driver. Table 9 summarizes the NYSDOT inspection history of the limousine and driver. Table 9. NYSDOT inspection history for crash limousine and driver. Date/Type Violations March 21, 2018 (Level 5 – Vehicle)

14 violations (4 OOS) • Brakes OOS: More than 25% brakes defective (OOS violation) • Operating a passenger vehicle with seating in excess of FMVSS label (10) (OOS violation) • Hydraulic brake line going to front axle left dangling. Can make contact with front left tire (OOS violation) • No or defective bus emergency exit (OOS violation) • Vice grip placed on hydraulic brake line, axle number 2 left side • ABS light remains on while vehicle is in operation • Deterioration of B-post pillar on left side of frame • Vehicle missing final FMVSS label • No USDOT number • USDOT number not displayed • State operating authority violation • License plate violation • Operating commercial motor vehicle without proof of periodic inspection • Carrier not certified through NYSDMV bus driver unit August 25, 2018 (Level 3 – Driver) 3 violations (1 OOS) • No passenger vehicle endorsement on CDL (OOS violation) • Carrier name and USDOT number not displayed on sides of vehicle • Motor carrier failed to file paperwork (MCS-150) for USDOT number September 4, 2018 (Level 5 – Vehicle) 14 violations (3 OOS) • Operating a passenger vehicle with seating in excess of FMVSS label (10) (OOS violation) • ABS brake line going to front axle left dangling. Can make contact with front left tire (OOS violation) • No or defective bus emergency exit (OOS violation) • Other non-OOS violations similar to violations found during March 21, 2018, inspection, including ABS light remaining on when vehicle is in operation

88 For more information on the roadside inspection program, see the FMCSA webpage on roadside inspections by inspection level, accessed August 23, 2020.

NTSB

Highway Accident Report 45 1.7.3.3 NYSDOT interactions with Prestige Limousine. The NYSDOT first interacted with Prestige in May 2016, when Prestige applied for and was denied emergency temporary operating authority (to participate in that year’s prom transport season). Prestige continued to operate without authority, but the NYSDOT took no action against the carrier. In June 2017, an NYSDOT inspector observed the limousine parked outside Mavis Discount Tire. The inspector recognized that this vehicle would require NYSDOT operating authority due to its size and classification (stretch limousine). The investigator conducted additional inquiries, which uncovered evidence that the carrier had misrepresented itself in official documents. Based on this evidence, the NYSDOT began a Notice of Violation (NOV) process against Prestige.89 (A record of the NYSDOT’s numerous interactions with Prestige Limousine as part of a lengthy investigation by the agency into the company’s operating without authority appears in appendix D.) An NOV process is designed to provide a continuous and structured approach to encourage acceptable inspection results by all operators subject to an NYSDOT semiannual inspection.90 The process begins with the NYSDOT sending a written NOV to the carrier. The motor carrier can appear before a New York administrative law judge to plead its case or accept the penalties for the violation and pay the accompanying monetary fine. As detailed in appendix D, Prestige did not address the second NOV until the registration for the vehicle was suspended as a result of failure to appear. When Prestige paid the fine to the NYSDOT, the department reinstated the vehicle registration a few weeks before the crash, even though Prestige still had not applied for or received NYSDOT operating authority to transport passengers. It also still had an outstanding NOV because the crash limousine had not yet received an NYSDOT inspection. Prestige’s three NOVs are summarized in table 10. Table 10. NYSDOT Notice of Violation history for Prestige Limousine.

89 For additional information, see the Motor Carrier Attachment in the NTSB public docket for this investigation (NTSB accident HWY19MH001) titled “Notice to Appear NOV Issued August 15, 2017 dated September 14, 2017.” 90 Refer to the Motor Carrier Attachment in the NTSB public docket for this investigation (NTSB accident HWY19MH001) titled “NYSDOT Passenger Carrier Guidebook Section 2.12 dated December 1, 2017.” Date Notice of Violation Violation Description and Disposition August 15, 2017 10138 Violation: Transporting passengers without operating authority Hearing date: October 6, 2017 – Failure to appear by Prestige Disposition: May 6, 2018 – Prestige paid $500 fine January 8, 2018 8320 Violation: Transporting passengers without operating authority Hearing date: May 4, 2018 – Failure to appear by Prestige Disposition: Prestige’s vehicle registrations suspended on September 17, 2018. Registrations reinstated on September 19, 2018 after Prestige paid $500 fine September 1, 2018 8858 Violations: (1) Transporting passengers without operating authority (2) Not having NYSDOT semi-annual vehicle inspection (3) Not having an active USDOT number (4) Using a driver not qualified (no “P” endorsement) Hearing date: October 5, 2018 – Failure to appear by Prestige Disposition: October 6, 2018 – Crash $2,000 civil penalty remains outstanding

NTSB

Highway Accident Report 46 1.7.3.4 Measures of effectiveness of NYSDOT inspection program. In a 2004 audit report, the New York Office of the State Comptroller examined the NYSDOT’s inspection program and determined that the agency did not effectively monitor compliance and did not have an adequate system to verify that OOS violations were repaired (NYOC 2004). The audit found more than 19,065 motor carriers, both interstate and intrastate, with recurring violations during a 14-month audit period. The agency made 111 repair verification visits to carriers. The New York Office of the State Comptroller recommended that the NYSDOT “establish an enforcement strategy that will increase the number of repair verification visits during truck inspector’s downtime to identify motor carriers that do not make the required repairs.” In response to the recommendation, the NYSDOT stated that “the repair verification function is labor intensive and due to the surprise nature of the visits, may end with the motor carrier not being available. Therefore, the NYSDOT will continue to focus its resources primarily on more value-added activities such as roadside inspections.” Ten years later, in 2014, the New York Office of the State Comptroller again issued a report of an audit of the NYSDOT and found that the department did not monitor whether carriers submitted required certifications that OOS violations had been repaired (NYOC 2014). It also found that the NYSDOT did not always impose penalties when it found that carriers knowingly placed the public at risk by continuing to operate OOS vehicles without repairing them. The 2014 report proposed that the NYSDOT fulfill the following “key recommendations”: • Actively monitor carrier compliance with the requirements for certification that vehicles have been repaired. Develop strategies to improve carrier compliance, particularly for those with poor safety histories and OOS violations. • Impose progressive enforcement actions, such as compliance reviews and formal Notices of Violation, when carriers are found to have continued to operate OOS vehicles. The report included NYSDOT’s response to the draft report and the key recommendations. In the response, the NYSDOT indicated that it would take steps to address both recommendations. During the first two quarters of fiscal year 2018, repair verifications were conducted on 244 of the 6,059 New York State-domiciled carriers with OOS defects, representing 4 percent of those carriers (NYS 2019). In the NYSDOT’s submission of its 2019–2021 Commercial Vehicle Safety Plan (CVSP) to the FMCSA, the agency stated: Through its monitoring efforts, New York has identified carriers, who continually violate the requirement to correct previously cited defects discovered during roadside inspections, prior to continuing operations (49 CFR 396.9(c)(2)). By continuing to operate without correcting the defects that have been cited, these carriers pose a major threat to safety on the state’s roadways. Carriers, who fail to comply with federal regulations regarding the correction of defects, are subject to intervention by federally certified NYSDOT Investigators. Other carriers are

NTSB

Highway Accident Report 47 subject to intrastate review and action by NYSDOT. New York included a State Specific Objective in the FFY 2016, FFY 2017, and FFY 2018 CVSPs to increase the percentage of intrastate carriers identified as having failed to correct previously cited defects. 1.7.4 Federal Oversight The FMCSA oversees, and takes steps to ensure compliance with, motor carrier safety regulations. Although the FMCSA has limited oversight responsibility for intrastate passenger- carrying companies, such as Prestige Limousine, New York is one of several states that require intrastate commercial motor vehicle carriers to obtain an FMCSA USDOT number before obtaining state operating authority.91 The USDOT number serves as a unique identifier when collecting and monitoring a company’s safety information acquired during audits, compliance reviews, crash investigations, and inspections. Prestige Limousine received a USDOT number on August 29, 2018 (less than 40 days before the crash).92 Once Prestige Limousine was issued a USDOT number, its previous NYSDOT inspections were uploaded into the FMCSA’s Safety Measurement System (SMS) database.93 Based on the inspection data, Prestige Limousine had a vehicle OOS rate of 80 percent, which compares with a national average of 6.2 percent for inspected vehicles of passenger motor carriers.94 Prestige Limousine’s driver OOS rate was 100 percent, which compares with a national average of 4.2 percent for passenger motor carriers. 1.8 Occupant Protection 1.8.1 Seat Belts and Seat Integrity 1.8.1.1 Seat belts. Postcrash evidence indicated that the limousine driver was wearing his lap/shoulder belt at the time of the crash. The driver airbag deployed during the crash sequence. Evidence from first responders and postcrash examinations indicated that none of the passengers were wearing their passenger lap or lap/shoulder belts at the time of the crash. Based on photographs of the crash limousine taken before the crash and examination of the other limousines in the Prestige Limousine fleet, the non-OEM lap belts were likely under the bench seats and inaccessible to passengers on the day of the crash. In addition, the seat belt anchor points and geometry relative to the possible occupant seating positions indicated that many of the lap belts in the rear passenger portion of the limousine were poorly designed. In some locations, the spacing between the anchorage points was extremely narrow (5.75 inches), which would result in improper passenger positioning for seat belt effectiveness.

91 Oversight is limited to areas of the Federal Motor Carrier Safety Regulations pertaining to CDL regulations and drug and alcohol testing requirements. 92 Prestige Limousine applied for a USDOT number only after being directed by the NYSDOT to do so. 93 The SMS is the FMCSA’s workload prioritization tool. The FMCSA uses the SMS to identify for interventions those interstate motor carriers with potential safety problems. The SMS is designed to incorporate the safety-based regulations related to motor carrier operations. The data are also available for state use. 94 The OOS rate is the percentage of all inspections that resulted in an OOS order.

NTSB

Highway Accident Report 48 At the time of the crash, New York State law governing seat belt use required the driver and front passengers to wear a seat belt; this law did not apply to rear seat passengers (unless they were 16 years old or younger). After the crash, New York revised its mandatory seat belt use law (A.8990) to require all passengers in a taxi or livery vehicle (including those older than 16 years) to wear a seat belt regardless of their seating position.95 The law also prohibits a person from operating a taxi or livery vehicle unless all passengers between the ages of 8 and 15 are restrained by seat belts.96 New York authorizes primary enforcement for seat belts for front seat occupants, which means that a police officer can issue a traffic ticket solely for failure by the driver or front seat passenger to wear a seat belt. The law at the time of the crash also allowed the officer to issue a ticket for a driver who does not ensure that rear seat passengers 16 years old or younger are properly secured by a seat belt or in a safety seat appropriate for their age and weight. 1.8.1.2 Seat integrity. Postcrash examination of the limousine’s non-OEM side- and rear- facing bench seats showed that the seat frames were constructed from welded square tubular steel and were attached to the floor using individual screws that were mounted through the metal seat anchor straps.97 The seat cushions had separated from the seat frames. The seat frames were deformed and separated from their anchorage points; they were displaced forward toward the driver’s compartment. When the crash occurred, the non-OEM side- and rear-facing bench seats and their anchorages were not sufficiently strong to keep them secured to the floor during the collision (even without the additional loading that would have occurred had the passengers been belted). In contrast, the rear OEM seats remained attached to the floor and intact, despite experiencing some damage. 1.8.2 Providing Occupant Protection for Limousine Passengers In September 2019, the NTSB issued a safety recommendation report titled Providing Occupant Protection for Limousine Passengers, which addressed occupant protection safety issues identified during the early stages of the Schoharie crash investigation (NTSB 2019a). The report focused on the importance of maintaining adequate seat integrity, providing well-designed passenger lap/shoulder belts, and encouraging seat belt use. The recommendations issued in that report, as well as their current status, are provided in section 2.4 of this report.

95 A livery vehicle is a vehicle for hire, such as a taxicab or chauffeured limousine, excluding a rented vehicle driven by the renter. 96 Passengers under 8 are required to be properly restrained in an age-appropriate child safety seat. 97 The anchor straps appeared to be made from commonly available, thin steel pipe-hanging strap.

NTSB

Highway Accident Report 49 1.9 New York State Postcrash Legislative Actions As a result of the Schoharie crash, the State of New York enacted several new laws related to limousine operations. These included the following: • New York Assembly Bill A.712A—Drug Testing: Requires motor carriers to conduct preemployment and random drug and alcohol testing of drivers who operate for-hire limousines, taxis, and liveries with seating capabilities of nine or more passengers including the driver. The bill also prohibits consuming drugs or alcohol within 8 hours of going on duty and consuming or possessing a drug, controlled substances, or alcohol while on duty. • New York Assembly Bill A.1316C—Limousine Safety Task Force: Creates an 11-member “stretch limousine passenger safety task force” to conduct a comprehensive review of the industry, including “matters influencing the safety, adequacy, efficiency and reliability of stretch limousine transportation.” A final report from the task force is due November 1, 2021.98 • New York Assembly Bill A.8214B—Safety Reporting: Requires the NYSDOT and NYSDMV to establish and maintain a toll-free hotline for reporting safety issues about for-hire stretch limousines. The NYSDOT and NYSDMV are authorized to investigate reports and consider enforcement actions. • New York Assembly Bill A.8474A—Commercial Driver’s License: Requires stretch limousine drivers to have a CDL with a passenger endorsement and requires that stretch limousines comply with safety regulations and vehicle inspections. • New York Assembly Bill A.8990—Seat Belts: Requires taxi or livery vehicle passengers age 16 and older to wear seat belts regardless of their seating position and prohibits a person from operating a taxi or livery vehicle unless all passengers between the ages of 8 and 15 are restrained by seat belts. (Previously enacted law required passengers 16 years of age and older sitting in the front seat of a taxi or livery vehicle to wear a seat belt.) • New York Assembly Bill A.9056—Vehicle Impoundment: Authorizes the NYSDOT to impound or immobilize stretch limousines that fail safety inspections, placing them out of service. Requires a vehicle to be held until the NYSDOT is satisfied that repairs have been scheduled (or made) and that the OOS defect has been fixed and the vehicle has been reinspected.99

98 As of the date of this report, the NTSB could not find evidence that a task force had yet been created. 99 Specifically, the new inspection law “allows the commissioner of transportation to impound or immobilize stretch limousines in certain situations; provides that such impounded motor vehicle shall not be released unless the commissioner of transportation is satisfied that repairs have been scheduled or been made to satisfactorily adjust such vehicle’s out-of-service defect or defects; provides that release of such impounded vehicle without approval by such commissioner shall be punishable by a fine of up to ten thousand dollars; makes related provisions.”

NTSB

Highway Accident Report 50 • New York Assembly Bill A.9057—Seat Belt Installation: Requires that all stretch limousines altered on and after January 1, 2021, have at least one seat belt installed in the rear area for each passenger that the vehicle was designed to hold. Stretch limousines altered before that day must be retrofitted with approved seat belts by January 1, 2023. • New York Assembly Bill A.9059—Driver’s License Validation: Requires the NYSDMV to maintain and annually update its website to provide information on motor carriers operating stretch limousines. The NYSDMV is also required to review driver files and annually verify that each driver holds a valid driver’s license. • New York Assembly Bill A.9646—Seat Belt Use Requirement: Provides that a police officer shall only issue a summons for a violation of failure to wear a seat belt in a taxi or a livery for minors 8 years of age or older but under age 16 to the parent or guardian, if the violation by such person occurs in the presence of such person’s parent or guardian and where such parent or guardian is 18 years of age or more. Also makes provisions concerning the posting of information in taxis and livery vehicles concerning seat belt availability and use requirements.

NTSB

Highway Accident Report 51 2 Analysis 2.1 Introduction The Schoharie crash occurred when a 2001 Ford Excursion stretch limousine, traveling south on NY-30, occupied by a driver and 17 charter group passengers, was descending a grade; the limousine brake system failed to slow the vehicle, and its speed increased to over 100 mph. After the driver made a steering maneuver to avoid a vehicle stopped at a stop sign near the bottom of the grade, the limousine entered and crossed the NY-30/NY-30A intersection, and then struck a 2015 Toyota Highlander SUV parked in a grassy field adjacent to a restaurant driveway. Two pedestrians who were standing near the SUV were struck when it was forced into them by the limousine’s impact. The limousine continued into a ravine, where it struck an earthen embankment and several trees. As a result of the crash, 20 people died, including all 18 limousine occupants and the 2 pedestrians. Section 2.2 discusses the crash factors, including the crash sequence (2.2.1). The section addresses the safety issues of inadequate brake system maintenance (2.2.2) and vehicle alteration affecting compliance with applicable FMVSSs (2.2.3). The section also addresses factors that might have influenced the driver’s actions in response to the emergency driving situation, which includes a discussion of the safety issue of drivers falsifying medical histories in medical certification examinations for CDLs (2.2.4). Section 2.3 examines Prestige Limousine’s operations (2.3.1) and the oversight provided by the NYSDMV (2.3.2) and the NYSDOT (2.3.3), addressing the safety issue of ineffective state oversight of intrastate motor carrier operations. Federal oversight (2.3.4) is also discussed. Section 2.4 details the actions that have been taken in response to the NTSB’s 2019 safety recommendation report on limousine occupant safety issues uncovered during the Schoharie investigation (NTSB 2019a). The section addresses the safety issue of insufficient occupant protection for limousine passengers. Following a comprehensive review of the circumstances that led to the Schoharie crash, the NTSB established that the following factors did not contribute to the cause of the crash: • Driver experience and familiarity with the limousine. The limousine driver had over 25 years of commercial driving experience (mostly as a truck driver), and he had driven limousines for about a year for Prestige Limousine. He was familiar with driving the crash limousine, although his behind-the-wheel time was limited because he drove for Prestige only part-time, usually on weekends.100

100 Although the limousine driver was an experienced driver familiar with the stretch limousine, he did not have CDL authority to drive a vehicle carrying passengers. (See section 2.3.1.) He held a New York class A CDL but did not have a passenger endorsement, which is required to operate a vehicle designed to transport 15 or more passengers. Obtaining a passenger endorsement would have required him to demonstrate knowledge of pre- and post-trip vehicle inspections. It is unknown whether, or how thoroughly, the driver conducted a pretrip inspection of the limousine on the day of the crash. However, a pretrip vehicle inspection would not necessarily have revealed any issue with the brake system that would have affected the outcome of this crash (although it might have detected the ABS failure).

NTSB

Highway Accident Report 52 • Roadway signage. The limousine’s route of travel was not the most direct one from the passenger pick-up location to the planned destination in Cooperstown, New York (refer to figure 1). We do not know why he chose this indirect route.101 Based on available information, it is likely that the driver was not familiar with the downgrade on NY-30 to the NY-30/NY-30A intersection, nor was he aware that it was the most severe grade on the trip, resulting in the heaviest load on the limousine’s brakes. There were, however, three hill warning signs posted in advance of the descending grade. Posted with each warning sign was an advisory plaque indicating the approximate length of the grade. Although the limousine driver was most likely unfamiliar with his route of travel and the final downhill grade to the crash location, the roadway had adequate hill warning signs that should have alerted him to the steep descent. • Alcohol impairment or fatigue. Postmortem toxicology tests did not detect ethanol in any of the driver’s tissue samples. An examination of the driver’s precrash activities showed sufficient opportunity for rest. The driver had over 10.5 hours of sleep opportunity the night preceding the crash, and he had been driving the limousine for less than 2 hours when the crash occurred. • Cell phone use. A review of cell phone records showed that the driver was not using his cell phone for calls or text messaging from the time he picked up the charter group passengers until the crash occurred. • Weather or visibility. There was no precipitation and the roadway was dry; there was adequate visibility. The sight distance on the approach to the stop sign for the NY-30/NY-30A T-intersection exceeded AASHTO minimum standards and provided sufficient stopping sight distance. The NTSB, therefore, concludes that none of the following were factors in this crash: (1) the driver’s experience or familiarity with the limousine, (2) roadway signage, (3) alcohol impairment or fatigue, (4) cell phone use, (5) weather conditions, or (6) visibility and stopping sight distance at the intersection where the crash occurred. Fire department, law enforcement, and emergency medical personnel arrived at the crash location within 4 minutes of the collision. The fire department quickly evaluated the crash scene and upgraded the response to a mass-casualty incident, which evoked mutual aid from multiple agencies in the surrounding jurisdictions. Despite the efforts of emergency response agencies, no limousine occupants or struck pedestrians survived. The NTSB concludes that the emergency response to the crash was timely and adequate.

101 The route recommended by the GPS would have had the limousine remain on Interstate 90.

NTSB

Highway Accident Report 53 2.2 Crash Discussion 2.2.1 Crash Sequence The limousine was traveling south on NY-30, approaching a T-intersection with NY-30A after descending a 1.81-mile-long downhill grade. The grade consisted of 13 changes in vertical alignment, ranging as high as 11.35 percent, which resulted in a total change in elevation of about 573 feet. The weight of the altered stretch limousine carrying 18 occupants was about 13,565 pounds, which exceeded by 58 percent the GVWR certified by Ford for the original SUV.102 The combination of rolling terrain throughout the majority of the limousine trip, the substantial final downhill grade, and the weight of the heavily laden limousine increased the demand on the vehicle’s brake system.103 When the limousine neared the bottom of the grade, the driver steered to avoid a vehicle that was stopped at the posted stop sign for the NY-30/NY-30A intersection. After crossing the east- and westbound travel lanes of NY-30A, the limousine struck an unoccupied 2015 Toyota Highlander SUV parked in a grassy field south of the intersection. The estimated speed of impact was 101–118 mph.104 The limousine’s impact propelled the SUV into two pedestrians who were standing near the SUV. After colliding with the SUV, the speed of the limousine was reduced to about 80 mph as it continued south into a ravine, where it struck an embankment and trees. Witnesses at the intersection reported that the limousine did not slow as it proceeded into and through the intersection. An NTSB survey of the crash scene revealed no tire marks or other physical evidence indicating braking. However, the driver took evasive steering maneuvers to avoid a crash, and there is no evidence that he would not have applied the brakes. Moreover, NYSP troopers examining the vehicle immediately after the crash reported noticing a strong odor of overheated brakes at the crash scene. The available information suggested brake system failure as a potential causal factor. To examine this issue further, the NTSB conducted a visual inspection of the brake system components and completed brake performance testing using an exemplar vehicle and a brake dynamometer.

102 The 2001 Ford Excursion was originally built with a designated GVWR of 8,600 pounds (before its alteration from an 8-occupant/passenger SUV into an 18-passenger stretch limousine). Because the kinetic energy possessed by the limousine while in motion was proportional to a change in weight, at any given speed, the kinetic energy the brake system had to be able to mitigate was about 58 percent greater for the altered stretch limousine. 103 The 35.4-mile trip from the passenger pick-up location to the crash site consisted of rolling terrain with frequent changes in vertical grade. One descending grade earlier in the trip covered 2.3 miles with an elevation decrease of more than 700 feet (refer to figure 8). 104 Multiple crash reconstruction methodologies were used to calculate the impact speed. An analysis of data extracted from the limousine’s RCM resulted in a speed range of 101–118 mph (median 109 mph). An airborne analysis of the SUV’s postimpact travel resulted in a range of 108–110 mph.

NTSB

Highway Accident Report 54 2.2.2 Inadequate Brake System Maintenance 2.2.2.1 Brake system mechanical condition. Visual inspection of the limousine revealed an inadequately maintained brake system in poor condition.105 Both the frame and the undercarriage of the vehicle were heavily corroded, including a steel brake line attached to the right rear differential housing. As reported in section 1.5.3.8, the brake line was corroded and crimped. The crimp was in the brake line near where the steel line connected with the right rear flexible brake hose. The crimp would have reduced the flow of brake fluid to the right rear brake and diminished the clamping force available to the brake caliper. In addition to the poorly maintained brake line, the right rear brake caliper was heavily corroded, and both pistons appeared to be seized in place, which could have made the right rear brake components inoperable because seized pistons would be unable to apply hydraulic force to the brake pad. (Further functional examination of the brake components would be necessary to determine whether the seized pistons were a contributing factor or a result of the crash; such functional examination was not possible in this investigation because, due to the criminal investigation, the New York authorities denied NTSB investigators’ timely access to the vehicle and its components.) The left rear brake caliper was also corroded, and one of the two pistons appeared to be stuck within its bore, which could have lessened the force being applied to the brake pads. The left rear inner and outer brake pads appeared to be in good condition with little to no evident wear.106 That might have been a result of inadequate hydraulic brake pressure being supplied through the rear brake line over an extended period, due to the leak in the corroded line. No evidence was found of the rear brake pads or rotors having overheated. When NTSB investigators inspected the front brakes, they found no obvious mechanical deficiencies, such as those presented by the rear brakes; however, there was evidence that the brake components had been overheated. Investigators noticed an odor of burned materials when examining the front brake components. Additionally, the front brake rotors appeared to contain embedded friction material from the brake pads. Although these observations indicated that the friction components of the front brakes experienced higher-than-normal temperatures, because investigators were denied timely access to the vehicle’s brake fluid, they were unable to evaluate it for contamination and susceptibility to failure at high temperatures. 2.2.2.2 Brake system failure. A dynamometer study (refer to section 1.5.6.3) was conducted using an exemplar Ford Excursion SUV loaded to simulate the weight of the crash limousine. The simulations showed that a properly functioning brake system equipped with OEM- specified parts would have had sufficient braking capacity to have safely negotiated the route. The study showed that the highest brake temperatures reached during the limousine’s final 1.81-mile-long portion of the trip would most likely have occurred near the bottom of the descent to the stop sign at the NY-30/NY-30A intersection. Brake dynamometer testing also showed that, in all the simulations, the highest brake temperatures occurred when the simulation assumed no

105 According to NYSDOT records, the vehicle was placed out of service in the months before the crash for deficiencies, including brake system deficiencies, which were not repaired. (The OOS record is discussed in section 2.3.1.2.) 106 Although the left rear brake pads were relatively new, there should have been at least a little wear or scoring on the pads as they broke into the wear patterns on the rotor, especially given the weight of the vehicle.

NTSB

Highway Accident Report 55 rear brakes were functioning. This resulted in the simulated front brakes reaching a temperature of more than 1,000ºF. Because of a lack of timely access to the crash vehicle, resulting in the NTSB’s inability to perform functional testing of the brake system and other vehicle components, we cannot state definitively and specifically why the brake system failed. However, based on NTSB investigators’ visual inspection of the crash limousine’s brake system, the rear brakes had been poorly maintained, and several components in the rear braking system exhibited visual indications that they had not been appreciably working. The split (front–rear) braking system would have enabled the limousine’s front brakes to function, despite the condition of the rear brakes, and the visual inspection of the front brakes did not reveal obvious mechanical deficiencies. On the day of the crash, the poorly maintained rear brakes were largely, if not entirely, nonoperational, which placed all the burden of braking on the front brakes. The extra burden would have increased the front brake temperature. During normal daily driving, the front brakes alone would have been adequate to stop the limousine. However, with the limousine’s heavy load (18 occupants), the long descent as it approached the NY-30/NY-30A intersection, and the increase in front brake temperature, the front brakes—the only operational brakes—failed or lost effectiveness. The restrictions encountered during the investigation prevented a detailed examination of specific brake components or analysis of their potential failure modes. For example, the performance parameters of the front brake pads were not known, so no assessment could be made of their potential for brake fade at higher temperatures. Additionally, the condition of the brake fluid could not be tested, so it could not be evaluated for contaminants and susceptibility to break down at higher-than-normal temperatures. Although no failure of a specific brake component could be verified, and the limited access to the limousine’s brake system prevented identification of a specific failure mode, such as heat-induced failure or mechanical failure (or a combination of both), all indications point to brake failure. Moreover, the high speed of this crash is an indicator of brake failure. An analysis of the limousine’s travel along the NY-30 downgrade leading to the crash site indicates that, assuming that the vehicle began at the top of the vertical grade and no braking took place, the limousine would have achieved an impact speed of 105–116 mph when it collided with the Toyota SUV. Therefore, the NTSB concludes that the limousine was unable to slow on the downhill grade approaching the intersection due to a failure within the poorly maintained brake system. 2.2.3 Vehicle Alteration Affecting Compliance with Applicable FMVSSs 2.2.3.1 Effect of vehicle alteration on crash. When 21st Century Coachworks altered the Ford Excursion SUV into a stretch limousine, NHTSA required the company to self-certify that the vehicle as altered conformed with all standards affected by the alteration and to affix a secondary

NTSB

Highway Accident Report 56 certification label specifying that the vehicle conformed with the applicable FMVSSs.107 It is not known whether 21st Century conducted such a certification process. At the time of the crash, the estimated weight of the stretch limousine with occupants was 13,565 pounds; this exceeded the GVWR of 8,600 pounds of the original SUV. The postcrash inspection found no evidence that 21st Century certified a new GVWR for the altered vehicle, nor was there evidence that it had altered the design of the Ford Excursion’s original brake system to accommodate the increase in weight caused by the additional vehicle length and passenger capacity resulting from the vehicle alteration. To examine the effect of the added weight on the limousine’s stopping capability, the NTSB conducted a brake performance study (refer to section 1.5.6). Although the test results showed that stopping distances were significantly greater for the heavier vehicle, they also showed that the altered vehicle’s braking still fell within the FMVSS 105 stopping distance requirements for the new weight (with the exception of the inoperable power assist test). The test results showed that, had the brake system been properly functioning and maintained, the limousine would have been able to come to a safe stop in the conditions preceding the crash, even with the additional vehicle and passenger weight of nearly 5,000 pounds resulting from the alteration. The NTSB concludes that, although 21st Century Coachworks, the company that altered the Ford Excursion SUV into a stretch limousine, does not appear to have certified that the altered vehicle met the applicable FMVSSs, the results of a brake system performance study show that, had the brake system been properly maintained, the limousine should have been capable of stopping safely at the bottom of the NY-30 downgrade. 2.2.3.2 Ensuring that vehicle alterers certify compliance with applicable FMVSSs. The alteration of vehicles into stretch limousines is a self-certification process that relies on alterers to document that the vehicles meet applicable federal safety standards. Many vehicles altered to become limousines are rebuilt within the original manufacturer design specifications outlined in programs, such as the Ford QVM program (enabling the alterer to use the OEM certification under 49 CFR Part 567). However, vehicle alterers that are not operating in such programs must conduct engineering analyses or FMVSS tests to document compliance with the FMVSSs. Recognizing the inconsistencies in the ways that different jurisdictions title and register altered vehicles, the American Association of Motor Vehicle Administrators (AAMVA) formed a working group and developed Best Practices for Title and Registration of Reconstruction and Replica Vehicles (AAMVA 2013). Included in AAMVA’s best practices is a recommendation that, before being issued a title, altered vehicles pass a structural integrity and mechanical safety inspection conducted by an engineer hired by the alterer. Additionally, the alterer must supply a certification letter from an engineer to the vehicle buyer, who could then provide it to the state DMV as part of the registration process.

107 Requirements for persons who alter certified vehicles are specified under 49 CFR 567.7. With respect to the vehicle alterations it performs, an alterer (1) has a duty to determine continued conformity of the altered vehicle with applicable federal motor vehicle safety, bumper, and theft prevention standards, and (2) assumes legal responsibility for all duties and liabilities for certification under the Vehicle Safety Act.

NTSB

Highway Accident Report 57 Although systems such as the Ford QVM program and AAMVA’s best practices provide some safeguards against potentially unsafe altered vehicles being newly registered and titled, buyers of limousines are responsible for ensuring that their vehicles—which will be used to transport passengers—are safe. This responsibility includes purchasing vehicles only from alterers who can verify that a limousine meets the applicable FMVSSs. The NTSB concludes that limousine operators can help ensure the safety of altered vehicles being acquired for use in passenger transportation service by (1) obtaining an engineer’s certification that the altered vehicle meets the FMVSSs and (2) ensuring that a secondary certification label is affixed to the limousine before purchase. The National Limousine Association (NLA) is a nonprofit membership organization representing the interests of chauffeured transportation. Part of the NLA’s charge is to inform and educate its members, which include chauffeured transportation operators, suppliers, and manufacturers, as well as local, state, and regional associations. The NTSB recommends that the NLA inform its member limousine operators of the importance of verifying the safety of altered vehicles planned for passenger transportation by ensuring that the altered vehicle passes a structural and mechanical safety inspection, obtaining from the alterer an engineer’s certification that the altered vehicle meets the FMVSSs affected by the alteration, and checking that a secondary certification label is affixed to the limousine before purchase. 2.2.4 Limousine Driver Medical Factors 2.2.4.1 Health and medical certification. When the crash occurred, the driver was taking at least three prescription medications—an antidepressant, a medication to treat bipolar disorder, and a heartburn medication. There was also evidence of marijuana use by the driver at some point before the crash. The limousine driver was required to be medically certified to operate a commercial vehicle. The driver’s most recent CDL medical examination was performed on September 6, 2017. At that time, the driver purposely omitted information and indicated no medical conditions or health history on the self-report section of the medical certification examination form. He also failed to report his use of prescription medications and denied his use of illegal substances. He falsely reported that he never had mental health problems, never had spent the night in a hospital, and did not have high cholesterol or stomach problems. Based on the incomplete information provided and a physical evaluation, the certified medical examiner (an advanced practice registered nurse) determined that the driver met the medical requirements and qualified him to drive commercial vehicles for 2 years. Medical examiners base their certification determinations largely on objective data (from the physical examination) and self-disclosed information on the examination form concerning the driver’s health history, prescribed medications, and alcohol or illegal drug use. The purpose of requiring drivers to provide a health history and to undergo a physical examination is to detect the presence of physical, mental, or organic conditions that might affect their ability to safely operate a commercial motor vehicle (Blumenthal and others 2002). The examiner’s determination, however, depends on the driver providing a truthful, accurate, and full health history (as well as undergoing a physical examination). Because medical certification relies on driver self-reporting, it is not always possible to systematically determine disqualifying medical conditions, especially

NTSB

Highway Accident Report 58 when a driver fails to disclose pertinent health information. Thus, drivers must certify the accuracy of their responses to this questionnaire. The NTSB concludes that the limousine driver failed to disclose pertinent information about his medical history as required on the examination form for CDL medical certification, which prevented accurate assessment of his fitness to drive a vehicle transporting passengers. Some of the medical conditions that the driver failed to report on the certification examination form were potentially disqualifying (for example, psychiatric conditions). However, depending on treatment and circumstances, an examiner might have permitted medical certification for periods shorter than the normal 2 years. The driver’s use of marijuana would have disqualified him from medical certification. Marijuana’s primary psychoactive chemical, THC, and its metabolites were detected in the driver’s postcrash tissue samples.108 Moreover, according to his wife, the driver smoked marijuana regularly. The driver did not report his history of marijuana use to the medical examiner. FMCSA guidance to medical examiners states specifically that a commercial driver should not be certified if the driver uses marijuana (even if the state permits medicinal use of the drug). The guidance further states that certification may require successful completion of a drug rehabilitation program, as required by a substance abuse professional. The NTSB concludes that, based on the limousine driver’s medical conditions, it cannot be determined whether he would have been granted medical certification to drive a limousine had he fully disclosed his medical history on the examination form for CDL medical certification; however, had he disclosed his use of marijuana, he would not have been medically certified. The problems associated with commercial drivers’ self-reporting to obtain medical certification are well-known and longstanding. The NTSB has a history of investigating crashes in which commercial drivers with serious medical conditions obtained medical certification to drive by falsifying (including through omission) information on the medical examination form, as well as by other problematic or questionable means.109 In February 2019, citing a rise in fatal crashes involving large buses and trucks, the USDOT Office of Inspector General opened a new audit to evaluate the FMCSA’s procedures for oversight of its medical certificate program, including the quality of commercial driver medical certificate data.110 2.2.4.2 Drug use. No information could be found to indicate when the driver had last consumed marijuana or taken his prescribed medications. Toxicology testing of tissues detected marijuana’s primary psychoactive chemical THC, THC’s most prominent psychoactive metabolite 11-OH-THC, and the inactive metabolite THC-COOH. The tests also detected the antidepressant bupropion, the anti-epileptic/bipolar disorder medication oxcarbazepine, and the heartburn medication famotidine. Because the concentration of drugs found in body tissue samples does not

108 A sufficient quantity of blood was not available for postcrash testing. 109 In just the past 5 years, the issue of driver certification has been addressed in at least four NTSB reports of investigations (NTSB 2016, 2018, 2019b, and 2019c). 110 (1) According to FMCSA data, fatalities in crashes involving large trucks and buses grew from 4,397 in 2012 to 4,897 in 2017, an 11 percent increase. (2) The FMCSA audit announcement was issued in February 2019 (accessed August 23, 2020). Audit results are not yet available.

NTSB

Highway Accident Report 59 directly correlate with levels in a person’s blood, it is difficult to determine the driver’s level of impairment, if any, at the time of the crash (Kemp and others 2013). The prescribed antidepressant bupropion and the bipolar medication oxcarbazepine can have side effects, including impaired thinking and diminished psychomotor skills. However, because the driver had been taking both drugs for over 4 months without reporting any adverse impacts, his side effects from the drugs were probably minor. Regarding the interaction of the prescribed medications with THC, the NTSB is not aware of any published studies that closely examine how marijuana interacts with these drugs. 2.2.4.3 Driver’s actions. During the course of the charter trip, the driver successfully negotiated several curves. At some point while descending the grade to the NY-30/NY-30A intersection, the brake system failed to effectively slow the vehicle. At that time, the driver was sufficiently engaged with the driving task to steer to avoid a vehicle stopped at the intersection. However, it is unknown whether he took any actions other than braking and emergency steering as the situation developed. For instance, guidance in the CDL manual and the Ford Excursion owner’s manual suggests that drivers consider using lower gears when going down grades so that engine braking can assist in slowing the vehicle. Additionally, the CDL manual recommends using the parking brake if the normal braking system is not working.111 Finally, guidance recommends that drivers of vehicles with failing brakes attempt to move off the road as soon as possible, because the longer a driver waits to act, the faster the vehicle will go, making it more difficult to stop. The NTSB had no evidence to determine whether the limousine driver considered or attempted any of these actions. It is not possible to determine whether the limousine driver’s precrash actions were appropriate for the emergency driving situation. Further, the NTSB cannot accurately assess whether the driver’s use of marijuana, in combination with prescription drugs, impaired him on the day of the crash. Therefore, the NTSB concludes that, although toxicology tests detected evidence of marijuana and prescription drug use by the limousine driver, insufficient information was available to determine whether the drugs in his system were at levels that would have impaired his ability to respond to the emergency situation. 2.3 Ineffective State Oversight of Intrastate Motor Carrier Operations 2.3.1 Prestige Limousine 2.3.1.1 Operating authority. Prestige Limousine was providing intrastate passenger carrier services from June 2016 until the date of the crash without having operating authority from the State of New York. New York requires a motor carrier to obtain operating authority before it may transport passengers because, for a carrier to acquire that authority, the NYSDOT must find that the applicant carrier “is fit, willing, and able to provide the service.”

111 It should be noted that, although the 2001 Ford Excursion manual also recommended that a driver use the parking brake to slow a vehicle in motion, there is no FMVSS requirement for a parking brake to be able to do so. The parking brake is not designed to (nor is it tested on its ability to) slow a vehicle in motion or be available as an emergency brake in the event of a complete failure of the service brakes.

NTSB

Highway Accident Report 60 Because it did not receive authority to transport passengers in New York, Prestige was operating without safety oversight and outside the NYSDOT bus inspection program. As an unauthorized carrier, Prestige (and its vehicles) bypassed the required semiannual NYSDOT vehicle safety and motor carrier inspections, which must be conducted by a certified NYSDOT inspector. Prestige was also not subject to the compliance reviews that examine whether a motor carrier is adhering to the state requirements for safely transporting passengers and is meeting current safety fitness standards (such as having qualified drivers, maintaining drug and alcohol testing records, and conducting vehicle maintenance and inspection recordkeeping). Although an NYSDOT inspector eventually examined the crash limousine and initiated an inspection that began the NOV process to bring Prestige under NYSDOT oversight, the process did not keep Prestige from continuing in business and transporting passengers before the October 6, 2018, crash occurred. As shown in appendix D, the NYSDOT had extensive interactions with Prestige Limousine and warned the company more than 15 times that it was operating without authority. Additionally, Prestige Limousine received three warning NOVs and multiple NYSDOT CVSA roadside inspections. Most recently before the crash, on September 1, 2018, Prestige was issued an NOV for transporting passengers without operating authority, for not having an NYSDOT semiannual vehicle inspection, and for using a driver not qualified to drive (due to lack of passenger endorsement). Between September 1 and October 6, 2018, the NYSDOT contacted Prestige Limousine at least seven times via e-mails regarding the procedures required for the carrier to obtain operating authority. Despite all the warnings, NOVs, and guidance, Prestige Limousine continued to transport passengers without having operating authority until the crash occurred. Therefore, the NTSB concludes that, despite numerous warnings and NOVs issued by the NYSDOT, Prestige Limousine violated the law by transporting passengers in its limousines without having operating authority. 2.3.1.2 Vehicle inspection. The NYSDMV classifies vehicles that have seating capacity for 15 or more passengers as buses. The crash limousine could seat 18 passengers. For over 2 years, beginning with Prestige Limousine’s falsification of its initial 2016 registration of the crash limousine with the NYSDMV, the carrier circumvented the state’s safety inspection program for buses. By failing to acknowledge on the vehicle registration that the crash limousine had been altered (or stretched) and by falsely reporting that it had a seating capacity as low as only eight, Prestige avoided participation in the NYSDOT bus inspection program. This program is intended to help ensure that vehicles that transport large numbers of passengers are properly maintained and in good repair. Because it was unaware that the crash limousine met its definition of a “bus,” the NYSDMV did not require that the limousine be registered as a bus and undergo NYSDOT inspection in the bus inspection program. The NYSDMV, however, had information that it could have used to detect the falsity of the information in Prestige Limousine’s registration. Specifically, for 2001–2016, the previous owners of the crash limousine had properly registered it as a bus. Its unique VIN was in the system as part of the bus inspection program. A vehicle’s VIN is required on all paperwork submitted to the NYSDMV and is how the NYSDMV tracks a vehicle for title, registration, and license plates. (See section 2.3.2.)

NTSB

Highway Accident Report 61 In the months preceding the crash, the NYSDOT was working to bring Prestige within its system of oversight by issuing NOVs to the carrier. In the roadside inspections that the NYSDOT performed when it initiated enforcement action against Prestige (after determining that the carrier was operating in passenger service without authority), the carrier had a vehicle OOS rate of 80 percent, compared with a national average of 6.2 percent for passenger motor carriers. The NYSDOT inspections also documented numerous violations specific to the crash limousine. On March 21, 2018, an NYSDOT inspector found several equipment violations on the vehicle. Three of the violations involved brake system problems, including (1) a vice grip crimping the left rear hydraulic brake line, (2) a dangling ABS wire enabling contact with the left front tire, and (3) the ABS malfunction indicator light remaining on during vehicle operation. The vehicle was placed in OOS status. On September 4, 2018—about 1 month before the crash—the NYSDOT again inspected the limousine and identified 14 violations. The inspector found many of the same equipment violations that had been detected during the March 2018 inspection, including the front brake line not being properly secured and the ABS light remaining on, indicating that the limousine’s ABS was inoperative. After the Schoharie crash, no maintenance records were found to indicate that any repairs had been made to the limousine between the September 4 inspection and the October 6, 2018, crash. The poor maintenance condition of the limousine was further documented in the NTSB’s postcrash inspection of the vehicle. Therefore, the NTSB concludes that, on the day of the crash, Prestige Limousine was knowingly operating a limousine in poor mechanical condition that had recently been placed out of service for safety deficiencies, including brake equipment violations. After the crash, NTSB investigators visually inspected three additional Lincoln Town Car limousines owned by Prestige Limousine. Many of the same mechanical and maintenance issues documented in the crash limousine were also present in those vehicles. Although component-level inspection was not performed, all three vehicles had extreme corrosion (including holes in the floorboards) that reduced their structural integrity. Based on the condition of its fleet and the similarity of the maintenance issues found, the NTSB concludes that Prestige Limousine did not have an effective maintenance program in place to ensure the safety of its passenger-carrying vehicles. 2.3.1.3 Driver oversight. NTSB investigators could not perform a full assessment of Prestige Limousine’s oversight of its drivers due to lack of access to company business records. It is unknown whether Prestige maintained driver qualification files or training records, or had a drug and alcohol testing program in place. Regarding the qualification of the driver involved in the crash, there is clear evidence that Prestige management knew that the driver did not have authority to operate a limousine in passenger service. On August 25, 2018, the NYSP stopped the driver for transporting passengers without having the proper CDL endorsement (a passenger endorsement). The NYSP issued the driver an OOS order prohibiting him from driving limousines until he was properly licensed. The NYSP sent written notification of the driver’s status to Prestige; the notice specifically stated that “no motor carrier shall permit or require this driver to operate any motor vehicle until the driver has proper CDL endorsement.” On September 1, 2018, the NYSDOT issued Prestige Limousine an NOV for using a driver not qualified to drive due to lack of passenger endorsement. Despite the OOS order, the driver did not obtain a CDL passenger endorsement. More than a month after receiving the NOV concerning the driver’s lack of qualification, on the date of the crash

NTSB

Highway Accident Report 62 (October 6), Prestige Limousine directed the crash limousine driver to transport a group of 17 passengers from Amsterdam to Cooperstown, knowing that he did not have a passenger endorsement. The NTSB concludes that despite knowing that the crash limousine driver was not properly licensed, Prestige Limousine repeatedly assigned him to transport passengers, in direct violation of an NYSDOT OOS order, which indicates deficiencies in driver-related safety controls at the motor carrier. 2.3.2 New York State Department of Motor Vehicles Oversight 2.3.2.1 Registration of stretch limousines. The NYSDMV is responsible for the registration of vehicles operating in the state of New York. Prestige Limousine was the third owner of the crash limousine. Under previous ownership, the vehicle had been properly registered as a bus, with a seating capacity of 18. After taking ownership of the crash limousine, and for over 2 years, Prestige registered the stretch limousine as a passenger vehicle rather than a bus by falsely reporting its seating capacity. The NYSDMV had access to multiple sources of information that could have been used to check and verify the classification of the vehicle being registered. The available verification documents included 15 years of previous registrations, an “Abstract of Title Record,” and an insurance document showing that the vehicle had a seating capacity of 16.112 By failing to appropriately screen and classify the Prestige limousine, the NYSDMV enabled the carrier to circumvent state safety regulations and avoid more rigorous inspection requirements. If the NYSDMV had classified and registered the Prestige limousine properly—as a bus—the carrier would automatically have been referred to the NYSDOT and required to apply for operating authority. If the NYSDMV had taken such an action, it would have resulted in additional scrutiny to ensure that Prestige was fit, willing, and able to operate safely in passenger transportation. It would also have required the carrier to obtain a USDOT number and enter the NYSDOT bus inspection program.113 The NTSB concludes that the NYSDMV’s failure to verify information in its vehicle registration program allowed the crash limousine to be incorrectly classified and improperly registered, which enabled Prestige Limousine to circumvent the more thorough state safety and inspection requirements that might have prevented the crash. Following the Schoharie crash, the NYSDMV took steps to improve the registration process to ensure that limousines are properly registered and that information concerning them is forwarded to the NYSDOT for operating authority and inspection, when warranted. In August 2019, the NYSDMV introduced new registration forms for registering vehicles in New York. The new form, MV-82, includes clearly marked sections concerning vehicle modifications and certifications, and an additional form must be filled out if the vehicle is used in for-hire operations. The NTSB supports these process improvements.

112 As has been noted, the definition of “seating capacity” varies somewhat. However, the altered vehicle demonstrably had more than the eight seating positions Prestige claimed (in 2017). 113 Prestige did not have a USDOT number until August 29, 2018.

NTSB

Highway Accident Report 63 2.3.2.2. NYSDMV oversight of state inspection stations. In 2016 and 2018, Prestige Limousine took the crash limousine to two different official NYSDMV-certified inspection stations for annual safety inspections.114 These stations, operated by contractors, were authorized to perform inspections on passenger vehicles, but NYSDMV policy strictly prohibited stations from inspecting modified or altered vehicles, including stretch limousines. Instead, the inspection stations were required to refuse to conduct an inspection and, instead, to direct operators of altered vehicles to the NYSDOT so that they could be enrolled in the bus inspection program and undergo the required semiannual bus safety inspections. Failing to follow this procedure, both inspection stations improperly inspected the limousine and issued it a passenger vehicle decal showing that the vehicle had passed the inspection. The NTSB concludes that the state inspection stations Mavis Discount Tire and Wilton Truck Center knowingly inspected and certified the crash limousine, which was clearly an altered vehicle, in contravention of the NYSDMV’s policy that prohibited stations from inspecting modified or altered vehicles, including stretch limousines. The issuance of the decals allowed Prestige Limousine to bypass the more demanding NYSDOT inspection process required for buses. Therefore, the NTSB concludes that by not ensuring that state inspection stations adhered to the policy that prohibited them from inspecting altered vehicles, the NYSDMV enabled the crash limousine to undergo annual vehicle inspections instead of the more rigorous semiannual NYSDOT bus safety inspections, as required. Not only did the inspection stations inspect the Prestige limousine when they should have refused to do so, but also, they did not follow all the procedures outlined in the Regulations of the Commissioner of Motor Vehicles, “Part 79, Motor Vehicle Inspections,” in conducting the inspections. Moreover, it appears that during the May 11, 2018, inspection of the limousine by Mavis Discount Tire, the limousine was not thoroughly inspected. Mavis Discount Tire passed the limousine even though it most likely had disqualifying conditions that should have been evident to safety inspectors. The conditions included the corroded and crimped steel brake line and a brake line hanging near the left front wheel.115 Based on the questionable quality of the Mavis Discount Tire inspection and the fact that two inspection stations ignored NYSDMV policy and inspected the stretch limousine when they should not have done so, the NTSB concludes that the NYSDMV did not provide effective oversight of state inspection stations, allowing Mavis Discount Tire and Wilton Truck Center to perform inadequate inspections of the crash limousine that failed to detect serious safety deficiencies before the crash. Vehicles like the crash limousine, which carry large numbers of passengers, should undergo higher levels of safety inspection than passenger cars; the State of New York recognizes this necessity by classifying them as buses, making them subject to the state’s bus inspection program. According to the NYSDMV, should a stretch limousine appear at an inspection station for inspection, whether by a carrier’s error or fraudulent intent, the inspection station “shall refuse to perform the inspection” and “shall provide the motorists with instructions on how to comply with New York Department of Transportation periodic inspection requirements.” In this case, the station would direct the motorist to the NYSDOT bus inspection program. Whether an administrative

114 Wilton Truck Center performed the first inspection on July 22, 2016. The second inspection station was Mavis Discount Tire, which reported an inspection date of May 11, 2018. (The vehicle apparently did not undergo a safety inspection in 2017.) 115 The hanging brake line was noted as an OOS condition on March 21, 2018, and again on September 4, 2018, before and after the Mavis Discount Tire inspection on May 11, 2018.

NTSB

Highway Accident Report 64 method is used (such as flagging the VINs of stretch limousines as ineligible for inspection at a state inspection station), or enforcement against noncompliant stations is increased, or some combination of measures is used, the NYSDMV is in the best position to determine how to keep stretch limousine carriers from exploiting this weakness in the state’s bus inspection program. Therefore, the NTSB recommends that the NYSDMV review its policies and protocols on the inspection of stretch limousines, and establish stricter safeguards and more rigorous enforcement protocols to ensure that state-contracted inspection stations do not inspect stretch limousines that have a seating capacity of 10 or more. In addition, the NTSB recommends that the NYSDMV renotify state-contracted inspection stations that they may not inspect stretch limousines that have a seating capacity of 10 or more. 2.3.3 New York State Department of Transportation Oversight 2.3.3.1 Oversight of Prestige Limousine. The NYSDOT conducted six roadside inspections of Prestige Limousine from March 21 to September 4, 2018. Three of the inspections were on the crash limousine and driver; they resulted in OOS violations. These inspections were conducted as a result of the NYSDOT’s investigating the carrier for transporting passengers without having New York State operating authority. In addition to the roadside inspections, the NYSDOT issued three NOVs to Prestige. Despite these multiple interactions and enforcement actions, Prestige Limousine was able to continue its passenger operation in violation of state regulations. When the NYSDOT and the NYSP were asked why they did not impound Prestige’s vehicles or confiscate their license plates, the agencies stated that they did not have clear authority to take those actions. New York State law provides broad authority to the NYSDOT commissioner to suspend and revoke the operating authority of any motor carrier of passengers when the carrier directs or allows an employee to operate a vehicle after the operator has been placed out of service.116 For instance, shortly after the Schoharie crash in 2018, during a focused enforcement action, the NYSDOT and the NYSDMV suspended the registrations of 59 limousines illegally operating without authority. Law enforcement seized the vehicles’ license plates at the request of the NYSDMV. At the time of the action, no new legal authority had been provided to law enforcement to conduct these suspensions; the existing authority was sufficient to enable this action. Investigators found no indication that an attempt had been made to obtain authority from the NYSDOT commissioner to take more aggressive enforcement action against Prestige Limousine before the crash. Moreover, the NYSDOT did not attempt to verify whether Prestige had repairs made after receiving multiple OOS vehicle violations. For example, after the limousine was inspected on March 21, 2018, most of the 14 OOS violation deficiencies found during that inspection were still on the vehicle when the NYSDOT inspected it again, on September 4, 2018. This means that documented OOS violations concerning the limousine, which were issued because of known vehicle safety deficiencies, were not repaired during the 6 months preceding the crash. The NTSB concludes that the NYSDOT’s ineffective enforcement and lack of repair verification processes allowed Prestige Limousine to continue to transport passengers in the crash limousine despite the

116 See 17 NYCRR 720.32.

NTSB

Highway Accident Report 65 carrier’s (1) not having operating authority and (2) failing to repair OOS vehicle violations that compromised the limousine’s safety. Following the crash, and with the intention of improving the safety of stretch limousine operations, the New York State legislature passed, and the governor signed, Assembly Bill A.9056. The new law specifically authorized the NYSDOT to impound or immobilize stretch limousines that fail safety inspections, placing them out of service. It also required that the failed vehicle be held until repairs to fix the OOS defect have been scheduled (or made) and the vehicle has been reinspected. The NTSB is encouraged by the passage of this law and expects that the NYSDOT is developing, or already has in place, a method of verifying that scheduled repairs have been made as a precondition for a vehicle’s release, as well as a means of enabling the system to re-impound the vehicle if repairs are not performed. Therefore, the NTSB concludes that the State of New York’s implementation of Assembly Bill A.9056 should help resolve the safety problem of stretch limousines continuing in commercial operation without having their OOS violations repaired. 2.3.3.2 Oversight of all motor carriers. The poor oversight of the motor carrier Prestige Limousine by the NYSDOT is not an isolated occurrence. The weaknesses of the NYSDOT’s inspection program have been repeatedly documented as a systemwide issue. In audit reports issued in 2004 and 2014, the New York Office of the State Comptroller found that the NYSDOT’s inspection program for commercial motor carriers did not adequately monitor compliance and did not have a sufficient system to verify that OOS violations were repaired (NYOC 2004 and 2014). Further, data continue to show that the number of OOS repair verifications remains extremely low. For fiscal year 2018, the State of New York identified a number of state objectives concerning significant problems in its Commercial Vehicle Safety Plan for the Federal Motor Carrier Safety Administration's Motor Carrier Safety Assistance Program, Fiscal Year 2018 (NYS 2017). One problem statement in this report read as follows: Repair verifications are not being conducted consistently and only a portion of out of service vehicle defect reports on NYS domiciled carriers are verified. For example, out of 10,046 inspections that found vehicle out of service violations, less than 1% led to repair verification. To address the problem, the state set a fiscal year 2018 performance goal as follows: Conduct repair verifications on 5% of NYS domiciled carriers with out of service vehicle defect inspection reports. The repair verifications will focus primarily on those with the most serious equipment violations. During the first two quarters of fiscal year 2018, 244 repair verifications were conducted of the 6,059 New York State-domiciled carriers with OOS defects, representing 4 percent of those carriers (NYS 2019). This number of verifications most likely does not deter noncompliant carriers from operating with serious OOS vehicle and driver violations.

NTSB

Highway Accident Report 66 Based on the evidence of NYSDOT’s oversight failures in connection with the limousine operator Prestige Limousine, as well as the statistical evidence of its limited enforcement effectiveness of motor carriers in general, the NTSB concludes that the NYSDOT’s enforcement efforts directed toward motor carriers that continue operating after being cited for serious OOS violations have been inadequate, and additional strategies and repair verification processes are needed. In its 2014 audit report (NYOC 2014), the New York Office of the State Comptroller issued two “key recommendations” to the NYSDOT. The first called on the NYSDOT to actively monitor motor carrier compliance with the requirements for certification that OOS vehicles have been repaired, and to develop strategies to improve carrier compliance, particularly for those carriers with poor safety histories and OOS violations. The second key recommendation was that the NYSDOT impose progressive enforcement actions, such as compliance reviews and formal NOVs, when carriers are found to have continued to operate OOS vehicles. Although the NYSDOT responded positively to these key recommendations in its comments on the audit report, based on the evidence of continuing deficiencies in the NYSDOT’s oversight of motor carriers with OOS violations, these key recommendations have not yet been effectively implemented. Therefore, the NTSB recommends that the State of New York require the NYSDOT to implement the “key recommendations” in the 2014 New York Office of the State Comptroller Report 2012-S-13 addressing vehicle repair certification requirements, strategies to improve carrier compliance with OOS violations, and progressive enforcement actions for continued operation of OOS vehicles. 2.3.3.3 Consistency of “bus” definition. During the course of its investigation, the NTSB noted that the NYSDMV defines a bus as a for-hire vehicle that seats 15 or more passengers, while the NYSDOT defines a bus as a for-hire vehicle that seats 10 or more passengers. This difference in definition between the two agencies is liable to cause confusion in regulating and inspecting for-hire vehicles that transport larger numbers of passengers. Federal safety standards (49 CFR 571.3[b]), like the NYSDOT, define a bus as any vehicle used in for-hire service that seats 10 or more passengers. The NTSB concludes that making the definition of what constitutes a “bus” consistent between the New York State agencies responsible for registering and inspecting higher occupancy passenger-carrying vehicles would reduce the likelihood of miscommunication between these safety oversight agencies and of motor carriers exploiting administrative loopholes to avoid safety scrutiny. Therefore, to harmonize these definitions, the NTSB recommends that the State of New York require the NYSDMV to adopt the NYSDOT’s definition of a bus as a passenger vehicle for hire with a seating capacity of 10 or more. 2.3.4 Federal Oversight The FMCSA has limited oversight responsibility for intrastate passenger-carrying companies. It provides guidance to the states through the Motor Carrier Safety Assistance Program and financial assistance to help states reduce the number and severity of crashes involving commercial motor vehicles. Each year, states submit a CVSP to the FMCSA with the state’s projected goals, activities, and objectives. Between 2016 and 2019, the NYSDOT’s CVSP identified as a priority objective the need to address the problem of carriers that fail to correct defects, a problem identified by the state’s own internal auditing.

NTSB

Highway Accident Report 67 The State of New York obviously has had, and is aware of, a problem concerning the verification of motor carriers’ repairs to correct OOS violations. The NTSB is concerned that the problem of motor carriers ignoring OOS orders and continuing to operate may not be limited to New York. FMCSA national data show that, in 2018, federal and state inspectors performed 2,405,751 vehicle inspections with 501,113 (20.8 percent) resulting in OOS violations. That same year, 3,395,955 driver inspections were conducted with 161,585 (4.8 percent) resulting in OOS violations (FMCSA 2019). Vehicles and drivers are placed in OOS status because of conditions that pose an imminent threat to safety. As the experience of New York suggests, in the absence of an aggressive OOS and repair verification process, carriers that choose to violate OOS orders will continue to pose a safety risk on our highways. Therefore, the NTSB concludes that although the extent of the problem is unknown, some motor carriers across the nation are likely continuing to operate without correcting OOS violations, placing the motoring public at risk. Although the FMCSA does not have oversight over intrastate carrier operations, most state regulations for intrastate commerce mirror federal regulations for interstate commerce, such as requiring motor carriers to have a USDOT number. A USDOT number is a unique identifier that allows the FMCSA to collect data about these motor carriers from states on enforcement activity, inspections, crashes, and registration statistics. The FMCSA has experience addressing the issue of interstate carriers and drivers that continue to operate in violation of OOS orders.117 Using its experience with interstate carriers and awareness of the strategies states use to verify repairs and ensure compliance with OOS orders with intrastate motor carriers, the FMCSA is best positioned to provide a model approach on how to address these problems, and, consequently, could provide guidance and programmatic assistance to states having difficulties with noncompliant intrastate carriers. Therefore, the NTSB recommends that the FMCSA provide guidance and best practices to states to enforce carrier compliance with state-issued OOS orders, based on available information on state efforts to prevent vehicles and drivers from continuing to operate without authority or after being cited for OOS violations. 2.4 Insufficient Occupant Protection for Limousine Passengers In September 2019, the NTSB issued a safety recommendation report titled Providing Occupant Protection for Limousine Passengers, which addressed occupant protection safety issues identified during the Schoharie crash investigation (NTSB 2019a). In the report, the NTSB reiterated Safety Recommendation H-15-42 regarding the enforcement of seat belt laws to the State of New York, as follows: H-15-42 Enact legislation that provides for primary enforcement of a mandatory seat belt use law for all vehicle seating positions equipped with a passenger restraint system.

117 The FMCSA oversees the rulemaking for driver/carrier issues, including establishing penalties for OOS order violations. It publishes annual OOS rates at the federal and state levels. Additionally, the FMCSA has a grant program that provides financial assistance to states to reduce the number and severity of crashes and hazardous materials incidents involving commercial motor vehicles. This includes supporting programs that examine issues such as strategies for identifying OOS motor carriers.

NTSB

Highway Accident Report 68 On August 10, 2020, New York enacted legislation requiring that all passengers in motor vehicles wear seat belts. The NTSB is evaluating this new law to determine if it fully satisfies Safety Recommendation H-15-42, which is currently classified “Open—Acceptable Response.” The NTSB issued two new safety recommendations to NHTSA in the safety recommendation report, as follows: H-19-14 Require lap/shoulder belts for each passenger seating position on all new vehicles modified to be used as limousines. H-19-15 Require that seating systems installed in new vehicles modified to be used as limousines meet minimum performance standards to ensure their integrity during a crash. The status of both recommendations is “Open—Unacceptable Response.” NHTSA indicated in its March 10, 2020, correspondence concerning Safety Recommendation H-19-14 that, because the safety recommendation report did not contain a probable cause for the Schoharie crash, which was an extremely severe event, its “ability to respond is limited.” The agency suggested that the NTSB close this recommendation and instead focus on a recommendation it deems similar, Safety Recommendation H-18-59, which calls for improving seat belt system integrity on newly manufactured medium-size buses. In its reply to NHTSA, the NTSB acknowledged that the intent of Safety Recommendation H-19-14 is similar to that of Safety Recommendation H-18-59, in that both recommendations are concerned with gaps in occupant protection standards for vehicles with GVWRs of 10,001–26,000 pounds, but that the two types of vehicles they address have significant differences. While classifying Safety Recommendation H-19-14 “Open—Unacceptable Response,” the NTSB stated that it believes that NHTSA can improve occupant protection for all vehicles in this weight class, including both medium-size buses and new vehicles modified to be used as limousines. In its March 10, 2020, response to Safety Recommendation H-19-15, NHTSA again stated that, because the safety recommendation report in which it was issued did not contain a causality determination and because of the severity of the Schoharie crash, the evidence presented in the report was insufficient to establish an unmet safety need concerning the integrity of seating systems on vehicles modified to be used as limousines. The response from NHTSA also stated that “large stretch limousines comprise a relatively small vehicle population, and have a low involvement in serious crashes overall.” In its letter to NHTSA classifying Safety Recommendation H-19-15 as “Open—Unacceptable Response,” the NTSB stated that the recommendation is intended to improve seating system integrity to enhance occupant protection at all levels of crash severity, not just those involving excessive speed. Moreover, the NTSB noted that the recommendation report discussed multiple crashes involving several different vehicles used in limousine-type service in addition to the Schoharie crash. The safety recommendation report contained the following new recommendation to the NYSDOT:

NTSB

Highway Accident Report 69 H-19-16 As an addition to your regular state inspection process, ensure that seat belts are functional and accessible in all limousines in the state equipped with passenger seat belts. On February 3, 2020, a new state law (New York Assembly Bill A.9057) went into effect that requires all stretch limousine vehicles operating in New York to have seat belts installed at the driver and all passenger seating positions by January 1, 2021. The law includes a provision for retrofitting existing vehicles, requires the NYSDOT to approve installation, and calls for a notice to be posted informing passengers that seat belts should be available and encouraging them to use the belts. Because seat belts are a mandatory inspection item when they are required to be installed in a vehicle, the NTSB considered that the February 3 law requiring seat belts in stretch limousine vehicles satisfied this recommendation in an acceptable alternate manner. Consequently, the NTSB classified it as “Closed—Acceptable Alternate Action.” The NTSB issued the following safety recommendation to the NLA in the safety recommendation report: H-19-17 Educate member limousine operators on the life-saving benefits of proper seat belt use, and recommend that they develop methods to (1) ensure that seat belts are functional and accessible to the passengers and (2) encourage passengers to use them. The status of this recommendation is “Open—Acceptable Response,” based on the NLA’s decision to develop an educational session that would include the recommended guidance about seat belt use, functionality, and accessibility, and to present the session at its next two conferences.

NTSB

Highway Accident Report 70 3 Conclusions 3.1 Findings

1. None of the following were factors in this crash: (1) the driver’s experience or familiarity

with the limousine, (2) roadway signage, (3) alcohol impairment or fatigue, (4) cell phone use, (5) weather conditions, or (6) visibility and stopping sight distance at the intersection where the crash occurred.

1. The emergency response to the crash was timely and adequate.
2. The limousine was unable to slow on the downhill grade approaching the intersection due

to a failure within the poorly maintained brake system.

1. Although 21st Century Coachworks, the company that altered the Ford Excursion sport

utility vehicle into a stretch limousine, does not appear to have certified that the altered vehicle met the applicable Federal Motor Vehicle Safety Standards, the results of a brake system performance study show that, had the brake system been properly maintained, the limousine should have been capable of stopping safely at the bottom of the New York State Route 30 downgrade.

1. Limousine operators can help ensure the safety of altered vehicles being acquired for use

in passenger transportation service by (1) obtaining an engineer’s certification that the altered vehicle meets the Federal Motor Vehicle Safety Standards and (2) ensuring that a secondary certification label is affixed to the limousine before purchase.

1. The limousine driver failed to disclose pertinent information about his medical history as

required on the examination form for commercial driver’s license medical certification, which prevented accurate assessment of his fitness to drive a vehicle transporting passengers.

1. Based on the limousine driver’s medical conditions, it cannot be determined whether he

would have been granted medical certification to drive a limousine had he fully disclosed his medical history on the examination form for commercial driver’s license medical certification; however, had he disclosed his use of marijuana, he would not have been medically certified.

1. Although toxicology tests detected evidence of marijuana and prescription drug use by the

limousine driver, insufficient information was available to determine whether the drugs in his system were at levels that would have impaired his ability to respond to the emergency situation.

1. Despite numerous warnings and Notices of Violation issued by the New York State

Department of Transportation, Prestige Limousine and Chauffeur Service violated the law by transporting passengers in its limousines without having operating authority.

NTSB

Highway Accident Report 71

1. On the day of the crash, Prestige Limousine and Chauffeur Service was knowingly

operating a limousine in poor mechanical condition that had recently been placed out of service for safety deficiencies, including brake equipment violations.

1. Prestige Limousine and Chauffeur Service did not have an effective maintenance program

in place to ensure the safety of its passenger-carrying vehicles.

1. Despite knowing that the crash limousine driver was not properly licensed, Prestige

Limousine and Chauffeur Service repeatedly assigned him to transport passengers, in direct violation of a New York State Department of Transportation out-of-service order, which indicates deficiencies in driver-related safety controls at the motor carrier.

1. The New York State Department of Motor Vehicles’ failure to verify information in its

vehicle registration program allowed the crash limousine to be incorrectly classified and improperly registered, which enabled Prestige Limousine and Chauffeur Service to circumvent the more thorough state safety and inspection requirements that might have prevented the crash.

1. The state inspection stations Mavis Discount Tire and Wilton Truck Center knowingly

inspected and certified the crash limousine, which was clearly an altered vehicle, in contravention of the New York State Department of Motor Vehicles’ policy that prohibited stations from inspecting modified or altered vehicles, including stretch limousines.

1. By not ensuring that state inspection stations adhered to the policy that prohibited them

from inspecting altered vehicles, the New York State Department of Motor Vehicles enabled the crash limousine to undergo annual vehicle inspections instead of the more rigorous semiannual New York State Department of Transportation bus safety inspections, as required.

1. The New York State Department of Motor Vehicles did not provide effective oversight of

state inspection stations, allowing Mavis Discount Tire and Wilton Truck Center to perform inadequate inspections of the crash limousine that failed to detect serious safety deficiencies before the crash.

1. The New York State Department of Transportation’s ineffective enforcement and lack of

repair verification processes allowed Prestige Limousine and Chauffeur Service to continue to transport passengers in the crash limousine despite the carrier’s (1) not having operating authority and (2) failing to repair out-of-service vehicle violations that compromised the limousine’s safety.

1. The State of New York’s implementation of Assembly Bill A.9056 should help resolve the

safety problem of stretch limousines continuing in commercial operation without having their out-of-service violations repaired.

1. The New York State Department of Transportation’s enforcement efforts directed toward

motor carriers that continue operating after being cited for serious out-of-service violations have been inadequate, and additional strategies and repair verification processes are needed.

NTSB

Highway Accident Report 72

1. Making the definition of what constitutes a “bus” consistent between the New York State

agencies responsible for registering and inspecting higher occupancy passenger-carrying vehicles would reduce the likelihood of miscommunication between these safety oversight agencies and of motor carriers exploiting administrative loopholes to avoid safety scrutiny.

1. Although the extent of the problem is unknown, some motor carriers across the nation are

likely continuing to operate without correcting out-of-service violations, placing the motoring public at risk. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of the Schoharie, New York, crash was Prestige Limousine and Chauffeur Service’s egregious disregard for safety, in dispatching a stretch limousine with an out-of-service order for a passenger charter trip, resulting in the failure of its brake system while descending the steep grade of New York State Route 30. Contributing to the crash was the New York State Department of Transportation’s ineffective oversight of Prestige Limousine, despite its knowledge of the carrier’s multiple out-of-service violations and lack of operating authority, as well as the department’s inadequate repair verification process. Further contributing to the crash was the New York State Department of Motor Vehicles’ inadequate oversight of state-licensed inspection stations and its failure to properly register the limousine, which enabled Prestige Limousine to circumvent the state’s safety regulations and more rigorous inspection requirements.

NTSB

Highway Accident Report 73 4 Recommendations 4.1 New Recommendations As a result of its investigation, the National Transportation Safety Board makes the following new safety recommendations: To the Federal Motor Carrier Safety Administration: Provide guidance and best practices to states to enforce carrier compliance with state-issued out-of-service orders, based on available information on state efforts to prevent vehicles and drivers from continuing to operate without authority or after being cited for out-of-service violations. (H-20-24) To the State of New York: Require the New York State Department of Transportation to implement the “key recommendations” in the 2014 New York Office of the State Comptroller Report 2012-S-13 addressing vehicle repair certification requirements, strategies to improve carrier compliance with out-of-service violations, and progressive enforcement actions for continued operation of out-of-service vehicles. (H-20-25) Require the New York State Department of Motor Vehicles to adopt the New York State Department of Transportation’s definition of a bus as a passenger vehicle for hire with a seating capacity of 10 or more. (H-20-26) To the New York State Department of Motor Vehicles: Review your policies and protocols on the inspection of stretch limousines, and establish stricter safeguards and more rigorous enforcement protocols to ensure that state-contracted inspection stations do not inspect stretch limousines that have a seating capacity of 10 or more. (H-20-27) Renotify state-contracted inspection stations that they may not inspect stretch limousines that have a seating capacity of 10 or more. (H-20-28) To the National Limousine Association: Inform your member limousine operators of the importance of verifying the safety of altered vehicles planned for passenger transportation by ensuring that the altered vehicle passes a structural and mechanical safety inspection, obtaining from the alterer an engineer’s certification that the altered vehicle meets the Federal Motor Vehicle Safety Standards affected by the alteration, and checking that a secondary certification label is affixed to the limousine before purchase. (H-20-29)

NTSB

Highway Accident Report 74 4.2 Previously Issued Recommendations In September 2019, the NTSB issued a safety recommendation report titled Providing Occupant Protection for Limousine Passengers, which issued and reiterated the following safety recommendations addressing occupant protection safety issues identified during the Schoharie crash investigation (NTSB 2019a): To the National Highway Traffic Safety Administration: Require lap/shoulder belts for each passenger seating position on all new vehicles modified to be used as limousines. (H-19-14) Require that seating systems installed in new vehicles modified to be used as limousines meet minimum performance standards to ensure their integrity during a crash. (H-19-15) The status of Safety Recommendations H-19-14 and -15 is “Open—Unacceptable Response.” To the New York State Department of Transportation: As an addition to your regular state inspection process, ensure that seat belts are functional and accessible in all limousines in the state equipped with passenger seat belts. (H-19-16) The status of Safety Recommendation H-19-16 is “Closed—Acceptable Alternate Action.” To the National Limousine Association: Educate member limousine operators on the life-saving benefits of proper seat belt use, and recommend that they develop methods to (1) ensure that seat belts are functional and accessible to the passengers and (2) encourage passengers to use them. (H-19-17) The status of Safety Recommendation H-19-17 is “Open—Acceptable Response.” In the Safety Recommendation Report, the NTSB reiterated Safety Recommendation H-15-42 to the State of New York: Enact legislation that provides for primary enforcement of a mandatory seat belt use law for all vehicle seating positions equipped with a passenger restraint system. (H-15-42) The status of Safety Recommendation H-15-42 to the State of New York is “Open— Acceptable Response.”

NTSB

Highway Accident Report 75 BY THE NATIONAL TRANSPORTATION SAFETY BOARD ROBERT L. SUMWALT, III

JENNIFER HOMENDY Chairman

Member BRUCE LANDSBERG

MICHAEL GRAHAM Vice Chairman

Member

THOMAS B. CHAPMAN

Member Report Date: September 29, 2020

NTSB

Highway Accident Report 76 Board Member Statement Chairman Sumwalt filed the following concurring statement on October 4, 2020. Notation 64871 Chairman Sumwalt, concurring.

Consumer Protections At a few minutes before 9 a.m. on Saturday, October 6, 2018, a call was placed to Prestige Limousine and Chauffer Service. The caller told the person answering the phone that he wanted to rent a limo that day. He explained that he had arranged a limo through another operator, but that operator had to back out due to unspecified problems. A price was quoted, and the caller agreed to hire Prestige. What the caller didn’t realize was that the operator he just contracted with had numerous warnings and Notices of Violation by the State of New York Department of Transportation (NYDOT). He didn’t know that the vehicle he had just rented was officially placed out-of-service by the State of New York due to safety deficiencies and violations. He wasn’t aware that Prestige Limo did not have an effective maintenance program in place to ensure the safety of its passenger-carrying vehicles. He had no way of knowing that the driver that would be assigned to drive the limo was not properly licensed to carry passengers for hire, and that the driver had also been placed out-of-service by the State. He didn’t know that the vehicle wasn’t inspected by NYDOT, as required by state laws. He would not have known that two years later, the NTSB would determine that Prestige Limousine and Chauffer Service displayed an “egregious disregard for safety in dispatching a stretch limousine with an out-of-service order for [this] passenger charter trip, resulting in the failure of its brake system while descending the steep grade of New York State Route 30.” And, unfortunately, he had no way of knowing that this vehicle, which was operated by Prestige Limo, and driven by that driver, would ultimately drive him and 19 others to their deaths. So, how can a customer be aware of such circumstances before chartering for such services? I believe it is essential to have an easy-to-use system where the consumer can learn important details about the limousine operator and drivers. The NYDOT has established such a system, and I applaud their efforts. That said, there’s more that needs to be done to inform consumers across the nation. I’m comforted to know that NTSB staff is planning to look for innovative ways to increase consumer awareness. The Office of Highway Safety has mentioned the possibility of developing a safety alert. While that may be effective, I’d like for them to consider a more comprehensive approach, such as a recommendation package to appropriate organizations. A safety alert is good because it can inform consumers, but without the appropriate organizations developing the easy-to-use software platforms by which consumers can search for safety information, consumers will miss out on valuable information. The bottom line is that consumers who charter vehicles have the right to know what they are getting. Much more needs to be done in this regard.

NTSB

Highway Accident Report 77 NTSB’s Right to Investigate Just as consumers have the right to know, I must point out that the NTSB has the clear and absolute right to investigate accidents and crashes such as this one. Unfortunately, the parallel criminal investigation conducted by the Schoharie County District Attorney’s Office and the New York State Police significantly impeded and curtailed the NTSB’s typical investigative efforts. Particularly early in our investigation, some NTSB investigators were outright blocked from even viewing, let alone examining, critical evidence. Specifically, our investigators were denied timely access to the crash vehicles and related information that would allow the NTSB to follow its usual investigative protocols. The involved motor carrier, Prestige Limousine and Chauffeur Service, would not permit access to its records, maintenance history, some witnesses, and other investigative material in light of the ongoing criminal case. I certainly realize that the victims’ families are entitled to justice through a criminal investigation. And, likewise, I realize that the defendants in this case are entitled to fair judicial proceedings. I certainly respect that process. But, I also know that by the powers granted by Congress, the NTSB has the statutory authority and responsibility to investigate crashes such as this one, in order to assess any safety issues that could prevent a similar crash from happening again. Specifically, 49 U.S.C. §1131(a)(1)(B) states: “The National Transportation Safety Board shall investigate or have investigated (in detail the Board prescribes) and establish the facts, circumstances, and cause or probable cause of -- a highway accident… the Board selects in cooperation with a State.” To further the point, 49 U.S.C. § 1134(a)(1) stipulates: “An officer or employee of the National Transportation Safety Board -- on display of appropriate credentials and written notice of inspection authority, may enter property where a transportation accident has occurred or wreckage from the accident is located and do anything necessary to conduct an investigation.” Quite simply, all parties have to work together, because we all have important roles to play. Unfortunately, that didn’t happen in this case. When these issues were brought before The Honorable George R. Bartlett, III, Schoharie County Judge, Judge Bartlett stated: It is hard to understand why the People, the NTSB, and the defense through their experts cannot work out a mutually acceptable protocol to allow all to fulfill their duties. [Underlining in original.] There must have been hundreds, if not thousands, of accidents where there has been a criminal investigation occurring cooperatively and simultaneously with an investigation by the NTSB… What is clear is that this is an untenable situation. Two critically important investigations are being delayed over unsubstantiated concerns by the People that an NTSB investigation will taint their investigation…. [T]he People’s position

NTSB

Highway Accident Report 78 effectively precludes the NTSB from performing its equally important public safety inquiry. This is despite the People’s failure to articulate or provide expert opinion as to why the criminal investigation and NTSB investigation cannot be conducted side by side, in a cooperative manner with clearly defined protocols which allow the investigations to proceed forthwith and also protect defendant’s rights. The victims, their families, and the public interest deserve nothing less than a complete investigation by both the People and the NTSB.1 These impediments delayed and complicated the NTSB’s investigation, but they did not affect its accuracy or completeness, as investigators used the factual information collected and developed alternative methodologies to complete an accurate investigation. That said, NTSB investigators must be allowed to conduct their duties, per the powers granted them by Congress.

Vice Chairman Landsberg, Member Homendy, Member Graham, and Member Chapman joined in this statement.

1 Letter and Order from The Hon. George R. Bartlett, III, to The Hon. Susan J. Mallery, Lee C. Kindlon, and Kathleen Silbaugh (January 18, 2019) at page 9. Quoted material retrieved from: https://dms.ntsb.gov/pubdms/search/document.cfm?docID=486342&docketID=62797&mkey=98417.

NTSB

Highway Accident Report 79 Appendix A: Investigation The National Transportation Safety Board was notified of this crash on October 6, 2018, and an investigative team was dispatched to the scene. Groups were established to investigate human performance; motor carrier operations; and highway, survival, and vehicle factors. The NTSB team also included staff from the Office of Aviation Safety (aerial imagery) and the Office of Research and Engineering. Chairman Robert L. Sumwalt, III, was the NTSB spokesperson on scene. Parties to the investigation were the Federal Motor Carrier Safety Administration, the New York State Police, the New York State Department of Transportation, and Ford Motor Company. Additionally, the NTSB contracted with Greening Testing Laboratories, Detroit, Michigan, to conduct performance-based brake system testing. The New York State Police and the Schoharie County District Attorney’s Office are conducting a criminal investigation of this crash. These state entities (particularly the District Attorney’s Office) denied the NTSB timely access to the crash vehicles and related information that would allow the NTSB to follow its usual investigative protocols. The involved motor carrier, Prestige Limousine and Chauffeur Service, would not permit access to its records, maintenance history, some witnesses, and other investigative material. These impediments delayed and complicated the NTSB’s investigation, but they did not affect its accuracy or completeness, as investigators used the factual information collected and developed alternative methodologies to complete an accurate investigation. In particular, to compensate for the District Attorney and state police denying our timely access to vehicle and braking components for any actions other than a visual inspection, the NTSB contracted an independent testing firm to conduct performance-based testing. The firm examined the braking performance of a Ford Excursion SUV at the original manufacture gross vehicle weight rating and at the weight of the stretch limousine at the time of the crash. The testing included brake dynamometer testing to simulate braking performance over the route the crash vehicle traveled. This testing was instrumental to understanding factors relevant to the crash.

NTSB

Highway Accident Report 80 Appendix B: Consolidated Recommendation Information Title 49 United States Code (USC) 11179(b) requires the following information on the recommendations in this report. For each recommendation— (1) a brief summary of the NTSB’s collection and analysis of the specific accident investigation information most relevant to the recommendation; (2) a description of the NTSB’s use of external information, including studies, reports, and experts, other than the findings of a specific accident investigation, if any were used to inform or support the recommendation, including a brief summary of the specific safety benefits and other effects identified by each study, report, or expert; and (3) a brief summary of any examples of actions taken by regulated entities before the publication of the safety recommendation to the extent such actions are known to the Board, that were consistent with the recommendation. To the Federal Motor Carrier Safety Administration: H-20-24 Provide guidance and best practices to states to enforce carrier compliance with state-issued out-of-service orders, based on available information on state efforts to prevent vehicles and drivers from continuing to operate without authority or after being cited for out-of-service violations. Information that addresses the requirements of 49 USC 11179(b), as applicable, can be found in section 2.3.4 Federal Oversight. Information supporting (b)(1) can be found on pages 66– 67; (b)(2) and (b)(3) are not applicable. To the State of New York: H-20-25 Require the New York State Department of Transportation to implement the “key recommendations” in the 2014 New York Office of the State Comptroller Report 2012-S-13 addressing vehicle repair certification requirements, strategies to improve carrier compliance with out-of-service violations, and progressive enforcement actions for continued operation of out-of-service vehicles. Information that addresses the requirements of 49 USC 11179(b), as applicable, can be found in section 2.3.3 New York State Department of Transportation Oversight. Information supporting (b)(1) can be found on pages 64‒66; (b)(2) and (b)(3) are not applicable.

NTSB

Highway Accident Report 81 H-20-26 Require the New York State Department of Motor Vehicles to adopt the New York State Department of Transportation’s definition of a bus as a passenger vehicle for hire with a seating capacity of 10 or more. Information that addresses the requirements of 49 USC 11179(b), as applicable, can be found in section 2.3.3 New York State Department of Transportation Oversight. Information supporting (b)(1) can be found on page 66; (b)(2) and (b)(3) are not applicable. To the New York State Department of Motor Vehicles: H-20-27 Review your policies and protocols on the inspection of stretch limousines, and establish stricter safeguards and more rigorous enforcement protocols to ensure that state-contracted inspection stations do not inspect stretch limousines that have a seating capacity of 10 or more. Information that addresses the requirements of 49 USC 11179(b), as applicable, can be found in section 2.3.2 New York State Department of Motor Vehicles Oversight. Information supporting (b)(1) can be found on pages 62–64; (b)(2) and (b)(3) are not applicable. H-20-28 Renotify state-contracted inspection stations that they may not inspect stretch limousines that have a seating capacity of 10 or more. Information that addresses the requirements of 49 USC 11179(b), as applicable, can be found in section 2.3.2 New York State Department of Motor Vehicles Oversight. Information supporting (b)(1) can be found on pages 62–64; (b)(2) and (b)(3) are not applicable. To the National Limousine Association: H-20-29 Inform your member limousine operators of the importance of verifying the safety of altered vehicles planned for passenger transportation by ensuring that the altered vehicle passes a structural and mechanical safety inspection, obtaining from the alterer an engineer’s certification that the altered vehicle meets the Federal Motor Vehicle Safety Standards affected by the alteration, and checking that a secondary certification label is affixed to the limousine before purchase. Information that addresses the requirements of 49 USC 11179(b), as applicable, can be found in section 2.2.3 Vehicle Alteration Affecting Compliance with Applicable FMVSSs. Information supporting (b)(1) can be found on pages 55–57; (b)(2) and (b)(3) are not applicable.

NTSB

Highway Accident Report 82 Appendix C: Highway Signage Map

NTSB

Highway Accident Report 83 Appendix D: NYSDOT Interactions with Prestige Limousine The table below summarizes interactions between the NYSDOT and Prestige Limousine. Date Activity May 18, 2016 Application for NYSDOT Emergency Temporary Authority (ETA) to transport passengers for prom season (under name Hasy Limousine and Prestige Limousine [Prestige Limousine had operated under other business names, including “Hasy Limousine]). Application lists 2002 Ford Excursion stretch limousine with seating capacity of 21 passengers. May 20, 2016 NYSDOT letter denies ETA application due to failure to meet requirements. Denial states incomplete application submitted and failure to list either Hasy or Prestige as sole operator. May 24, 2016 Application is submitted to NYSDOT for ETA to transport passengers for prom season. Application lists 2002 Ford Excursion stretch limousine with seating capacity of 21 passengers that was listed on May 18, 2016, application. May 26, 2016 Reapplication for NYSDOT ETA to transport passengers for prom season. Includes copy of contract (dated March 28, 2016) to perform transportation in June 2016. Application lists 2002 Ford Excursion stretch limousine with seating capacity of 21 passngers. June 8, 2017 NYSDOT Intermodal Transportation Specialist observes 21-passenger crash-involved stretch limousine parked outside Mavis Discount Tire in Saratoga Springs. Inspector recognizes that vehicle size would require NYSDOT authority to operate. Inspector checks NYSDMV database. Registration lists vehicle as having 11-passenger seating capacity. Inspector finds that NYSDOT previously inspected vehicle; it was listed as 18-passenger vehicle. Inspector also notices that vehicle has livery license plate that normally indicates it transports passengers for hire. NYSDOT Intermodal Transportation Specialist contacts limousine company via e-mail on June 9, 2017, regarding its operating authority. June 9, 2017 E-mail from NYSDOT Intermodal Transportation Specialist, titled “Warning‒No Authority.” E-mail explains requirements to obtain NYSDOT operating authority. Also notes error: current crash-involved stretch limousine vehicle registration seating capacity is reported as 11, while previous NYSDOT vehicle records show seating capacity of 18. July 24, 2017 Hasy (Prestige) Limousine receives e-mail from NYSDOT investigator (undercover) to arrange transportation from Rotterdam, New York, to Albany Airport for 8 passengers. Hasy (Prestige) Limousine quotes NYSDOT fee of $175 plus tip. August 15, 2017 As result of July 24, 2017, e-mail from NYSDOT to Hasy (Prestige), with Hasy acceptance to transport passenger from Rotterdam to Albany Airport, NYSDOT issues Hasy Limousine Notice of Violation and cites Transportation Law 152, Passenger Authority/None. Hasy is fined $5,000. Notice of Violation #1: (NYSDOT violation #10138) September 14, 2017 NYSDOT sends letter for Notice to Appear in court for hearing on October 6, 2017, to Hasy (Prestige) in response to NOV issued August 15, 2017. Notice of Violation #1 (NYSDOT violation #10138) October 6, 2017 Hasy (Prestige) does not appear at court hearing. NYSDOT sends Order After Hearing Default Notice to Hasy. Notice of Violation #1 (NYSDOT NOV #10138) January 5, 2018 NYSDOT Intermodal Transportation Specialist searches internet for operators transporting passengers without authority. Inspector finds Saratoga Luxury Limousines (Prestige) and photograph on Facebook of crash-involved limousine, 2001 Ford Excursion, available for transporting passengers, with same license plate observed on June 8, 2017, at Mavis Discount Tire. Inspector contacts Saratoga and receives response from Saratoga quoting contract price to transport 13 passengers for 5 hours.

NTSB

Highway Accident Report 84 Date Activity January 8, 2018 NYSDOT Intermodal Transportation Specialist issues Saratoga (Prestige) Notice of Violation and cites Transportation Law 152, Passenger Authority/None, as violation for quoted contract to transport passengers. Saratoga is fined $500. Notice of Violation #2 (NYSDOT violation #8320). Inspector sets appointment for NYSDOT to inspect 2001 Ford Excursion stretch limousine on January 12, 2018, confirmed by e-mail from NYSDOT to Saratoga. Notice of Violation #2 (NYSDOT violation #8320) January 12, 2018 NYSDOT Intermodal Transportation Specialist e-mails Hasy Limousine (Prestige) to confirm 12 p.m. appointment to inspect 2001 Ford Excursion (limousine) based on Notice of Violation #2. E-mail from Saratoga Limousine reports 2001 stretch limousine was sent to Mavis Discount Tire in Saratoga Springs, NY, for repairs. Inspection is cancelled. February 21, 2018 Four months after Hasy (Prestige) fails to appear at October 6, 2017, hearing for NYSDOT Notice of Violation #1 (#10138), NYSDOT sends Hasy Limousine “offer of settlement” and adjourned hearing date of March 6, 2018, for Notice of Violation #1. Offer of settlement reduces penalty for operating without authority from $5,000 to proposed settlement of $500 fine and guilty plea. March 6, 2018 Date of adjourned hearing for NYSDOT Notice of Violation #1. Hasy (Prestige) pays reduced settlement fine of $500 by cashier’s check to settle Notice of Violation #1. March 15, 2018 NYSDOT Intermodal Transportation Specialist contacts Hasy (Prestige) Limousine to confirm NYSDOT inspection of 2001 stretch limo (accident vehicle) on March 21, 2018, at 12 p.m. E-mail includes request that Hasy Limousine provide two additional stretch vehicles (2008 Lincoln limousines) for NYSDOT inspection. E-mail includes instructions to Hasy on how to apply for NYSDOT operating authority, as required by law. March 21, 2018 Intermodal Transportation Specialist performs NYSDOT inspection on crash-involved stretch limousine and one 2008 Ford stretch limousine. Four OOS violations are found on crash- involved limousine and 10 non-OOS violations, including operating without authority. 2001 Ford Excursion stretch limousine is placed in OOS status, with OOS sticker affixed to vehicle by NYSDOT. Same day, NYSDOT sends e-mail to Hasy (Prestige) Limousine, with copies of vehicle inspection reports and explanation that all vehicle repairs are required to be performed before vehicles can be used in for-hire service. NYSDOT e-mail also reminds carrier of outstanding Notice of Violation #2 (NYSDOT #8320) issued on January 8, 2018, for operating without authority and that Hasy Limousine is required to obtain active USDOT number from FMCSA per NY state law. April 12, 2018 NYSDOT sends Notice to Appear for Notice of Violation #2 (NYSDOT NOV #8320) issued January 8, 2018, for operating without NYSDOT-issued operating authority. Notice includes notice of civil fine of $500 for violation. May 3, 2018 NYSDOT sends letter to Hasy Limousine, Saratoga Luxury Limousine, and Prestige Limousine and Chauffeur Service returning Prestige’s application for NYSDOT operating authority. August 2, 2018 NYSDOT Intermodal Transportation Specialist sends e-mail as follow-up to conversation about outstanding NYSDOT Notice of Violation #2 (#8320). NYSDOT inspector advises company to become compliant with NYSDOT operating regulations, including applying for active FMCSA USDOT number, as required. Inspector’s e-mail provides guidance to apply online with FMCSA. August 26,2018 NYSDOT Intermodal Transportation Specialist receives information that another NYSDOT inspector has come into contact with crash-involved stretch vehicle, 2001 Ford Excursion, which has new license plate. August 27, 2018 NYSDOT Intermodal Transportation Specialist schedules NYSDOT vehicle safety inspection for 2001 Ford Excursion limousine on September 4, 2018, at 10 a.m. Specialist receives affirmative response from Prestige.

NTSB

Highway Accident Report 85 Date Activity September 1, 2018 NYSDOT issues a Notice of Violation #3 for four violations of NYSDOT regulations, with fine of $2,000. September 4, 2018 NYSDOT Intermodal Transportation Specialist performs NYSDOT vehicle safety inspection on two 2008 Ford stretch limousines, finds 3 OOS violations and 11 non-OOS violations. NYSDOT inspection is also performed on 2001 Ford Excursion stretch limousine. Inspection report lists 3 OOS violations and 10 non-OOS violations. Report also lists defects from earlier inspection on March 21, 2018, that were not corrected, and notes that no evidence has been produced that repairs were completed as required. NYSDOT Intermodal Transportation Specialist again places OOS sticker on limousine. September 6, 2018 NYSDOT Intermodal Transportation Specialist e-mails Prestige that because Notice of Violation #2 (NYSDOT NOV #8320) has not been addressed, Prestige/Hasy Limousine’s NYSDMV vehicle registrations will be suspended. Second e-mail is sent to Prestige, with copy of NYSDOT Passenger Carrier Informational Packet (published April 2016) as follow-up from email sent September 4 about how to comply with NYSDOT regulations. September 11, 2018 NYSDOT sends Notice to Appear to Prestige regarding Notice of Violation #3 issued September 1, 2018, with hearing date of October 5, 2018. September 11, 2018 NYSDOT Intermodal Transportation Specialist sends four separate e-mails to Prestige between September 11 and October 1, about Prestige’s improper registration with FMCSA for USDOT number. September 17, 2018 NYSDOT through NYSDMV suspends Prestige Limousine’s vehicle registrations for failure to address Notice of Violation #2 issued January 8, 2018. Prestige pays fine penalty of $500, and NYSDMV reinstates vehicle registrations on September 19, 2018. September 19, 2018 NYSDOT Intermodal Transportation Specialist requests owner drug- and alcohol-testing records from Prestige and copies of Saratoga County Clerk’s Office Certificate of Doing Business Under Assumed Name filings for Saratoga Luxury Limousine and Prestige Limousine & Chauffeur Service. Request is for copies of all records to be provided to NYSDOT by September 21, 2018. September 19, 2018 Prestige vehicle registration suspensions are lifted on payment of $500 fine by Prestige. Vehicle registrations are reinstated. October 1, 2018 NYSDOT Intermodal Transportation Specialist e-mails Prestige owner, stating that he has not yet received documents NYSDOT requested in September 19, 2018, e-mail. October 5, 2018 Prestige ownership fails to appear for hearing set for Notice of Violation #3 NYSDOT issued on September 1, 2018. October 6, 2018 Crash occurs in Schoharie with Prestige-registered 2001 Ford Excursion stretch limousine.

NTSB

Highway Accident Report 86 References AAMVA (American Association of Motor Vehicle Administrators). 2013. Best Practices for Title and Registration of Reconstruction and Replica Vehicles, Vehicle Standards Committee Unconventional Vehicles Working Group. Arlington, VA: AAMVA. American Psychiatric Association. 2013. Diagnostic and Statistical Manual of Mental Disorders. 5th ed. Arlington, VA: American Psychiatric Publishing. Blumenthal, R., J. Braunstein, H. Connolly, A. Epstein, B. J. Gersh, and E. H. Wittels. 2002. Cardiovascular Advisory Panel Guidelines for the Medical Examination of Commercial Motor Vehicle Drivers. Report No. FMCSA-MCP-02-002. Washington, DC: FMCSA. Compton, R. 2017. Marijuana-Impaired Driving – A Report to Congress. DOT HS 812 440. Washington, DC: NHTSA. FMCSA (Federal Motor Carrier Safety Administration). 2019. Pocket Guide to Large Truck and Bus Statistics. RRA-19-012. Washington, DC: FMCSA. Kemp, P. M., P. S. Cardona, A. K. Chaturvedi, and J. W. Soper. 2013. Distribution of Delta 9-Tetrahydrocannabinol and 11-Nor-9-Carboxy-Delta 9-Tetrahydrocannabinol Acid in Postmortem Biological Fluids and Tissues from Pilots Fatally Injured in Aviation Accidents. Washington, DC: Office of Aerospace Medicine, Federal Aviation Administration. NTSB (National Transportation Safety Board). 2016. School Bus Roadway Departure, Anaheim, California, April 24, 2014. Highway Accident Brief NTSB/HAB-16/06. Washington, DC: NTSB. _____. 2018. Selective Issues in School Bus Transportation Safety: Crashes in Baltimore, Maryland, and Chattanooga, Tennessee. Special Investigation Report NTSB/SIR-18/02. Washington, DC: NTSB. _____. 2019a. Providing Occupant Protection for Limousine Passengers. Highway Safety Recommendation Report NTSB/HSR-19/02. Washington, DC: NTSB. _____. 2019b. Collision Between Passenger Train and Refuse Truck at Active Grade Crossing, Crozet, Virginia, January 31, 2018. Highway Accident Brief NTSB/HAB-19/03. Washington, DC: NTSB. _____. 2019c. Motorcoach Roadway Departure and Crash Into Ravine Near Loxley, Alabama, March 13, 2018. Highway Accident Brief NTSB/HAB-19/05. Washington, DC: NTSB. NYOC (New York Office of the State Comptroller). 2004. Selected Truck Inspection Practices. Report 2003-S-24. (Report dated September 17, 2004.)

NTSB

Highway Accident Report 87 _____. 2014. Selected Aspects of the Motor Carrier Safety Assistance Program. Report 2012-S-13. https://www.osc.state.ny.us/state-agencies/audits/2014/01/22/selected-aspects-motor- carrier-safety-assistance-program?redirect=legacy, accessed August 23, 2020. NYS (New York State). 2017. Commercial Vehicle Safety Plan for the Federal Motor Carrier Safety Administration's Motor Carrier Safety Assistance Program, Fiscal Year 2018. https://www.fmcsa.dot.gov/sites/fmcsa.dot.gov/files/docs/fastact/445181/fy18-cvsp-new- york-final-redacted.pdf, accessed October 1, 2020. _____. 2019. New York Commercial Vehicle Safety Plan FY 2019‒2021. https://www.fmcsa.dot.gov/mission/grants/new-york-fy19-mcsap-commercial-motor- vehicle-safety-plan-cvsp, accessed August 23, 2020. Robbe, H. 1998. “Marijuana’s Impairing Effects on Driving Are Moderate When Taken Alone But Severe When Combined with Alcohol.” Human Psychopharmacology: Clinical and Experimental 13, S70–S78.

FD07272 ｜ 2003_美国_MAR2003.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2003 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Fire Aboard Small Passenger Vessel Conception Platts Harbor, Channel Islands National Park, Santa Cruz Island, 21.5 miles South-Southwest of Santa Barbara, California September 2, 2019

Marine Accident Report NTSB/MAR-20/03 PB2020-101011

National Transportation Safety Board

NTSB/MAR-20/03 PB2020-101011 Notation 65936 Adopted October 20, 2020

Marine Accident Report Fire Aboard Small Passenger Vessel Conception Platts Harbor, Channel Islands National Park, Santa Cruz Island, 21.5 miles South-Southwest of Santa Barbara, California September 2, 2019

National Transportation Safety Board

490 L’Enfant Plaza SW Washington, DC 20594

National Transportation Safety Board. 2020. Fire Aboard Small Passenger Vessel Conception Platts Harbor, Channel Islands National Park, Santa Cruz Island, 21.5 miles South-Southwest of Santa Barbara, California, September 2, 2019. Marine Accident Report NTSB/MAR-20/03. Washington, DC. Abstract: This report discusses the September 2, 2019, fire on board the 75-foot-long small passenger vessel Conception, operated by Truth Aquatics, Inc., in Platts Harbor on the north side of Santa Cruz Island, 21.5 nautical miles south-southwest of Santa Barbara, California. Thirty- three passengers and one crewmember died. Safety issues identified in this report include the lack of small passenger vessel regulations requiring smoke detection in all accommodation spaces, the lack of a roving patrol, small passenger vessel construction regulations for means of escape, and ineffective company oversight. As part of its accident investigation, the National Transportation Safety Board makes ten new safety recommendations to the US Coast Guard, associations that have members operating small passenger vessels with overnight accommodations, and Truth Aquatics, Inc.; the NTSB reiterates one safety recommendation to the Coast Guard. The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974, to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties … and are not conducted for the purpose of determining the rights or liabilities of any person” (Title 49 Code of Federal Regulations section 831.4). Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report (Title 49 United States Code section 1154(b)). For more detailed background information on this report, visit the NTSB investigations website and search for NTSB accident ID DCA19MM047. Recent publications are available in their entirety on the NTSB website. Other information about available publications also may be obtained from the website or by contacting— National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551 Copies of NTSB publications may be downloaded at no cost from the National Technical Information Service, at the National Technical Reports Library search page, using product number PB2020-101011. For additional assistance, contact— National Technical Information Service 5301 Shawnee Rd. Alexandria, VA 22312 (800) 553-6847 or (703) 605-6000 NTIS website

NTSB Marine Accident Report i Contents Contents .......................................................................................................................................... i Figures and Tables ....................................................................................................................... iii Acronyms and Abbreviations .......................................................................................................v Executive Summary ..................................................................................................................... vi 1 Factual Information ..............................................................................................................1 1.1 Background .............................................................................................................................1 1.2 Accident Narrative ..................................................................................................................7 1.3 Search and Rescue ................................................................................................................13 1.4 Injuries ..................................................................................................................................18 1.5 Vessel Information ................................................................................................................20 1.5.1 Applicable Regulations .............................................................................................20 1.5.2 Main Engines and Propulsion ...................................................................................20 1.5.3 Electrical Generation and Distribution .....................................................................20 1.5.4 Air Conditioning System and Ventilation.................................................................23 1.5.5 Auxiliary Systems .....................................................................................................25 1.5.6 Galley Equipment .....................................................................................................26 1.5.7 Maintenance and Repair ...........................................................................................26 1.5.8 Certification, Inspections, and Examinations ...........................................................27 1.6 Accident Damage ..................................................................................................................29 1.7 Operations .............................................................................................................................32 1.7.1 Charter Company ......................................................................................................32 1.7.2 Company Information ...............................................................................................32 1.7.3 Company Loss Control Program ..............................................................................34 1.7.4 Watchstanding...........................................................................................................37 1.8 Survival Factors ....................................................................................................................38 1.8.1 Station Bill ................................................................................................................39 1.8.2 Passenger Manifest and Accountability ....................................................................40 1.8.3 Safety Briefing ..........................................................................................................40 1.8.4 Smoke Detectors and Firefighting Equipment ..........................................................41 1.8.5 Means of Escape and Egress .....................................................................................44 1.8.6 Lifesaving Appliances ..............................................................................................46 1.8.7 Emergency Drills ......................................................................................................47 1.9 Personnel Information ...........................................................................................................48 1.9.1 Crew Recruitment and Training ................................................................................48 1.9.2 Crew Licensing and Certification .............................................................................49 1.9.3 Toxicological Testing ...............................................................................................50 1.10 Waterway Information ..........................................................................................................51 1.11 Meteorological Information ..................................................................................................51 1.12 Postaccident Actions .............................................................................................................51 1.13 Similar Small Passenger Vessel Accidents and Related NTSB Safety Recommendations Previously Issued ...........................................................................................................................53

NTSB Marine Accident Report ii 1.13.1 Passenger Ferry Andrew J. Barberi – 2003 ..............................................................53 1.13.2 Passenger Ferry Andrew J. Barberi – 2010 ..............................................................54 1.13.3 Seastreak Wall Street – 2013 ....................................................................................54 1.13.4 Island Lady – 2018....................................................................................................54 1.13.5 Vision – 2018 ............................................................................................................55 1.13.6 Red Sea Aggressor – 2019 ........................................................................................56 2 Analysis ................................................................................................................................57 2.1 General ..................................................................................................................................57 2.2 Exclusions .............................................................................................................................57 2.2.1 Weather .....................................................................................................................57 2.2.2 Alcohol and Other Drugs ..........................................................................................57 2.3 Origins and Potential Sources of the Fire .............................................................................57 2.3.1 Area of Origin ...........................................................................................................58 2.3.2 Ignition ......................................................................................................................60 2.4 Cause of Death ......................................................................................................................62 2.5 Fire Detection........................................................................................................................62 2.6 Roving Patrol ........................................................................................................................65 2.7 Means of Escape ...................................................................................................................67 2.8 Search-and-Rescue Efforts....................................................................................................69 2.9 Oversight ...............................................................................................................................69 3 Conclusions ..........................................................................................................................74 3.1 Findings.................................................................................................................................74 3.2 Probable Cause......................................................................................................................75 4 Recommendations ...............................................................................................................76 4.1 New Recommendations ........................................................................................................76 4.2 Recommendation Reiterated in this Report ..........................................................................77 Appendix A Investigation ............................................................................................................78 Appendix B Consolidated Recommendation Information .......................................................81 Appendix C Small Passenger Vessel Casualty Data Study ......................................................84 References .....................................................................................................................................87

NTSB Marine Accident Report iii Figures and Tables Figure 1. Preaccident photo of Conception .................................................................................... 1 Figure 2. Port side of Conception's salon looking aft .................................................................... 2 Figure 3. Conception simple plan and profile views. .................................................................... 3 Figure 4. Aft main deck of Conception during a previous voyage ................................................ 4 Figure 5. Conception bunkroom arrangement ............................................................................... 5 Figure 6. Vision's and Conception's escape hatches ....................................................................... 6 Figure 7. Conception accident voyage ........................................................................................... 8 Figure 8. Devices charging in Conception's salon. ........................................................................ 9 Figure 9. Conception forward salon windows ............................................................................. 11 Figure 10. Conception on fire ...................................................................................................... 12 Figure 11. Accident site in relation to emergency response assets .............................................. 14 Figure 12. Conception prior to sinking ........................................................................................ 17 Figure 13. Salvaged hull of Conception ....................................................................................... 21 Figure 14. Bunkroom emergency lighting and public address system speaker on Vision ........... 22 Figure 15. Starboard-side main deck of Conception.................................................................... 23 Figure 16. Port side of Conception’s bunkroom. ......................................................................... 24 Figure 17. Truth Aquatics Engine Room Check Log .................................................................. 27 Figure 18. Toilets and stairway to upper deck of Conception ..................................................... 29 Figure 19. Conception wreckage layout at Port Hueneme........................................................... 30 Figure 20. Below-deck areas of Conception ................................................................................ 30 Figure 21. Conception main deck wreckage ................................................................................ 31 Figure 22. Postaccident photo of bunkroom ................................................................................ 32 Figure 23. Power cable for lighting routed through ventilation grille ......................................... 34 Figure 24. Fire at sea emergency instructions .............................................................................. 39

NTSB Marine Accident Report iv Figure 25. Truth Aquatics “Welcome Aboard” information ....................................................... 41 Figure 26. Galley of Conception .................................................................................................. 42 Figure 27. Interior view of Conception bunkroom ...................................................................... 43 Figure 28. Staircase from salon leading down to bunkroom ....................................................... 45 Figure 29. Conception bunkroom escape hatch ........................................................................... 45 Figure 30. Conception firefighting equipment, lifesaving appliances, and evacuation plan ....... 46 Figure 31. Postaccident photo of Conception's skiff ................................................................... 47 Figure 32. Postaccident modifications made to Vision ................................................................ 53 Figure 33. Battery charger that caught fire on Vision. ................................................................. 55

Table 1. Initial VHF distress communications between the captain of the Conception and Coast Guard Sector Los Angeles/Long Beach ........................................................................................ 13 Table 2. VHF communications between Coast Guard Sector Los Angeles/Long Beach and the Grape Escape ................................................................................................................................ 15 Table 3. Summary of resources assigned in the initial response .................................................. 18 Table 4. Injuries sustained in the Conception accident ................................................................ 19 Table 5. Number of small passenger vessels by initial event type based on the NTSB classification’s ten most common vessel types ............................................................................. 85 Table 6. Fatalities and injuries by vessel type .............................................................................. 86

NTSB Marine Accident Report v Acronyms and Abbreviations AC alternating current AIS automatic identification system ATF Bureau of Alcohol, Tobacco, Firearms and Explosives cfm cubic feet per minute CFR Code of Federal Regulations COI Certificate of Inspection CPR cardiopulmonary resuscitation DC direct current EMT emergency medical technician FBI Federal Bureau of Investigation FRP fiberglass-reinforced plastic GPS global positioning system hp horsepower mph miles per hour MSD Marine Safety Detachment MSIB Marine Safety Information Bulletin NAVTEX Navigational Telex NBVC Naval Base Ventura County NTSB National Transportation Safety Board OCMI Officer in Charge, Marine Inspection OSC on-scene coordinator POB persons on board RB-M response boat-medium SCC sector command center SMS safety management system UMIB Urgent Marine Information Broadcast VCFD Ventura County Fire Department VHF very high frequency

NTSB Marine Accident Report vi Executive Summary Accident About 0314 Pacific daylight time on September 2, 2019, the US Coast Guard received a distress call from the Conception, a 75-foot-long small passenger vessel operated by Truth Aquatics, Inc. The vessel was anchored in Platts Harbor on the north side of Santa Cruz Island, 21.5 nautical miles south-southwest of Santa Barbara, California, when it caught fire. When the fire started, 5 crewmembers were asleep in their bunks in the crew berthing on the upper deck, and 1 crewmember and all 33 passengers were asleep in the bunkroom below. A crewmember sleeping in an upper deck berth was awakened by a noise and got up to investigate. He saw a “glow” outside. Realizing that there was a fire rising up from the salon compartment directly below, the crewmember alerted the four other crewmembers sleeping on the upper deck. The captain was able to radio a quick distress message to the Coast Guard. Crewmembers jumped down to the main deck and attempted to access the salon to assist the passengers and crewmember in a bunkroom below the main deck but were blocked by fire and overwhelmed by thick smoke. The five surviving crewmembers jumped overboard. Two crewmembers swam to the stern, re-boarded the vessel, and found the access to the salon through the aft corridor was also blocked by fire, so, along with the captain who also had swum to the stern, they launched the vessel’s skiff and picked up the remaining two crewmembers in the water. The crew transferred to a recreational vessel anchored nearby where the captain continued to radio for help, while two crewmembers returned to the waters around the burning Conception to search for possible survivors. The Coast Guard and other first responder boats began arriving on scene at 0427. Despite firefighting and search and rescue efforts, the vessel burned to the waterline and sank just after daybreak, and no survivors were found. Thirty-three passengers and one crewmember died. The surviving crew were transported to shore, and two were treated for injuries. Loss of the vessel was estimated at $1.4 million. Probable Cause The National Transportation Safety Board determines that the probable cause of the accident on board the small passenger vessel Conception was the failure of Truth Aquatics, Inc., to provide effective oversight of its vessel and crewmember operations, including requirements to ensure that a roving patrol was maintained, which allowed a fire of unknown cause to grow, undetected, in the vicinity of the aft salon on the main deck. Contributing to the undetected growth of the fire was the lack of a United States Coast Guard regulatory requirement for smoke detection in all accommodation spaces. Contributing to the high loss of life were the inadequate emergency escape arrangements from the vessel’s bunkroom, as both exited into a compartment that was engulfed in fire, thereby preventing escape. Investigative Constraints The Office of the US Attorney is conducting a criminal investigation of this accident. The Assistant US Attorney assigned to the case requested the National Transportation Safety Board (NTSB) not interview the captain of the Conception out of concern that the interview could hinder the ability of their office to bring criminal charges against the captain. The NTSB obtained significant information from the other crewmembers; however, the Conception’s captain had many

NTSB Marine Accident Report vii years of experience on the same vessel, so the owner and surviving crewmembers referred many of investigators’ questions to the captain, which remain unanswered. The Office of the US Attorney also requested that NTSB investigators not interview the first galley hand, who was hospitalized at the time, or any Truth Aquatics employee responsible for operations. From September 8 to 10, 2019, the Office of the US Attorney served search warrants on the offices and two remaining vessels of Truth Aquatics; the NTSB was not invited to participate. The search warrants resulted in the seizure of thousands of pages of documents and records. Computers, security camera servers, and items such as fans, smoke detectors, and heat sensors from each vessel were also seized. Truth Aquatics was not able to provide records or information to NTSB investigators after the search warrants were executed. Scans of the seized documents and records were not provided to NTSB investigators until February 2020, and no electronic evidence recovered from computers and servers was included in the materials provided. These impediments delayed and complicated the NTSB’s investigation, but they did not affect its quality, as investigators used the factual information collected to complete an accurate, safety-focused investigation (see Appendix A for more details on the investigation). Safety Issues The safety issues identified in this accident, some of which have been identified in previous accidents involving passenger vessels, include the following: • Lack of small passenger vessel regulations requiring smoke detection in all accommodation spaces. In accordance with the fire safety regulations applicable to the Conception in Title 46 Code of Federal Regulations Subchapter T, the only compartment that was required to be fitted with smoke detectors was the passenger bunkroom, since it was the vessel’s only overnight accommodation space.1 The Conception was equipped with two modular smoke detectors in the bunkroom—one mounted on the overhead of each of the port and starboard aisles. The Conception had no smoke detectors anywhere in the main deck salon area where crewmembers reported seeing the fire. The nearest heat detector was well forward in the galley, a deck above the bunkroom, and was not intended to be utilized as a fire detector for the entire salon. Additionally, all detectors aboard the vessel only sounded locally. Although the Conception met the regulatory compliance for smoke detectors in the bunkroom where the passengers and crewmember slept, the fire above them in the salon would have been well developed before the smoke activated these detectors. • Lack of a roving patrol. NTSB investigators found that, prior to the accident, the Conception and other Truth Aquatics vessels were regularly operating in contravention of the regulations and the vessel’s Certificate of Inspection, which required a roving patrol at night and while passengers were in their bunks to guard against, and give alarm in case of, a fire, man overboard, or other dangerous situation. During the investigation, NTSB staff visited other dive boats operating from Southern California ports and harbors and spoke with their owners/operators. During informal discussions, all owners/operators stated that night patrols were assigned whenever passengers were aboard, but the procedures for the patrols varied greatly. When asked by investigators, Coast Guard inspectors stated that they

1 According to Title 46 Code of Federal Regulations 175.400, accommodation spaces include those spaces used as a public space, dining room or mess room, lounge or café; overnight accommodation space; or washroom or toilet space. On board the Conception, the accommodation spaces included the salon, bunkroom, and shower room.

NTSB Marine Accident Report viii could not verify compliance with the roving patrol requirement, since inspections were not conducted during overnight voyages with passengers embarked. • Small passenger vessel construction regulations for means of escape. The Conception was designed in accordance with the regulations in Subchapter T in force at the time of construction. As such, the vessel was required to have at least two emergency egress pathways from all areas accessible to passengers. The Conception had two means of escape from the bunkroom: spiral stairs forward and an escape hatch aft, accessible from either port or starboard aisles by climbing into one of the top aftermost inboard bunks. However, both paths led to the salon, which was filled with heavy smoke and fire, and the salon compartment was the only escape path to exterior (weather) decks. Therefore, because there was fire in the salon, the passengers were trapped, and the crew was not able to reach them. If regulations had required the escape hatch to exit to a space other than the salon, optimally directly to the weather deck, the passengers and crewmember in the bunkroom would have likely been able to escape. • Ineffective company oversight. During the investigation, the NTSB found several unsafe practices on company vessels, including a lack of crew training, emergency drills, and the roving patrol. In reviewing the company’s policies and procedures, along with the Coast Guard regulations, it is clear that Truth Aquatics had been deviating from required safe practices for some time. If the company had been actively involved in ensuring the safe practices required by regulations were enforced, most notably the requirement for a roving patrol, it is likely this accident would have not happened. Had a safety management system been in place at Truth Aquatics, it would have likely included procedures for roving patrols that complied with regulations and a company-involved audit process for identifying and correcting when non-conformities with the patrol requirements existed. Findings 1. Weather and sea conditions were not factors in the accident. 2. The use of alcohol or other tested-for drugs by the Conception deck crew was not a factor in the accident. 3. The origin of the fire on the Conception was likely inside the aft portion of the salon. 4. Although a definitive ignition source cannot be determined, the most likely ignition sources include the electrical distribution system of the vessel, unattended batteries being charged, improperly discarded smoking materials, or another undetermined ignition source. 5. The exact timing of the ignition cannot be determined. 6. Most of the victims were awake but could not escape the bunkroom before all were overcome by smoke inhalation. 7. The fire in the salon on the main deck would have been well developed before the smoke activated the smoke detectors in the bunkroom. 8. Although the arrangement of detectors aboard the Conception met regulatory requirements, the lack of smoke detectors in the salon delayed detection and allowed for the growth of the fire, precluded firefighting and evacuation efforts, and directly led to the high number of fatalities in the accident.

NTSB Marine Accident Report ix 9. Interconnected smoke detectors in all accommodation spaces on Subchapter T and Subchapter K vessels would increase the chance that fires will be detected early enough to allow for successful firefighting and the evacuation of passengers and crew.

1. The absence of the required roving patrol on the Conception delayed detection and allowed

for the growth of the fire, precluded firefighting and evacuation efforts, and directly led to the high number of fatalities in the accident.

1. The US Coast Guard does not have an effective means of verifying compliance with roving

patrol requirements for small passenger vessels.

1. The Conception bunkroom’s emergency escape arrangements were inadequate because both

means of escape led to the same space, which was obstructed by a well-developed fire.

1. Subchapter T regulations (Old and New) are not adequate because they allow for primary

and secondary means of escape to exit into the same space, which could result in those paths being blocked by a single hazard.

1. Although designed in accordance with the applicable regulations, the effectiveness of the

Conception’s bunkroom escape hatch as a means of escape was diminished by the location of bunks immediately under the hatch.

1. The emergency response by the Coast Guard and municipal responders to the accident was

appropriate but was unable to prevent the loss of life given the rapid growth of the fire at the time of detection and location of the Conception.

1. Truth Aquatics provided ineffective oversight of its vessels’ operations, which jeopardized

the safety of crewmembers and passengers.

1. Had a safety management system been implemented, Truth Aquatics could have identified

unsafe practices and fire risks on the Conception and taken corrective action before the accident occurred.

1. Implementing safety management systems on all domestic passenger vessels would further

enhance operators’ ability to achieve a higher standard of safety. Recommendations New Recommendations As a result of its investigation of this accident, the NTSB makes the following ten new safety recommendations: To the US Coast Guard Revise Title 46 Code of Federal Regulations Subchapter T to require that newly constructed vessels with overnight accommodations have smoke detectors in all accommodation spaces. (M-20-14) Revise Title 46 Code of Federal Regulations Subchapter T to require that all vessels with overnight accommodations currently in service, including those constructed prior to 1996, have smoke detectors in all accommodation spaces. (M-20-15) Revise Title 46 Code of Federal Regulations Subchapter T and Subchapter K to require all vessels with overnight accommodations, including vessels constructed

NTSB Marine Accident Report x prior to 1996, have interconnected smoke detectors, such that when one detector alarms, the remaining detectors also alarm. (M-20-16) Develop and implement an inspection procedure to verify that small passenger vessel owners, operators, and charterers are conducting roving patrols as required by Title 46 Code of Federal Regulations Subchapter T. (M-20-17) Revise Title 46 Code of Federal Regulations Subchapter T to require newly constructed small passenger vessels with overnight accommodations to provide a secondary means of escape into a different space than the primary exit so that a single fire should not affect both escape paths. (M-20-18) Revise Title 46 Code of Federal Regulations Subchapter T to require all small passenger vessels with overnight accommodations, including those constructed prior to 1996, to provide a secondary means of escape into a different space than the primary exit so that a single fire should not affect both escape paths. (M-20-19) Review the suitability of Title 46 Code of Federal Regulations Subchapter T regulations regarding means of escape to ensure there are no obstructions to egress on small passenger vessels constructed prior to 1996 and modify regulations accordingly. (M-20-20) To the Passenger Vessel Association, Sportfishing Association of California, and National Association of Charterboat Operators Until the US Coast Guard requires all passenger vessels with overnight accommodations, including vessels constructed prior to 1996, to have smoke detectors in all accommodation spaces, share the circumstances of the Conception accident with your members and encourage your members to voluntarily install interconnected smoke and fire detectors in all accommodation spaces such that when one detector alarms, the remaining detectors also alarm. (M-20-21) Until the US Coast Guard requires small passenger vessels with overnight accommodations to provide a secondary means of escape into a different space than the primary exit, share the circumstances of the Conception accident with your members and encourage your members to voluntarily do so. (M-20-22) To Truth Aquatics, Inc. Implement a safety management system for your fleet to improve safety practices and minimize risk. (M-20-23)

NTSB Marine Accident Report xi Recommendation Reiterated in this Report As a result of its investigation of this accident, the NTSB reiterates Safety Recommendation M-12-3, which is currently classified as “Open—Unacceptable Response”: To the US Coast Guard Require all operators of U.S.-flag passenger vessels to implement SMS, taking into account the characteristics, methods of operation, and nature of service of these vessels, and, with respect to ferries, the sizes of the ferry systems within which the vessels operate. (M-12-3)

NTSB Marine Accident Report 1 1 Factual Information 1.1 Background

Figure 1. Preaccident photograph of the Conception. (Source: www.seawayboats.net) Owned by the Fritzler Family Trust and operated by Truth Aquatics, Inc. (hereafter referred to as Truth Aquatics), the 75-foot-long small passenger vessel Conception was constructed in 1981 by Seaway Boats, Inc, in Long Beach, California. The dive vessel was purpose-built to take recreational divers on one-day and overnight trips to dive sites around the Channel Islands. The Conception was constructed of fiberglass laid over plywood and had three decks: the upper deck, main deck, and below deck. Vessel particulars of the Conception were as follows: Length: 75 feet Beam: 26 feet Draft: 4 feet Tonnage: 97 gross register tons Crew: 6 Passenger capacity: 99 (or 46 overnight passengers) Engine: Two 550-horsepower (hp), 2-stroke, turbo-charged, 92 series, V8 Detroit Diesel engines

NTSB Marine Accident Report 2

Figure 2. Port side of the Conception's salon looking aft. (Source: M. Ryan) The Conception’s main deck ran the full length of the vessel, with exterior (open) decks and an enclosed salon and galley.2 The salon had food service counters along the centerline and fixed dining tables on either side. Installed benches along the port and starboard bulkheads provided seating outboard of the tables, and plastic (outdoor-type) chairs provided seating inboard of the tables. The galley was forward of the seating area. The center window of three windows on the forward bulkhead of the galley could be opened from the inside by turning a hand screw and pushing the window outward at the bottom, since it was hinged at the top. On the forward starboard side of the salon, two sets of spiral stairways led down below to a shower room (forward) and a bunkroom (aft). Doors at the aft end of the salon opened to a large, open aft deck. According to the owner, the doors were always kept open when passengers were on board. There were no other doors to the exterior from the salon.

2 During interviews, the crew of the Conception referred to the entire salon and galley space as the “galley.” For clarity, this report will refer to the full space as the “salon,” unless specifically referring to the food preparation area.

NTSB Marine Accident Report 3

Figure 3. Conception simple plan and profile views.

NTSB Marine Accident Report 4 Three small restrooms, each with a single toilet and a small sink, were located just aft of the salon. Aft of the portside restroom door, a sign posted on the bulkhead identified the location as the muster area. Exterior walkways on either side of the salon and restrooms extended from the bow to the aft open deck. Fire hose stations were located on both port and starboard walkways adjacent to the restrooms (see figure 30 for the location of all firefighting equipment and lifesaving appliances). The open deck aft of the salon had a raised platform centerline with racks on either side for storing scuba tanks and other gear. The raised platform also contained hatches for accessing the engine room (forward) and lazarette (aft).3 On the stern of the vessel, a large swim platform accessible by stairs from the open deck was raised and lowered using an electrically powered hydraulic winch. When in the raised position, the metal swim platform served as a cradle for a small outboard-powered inflatable skiff.

Figure 4. Aft main deck of the Conception during a previous voyage. (Source: Profundo no Mundo, YouTube, annotated by NTSB) Below the main deck, the vessel was divided into four compartments. The forwardmost space was an anchor room that was accessible via a small hatch on the forward weather deck. The shower room was aft of the anchor room, followed by the bunkroom. The bunkroom contained 33 bunks, arranged around 2 aisles, with bunks on either side of each aisle (figure 5). Twelve double bunks, which allowed two people to sleep in the same bunk, were stacked two-high and located on the outside of the aisles. One additional double bunk was located underneath the forward stairway on the starboard side. The remaining 20 bunks were single bunks, with 4 sets of bunks

3 A vessel’s lazarette is its aftermost compartment below the main deck, typically accessed by a deck hatch.

NTSB Marine Accident Report 5 stacked three-high arranged along the centerline, and 2 sets arranged athwartship (across the ship from side to side) along the aft bulkhead. A two-high set of single bunks was located along the forward bulkhead on the port side (the upper bunk was reserved for a crewmember). The maximum occupancy of the bunkroom was 46 persons. Each of the bunks had a privacy curtain that could be pulled fully across the aisle-accessible side of the bunks.

Figure 5. Conception bunkroom arrangement, with escape hatch location added by NTSB. (Source: Truth Aquatics; annotated by NTSB) An escape hatch provided an alternate means of exiting the bunkroom (the stairway at the forward end was the primary means). The escape hatch, which consisted of a removable wooden panel that was about 22 inches by 22 inches in size, was located in the overhead between the aftmost centerline bunks.4 It could be reached from either aisle by climbing a wooden ladder installed on the side of each centerline aft set of bunks. The hatch exited into the aft end of the

4 The measurements for the escape hatch are from Truth Aquatics’ similar vessel, the Vision, which was built from the design of the Conception. There was no difference in the design of the escape hatch between both vessels.

NTSB Marine Accident Report 6 salon, and thus both escape routes from the bunkroom exited into the salon. The upper bunks nearest the emergency escape hatch had passengers assigned to them during the accident voyage.

Figure 6. Photo left is the escape hatch, viewed from the bunkroom, on the Vision, a Truth Aquatics dive vessel with arrangements nearly the same as the Conception. (Source: NTSB) Photo right, taken during a previous voyage, shows the escape hatch, viewed from aft in the salon, on the Conception. (Source: J. Palmer, annotated by NTSB) A watertight bulkhead divided the bunkroom from the engine room, which contained the vessel’s two main propulsion engines and a single electrical generator. Fuel tanks that supplied the engines and generator were located forward in the engine room, outboard of each of the main propulsion engines. The generator was located aft of the port main propulsion engine. Two air compressors used for filling scuba diving tanks were mounted aft of the starboard main propulsion engine. A 40-gallon, 220-volt electric hot water heater was located in the engine room forward of the starboard main engine. The lazarette was the aftmost space below the main deck and contained the steering gear for two rudders, a refrigerator/freezer for storing seafood caught during dives, a clothes dryer, and a generator/compressor for enriched-oxygen air—commonly referred to as nitrox—used in diving.5 The generator produced nitrox on demand and did not store the compressed gas within the system. (Compressed air and nitrox were stored only in scuba tanks brought on board by

5 Nitrox, with respect to underwater diving, is an air mixture composed of nitrogen and an elevated percentage of oxygen (when compared to atmospheric air). It is created by passing compressed air through a semi-permeable membrane, which removes a portion of nitrogen, thus increasing the amount by volume of oxygen in the resultant air mixture. Typical oxygen percentages used in recreational diving are 32 and 36 percent by volume. Using nitrox- enriched oxygen air while diving is advantageous because the diver is exposed to less nitrogen and its negative effects. Divers aboard the Conception paid an extra fee in order to be supplied with nitrox.

NTSB Marine Accident Report 7 passengers and secured in the outer main deck racks.) In addition to the mechanical equipment, wet suits were dried and stored in the lazarette. On the upper deck, the Conception’s wheelhouse sat atop the forward end of the salon. In addition to controls for the engines and rudders, the wheelhouse contained radar and depth sounder displays, global positioning system (GPS) receivers, a very high frequency (VHF) radio, and an electronic charting system. Two crew bunks with privacy curtains were installed at the back of the wheelhouse. A short passageway led aft from the wheelhouse to a door out to the sun deck. Two small crew staterooms were located on either side of the passageway; the portside room contained two crew bunks, and the starboard side room held a single bunk. A small shower room on the starboard side aft was also accessed from the passageway. The sun deck contained benches and large boxes for storing the vessel’s lifejackets and life floats, and there were two additional life floats on top of the wheelhouse.6 A single staircase on the starboard side of the sun deck, aft, provided access between the main deck and the sun deck. 1.2 Accident Narrative The Conception had been chartered by Worldwide Diving Adventures, Inc., a scuba diving tour, instruction, and guide company, to take a group of 33 passengers on a 3-day dive trip to locations around the Channel Islands, California, over the 2019 Labor Day weekend. The voyage was scheduled to get under way from Santa Barbara, California, at 0400 on Saturday, August 31, and return by 1700 on Monday, September 2. Truth Aquatics encouraged customers to board the vessel the night before early morning departures, and passengers for the accident voyage began arriving in the evening on August 30, embarking via the main deck. Per Truth Aquatics’ website and the company’s General Information Handbook, passengers were instructed to sign a posted manifest upon boarding, store their gear, and then proceed to their bunks below deck.7 On the accident voyage, all bunks had assigned occupants, except for numbers 7U, 9L, 24U, and 26L (these were the upper and lower bunks of the three-high single bunks running athwartships on the aft bulkhead). Four of the ten double bunks were occupied with two passengers; the remaining double bunks had a single occupant. A Conception deckhand told investigators that passengers on the accident voyage kept to the posted sleeping arrangements. According to the deckhand, luggage was stowed below some of the bunks and above them, in a designated area, and the aisles between the bunks were clear of luggage at all times. Some passengers kept personal items and effects, such as purses and backpacks, with them in their bunk spaces. The second captain (mate) was the first of the vessel’s six crewmembers to arrive at the Conception, embarking sometime between 2200 and 2300.8 The first and second galley hands were next to arrive, boarding separately between 2300 and midnight. They each told investigators that after boarding, they went to their bunks on the upper deck and went to sleep. The first deckhand stated that he and the second deckhand arrived at the vessel at 0320 the next morning, and, according to crewmembers interviewed after the accident, the captain boarded about 10 minutes

6 Life floats are buoyant primary lifesaving devices designed to support a number of persons partially immersed in the water, unlike life rafts that keep people completely out of the water. 7 According to crewmembers, passenger bunks were generally assigned by the charterer. 8 The vessel was required to have a credentialed master and mate, although there is no mate’s credential for vessels of this size. “Second captain” was the term used by Truth Aquatics and the Conception crew in lieu of mate.

NTSB Marine Accident Report 8 later.9 Once on board, the deck crew began conducting pre-underway checks of the vessel’s equipment. The generator was then started and shore power removed, a visual inspection of the bilges was performed, and the main engines were started and tested. The deckhands cast off lines, and, according to the vessel’s automatic identification system (AIS), the Conception was under way at 0404 outbound from Santa Barbara Harbor.10 The captain took the helm for the outbound voyage, while the rest of the crew went to sleep until about 0600. During Truth Aquatics’ dive trips, the destinations were at the discretion of the captain and based on weather conditions and the charterer’s preferences. For this voyage, the captain of the Conception chose to head toward Santa Cruz Island, which provided dive sites that were protected from moderate-to-high winds in the area. The vessel transited to the south side of the island and anchored at a dive site near Albert Anchorage at 0830 that morning. Once anchored, the passengers gathered in the salon to eat breakfast and listen to a safety brief.

Figure 7. Conception accident voyage reconstructed from AIS data, with selected diving and anchoring sites at Santa Cruz Island. (Background source: Google Earth) The standard safety brief included information on the lifejackets and other lifesaving equipment, escape routes from the passenger bunkroom and salon, the location for mustering in the event of an emergency, and dive safety information. During the accident voyage, the safety briefing, which was being conducted by the first deckhand, was interrupted when a passenger

9 The agency’s investigation of this accident was conducted in parallel with the Office of the US Attorney’s ongoing criminal investigation. The criminal investigation resulted in the NTSB having limited access to key personnel of Truth Aquatics working at the time of the accident, including the captain of the Conception, the first galley hand, or any employee responsible for operations. While on scene, investigators interviewed the remaining surviving Conception crewmembers; the owner of Truth Aquatics, former Truth Aquatics crewmembers, passengers, contractors, and service providers; and several first responders. See Appendix A for more details regarding the investigation. 10 AIS is a maritime navigation safety communications system. At 2- to 12‑second intervals on a moving vessel, the AIS automatically transmits vessel information, including the vessel’s name, type, position, course, speed, navigational status, and other safety‑related information, to appropriately equipped shore stations, other vessels, and aircraft. The rate at which the AIS information is updated depends on vessel speed and whether the vessel is changing course. AIS also automatically receives information from similarly equipped vessels.

NTSB Marine Accident Report 9 fainted. After the passenger was revived and his vital signs checked, the remainder of the safety brief was conducted by the captain, who, according to the deckhand, provided “an abridged version” of the dive safety section of the brief. Over the next two days, the Conception transited between sites around Santa Cruz Island, anchoring at each location to allow the passengers to dive. The vessel spent the first night anchored at Smugglers Cove on the eastern side of the island. The next day, Sunday, September 1, the vessel transited to various dive sites on the north side of the island. Between 2030 and 2130, seventeen divers conducted a night dive at a location known as Quail Rock on the northwest side of the island. While the divers were in the water, the second galley hand opened the electrical circuit breakers for the galley burners and griddle. (He told investigators that this had been the normal practice each night, ever since a burner had been left on inadvertently on a previous voyage.) He also closed the circuit breakers for the air conditioning unit to allow the bunkroom to cool before the passengers went to sleep. Once the divers were back on board, the flashlights and cameras that they used during the dive were stowed on the two aft tables in the salon. During interviews, crewmembers stated that some of these electronics, along with cell phones and tablets, were plugged in to recharge via 110-volt alternating current (AC) receptacle outlets located between the bench seat padding and on the aft bulkhead (figure 8). Crewmembers remembered seeing at least one passenger- owned power strip being used to recharge the electronics. After the night dive, the Conception relocated to Platts Harbor, a natural, semi-protected anchorage to the east of Quail Rock, to anchor for the night. The second captain remembered seeing a large sportfishing boat (later identified as the Grape Escape) in the anchorage when the dive boat arrived about 2300. According to the second captain, the crew conducted a walkthrough of the main deck to check for trip hazards and to stow loose gear. The doors to the salon remained open, as they always were when passengers were on board. Sometime before midnight, each of the crewmembers went to bed: the second deckhand slept in the passenger bunkroom, and the other crewmembers slept in berths on the upper deck. Crewmembers reported that a few passengers were still awake when they left the salon to head to their berthing. There were no crewmembers assigned to monitor the position of the Conception while it rode at anchor (according to the second captain, there was an alarm in vessel’s wheelhouse to notify the crew if the anchor was dragging). Figure 8. Photo taken during accident voyage (August 31, 2019) of devices plugged in to charge at the port side aft corner of the salon on the Conception. (Source: J. Dignam).

NTSB Marine Accident Report 10 According to the second galley hand, he woke up about 0130 on Monday, and, as was his usual practice when he awoke in the middle of the night, he went down to the galley to collect and wash any used coffee cups and other dishes and to conduct general cleaning. He told investigators that there were no passengers or crew awake or in the salon at the time he was working in the galley. After cleaning up, he used one of the restrooms on the aft main deck and went to his bunk on the upper deck to go back to sleep. He stated that as he came out of the restroom, he looked up at a wall clock and noted that it was 0235. Sometime later, the second galley hand was awoken by the sound of what he thought was a plastic chair sliding on the salon deck. He stated that then he heard a noise that “sounded like someone fell.” He considered getting up, concerned that a person might be injured, but then heard what he thought to be the sound of the restroom door shutting. He continued to lay in his bunk, and next heard what he thought was a person yelling, “ahhh!” The second galley hand got out of his bunk to go check on the person and, looking out through the door to the sun deck, saw a yellow glow emanating from the main deck below the aft starboard side of the sun deck. Realizing what he was seeing, the second galley hand turned around and yelled “fire! fire!” to wake up the four other crewmembers sleeping on the upper deck. The first galley hand told investigators that he had heard “a pop, and then a crackle downstairs.” He then heard the second galley hand jump down from his bunk, and shortly thereafter yell, “fire!” After warning the crew, the second galley hand ran to the staircase at the aft end of the sun deck to attempt to get down to the main deck. He stated that when he reached the staircase and looked down, the restroom at the bottom of the staircase was on fire, and flames blocked the way down. He returned to the upper deck stateroom area, told the other crewmembers that the way was blocked, and then proceeded to the port side of the sun deck. There, he climbed over the railing and lowered himself down onto the main deck. The second galley hand stated that he ran back to the open deck, intending to enter the salon through the open rear doors to retrieve fire extinguishers. However, he could not get into the salon because the entire entryway was on fire. He told investigators that the area where the bunkroom escape hatch was located was engulfed in flames and was not visible, and the fiberglass on the ceiling of the entryway to the salon was melting and dripping down. He said that he ran aft toward the stern, but, realizing there was nothing that he could do there, he turned around again. The second captain and first deckhand slept in the bunks in the wheelhouse, and when awakened by the second galley hand, they had both proceeded aft toward the door to the sun deck and saw the flames on the aft starboard side. They were met at the door by the second galley hand, who told them that the staircase to the main deck was blocked. Returning to the wheelhouse, the second captain and the first deckhand were instructed by the captain to lower themselves to the main deck via the wheelhouse wing stations. In a statement to investigators, the captain wrote that he opened the wing station doors on either side of the wheelhouse. The second captain exited through the wing station door on the port side and lowered himself down to the main deck. From there, he looked to go aft, but he said that the exterior passageway was blocked by smoke and flames emanating from the salon windows. He stated that he proceeded forward and opened the bow gate on the port side, reasoning that if passengers could escape the bunkroom and get to the main deck bow, they would be able to more easily evacuate through the open gate.

NTSB Marine Accident Report 11 From the aft deck, the second galley hand saw a crewmember lowering himself down to the main deck, so he ran forward through the smoke along the port exterior passageway. About the same time, the first galley hand was attempting to jump down to the main deck from the port wheelhouse wing station. The first galley hand told investigators that he misjudged the distance to the deck and landed with all his weight on his left leg, breaking his leg as he hit the deck. He landed in front of the second galley hand, who leapt over him and continued forward to the bow. The first deckhand had also exited the wheelhouse via the port wing station. Once on the main deck, he looked aft and saw that the port exterior passageway was blocked by smoke and flames coming out of the salon windows and wrapping around the sun deck above. He proceeded to the bow and tried to open the center window on the forward bulkhead of the salon, which looked into the galley area, in an attempt to reach the passengers. The center window was the only window on the front of the salon that was designed to open, but it was secured from the inside by threaded knobs (it was not a designated emergency exit). The deckhand, aided by the second galley hand, struggled to pry the window open, but could not. The two crewmembers told investigators that the window was warm, but not hot, and when they looked through the window, the view was completely obscured by thick, black smoke.

Figure 9. Preaccident photo of Conception forward salon windows. In this photo, the center window is open. However, during the accident, the window was closed and secured as the crew attempted to access the space. The port and starboard windows were not designed to be opened. (Source: T. Thompson) During this time, the captain was in the wheelhouse making a distress call over VHF radio. At 0314, he transmitted, “Mayday, Mayday, Mayday. Conception, Platts Harbor, north side Santa Cruz.” When Coast Guard Sector Los Angeles/Long Beach watchstanders responded to the distress call, the captain transmitted, “39 P-O-B. I can’t breathe. 39 P-O-B. Platts.” The smoke filling the wheelhouse then forced the captain out of the space, and he jumped into the water from the starboard side wheelhouse wing station. As the first deckhand continued to try to open the forward salon window, he remembered a fire axe mounted in the wheelhouse. He looked up to the wheelhouse and was about to yell to the captain to get the axe when he and the second captain saw the captain leap into the water. As the captain jumped, smoke followed him down to the water. Both the first deckhand and the second captain believed the captain was on fire as he jumped. Consequently, the second captain dove into the water on the starboard side to attend to the captain.

NTSB Marine Accident Report 12 Attempting to find another way to reach passengers, the first deckhand opened the anchor locker hatch on the bow. Looking inside, he saw that there was no access aft to the shower room and bunkroom below, and there was no smoke in the space at the time. He then checked the port and starboard exterior passageways, and both were blocked by smoke and flames. According to the first deckhand, the captain then told the remaining three crew on the bow to jump into the water. The first galley hand was in a great deal of pain due to his broken leg, but he eventually entered the water through the port bow gate. The second galley hand and the first deckhand also entered the water. The first and second galley hand then swam away from the vessel, while the first deckhand swam toward the stern. After finding that the captain was unharmed, the second captain swam to the stern and re- boarded the Conception via the vessel’s swim platform, which was in the raised position with the inflatable skiff stowed on it. He proceeded up onto the open main deck and toward the salon, where he found that the entire deckhouse was being consumed by fire. He said that he “could see the aft escape was fully engulfed in flames.” He stated that he opened the engine room hatch but was blocked from entering by black smoke, though he did not see flames. The second captain’s next thought was to launch the skiff so that the crew could pick up any survivors that had made it off the Conception. He stated that as he proceeded aft, he noted that the lights were still on in the lazarette (the hatch was normally left open), so he knew that the vessel still had electrical power. He energized the hydraulic pump for the winch that raised and lowered the swim platform and prepared to lower the skiff into the water. By this time, the first deckhand had also climbed up on the stern of the Conception, and he assisted the second captain in launching the skiff. Once the boat was in the water, the second captain assisted the captain, who had swum to the stern of the Conception, into the boat. Meanwhile, the first deckhand went up onto the back deck of the dive boat to once again look for a way to help any passengers. The fire had continued to consume the vessel, and he found no way to get into the salon or to the bunkroom below. The fire also prevented the deckhand from accessing the fire hose and the fire pump remote start control, which were located on the port side of the vessel. He next attempted to reach the fire pump in the engine room but was prevented from entering the space due to smoke at the hatchway. (He also reported seeing no flames in the engine room.) The captain yelled at him to get in the skiff, so he went aft and boarded the small boat. After the three crewmembers got the engine on the skiff running, they drove to where the two galley hands had swum away from the Conception and helped both into the boat. The first deckhand then took the controls and drove the skiff over to the anchored sportfishing boat Grape Escape. When they arrived at the vessel, the crewmembers yelled and banged on the hull and back door to the salon until the Grape Escape’s owners were awakened. The Grape Escape owners described their first sight of the Conception as “completely on fire from one end to the other. It was already completely engulfed. There wasn’t a spot on that boat Figure 10. Cell phone photo of Conception on fire, taken from sportfishing boat Grape Escape. (Source: S. Hansen)

NTSB Marine Accident Report 13 that wasn’t on fire.” One of the owners then took the captain and second captain up to the wheelhouse to make radio calls to the Coast Guard shortly before 0329, while the other owner assisted the remaining crewmembers. The first deckhand and second galley hand assisted the injured first galley hand onto the Grape Escape. 1.3 Search and Rescue The Coast Guard Sector Los Angeles/Long Beach Command Center (SCC), located in San Pedro, California, maintained command, control, and communications for Coast Guard operations in the area. The SCC received the Conception’s initial distress call by VHF radio at 0314:23. The SCC made repeated call-outs, which went unanswered after the crew abandoned the vessel. Using the VHF radio direction finder, the SCC was able to estimate the vessel’s position and issued an Urgent Marine Information Broadcast (UMIB) at 0322:54.11 Table 1. Initial VHF distress communications between the captain of the Conception and Coast Guard Sector Los Angeles/Long Beach. Time (PDT) Originator Message 03:14:23 Conception Mayday, mayday, mayday! Conception. Platts Harbor, north side Santa Cruz. Help. 03:14:34 Coast Guard Vessel under distress, this is Coast Guard Sector Los Angeles on Channel one-six. What is your position and number of persons on board? Over. 03:14:42 Conception [unintelligible] three-nine P-O-B. I can't breathe. Three-nine P-O-B. Platts. 03:14:54 Coast Guard Vessel in distress, Coast Guard Sector Los Angeles. Roger. You have 29 persons on board and you can't breathe. What is your current GPS position? Over. 03:15:20 Coast Guard Vessel in distress, Coast Guard Sector Los Angeles on Channel one-six. What is your GPS position? Over. 03:16:06 Coast Guard Vessel in distress, Coast Guard Sector Los Angeles on Channel one-six.

The SCC then telephoned Coast Guard Station Channel Islands Harbor at 0323 and requested that they proceed to the scene for a medical emergency, based on the Conception captain’s transmission of “I can’t breathe.”12 While the crew prepared to get under way, the Station’s Officer of the Day called the Ventura County Fire Department dispatch by radio to request support (at least one paramedic and advanced life support equipment) to get under way with them. At 0324, the SCC requested Coast Guard air assets located at Naval Base Ventura County (NBVC) Point Magu conduct search and rescue. The SCC also directed the Coast Guard cutter Narwhal, which was 5 hours away, about 6.5 miles southeast of Long Beach and already under way, to proceed to the accident location.13

11 An Urgent Marine Information Broadcast (UMIB) is a request for assistance from any available mariners. It is broadcasted on VHF Channel 16 and by Navigational Telex (NAVTEX). 12 Unless otherwise noted, “Station” in this report refers to Coast Guard Station Channel Islands Harbor. 13 USCGC Narwhal (WPB87335) was an 87-foot patrol boat homeported in Corona Del Mar, California.

NTSB Marine Accident Report 14

Figure 11. The accident site in relation to emergency response assets. The red triangle marks the site of the Conception fire. (Background: Google Maps) At 0329, the owner of the Grape Escape called the Coast Guard on VHF radio, stating “We have a Mayday. I have a commercial boat on fire. Santa Cruz Island.” This was the first notification to the Coast Guard that the nature of the distress was a fire. He gave the position of the vessel, and then the second captain got on the radio and reported to the Coast Guard that there were “33 souls” trapped in the bunkroom.14 The Conception captain took over the radio from the second captain and explained the situation in more detail to the SCC. The second captain and first deckhand next re-boarded the skiff to go search for survivors, while the two galley hands and the captain remained on the Grape Escape. The second captain stated that while the skiff circled the burning Conception, he and the first deckhand heard several “explosions.” The crew did not locate any survivors, and they returned to the Grape Escape. Later, at the SCC’s request, they made additional searches, also without success.

14 The SCC watchstander misheard the Conception captain say the passengers were “locked” below deck when they were actually “blocked” by fire. The second captain mistakenly omitted the missing crewmember in his initial report by radio, stating there were “33 souls” still aboard.

NTSB Marine Accident Report 15 Table 2. VHF communications between Coast Guard Sector Los Angeles/Long Beach and the Grape Escape. Time (PDT) Originator Message 03:29:30 Grape Escape Pan-Pan, Pan-Pan, Coast Guard, Coast Guard. 03:29:35 Coast Guard Vessel Conception, Coast Guard Sector Los Angeles on Channel one-six. Over. 03:29:39 Grape Escape This is a -- actually it's a mayday. I have a commercial boat on fire. It's on Santa Cruz Island at ah -- 03:29:57 Coast Guard Vessel hailing Coast Guard Sector Los Angeles, come back or say again your last. Couldn't understand it. Over. 03:30:05 Grape Escape We're at Platts Harbor on Santa Cruz Island. 03:30:12 Coast Guard Say again the harbor name. Over. 03:30:17 Grape Escape Platts Harbor. Platts Harbor. 03:30:20 Coast Guard Roger, Captain. What is the, what is the emergency? Over. 03:30:30 Coast Guard Vessel Conception, Coast Guard Los Angeles. What is the emergency? Over. 03:30:35 Grape Escape Hang on just a second. 03:30:40 Conception second captain on Grape Escape Hello. This is crew of Conception. Our boat is on fire. We are on a neighboring vessel. We have 33 souls on board down below trapped in the bunkroom. We cannot evacuate them off the vessel. 03:30:57 Coast Guard Vessel reporting a vessel on fire. Roger, Captain. Your vessel is on fire; is that correct? 03:31:07 Conception Second Captain The vessel's on fire, the vessel's name is Conception. 03:31:10 Coast Guard Roger. Are you on board the Conception? 03:31:13 Conception Second Captain We're on board a neighboring vessel. We abandoned ship. 03:31:19 Coast Guard Roger. And there's 33 people on board the vessel that's on fire; they can't get off? 03:31:24 Conception Second Captain That is correct. 03:31:27 Coast Guard Roger. Are they locked inside the boat? 03:31:32 Conception Second Captain That’s correct, sir. 03:31:37 Coast Guard Roger. Can you get back on board and unlock the boat or unlock the doors so they can get off? 03:31:43 Conception Second Captain Every escape path was on fire. 03:31:48 Coast Guard Roger. You don’t have any firefighting gear at all? No fire extinguishers or anything?

NTSB Marine Accident Report 16 Time (PDT) Originator Message 03:32:05 Conception Captain [The captain relieved the second captain on the radio.] Coast Guard Sector LA, we could not get to the bunkroom. The fire absorbed the wheelhouse and -- 03:32:26 Coast Guard Roger, that. Is this the captain of the Conception? 03:32:30 Conception Captain Yes. My name is [redacted]. I got one mayday out. Smoke, in the wheelhouse there was flames at the back door and the side door. We had to jump from the wheelhouse off the boat. 03:32:59 Coast Guard Roger. Was that all the crew that jumped off? 03:33:04 Conception Captain Five of the crew from the wheelhouse jumped out. One crew is down in the bunkroom. Thirty-four people still on board, okay? 03:33:22 Coast Guard Roger. Is the vessel fully engulfed right now? 03:33:26 Conception Captain To the deck. Fully engulfed to the deck. At 0335, the SCC broadcast another UMIB with the name and position of the vessel and indicating that the vessel was on fire. The crew at Coast Guard Station Channel Islands Harbor overheard the radio conversation between the Conception crew on board the Grape Escape and the SCC, and between 0342 and 0349, they launched two 45-foot response boats-medium (RB- Ms). At 0343, the Ventura County Fire Department (VCFD) Engine 53 company captain requested an additional engine company respond aboard Channel Islands Harbor Patrol Boat 15, a 32-foot fire boat jointly operated with the VCFD. Channel Islands Harbor Patrol overheard the Coast Guard radio traffic on both VHF and VCFD frequencies, retrieved the Conception’s AIS position from an online source, and immediately prepared its Boat 15 to respond once an engine company arrived. Boat 15 was under way with the crew of Engine 54 at 0404 (Ventura City Harbor Patrol’s fireboat, Boat 1, later got under way, with Engine 26, at 0448). Multiple additional agencies responded to the Coast Guard Channel Islands Station, where an Incident Command Post was set up at 0358.15 The first Coast Guard RB-M arrived on scene at 0427 after travelling 27 miles and crossing the channel through conditions of reduced visibility; they found the Conception completely engulfed in flames and began searching for survivors. The second Coast Guard RB-M, with VCFD Engine 53 embarked, arrived on scene immediately after and assumed the role of on-scene coordinator (OSC).16 Two firefighters (a paramedic and an emergency medical technician [EMT]) from the second RB-M boarded the Grape Escape to assess the injured Conception crewmembers, and then the boat began searching the area for any other survivors.

15 Agencies responding to Coast Guard Channel Islands Station included the VCFD, Channel Islands Harbor Patrol, Ventura County Sheriff’s Department, VCFD Public Affairs, Ventura County Coroner’s Office, Channel Islands Parks Service, and the owner of the Conception. 16 The on-scene coordinator is the designated vessel or aircraft assigned to coordinate the activities of all participating search units.

NTSB Marine Accident Report 17 Each RB-M was equipped with a P6 portable dewatering pump, which was the only equipment that could be used for firefighting.17 Since Boat 15 was en route with more pump capacity and the firefighting foam required to fight a fire of this size, the two RB-Ms searched for survivors in the water, deeming it a higher priority after concluding that there were likely no survivors in the wreck given the mass conflagration. A Coast Guard helicopter arrived on scene about the same time as the Coast Guard RB-Ms. When the paramedic and EMT from the RB-M had boarded the Grape Escape, they determined that the first galley hand needed to be evacuated. However, due to the risk of entanglement with the rescue litter and the Grape Escape’s rigging, the Engine 53 crew determined that it was safer to leave the injured crewmembers on the Grape Escape rather than transfer them to the helicopter. The two RB-Ms, the Conception skiff, other small boats, and Coast Guard helicopters continued to search the area and the shoreline for survivors and found none. Channel Islands Harbor Patrol Boat 15 arrived on scene at 0455, followed by Santa Barbara Harbor Patrol’s Boat 3, and commenced fire suppression efforts. Shortly after, at 0502, the Retriever II, a 30-foot, rigid-hull, inflatable boat owned by TowBoatUS Ventura, arrived on scene and began towing the burning wreck away from the shallow water with a grappling hook to a location where the fire boats could better reach it. The fire was first reported extinguished at 0508 but re-flashed several times in the area of the fuel tanks and on the bow. Burned-out through-hull penetrations—where the main engine exhausts had been—eventually submerged, and the vessel sank stern first at 0654, approximately 20 yards from shore, in 61 feet of water. First responders were not able to safely board the vessel before it sank. Underwater recovery divers later found the wreckage lying on the seafloor in an upside-down position.

Figure 12. Small passenger vessel Conception at sunrise prior to sinking. (Source: VCFD) The Grape Escape departed the accident site at 0516 to transport the surviving Conception crew to Coast Guard Station Channel Islands Harbor, arriving about 0735. The Conception captain

17 The CG-P6 gasoline motor-driven dewatering pump is used primarily for emergency dewatering of vessels. It has a rated output of 250 gallons per minute at a 12-foot suction lift. Under load, this pump will dewater for approximately 4–5 hours on the gasoline supplied with the kit.

NTSB Marine Accident Report 18 stayed on scene aboard one of the RB-Ms until it departed the scene at 0743 and returned to the Station. At 0804, the remains of four victims were recovered on the surface and transported to Santa Barbara Harbor, where they were transferred to the Santa Barbara County coroner’s office. Air and surface search and rescue efforts continued thereafter until suspended by the Sector Commander at 0938 on September 3. No equipment damage or first responder injuries were reported. Over nine days, divers from several local law enforcement agencies and the Federal Bureau of Investigation (FBI) dove on the wreck. They recovered all but one of the remaining victims, most of whom were found in the bunkroom or nearby on the seafloor. The last victim was recovered on the surface in shallow water along the shore, near the accident site, on September 11. Table 3. Summary of resources assigned in the initial response. Name/hull/tail number Type and affiliation Role Arrival time at scene CG 45643 Response Boat-Medium - Coast Guard Station Channel Islands Harbor First search and rescue unit on scene 0427 CG 6540 HH-65 helicopter - Coast Guard Air Station San Francisco (forward deployed to NBVC Point Mugu) Search and rescue, medical response, and first OSC 0432 CG 45739 Response Boat-Medium - Coast Guard Station Channel Islands Harbor with VCFD Engine 53 embarked Search and rescue, OSC 0432 Boat 15 Fire boat - Channel Islands Harbor Patrol and Ventura County Fire Department. Engine 54 embarked (also called Boat 5 by some witnesses and in AIS data) Fire suppression 0455 Retriever II Commercial towing vessel - TowBoatUS Ventura Harbor Towing support and victim recovery 0502 Boat 3 Patrol boat - Santa Barbara Harbor Patrol Fire suppression 0518

Boat 1 Patrol boat - Ventura City Harbor Patrol with VCFD Engine 26 embarked Ferried foam to the scene N/A - mechanical failure Narwhal (WPB 87335) Coast Guard Patrol Boat homeported in Corona del Mar Assumed OSC on arrival 0841 CG 6014 MH-60 helicopter - Coast Guard Air Station San Diego Search and rescue 0940 1.4 Injuries Of the 39 persons on board the Conception at the time of the accident, 33 were passengers, and 6 were crewmembers. Passenger ages ranged from 16 to 62 years, with a median age of 41 years old. There were 13 male and 20 female passengers (two were female minors under the age of 18 years); all 33 passengers perished in the fire. The second deckhand, a 26-year-old female, also perished in the fire.

NTSB Marine Accident Report 19 The first galley hand suffered a closed fracture of the left tibia. The second galley hand bruised his right foot when jumping from the top deck, only realizing that he was injured when he boarded the Grape Escape. Table 4. Injuries sustained in the Conception accident.18 Type of Injury Crew Passengers Total Fatal 1 33 34 Serious 1 0 1 Minor 1 0 1 None 3 0 3

The Santa Barbara Sheriff’s Office, Coroner’s Bureau conducted an examination of the victims recovered, and a coroner’s report was completed for each of the 34 victims. The Sheriff- Coroner conducted external examinations on each of the decedents but elected not to conduct internal examinations. The Santa Barbara Coroner’s Bureau stated more complete autopsies were not performed because the cause of death was easily determined by a body examination and toxicology tests and there were witnesses to the event. According to the coroner’s reports, the cause of death in every case was smoke inhalation. Additionally, in two cases, carbon monoxide was found to be contributory. 19 Carbon monoxide is a product of incomplete combustion and is a central nervous system depressant. Carbon monoxide also binds readily with hemoglobin and displaces oxygen in the blood. External examinations conducted by the Sheriff-Coroner, as confirmed by recovery divers’ video, documented 27 decedents as being fully or partially clothed. One female passenger was wearing a jacket, while another had plastic reading glasses entangled in her hair. The coroner reports also documented that 14 people were wearing some sort of footwear, including the second deckhand, who had sandals on both of her feet. Three other cadaver bags included footwear, though not worn at the time of arrival ashore, and one contained a backpack. One passenger had a hiking boot on one foot and a sandal the other, and a phone in his hand. None of the victims were found with any type of smart or dive computer watch, which could have provided a timeline of the victims’ activity as well as information regarding the victims’ vital signs. At least four phones were recovered with the victims and at least five in the wreckage, all with no visible signs of heat damage. These were taken into possession by the FBI for examination to recover any relevant information, such as pictures and video of the vessel or any attempt to place phone calls or send messages at the time of the fire. At the time of publication of this report,

18 The NTSB uses the International Civil Aviation Organization injury criteria in all of its accident reports, regardless of transportation mode. A serious injury is a non-fatal injury that requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; results in a fracture of any bone; causes severe hemorrhages, nerve, muscle, or tendon damage; involves any internal organ; or involves second- or third- degree burns, or any burn affecting more than 5 percent of the body surface. 19 Toxicology testing on the Conception victims indicated carbon monoxide saturation levels between 39 and 75 percent, with a median 62 percent. The highest levels were reported as greater than 75 percent. According to National Fire Protection Association guidance, carbon monoxide levels of 40 percent or higher indicate that victims “likely to have died from CO [carbon monoxide] alone or in combination with other factors…or may simply have been incapacitated sufficiently by CO poisoning to be unable the flee the fire.” National Fire Protection Association, NFPA 921 Guide for Fire and Explosion Investigation, 2017, Quincy, Massachusetts, 2016, page 263.

NTSB Marine Accident Report 20 one phone had been examined and the obtained information reviewed by the NTSB (see Appendix A for more details of the investigation). Cell phone records for the captain, first galley hand, and second deckhand were analyzed by the NTSB, and none of the cell phone records indicated any user-initiated activity during the time of or after the accident. 1.5 Vessel Information 1.5.1 Applicable Regulations Title 46 Code of Federal Regulations (CFR) Subchapter T governs the construction, outfitting, and operation of small passenger vessels, like the Conception, that are under 100 gross tons and carry 150 or fewer passengers or have overnight accommodations for 49 or fewer passengers. The current regulations under this subchapter were significantly updated in 1996, and vessels constructed after 1996 are required to comply with all of the current regulations. Vessels constructed before 1996 (known as “existing vessels”) are required to comply with portions of the current regulations, including those pertaining to inspections and certification, vessel control and other systems and equipment, and operations. For regulations relating to construction and arrangement, lifesaving equipment, some fire protection equipment, machinery installation, and electrical installation, vessels that existed prior to 1996 are subject to those portions of Subchapter T regulations that were in force at the time the vessel was built, with certain exceptions. When referring to the post-1996 regulations, Coast Guard inspectors use the term “New Subchapter T” or, more simply, “New T” regulations, and when referring to the pre-1996 regulations, they use the term “Old Subchapter T” or “Old T.” As a vessel built in 1981, the Conception was considered an existing vessel and therefore subject to portions of both the pre- and post-1996 regulations. In this report, “New T regulations (all vessels)” and “Old T regulations (existing vessels)” will be used to differentiate between the two sets of regulations as they applied to the accident vessel. 1.5.2 Main Engines and Propulsion The Conception was propelled by two 550-hp, 2-stroke, Detroit Diesel engines. The turbo-charged, 92 series, V-8 engines drew combustion air from the engine room, which was ventilated from ducting leading out to the main deck. The engines were bolted to Twin Disc MG- 514C Series marine transmissions that acted as both reduction and reversing gears. The transmissions coupled directly to 3-inch stainless steel shafts. The shafts exited the hull of the vessel through bronze compression packing glands and connected to two four-bladed propellers. The propellers, along with two stainless steel spaded rudders, provided maneuvering. An electric motor-driven hydraulic pump in the vessel’s engine room powered control valves and actuators attached to the rudder posts. At the time of the fire, the Conception was at anchor, and neither main engine was operating. 1.5.3 Electrical Generation and Distribution Generator. The Conception had a single Northern Lights MP55C generator package located in the aft port corner of the engine room. While the vessel was away from the dock, the generator package supplied the vessel with 120/208-volt, alternating current (AC), 3-phase electrical power. The generator package consisted of an 83-hp John Deere diesel engine prime

NTSB Marine Accident Report 21 mover, coupled to a Newage 55-kilowatt generator. At the time of the accident, the generator package was running and providing the vessel with electricity. The generator’s engine had been replaced with a new model in September 2018 due to wear. In the months prior to the accident, the new engine would reportedly overheat if put under high electrical demand. If the flat-top stove in the galley was being used at the same time that scuba tanks were being filled with nitrox, the generator’s engine would overheat and eventually shut down. As a result, a standard procedure was established for the deck crew to coordinate with the galley crew so that galley equipment was not operated while scuba tanks were being filled with nitrox.

Figure 13. The salvaged hull of the Conception, looking from aft to forward, with recovered engine room and lazarette equipment placed in their original installed location (with the exception of the water heater, which was located on the starboard side). Electrical Distribution. The vessel’s grounded, 3-phase AC electrical distribution system consisted of a neutral lead and three conductors. While the vessel was docked, a shoreside power connection could be used in lieu of the generator to provide the vessel with single-phase power. Thermal circuit breakers provided overcurrent protection. Original vessel electrical schematics indicated that the rating for these breakers varied with application. For the larger 3-phase, 208-volt equipment, each phase was protected with either a 30- or 60-amp breaker. The smaller 120-volt, single-phase equipment and lighting was protected by 15- and 20-amp breakers. Original wiring schematics showed that the Conception had both 12-volt and 24-volt direct current (DC) voltage systems. The wheelhouse had a 12-volt battery system that was set up to be trickle-charged from the vessel’s service 120-volt AC system. The battery and charger were located

NTSB Marine Accident Report 22 under the console in the wheelhouse. The plans indicated that the 12-volt system was set up to power navigation lights, radio equipment, and selected lighting in the engine room, lazarette, bunkroom, anchor room, and restrooms. The propulsion engines’ starters and shifting actuators operated on 24 volts, while the propulsion engines’ controls and the vessel’s diesel generator starter and control systems operated on 12 volts. The batteries used for both main engines and generator set were located on the forward workbench in the engine room. Battery chargers were set up for respective voltages and located on the forward bulkhead. Aboard the Conception, normal charging of the main engine batteries was accomplished via the ship’s service 120-volt system. The main engines’ attached alternators had their drive belts manually removed and were only used in a stand- by capacity. In contrast, the generator set’s alternator was used and charged its batteries while the generator was running. In August of 2000, Coast Guard inspectors issued a deficiency for the vessel having non-approved wiring in some of its AC electrical system. The Conception was required by Old T (existing vessel) regulations to use stranded or braided conductor core wire. Instead, the wiring being used was flexible “service” wire, commonly referred to in industry as SO, SJO, or STO wiring. It was similar in type to that used in commercially sold extension cords. Both Old T and New T regulations prohibited the use of this wire in the way it was being used aboard the Conception. This wiring had been installed by the boat builder and approved by Coast Guard inspectors in 1981 during the original construction of the vessel. Truth Aquatics appealed the Coast Guard’s decision and requested a waiver to the Coast Guard’s requirements but was denied. In 2002, all non-approved wiring was replaced with approved wiring, and, following a Coast Guard inspection, the vessel was deemed to be in compliance and the deficiency cleared. Emergency Lighting. The Conception had emergency lighting in the bunkroom. It was mounted near the main stairs going up to the galley/salon at the top of the forward bulkhead of the bunkroom, and was designed to automatically activate, in the event of the loss of the vessel’s service supply power, to provide lighting along the escape path to the main deck from accommodation spaces below. The emergency lighting was powered from the ship’s service 120-volt AC system, and if this source was lost, batteries internal to the unit would supply power for lighting. Replacement of Electrical Components. Throughout the 39-year operation of the Conception, many electrical components had been changed with “replacement in kind” alternatives, such as circuit breakers and receptacle Figure 14. Bunkroom emergency lighting on board the similar vessel Vision. The lighting was of the same make and in a similar location as was on board the Conception. Also note the public address system speaker to the right of the lights.

NTSB Marine Accident Report 23 outlets.20 Subpart G of New T regulations (all vessels) specifies that if a repair or alteration is not a replacement in kind, the owner or managing operator must submit to the local Coast Guard unit drawings, sketches, or written specifications describing the details of the proposed alteration. The Coast Guard would then initiate a plan review to determine if the repair or alteration was safe and within regulations. Most reviews are handled locally at the Coast Guard sector or detachment level. If the repair or alteration is deemed “major” by the Officer in Charge, Marine Inspection (OCMI) at the sector, then the plan review is elevated to the Coast Guard’s Marine Safety Center in Washington, D.C. At the Marine Safety Center, professional engineers, naval architects, and/or subject matter experts conduct the plan review and issue recommendations, interpretations, or guidance to the respective OCMI. Crewmembers reported to investigators that in the weeks prior to the accident, two of the vessel’s deckhands changed out the overhead florescent lighting fixtures in the salon with new LED light fixtures. Plans detailing the modification were not submitted to the local Coast Guard Marine Safety Detachment (MSD), and the Coast Guard was not notified of this change. Truth Aquatics last submitted plans for review in 2000 for the installation of a galley hood heat detection sensor, which was required by New T regulations (all vessels). The plans were approved by the OCMI at Coast Guard Sector Los Angeles/Long Beach. 1.5.4 Air Conditioning System and Ventilation The heating, ventilation, and air conditioning system on board the Conception consisted of a combination of supply and exhaust fans, natural ventilation, and an air conditioner in the bunkroom. According to a former crewmember, the only heater on board was a small plug-in space heater located in the wheelhouse. The crewmember stated that this heater was used occasionally during the winter months but usually was not used during the summer season. The engine room used both natural ventilation and two forced-draft fans to supply air for cooling and engine combustion consumption. Outside supply air was ducted into the engine room from openings on the aft main deck. In the event of an engine room fire, these ducts could be closed manually by dampers, with the shutoffs located on the main deck port- and starboard-side across from

20 According to 46 CFR 136, replacement in kind refers to the “replacement of equipment or components that have the same technical specifications as the original item and provide the same service. If the replacement item upgrades the system in any way, the change is not replacement in kind.” Figure 15. The starboard-side main deck of Conception, looking aft from forward of the galley. Arrows indicate the location of the bunkroom ventilation intake and exhaust ducts. Note the sliding windows. (Source: R. White)

NTSB Marine Accident Report 24 the engine room hatch. On the night of the fire, the ducting in the engine room was not closed by the crew. Another ventilation fan was positioned in the bulkhead that connected the engine room to the lazarette. The fan could be run to supply additional air to the engine room (pulled through the lazarette), or in reverse to supply warm engine room air exhausting to the lazarette, where scuba diving suits were hung to dry. Investigators were unable to determine in which direction the fan was operated on the night of the accident. According to the owner, it was normal procedure when at anchor at night to have the fan in reverse operation. The galley flat-top and twin burner stove had a mechanical extraction fan directly above the stove, which was used while cooking to expel fumes via a duct directly outside to the port forward main deck. The salon used natural ventilation via the three sliding windows on each side of the salon and the outward-opening window at the forward galley area. Crewmembers stated that, at the time of the accident, the aft port and starboard sliding windows in the salon were open several inches for ventilation and the forward, outward-opening galley window was closed. The aft salon doors were also open for ventilation, as they always were while the boat was at sea with passengers on board. These doors were only closed when the boat was docked, not being used, and with no one on board. The wheelhouse and crew staterooms on the upper deck of the Conception also relied on natural ventilation through windows, the wheelhouse wing doors, and the door to the sun deck. At the time of the accident, it was reported by the crew that the sun deck door was open, the port and starboard wheelhouse wing doors were shut, and the positions of the stateroom windows were unknown. The bunkroom regularly used a combination of circulation fans and an air conditioning unit. The supply fan, located at the forward end of the space, drew air through ducting that originated 12 inches above the main deck. The ducting attached to air plenum boxes that were about 6– 10 inches off the main deck. These boxes were located on both the port and starboard sides, just below the forwardmost side salon windows. Two exhaust fans, one located on each side of the aft area of the bunkroom, expelled air from the space to the main deck. The ducting for these fans led to identical plenum boxes, which were located aft of the intake plenum boxes. Figure 16. Port side of the Conception’s bunkroom looking aft, with inset of grille/diffuser. (Source: M. Ryan; Inset: S. Landis)

NTSB Marine Accident Report 25 The air conditioning unit, which was the primary means of cooling and ventilation for the bunkroom, was located under the bunkroom deck boards, just port of midship, underneath bunks 30U, 31M, and 32L (see figure 5 for the bunkroom layout) in the vessel’s bilge area. The unit was sized for the space and was estimated to be 4–5 tons. The direct expansion package unit consisted of an evaporator coil, blower fan, compressor, and seawater-cooled condenser. The system was designed to pull air from the space through a diffuser and filter element, located at the forward end of the space, directly at the bottom of the stairs. The blower fan would draw ambient air across the evaporator coil and discharge the cool conditioned air through a network of flexible insulated distribution ductwork located in the bilge. This ductwork connected to permanent ducts and passageways built into the framework of the bunkroom. Each bunk was fitted with a grille/diffuser that could be opened or closed dependent on need. Similar grille/diffusers and ductwork were positioned on the overhead between the rows of bunks on both the port and starboard sides. A month prior to the accident, a technician had been called to the vessel to repair a leak on the condenser tubing, which required some soldering to fix. Since the repair, the unit had been operating as expected. It was standard practice for the vessel’s crew to only operate the air conditioner through the night when the passengers were sleeping. A crewmember would turn the unit on and off by means of a circuit breaker located in the circuit breaker panel at the top of the stairs leading down to the shower room. At the time of the accident, the air conditioning system was in operation; a crewmember stated that he closed the breaker to the air conditioner before going to bed. The air conditioning unit was recovered still in place in the wreckage and was examined by investigators. There were no signs of mechanical failure to the components of the unit. The air conditioning system was not connected to the vessel’s emergency power. None of the surviving crewmembers turned off the air conditioning system at the time the fire was discovered. The unit would have operated until the Conception’s main power was lost (although there was no means to confirm that this occurred). 1.5.5 Auxiliary Systems Bilge and Fire Main Systems. The bilge and fire main systems were interconnected on board the Conception. The fire pump or bilge pump could be used to pump out the vessel’s bilges. According to the crew, during normal operations, when bilges were not being actively pumped, the fire main was lined up in a ready state, with the bilge crossover valves shut. Located on the port side forward in the engine room, the fire pump was driven by a 208-volt electric motor. The 1.5-inch diameter Jabsco bilge pump was driven off the starboard main engine. Bilge level sensors were positioned below the deck in the engine room, bunkroom, lazarette, shower room, and forward of the collision bulkhead. If a high-liquid level in a space was reached, the sensor would be activated, and an alarm would sound in the wheelhouse to notify the operator. A series of 1.5-inch piping connected the bilge spaces to the pumps, which were normally lined up to pump overboard. Diesel Fuel Tanks. The Conception had two steel 800-gallon diesel fuel tanks that stored fuel for the vessel’s two main engines and electric generator. At the time of the fire, the vessel was carrying about 1,400 gallons of fuel. The tanks were constructed of steel and located alongside the hull on the port and starboard sides of the forward engine room. Held in place by wooden frames, their outboard side was shaped to match to the side of the vessel. Filling and venting of the tanks were accomplished via steel pipes running up to the aft main deck. To secure fuel from the tanks

NTSB Marine Accident Report 26 to the engines in an emergency, two handwheels (located in the port and starboard main deck restrooms) were connected to the main supply valves through linkages. Operating fuel supply to the main engines and generator was through their respective engine-driven fuel pump and a network of both copper piping and fuel-rated synthetic hose. Water and Sewage. Fresh water on board the Conception was stored in four polyethylene tanks located on the forward bulkhead of the lazarette. The total freshwater storage capacity in these four tanks was 1,200 gallons. The vessel’s three pressure saltwater toilets drained to a plywood and fiberglass sewage holding tank in the engine room. The tank, which was situated midships along the forward bulkhead, was covered with a workbench. The bench functioned not only as a workspace but also as a platform for the 12- and 24-volt marine engine-starting batteries. Once full, the sewage tank could be drained overboard after the vessel was under way and at least 3 miles away from shore. Additionally, the vessel had several auxiliary freshwater and saltwater pumps, located in the engine room and lazarette. These pumps were used for washing down the deck, cleaning scuba diving equipment, and other onboard tasks. Air Compressors. To fill scuba air bottles, the Conception used three breathing air compressors, which operated off 3-phase, 208-volt alternating current. All three compressors were used solely for filling air bottles. They were operated manually by the crew and could be used independently or in conjunction with each other depending on demand and purpose. The two primary Ingersoll-Rand air compressors were in the aft starboard corner of the engine room. The third compressor was part of a nitrox generator unit, positioned in the forward starboard corner of the lazarette. According to crewmembers interviewed, none of the air compressors were in use at the time of the accident. Winches. The Conception had two winches on board. The bow capstan winch was powered by a 208-volt, 5-hp, 3-phase electric motor. It was used to haul the vessel’s bow anchors and heave mooring lines as needed. The stern electric hydraulic winch system was powered by a similar 1-hp motor and was primarily used to hoist and lower the vessel’s swim platform, which acted as a cradle for the vessel’s rigid hull inflatable skiff. Neither of these winches were wired to the vessel’s emergency power, nor were they in use prior to the fire. 1.5.6 Galley Equipment The galley consisted of a two-burner cooktop, flat-top griddle, double oven, microwave, coffee pot, and refrigerator. Midships in the salon aft of the galley was a fountain soda dispenser, ice maker, and a large refrigerated cooler. On the open main deck aft of the salon doors, there was a barbeque grill. All equipment was electric. As a precaution, at night, the flat-top griddle and two- burner cooktop were secured via the breaker panel located at the top of the stairs leading to the shower room. On the night of the accident, the second galley hand stated that he turned off this equipment by opening the respective circuit breakers. The first deckhand stated that, at the time of the accident, the refrigerators were the only galley equipment running. Above the flat-top griddle was a fixed-temperature heat detector, which had been replaced on February 23, 2016. The siren was set to alarm at 135°F and would sound locally in the galley when activated. 1.5.7 Maintenance and Repair Most of the maintenance on board was conducted by the crew under the direction of the captain. Crewmembers told investigators that some equipment on board the vessel, such as the

NTSB Marine Accident Report 27 main engines, generator, and air compressors, were maintained regularly under the direction of the captain. Crewmembers also said that equipment maintenance was recorded, and running logs were kept for equipment and rounds made. All records and logs were kept on board and were lost in the fire. Conception crewmembers told investigators that they conducted maintenance and engine room rounds and documented them in a log, which showed a general maintenance checklist for much of the vessel’s engine room equipment. Similar logs were found aboard the Vision, a Truth Aquatics vessel similar in size and type to the Conception. The Vision’s round sheets showed routine daily engine room checks, and the vessel’s logs documented equipment maintenance history, which reflected the maintenance instructions. Maintenance completed by the Vision’s crew consisted of oil changes, coolant flushing, filter changes, zinc renewal, pump rebuild, and belt replacement.

Figure 17. Engine Room Check Log used on the Truth Aquatics vessel Vision (Source: Truth Aquatics). The owner of the Conception stated that if the captain deemed that the maintenance was outside the capability of the vessel’s crew, the captain would schedule an outside contractor to come on board and carry out the work and/or repair. 1.5.8 Certification, Inspections, and Examinations The Conception was required to have a valid Certificate of Inspection (COI) issued by the Coast Guard. As stated in the New T regulations (all vessels), the COI: describes the vessel, the route(s) that it may travel, the minimum manning requirements, the survival and rescue craft carried, the minimum fire extinguishing equipment and lifejackets required to be carried, the maximum number of passengers and total persons that may be carried, the number of passengers the vessel may carry in overnight accommodation spaces, the name of the owner and managing operator,…and such other conditions of operations as may be determined by the cognizant [Coast Guard OCMI]. A COI is issued by the Coast Guard and is valid for 5 years for vessels traveling on domestic routes. Prior to renewal at the end of 5 years, the vessel must be inspected to ensure that it is in satisfactory condition, fit for the service intended, and complies with regulations. The inspection includes examination and testing of the vessel’s structure, machinery, and equipment, and may include fire, abandon ship, or man overboard drills. The OCMI may require the vessel to get under way for the inspection. The Conception had a valid COI issued on November 19, 2014. Per the COI, the vessel was required to be manned by a credentialed master and mate, as well as two uncredentialed

NTSB Marine Accident Report 28 deckhands.21 The vessel could carry up to 99 passengers but was limited to 46 passengers for overnight accommodations. The COI listed the Conception’s hull material as “wood.” A vessel carrying a COI valid for 5 years must also be inspected annually. The scope of the annual inspection is the same as the inspection for certification but in less detail, unless the Coast Guard inspector finds deficiencies or determines that a major change has occurred since the last inspection. If the vessel passes the annual inspection, the inspector endorses the COI. If a vessel does not pass an inspection, the attending marine inspector may place operational controls on the vessel, such as an order requiring a correction “prior to carriage of passengers,” until deficiencies are rectified to the satisfaction of the marine inspector. In addition to certifications and annual inspections, vessels that operate on domestic routes and are exposed to salt water more than 3 months per year are required to undergo a drydock hull examination and an internal structure examination every 2 years. To aid in the conduct of these inspections, the Coast Guard issued inspectors the T-Boat Inspection Book, CG-840 TI, which contains checklists for each of the areas normally covered during an inspection. The CG-840-TI was not required to be used or retained by inspectors and was last updated in 2011. Coast Guard sector commands and MSDs may also have supplemental or compressed checklists for inspections. MSD Santa Barbara, a sub-unit of Sector Los Angeles/Long Beach that was responsible for conducting the regulatorily mandated inspections of the Conception, had a “Small Passenger Vessel – T” checklist that was last updated in 2014. MSD Santa Barbara conducted the 5-year COI renewal inspections, annual inspections, and biannual drydock hull and internal structural examinations on the Conception. The detachment had two officers assigned as inspectors, and, according to the Coast Guard, the inspectors were appropriately qualified for the inspection of small passenger vessels under Subchapter T. The MSD Supervisor, the officer overall responsible for all activities at the detachment, was also a qualified inspector. According to the Supervisor, there were about 74 domestic vessels under the MSD’s area of responsibility, most of which were small passenger vessels regulated under Subchapter T. During the 2014 inspection for certification, subsequent annual inspections, and biannual hull and structural inspections aboard the Conception, minor discrepancies were reported, and the vessel owner corrected the discrepancies either immediately upon discovery or soon thereafter. One “prior to carriage of passengers” operational control was issued in February 2016 because the operator could not prove that the fire pump was operational. The operational control was removed the day after it was issued when the inspector witnessed the proper operation of the pump. There were no discrepancies reported in the annual inspection conducted in February 2019. The last Coast Guard drydock inspection took place in February 2019, in conjunction with the annual inspection. There were no discrepancies noted during the examination. For all inspections from 2014 onward, the inspection for certification and subsequent annual inspections were conducted by the same MSD Santa Barbara inspector. All hull and structural examinations from 2015 onward were also conducted by the same MSD Santa Barbara inspector.

21 For voyages of less than 12 hours, the crew requirement was reduced to a credentialed master and two uncredentialed deckhands.

NTSB Marine Accident Report 29 In eyewitness photos and videos of the Conception, large polyethylene trash cans can be seen throughout the interior and exterior areas of the vessel, including the bunkroom. The trash cans were manufactured by Rubbermaid from 2016 onward. Neither the Old T nor the New T regulations allow for these types of trash cans to be used in passenger bunkrooms and instead require that trash cans be constructed of non-combustible materials. New T regulations extend the prohibition on combustible trash cans to all compartments, but only apply to existing (Old T) vessels when the trash cans are replaced. Throughout the inspection history of the Conception, there were no remarks or deficiencies related to the waste receptacles on board.

Figure 18. Left: Photo from a previous voyage of stairway to the upper deck and restrooms of the Conception. Note the regular stowage of a polyethylene trash can under the stairway aft of the salon. Right: Still image from a 2019 video taken of the stairway on board the Conception with shelving installed. (Source: M. Ryan [left], R. Clevenger [right]) 1.6 Accident Damage Evidence was recovered from the accident site, including equipment and small parts of the hull, and brought ashore, where it was photographed and catalogued by the FBI Evidence Response Team. The wreckage was recovered on September 12 and transported by barge to the NBVC–Port Hueneme on September 13. The Coast Guard; Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF); FBI; and Santa Barbara Fire Department inspected the wreck. All debris and personal effects recovered from the seafloor were also brought to the wreckage site for examination. On September 25–27, the NTSB examined the wreckage and debris recovered from the seafloor and surface. The wreckage and debris were laid out by the ATF and FBI in a secure parking lot into three sections consisting of the main hull with the below deck spaces, the main deck, and the upper deck (figure 19). There were also bags full of items that had been floating in the water and/or collected from the seabed. The ATF and FBI, with Coast Guard assistance, placed the recovered items and portions of structure that could be identified in their corresponding places for each of the three sections of the wreckage representing the three decks. Identifiable engine room machinery and equipment, such as the generator and sewage tank, were placed back in their original position in the engine room within the hull. For the main deck and upper deck portions, an outline was made on tarpaulin underlays, and the items and structure were placed within the

NTSB Marine Accident Report 30 outlines in the areas where they belonged. Very little structural material remained from the upper deck and the main deck.

Figure 19. Conception wreckage layout at Port Hueneme. (Source: FBI Evidence Response Team) The hull of the Conception, where the below-deck compartments had been located, represented the bulk of the remaining structure. The transverse bulkheads were severely fire damaged, eliminating the separation of the below-deck compartments between the anchor room, shower room, bunkroom, engine room, and lazarette from forward to aft. The entire interior of the below-deck space was charred. Overall, the interior of the below-deck compartments had burned all the way down to the floor in the bunkroom and shower room and had consumed the floor, exposing the longitudinal frames, in both the engine room and lazarette (figure 20).

Figure 20. Below-deck areas of the Conception. The solid white lines mark the approximate boundaries of each compartment. (Source: FBI Evidence Response Team)

NTSB Marine Accident Report 31 Portside portions of the hull exterior had burned down to a few inches from the waterline. The areas with fire damage closest to the waterline corresponded with the locations of the lazarette compartment and the passenger bunkroom. On the bow portion of the hull exterior, the fire burned down to the level of the main deck rub rails. On the starboard side of the hull exterior, as on the port side, the areas with fire damage closest to the waterline corresponded to the lazarette and passenger bunkroom areas. Overall, the area of lowest burn-through of the hull on the starboard side of the passenger bunkroom was larger than the area of lowest burn-through on the port side. The structure and items recovered belonging to the main deck of the vessel consisted mostly of a few pieces of partially charred deck material and the noncombustible remains of the galley and salon equipment (figure 21). The decking material that remained belonged to the three restrooms on the main deck and small portions of the port and starboard walkways that were adjacent to them.

Figure 21. Wreckage belonging to the main deck of the Conception. Solid yellow lines indicate the enclosed spaces on the deck. The blue box marks the location of the stairway to the sun deck. (Source: FBI Evidence Response Team) No recognizable structural components remained from the upper deck, which included the sun deck, crew staterooms, and wheelhouse; some larger items that remained from this deck were the metal frame of the helm wheel, a piece of a life float, and the batteries for the vessel’s radios. Upon examination of the wreckage, investigators found silhouette evidence markings resembling the outline of persons or objects of non-uniform shape (e.g., duffel bags) in the bunkroom at the bottom of the main stairs leading to the salon, on the port side forward lower double bunk, and adjacent vertical and horizontal bunk frames at bunks 17L and 19L (figure 22).22 The air conditioning intake louver at the bottom of the main stairs had an observable silhouette and traces of human tissue on it.

22 In a fire, when one object is covered by another, it creates a protected area, or silhouette, of that object on the material below.

NTSB Marine Accident Report 32

Figure 22. Postaccident photo of the bunkroom looking from the starboard aisle forward and to port. 1.7 Operations 1.7.1 Charter Company The accident charterer, Worldwide Diving Adventures, had been in business for about 50 years. The organizer and leader of the chartered trip, also one of the charter company owners, was a passenger on board the Conception at the time of the accident. According to Truth Aquatics’ owner, the group leader had been “coming out with us for probably 30 years,” and many of the group’s participants were regular customers. Per the charter agreement, Worldwide Dive Adventures was not responsible for the operation of the Conception or its equipment, which was handled by the crew employed by Truth Aquatics. 1.7.2 Company Information Owner and Operator. Truth Aquatics, a small, family-run company based in Santa Barbara, operated a fleet of three dive vessels, the Conception, the Truth, and the Vision. The business was founded in 1974, and the current owner became a partner in the company in 1979 before eventually assuming full ownership. Ownership of the three vessels was under a trust set up by the owner of Truth Aquatics. In addition to six crewmembers assigned to each vessel, Truth Aquatics employed a shore staff of about ten people to handle logistics, scheduling, and the overall operation of the company. Current and former employees described the Truth Aquatics’ owner as being “very involved” in the operation. According to the company’s website, the owner had personally overseen the construction of the Conception and the Vision. He held a valid Coast Guard merchant mariner credential as a master of self-propelled vessels (not including auxiliary sail) of less than 100 gross register tons upon near coastal waters and occasionally captained the company’s vessels.

NTSB Marine Accident Report 33 The company was a member of the Sportfishing Association of California, an industry advocacy and advisory group.23 According to the company owner and former captains of Truth Aquatics vessels, the captains of the Conception, Vision, and Truth were given broad authority over the operations of their vessels, to include the hiring, training, and dismissal of crewmembers; the conduct of routine maintenance; and the establishment and enforcement of vessel operating procedures. The owner stated that there were no company-wide operating procedures or crew work/rest policies; these were left to the qualified captains of each vessel to establish and manage. Truth Aquatics was generally well regarded among regulators, current and former employees, customers, and other dive boat operators in Southern California. According to the Assistant Chief, Inspection Division, Coast Guard Sector Los Angeles/Long Beach, Truth Aquatics and the company owner “had a good reputation for being good operators. They were always more than willing to engage in conversation about vessel operations…We’ve always had a good relationship with Truth Aquatics.” A customer who had made several trips on Truth Aquatics vessels stated that the company was “considered to be the top [dive boat] outfitter,” and a former captain of the Vision described the vessels as “the safest boats on the coast...No expenses were spared.” Company Fleet. The Truth, built in 1974, was a 64.5-foot-long, 78-gross-ton small passenger vessel, also inspected under Old T regulations. It had a fiberglass-over-wood hull and was smaller and arranged differently than the Conception. The Vision, built in 1985, was an 80-foot-long, 98-gross-ton small passenger vessel similar in size and layout to the Conception and inspected under the same criteria. After the accident, NTSB investigators visited the Vision to inspect construction material, general arrangement, firefighting and lifesaving equipment, means of escape, and egress arrangements. The salon and galley compartment was similarly arranged with the salon area in the aft portion and the galley forward. The passenger bunkroom, which had the same capacity (45 passengers and 1 crew), was also similarly arranged and outfitted with bunkbeds along the centerline and bunkbeds along aisles on the port and starboard sides. As on board the Conception, egress from the passenger bunkroom was available from the main staircase near the galley and from an emergency exit hatch above one of the aft bunks. Both exits from the passenger bunkroom led to the salon compartment. The Vision’s bunkroom ventilation system was similar to the system on board the Conception. Located in the bunkroom bilge was a six-ton, direct-expansion air conditioning unit, which drew air from within the space through a grille located at the bottom of the stairs and discharged air-conditioned air through a system of ducts to individual bunks and to the passageways on the port and starboard sides of the bunkroom. A single supply fan, rated for 595 cubic feet per minute (cfm), was used to distribute fresh outside air to the bunkroom. Two 480- cfm exhaust fans, one located on each side of the bunkroom, were used to expel air from the space. With passengers on board, the Vision, like the Conception, operated the bunkroom supply and exhaust fans continuously and used the bunkroom air conditioning unit at night or as needed.

23 According to the organization’s website, “The Sportfishing Association of California (SAC) was founded in 1972 by industry leaders speaking out on behalf of their interests. SAC works with several agencies and stakeholders, including the California Department of Fish and Wildlife, United States Coast Guard, Navy, National Marine Fisheries Service, Federal Communications Commission, Congress, California Legislature, and the Mexican Government. SAC employees serve on multiple advisory panels in the state and federal arena, and represent industry interests on a variety of topics.” Sportfishing Association of California, www.californiasportfishing.org/about, accessed on April 28, 2020.

NTSB Marine Accident Report 34 Although the passenger bunkroom had smoke detectors, the salon and galley did not. The interior furnishings of the Vision’s salon were generally the same type and material as those that had been in the Conception. The furnishings consisted of wooden tables, plastic chairs, seat cushions and various surfaces sheathed with fiberglass-reinforced plastic (FRP) laminate. These furnishings were not required to be fire-resistant. Investigators examined the Vision’s salon for potential ignition sources. There were cable runs located behind the seatback of the bench-type seating and receptacle drops just under the seatbacks. The electrical cable runs were not enclosed in protective conduit, were often not supported, and did not have the appearance of a professional installation. Similar installations were also observed in the bunkroom (figure 23).

Figure 23. Power cable for lighting routed through ventilation grille in the Vision’s bunkroom. 1.7.3 Company Loss Control Program In the 1980s, the International Maritime Organization (IMO) developed the International Safety Management Code (ISM Code), the purpose of which is “to provide an international standard for the safe management and operation of ships and for pollution prevention.”24 The ISM Code, along with 33 CFR part 96 and Title 46 US Code Section 3203 that implement the code for US and other applicable vessels, requires that vessel operators implement a safety management system (SMS). The SMS defines the roles and responsibilities of all personnel, outlines safe practices in vessel operation and navigation, and establishes safeguards against identified risks. According to US law, an SMS must contain the following elements:

1. a safety and environmental protection policy;

24IMO, “ISM Code and Guideline of Implementation of the ISM Code,” http://www.imo.org/en/OurWork/HumanElement/SafetyManagement/Pages/ISMCode.aspx, accessed April 6, 2020.

NTSB Marine Accident Report 35

1. instructions and procedures to ensure safe operation of those vessels and protection of

the environment in compliance with international and United States law;

1. defined levels of authority and lines of communications between, and among, personnel

on shore and on the vessel;

1. procedures for reporting accidents and nonconformities with this chapter;
2. procedures for preparing for and responding to emergency situations; and
3. procedures for internal audits and management reviews of the system.

Truth Aquatics did not have an SMS for its vessels, nor was it required to. Current regulations for SMSs do not apply to small passenger vessels operating on domestic routes. However, the Coast Guard Authorization Act of 2010 authorized the Secretary of the Department of Homeland Security (DHS, in which the Coast Guard operates) to “prescribe regulations which establish a safety management system” for all small passenger vessel operators, including domestic. To date, the Coast Guard has not issued the regulations authorized in the 2010 law; however, the service has signaled its intent to start the development process in the federal government’s Spring 2020 Unified Agenda of Regulatory and Deregulatory Action.25 Additionally, in February 2020, the Coast Guard issued a Marine Safety Information Bulletin (MSIB) encouraging operators to voluntarily implement SMSs and providing references for developing these systems.26 Although Truth Aquatics did not have an SMS, paperwork that was presented to new employees when they were hired by the company included a Loss Control Program, which included some elements common to an SMS.27 The first element of the program document, titled “Purpose, Duties, Responsibilities and Administration,” provided an overall safety policy for the company. The policy included the following: The health and safety of employees and passengers on Truth Aquatics’ property is of critical concern. We strive to attain a high level of safety in all activities and comply with all health and safety laws applicable to our operations. The company expects that every employee will accept the responsibility for loss prevention and reduction. Captains of each vessel will be directly responsible for maintaining safe working conditions and practices and for the safety of passengers and crewmen under their supervision. They will direct the program to each of their crewmembers in the form of instruction and control. Any safety deficiencies should be brought to the attention of the captain. All employees have a safety responsibility to themselves, their fellow crewmen, and to the company. Their performance must reflect this mutually beneficial

25 Office of Management and Budget (OMB), “Spring 2020 Unified Agenda of Regulatory and Deregulatory Action, Department of Homeland Security Agency Rule List,” 2020, https://www.reginfo.gov/public/do/eAgendaMain. 26 (a) An MSIB is a Coast Guard publication that provides a brief, concise, and timely notice of changes in the maritime transportation system, usually to provide guidance to industry on how to comply with new requirements and/or address evolving operational hazards. MSIBs are announced through various press and social media outlets and are available online at https://www.dco.uscg.mil/Featured-Content/Mariners/Marine-Safety-Information- Bulletins-MSIB/. (b) Coast Guard, Resources for Voluntarily Establishing a Safety Management System, MSIB 03- 20, Washington DC: Department of Homeland Security, 2020. 27 Loss control is an insurance industry term for a program to manage risk and reduce losses.

NTSB Marine Accident Report 36 obligation through active support of the safety and loss control program and compliance with established safety practices and procedures. The captains will provide training and instruction to help meet these responsibilities. Follow-on sections of the document included instructions for the conduct of inspections for safety hazards, accident investigation and reporting requirements, and guidance for annual safety meetings between vessel captains, management, and the owner. The fifth element of the program, “Training,” stated the following: Truth Aquatics will provide adequate training to all employees so that they can perform their assigned tasks. Training programs shall be performed by captains on an as-needed basis. Records shall be kept of meeting agendas and attendance. Management shall maintain these records in the [company’s shoreside] office and they will be made available to all employees. Annual CPR training classes will be held at appropriate times and all crewmembers are encouraged to attend. The final element of the Loss Control Program, “Emergency Procedures,” contained a list of nine emergencies, including fires, flooding, and abandon ship, with step-by-step instructions for crew responses to each emergency. The section lead paragraph stated, “This list is required to be reviewed by all participants.” The first procedure on the list was firefighting and consisted of the following instructions: • Shut off all engines, generators and ventilation systems, unless they are needed to maneuver the vessel. • Recover and evacuate anyone injured. • Locate the fire and evaluate the extent of the fire. • Cut off air supply to fire – close items such as hatches, ports, doors, ventilators, louvers, and shut off power ventilation system (blowers). • Cut off electrical system supplying affected compartment if possible. • If safe, immediately use portable fire extinguishers at base of flames for flammable liquid or grease fires, or water for fires in ordinary combustible materials. Do not use water on electrical fires. • If fire is in machinery spaces, shut off fuel supply and ventilation, and activate fixed extinguishing system. • Maneuver vessel to minimize effect of wind on fire. • If unable to control fire, immediately notify the Coast Guard and other craft in the vicinity by radiotelephone (VHF). • Move passengers away from fire, have them put on lifejackets, and if necessary, prepare to abandon ship [emphasis in original]. The employee handbook stated, “The Loss Control Program manual is designed for the safety of all employees. You are responsible for reading this manual and are required to sign and date that you have read and understand it.” The second captain, first galley hand, and an alternate second captain who had been on Conception during the previous voyage stated that they had received a copy of the Loss Control Program, as well as an employee handbook and other documents, after being hired by Truth Aquatics. The second captain and alternate second captain

NTSB Marine Accident Report 37 (who had been hired in August 2019) stated that they had received the documents in an email with attachments. The alternate second captain stated that he had reviewed the program document, but that no one verified that he had read it or understood the policies and procedures before he got under way on the Conception. The first galley hand stated that he did not receive the new employment documents until just prior to the accident voyage, his fifth or sixth voyage on the vessel. He stated that he wrote down the headings of the emergency procedures listed in the Loss Control Program and asked the captain to discuss the procedures on the day before the accident. The first galley hand stated that the captain’s response was, “When we have time.” He further said that during the accident, “I didn’t know what the procedures were supposed to be.” 1.7.4 Watchstanding Truth Aquatics’ owner stated that there were no company-wide policies or procedures regarding watchstanding on board its vessels; watches were at the discretion of the captain of each dive boat. Conception crewmembers and former crewmembers interviewed by investigators stated that there was no formal watch rotation for the vessel. Navigation Watches. Per New T regulations (all vessels), “the movement of vessel shall be under the direction and control of the master or a licensed mate at all times.” (The terms “licensed” as used in this section of Subchapter T is equivalent to “credentialled” as used in this report and other portions of 46 CFR.) The captain of the Conception was the principal operator of the vessel’s controls, and during the accident voyage the credentialled second captain also took the helm for brief periods. In an interview with law enforcement officials, the first deckhand stated that, on previous voyages, the deckhands would also be assigned helm watches at night. When a deckhand had the watch, all other crewmembers were asleep, including the captain and second captain. He said that the captain would “strategically pick the legs that the deckhands would take so that we’re not going to be crossing the channel, or intercepting islands, or basically anything like that.” The deckhands were instructed to monitor the radar, the VHF radio, and the electronic charting system and to wake up the captain if the engines made unusual noises or if other vessels came within 2 miles of the Conception. (There is no requirement in New or Old T to maintain a wheelhouse watch while a vessel is at anchor.) Roving Patrols. The requirement to keep a watch at night while passengers are embarked on a vessel has been codified in US law since 1871. Per the current statute (46 United States Code [USC] Section 8102), “the owner, operator, or charterer of a vessel carrying passengers during the nighttime shall keep a suitable number of watchmen in the vicinity of cabins or staterooms and on each deck to guard against and give alarm in case of fire or other danger.” An owner, operator, or charterer who fails to comply with this law is subject to a civil penalty of $1,000. In interpreting the statute for small passenger vessels under New T regulations (all vessels), the Coast Guard requires that a “suitable number of watchmen patrol throughout the vessel during the nighttime, whether or not the vessel is underway, to guard against, and give alarm in case of, a fire, man overboard, or other dangerous situation.” As a result, a provision was included in the “Route Permitted And Conditions of Operation” section of the Conception’s COI stating that “a member of the vessel’s crew shall be designated by the master as a roving patrol at all times, whether or not the vessel is underway, when the passenger’s [sic] bunks are occupied.” NTSB investigators reviewed COIs from other small

NTSB Marine Accident Report 38 passenger vessels with overnight accommodations, and all of the certificates had a similar statement regarding the requirement for a roving patrol, both under way and not under way. When the Conception was not under way, whether moored in harbor in Santa Barbara or anchored around the Channel Islands, there was no designated roving patrol while passengers were aboard, according to crewmembers and former crewmembers. When passengers boarded the vessel the night before an early departure, it was common for there to be no crew on board until hours after the passengers had arrived. While on a dive trip and at anchor, no watch was set at night, and all crewmembers normally slept after the day’s activities had ended until the next morning. The NTSB interviewed captains and crewmembers from other Truth Aquatics vessels, and all stated that the practices on their vessels were the same as those on the Conception. A captain of the Vision stated, “We’d prep the boat the day before, and then leave the boat open for the passengers to board…all of the deck crew would arrive a half hour before our scheduled departure.” No watches were set while in port or at anchor. The Vision captain stated that he believed that having one of the crew sleep in the bunkroom “somehow fulfilled” the roving patrol requirement. He said that he had followed the practice that was shown to him when he began working for Truth Aquatics, and he thought “the boat’s been operating this way for so long successfully after so many inspections that it must be fine.” Referring to the roving patrol requirement, a former captain of the Truth told Los Angeles Times reporters, “It’s a regulation, but it wasn’t really followed.”28 After the accident, NTSB staff visited other dive boats operating in Southern California waters to gather information about industry-wide practices. During informal discussions with investigators, the owners and operators of all vessels that were visited stated that crewmembers were aboard the vessel and night watches were conducted when passengers were embarked. However, procedures for the conduct of night watches varied from boat to boat, ranging from active roving patrols to stationary watches located in the wheelhouse or salon. When asked by NTSB investigators, Coast Guard representatives stated that during inspections for certification and annual inspections, inspectors have no practical way of verifying that operators were complying with the requirement for a roving patrol on small passenger vessels with overnight passengers. A Coast Guard senior marine inspector stated, “The master of the vessel is responsible for operating the vessel within the parameters on the certificate. But there’s no way during an inspection to know, because the inspection is conducted dockside, and even if you took the vessel out to do drills, it wouldn’t be with passengers.” Neither the CG-840 TI inspection book nor MSD Santa Barbara’s “Small Passenger Vessel – T” checklist included a line item for verifying that a roving patrol was being conducted. Coast Guard records show that, nationwide since 1991, no citations have been issued and no fines have been levied for failure to post a night watch or roving patrol. 1.8 Survival Factors The 33 passengers on board the Conception at the time of the accident were all United States citizens from various states across the country. Passenger ages ranged from 16 to 62 years old.

28 Puente, Mark, Richard Winton, Leila Miller, “Before Conception boat fire, captains say Coast Guard safety rule was ignored,” The Los Angeles Times, December 30, 2019.

NTSB Marine Accident Report 39 1.8.1 Station Bill Per New T regulations (all vessels), the Conception had a station bill—an official list of each crewmember’s assigned duties and watch station—which outlined instructions to the crew in case of emergency situations involving man overboard, fire at sea, and rough weather or crossing hazardous bars. The station bill for the Conception was not found in the wreckage; however, the two other vessels in the Truth Aquatics fleet, the Vision and Truth, had the same station bill as the Conception. For onboard fires, the station bill required the second captain to cut off air supply to the fire and close hatches, ports, doors, and ventilation dampers, while the first deckhand was to use portable fire extinguishers to extinguish the fire. The second deckhand was tasked to shut off the fuel supply and ventilation to the engine room and discharge the system for any fire in machinery space. The captain’s task was to minimize the effect of wind on the fire and to immediately notify the Coast Guard and other boats in the vicinity if the fire was unable to be controlled. The second captain was also responsible for moving passengers away from the fire, having them don lifejackets, and, if necessary, have them prepare to abandon ship. There were no specific emergency duties assigned to the first or second galley hands. Additional procedures were discussed in Truth Aquatics Loss Control Program.

Figure 24. Fire at sea emergency instructions/station bill from the Vision. Although the station bill was required to be posted by regulation, none of the crewmembers on the Conception at the time of the accident were aware of any posted station bill. The first galley hand was unfamiliar with the concept of a station bill when asked by investigators. The second captain stated that he understood that his role in a fire emergency was to start the fire pump and/or launch the skiff. The Conception was fitted with a fixed installation public address (PA) system that could be used to alert passengers and crew of an emergency from the wheelhouse, with speakers on the bow, stern, and in the bunkroom. Regulations required the fixed PA system to be audible during

NTSB Marine Accident Report 40 normal operating conditions in passenger accommodation spaces and all other spaces normally manned by crewmembers.29 Although there was a speaker for the PA system in the bunkroom, it was reported to have been disconnected so that passengers who were sleeping would not be interrupted by routine announcements. There were no pre-accident records from the Coast Guard showing whether the PA system on board the Conception was checked during inspections or any deficiencies noted. During an inspection after the accident, the Coast Guard found that the PA system on board the Vision was disconnected in the passenger bunkroom, and inspectors issued a deficiency requiring it to be rectified. 1.8.2 Passenger Manifest and Accountability New T regulations (all vessels) require the owner, charterer, managing operator, or master of a vessel to “keep a correct list of the names of all persons that embark on and disembark from a vessel…where passengers are carried overnight.” The list “must be communicated verbally or in writing ashore at the vessel’s normal berthing location or with a representative of the owner or managing operator of the vessel.” On the Conception, a handwritten crew and passenger list was kept on board the vessel, and a copy of the list for the accident voyage was found in the company office ashore. Passengers were required to write their own names on the list after boarding, and some of the names appeared to be signatures, making them difficult to read. The list had the names of 32 passengers; the name of 1 passenger was missing (the owner of Truth Aquatics was able to provide an up-to-date list of passengers after the accident). No emergency contact information was required to be given by any of the passengers. 1.8.3 Safety Briefing Passenger safety orientations are required on small passenger vessels by New T regulations (all vessels). The regulations require that the orientation be conducted “before getting underway on a voyage or as soon as practicable thereafter.” Among several required topics, the orientation must include a briefing on the location of emergency exits and a demonstration of life jacket donning or instructions that passengers may contact a crewmember for a demonstration. The regulations also required that passengers “shall be requested to don life jackets and go to the appropriate embarkation station during the safety orientation for vessels on a voyage of over 24 hours.” Crewmembers told investigators that the 15–20-minute safety briefing on the Conception was conducted by the crew following a standard bullet-point script. For trips that began late at night or early in the morning, such as the accident voyage, the safety briefing was normally conducted following breakfast, after the vessel had anchored at the first dive site. All passengers were required to attend. Former passengers confirmed that during the briefing, the location of the bunkroom escape hatch was discussed, as the briefer normally stood directly aft of the hatch in the salon during the presentation. Passengers were informed but not shown where the hatch was located in the bunkroom. According to current and former crewmembers, the briefer did not demonstrate donning of lifejackets. During interviews with investigators, current and former

29 According to 46 CFR 175.400, accommodation spaces include those spaces used as a public space, dining room or mess room, lounge or café; overnight accommodation space; or washroom or toilet space. On board the Conception, the accommodation spaces included the salon, bunkroom, and shower room.

NTSB Marine Accident Report 41 crewmembers on other Truth Aquatics vessels confirmed that the safety orientation procedures on their vessels were the same or similar to the procedures on the Conception. On the evening of August 30, passengers boarded the vessel and went to their assigned bunks to sleep. The Conception got under way from Santa Barbara about 0404 on August 31. Sometime after 0830 that morning, after the Conception anchored at the initial diving site, the first deckhand completed the safety orientation in the salon. The first deckhand stated that he briefed passengers on the location of lifejackets, extinguishers, and escape routes but was interrupted when a passenger fainted. According to crewmembers’ accounts of the safety brief on the accident voyage, the passengers on the Conception were not requested to don lifejackets or muster at the embarkation station. After the passenger was revived and his vital signs checked, the remainder of the safety brief was conducted by the captain, who, according to the deckhand, provided “an abridged version” of the dive safety section of the brief. As an alternative to the safety orientation announcements, New T regulations (all vessels) permitted the use of a card or pamphlet, delivered to each passenger before getting under way, with the information that would have been provided in a safety briefing. If using the pamphlet, an abbreviated announcement must be made prior to getting under way. A “Welcome Aboard” card was available in the Conception salon, containing general information that would “serve as your pre-departure safety briefing,” as well as the location of lifesaving equipment. Placards in each bunk provided lifejacket donning instructions. During interviews, surviving crewmembers did not report that an announcement was made prior to getting under way for the accident voyage.

Figure 25. Truth Aquatics “Welcome Aboard” information specific to pre-departure safety briefing. (Source: Truth Aquatics) In the months prior to the accident, Truth Aquatics was finalizing the production of a vessel and safety orientation video that was intended to be shown on board both the Vision and Conception, which were similar in layout. The video had been completed by the contractor tasked with production but was not yet in place on board each vessel. The safety orientation video showed how to don a lifejacket, the locations of the muster area and of lifesaving appliances, instructions for a man overboard, and the locations of the emergency escape hatch from the bunk room and salon. 1.8.4 Smoke Detectors and Firefighting Equipment According to the Coast Guard, the Conception was in compliance with the applicable regulations pertaining to fire safety for this class of vessel. Smoke Detectors. New T regulations (all vessels) specified that “each overnight accommodation space on a vessel with overnight accommodations for passengers must be fitted with an independent modular smoke detection and alarm unit.” The smoke detection and alarm system was further required to:

NTSB Marine Accident Report 42 (1) Meet UL 217 (incorporated by reference, see 46 CFR 175.600) and be listed as a ‘Single Station Smoke detector—Also suitable for use in Recreational Vehicles,’ or other standard specified by the Commandant; (2) Contain an independent power source; and (3) Alarm on low power.30 Neither Old T nor New T regulations required the salon and galley compartment to have smoke detectors installed. Heat detectors were installed in the engine room and galley. The smoke and heat detectors were not interconnected to other alarms or a central operating station in the wheelhouse. In the engine room, the heat detector, if activated, would initiate the carbon dioxide fixed fire-extinguishing system for the engine room. The galley detector was not connected to the range hood fan or any damper, nor was it required to be. As required by 46 CFR 181.405(c), which applied retroactively to existing vessels with an overnight accommodation space, the bunkroom area contained two independent modular smoke detectors, installed in the overhead on the port and starboard aisles between the bunks. Investigators were informed by the vessel owner that the smoke detectors in the bunkroom were hardwired into the vessel’s electrical system, with a 9-volt battery backup. The smoke detectors were not interconnected to other alarms or a centralized system in the wheelhouse. Based on photos and video, the smoke detectors appeared to be common consumer-type smoke detectors, as specified in the regulations. The smoke detectors in the bunkroom were the only ones required to be on board. There were no additional smoke detectors installed on board.

30 (a) UL 217 is an industry standard describing the basic requirements and minimum performance characteristics of single and multiple station smoke detectors used in ordinary indoor locations. (b) In contrast, the regulations in 46 CFR Subchapter K, applicable to larger US-flagged passenger vessels, require accommodation, control, and service spaces to have a “smoke actuated fire detection system” and “a manual alarm system.” Figure 26. Photo of the galley of the Conception taken from the forward centerline window. (Source: NTSB eyewitness submission)

NTSB Marine Accident Report 43

Figure 27. Interior view of Conception bunkroom. (Source: Truth Aquatics; annotated by NTSB) There were no requirements related to the testing and inspection of smoke detectors. The owner was aware that the bunkroom smoke detectors functioned properly less than a month before the accident voyage, when a contractor soldering on the air conditioning unit activated them. The owner told investigators that after the smoke detectors activated, the captain of the Conception “unplugged” them while the soldering was ongoing. When the work was completed, the smoke detectors were plugged back in, “fresh” batteries were added, and the detectors were tested. When asked whether there were routine inspections or testing of the smoke detectors on the Conception, the owner stated the captain was responsible for any inspections or testing. At the time of the accident, the second galley hand stated that he did not hear any alarms, nor did he smell smoke from his bunk aft of the wheelhouse. The first deckhand, whose bunk was also in the wheelhouse, said that he heard a faint alarm when he was awakened. He did not recognize the alarm and described it as “coming from the dash [in the wheelhouse]…barely a little chirp.” He further noted that when he looked, he did not notice anything flashing on the console in the wheelhouse. Fixed Fire-Extinguishing Systems. New T regulations included fixed fire-extinguishing requirements for a number of spaces, including most engine rooms. Existing wooden vessels, such as the Conception, were required to comply with the new regulations by March 1999. In accordance with the New T regulations (all vessels), the engine room was equipped with an approved fixed fire-extinguishing system. Two 75-pound fixed cylinders charged with carbon dioxide could be activated automatically via heat sensors located above the main engines or remotely at a pull station positioned on the port side of the aft main deck. Once activated, the system would flood the engine room with carbon dioxide. The carbon dioxide bottles were located on the forward bulkhead in the lazarette, starboard side. The fire-extinguishing system and ventilation dampers for the engine room were not activated manually on the night of the fire.

NTSB Marine Accident Report 44 A third-party inspection of the engine room fixed fire-fighting system and extinguishers was competed in February 2019, and no outstanding deficiencies were noted. The Conception’s galley had a flat griddle for which regulations prescribed a fixed fire- extinguishing system. Due to the short 14-inch ducting that led directly outside, in 2000, the Coast Guard granted a waiver for the system contingent on the company providing an additional B-II extinguisher (10-pound dry chemical) in the galley, installing a heat detector, and implementing a maintenance program “to ensure the existing galley and ventilation equipment is kept free from any build-up of grease.” The second galley hand told investigators it was his duty to clean the grease trap. According to the owner, the captains for each vessel in the fleet were responsible for all maintenance on board the vessel and all maintenance records were kept on each vessel. Firefighting Equipment. The Conception used a combination of fire extinguishers, a fire pump, and a fire axe to meet the fire equipment carriage regulations. There was no additional fire equipment on board in excess of the requirements. In total, there were six fire extinguishers on board the Conception. According to the COI, five of them were type B-II and one was type B-I (2-pound dry chemical). On the main deck, one fire extinguisher was mounted in the galley by the coffee pot, and one was mounted port side aft in the salon. In the bunkroom, there was a fire extinguisher mounted on a bulkhead across from the main stairs by the changing room. There was one fire extinguisher in the engine room, one in the lazarette, and one in the wheelhouse dash at the console. An electrically driven fire pump in the engine room provided firefighting water to hoses at two fire stations located on the main deck on either side, outboard of the salon. Each fire station contained 50 feet of 1.5-inch fire hose. The fire pump could be activated from two locations: locally at the motor controller and remotely from the vessel’s port fire station. Crewmembers on board at the time of the accident stated that the fire pump was tested daily to ensure performance and maintain the pump’s readiness. On September 1, the day before the fire, the sewage holding tank had overflowed into the port bilge, and the first deckhand attempted to use the bilge pump to clean up. The bilge pump was inoperable, so the deckhand lined up the fire pump to finish cleaning. He told investigators that after the clean-up, before leaving the engine room, he lined up the fire pump so that it was ready for use. The fire hoses were tested annually during Coast Guard inspections. A single fire axe, as required by regulations, was stowed on the aft bulkhead of the wheelhouse. The Coast Guard documented a total of 31 deficiencies on the Conception from 2009-2019, 4 of which were related to fire protection, including the fire pump, galley heat detector, hose, and wheelhouse extinguisher, all of which were rectified to the Coast Guard’s satisfaction. 1.8.5 Means of Escape and Egress When the Conception was constructed and underwent sea trials in 1981, the Coast Guard “Sea Trials; T new construction and conversion” inspection form required the attending Coast Guard inspector to “physically use each emergency escape on board.” The inspection item was checked as completed on the form. The inspector wrote on the signed form that the sea trials were satisfactory.

NTSB Marine Accident Report 45 As an existing vessel, the Conception was required to meet the Old T standards for means of escape and emergency egress, which required that “not less than two avenues of escape from all general areas accessible to the passengers or where the crew may be quartered or normally employed, so located that if one is not available the other may be.” The New T regulations in 46 CFR 177.15-1, which did not apply to the Conception, further require the means of escape to be sufficient for rapid evacuation in an emergency for the number of persons served. Investigators were unable to find a quantitative definition of the word “rapid.” Although there was no specific minimum dimension guidance in either Old or New T regulations regarding means of escape, New T regulations state the “dimensions of the means of escape must be such as to allow for easy movement of persons wearing lifejackets and that there must be no protrusions that could cause injury, ensnare clothing, or damage lifejackets.” From the Conception’s bunkroom, there were two means of escape, both leading to the salon above: (1) the spiral stairs forward in the bunkroom (figure 28), and (2) the escape hatch installed centerline at the aft end of the bunkroom (figure 29). The hatch, marked with a two-inch plastic sign, was accessible from either aisle by climbing a wooden ladder, located in the corner where the aftermost middle and aft athwartship tiers of bunks were, onto the upper bunk; crawling to the centerline; and then pushing the plywood escape hatch up and out of the way. The hatch opened below the centerline countertop in the salon. Investigators measured the Vision’s escape hatch, which, according to the owner, was similar to the Conception’s escape hatch. The opening dimensions were approximately 22 inches by 22 inches through the main deck, with the aft-facing vertical opening having a clearance of about 35 inches from the main deck to the countertop above, or 28 inches from the top of the 7-inch main deck coaming. The two means of escape were at opposite ends of the bunkroom (so as to minimize the possibility of one incident blocking both escapes) and did not pass through a watertight door, thereby fulfilling the regulations applicable to the Conception. In the available documentation and inspection history of the vessel, no deficiencies or modifications were found related to the emergency escape hatch or the bunk ladders to the hatch.

Figure 29. The Conception bunkroom escape hatch from above in the salon (left) and in the bunkroom from the port side (right). (Source: R. Clevenger [left]; Truth Aquatics [right], annotated by NTSB) Figure 28. Staircase from the main deck galley/salon leading down to the bunkroom on the Conception. (Source: NTSB eyewitness submission)

NTSB Marine Accident Report 46 The salon compartment of the Conception had three means of escape—the main doors aft in the salon, the forwardmost sliding window on the port side, and the middle sliding window on the starboard side of the salon. If closed, the windows latched and could not be opened from the exterior walkways. 1.8.6 Lifesaving Appliances

Figure 30. Locations of firefighting equipment, lifesaving appliances, and evacuation plan for the Conception at the time of the accident (compiled from the investigation and drawn by the NTSB). The primary lifesaving appliances aboard the Conception included 6 various-sized life floats, with an aggregate capacity of 104, or 100 percent of the people allowed on board. All lifesaving appliances were located either on the upper deck or on top of the wheelhouse.

NTSB Marine Accident Report 47 Per its COI, the vessel was required to carry Type I offshore lifejackets for 103 adults and 11 children. All Type I lifejackets were stowed on the upper deck in boxes with float-free covers. According to the station bill on the Conception, the second captain was responsible for ensuring passengers donned their lifejackets in an emergency. The crew was unable to retrieve any lifesaving equipment before abandoning ship, and all equipment was consumed in the fire. Investigators were not able to examine the Conception’s lifesaving equipment; only pieces survived the fire. The largest piece recovered was a corner of a life float. The Conception was also required to have a rescue boat. The skiff served as the vessel’s designated rescue boat. The 16-foot Caribe UB15 rigid-hull inflatable, equipped with a 40-hp Honda 4-stroke outboard engine, was capable of carrying up to 8 people. The skiff was primarily used to support diving operations but was also intended to be used to retrieve persons overboard. It was stowed on the raised swim platform at the stern when not in use. The Conception had a Category I float-free Emergency Position Indicating Radio Beacon (EPIRB), which was mounted on the upper deck bulwark on the starboard side, near the top of stairs to the main deck. The surviving crew of the Conception did not retrieve or manually activate the EPIRB, and the EPIRB was destroyed in the fire; there were no signals received by the Coast Guard. Medical equipment, including a first aid kit, oxygen, and an automated external defibrillator were stowed under the wheelhouse console. The Conception also had flares that were reported to be located in the wheelhouse. None of this equipment was retrieved or used in the accident. 1.8.7 Emergency Drills New T regulations (all vessels) require the master of a small passenger vessel to “conduct sufficient drills to make sure that all crew members are familiar with their duties” in the event of a man overboard, an emergency necessitating abandoning ship, or a fire. The regulations do not specify the frequency that the drills must be conducted but state that the drills shall include a muster of the passengers and reporting of the crew to assigned stations and preparation for assigned duties. Man-overboard and abandon ship drills must include checking that life preservers are properly donned and instruction in the automatic or manual deployment of survival craft. Fire drills must include a demonstration of assigned duties by the crew and instruction in the use of fire alarms, extinguishers, and any other firefighting equipment on board. Required drills must be logged and include the date of the drill and a general description of the drill scenario or training topics. Figure 31. Postaccident photo of the Conception skiff.

NTSB Marine Accident Report 48 According to the Truth Aquatics owner, logs for drills and other training activities on the Conception were kept on the vessel. No logbooks were found after the accident—the wheelhouse where the logs were stored was destroyed by the fire. During a 2017 Coast Guard annual inspection of the Conception, inspectors noted that the drill log was not up to date. The inspectors cleared the discrepancy once underway drills were completed and logged. No other discrepancies with logs or the conduct of drills were noted by inspectors in the 5 years prior to the accident. The second captain, first deckhand, and second galley hand told investigators that they had not participated in a fire drill aboard the Conception. The first deckhand stated that he had never pulled out a fire hose on the vessel and had “never done a dry run on anything, with the exception of during the Coast Guard inspections.” He stated that he had participated in one fire drill on another Truth Aquatics vessel during a Coast Guard inspection, and the drill log for the Truth reflected his participation in a drill during an April 2019 inspection of that vessel. A former first galley hand stated that the crew had pulled out fire hoses during a training session while she was on the Conception. Other former crewmembers told investigators that they had never participated in a fire drill. 1.9 Personnel Information By regulation, the Conception was required to have four crew, with two being credentialled mariners. The vessel normally operated with six crew, including a captain and second captain, two deckhands, and two galley hands. During overnight voyages, the second captain and first deckhand slept in the wheelhouse bunks, the galley hands slept in the two-bunk stateroom, and the captain slept in the single-bunk stateroom. The second deckhand slept below in the passenger bunkroom. 1.9.1 Crew Recruitment and Training Current and former crewmembers interviewed by NTSB investigators described the hiring and training process for employees on board Truth Aquatics vessels. A prospective employee was first invited to participate in a voyage without pay. During this voyage, the prospective employee was provided the opportunity to interact with and work alongside the crew, and the captain evaluated the person to determine whether they would be a “good fit.” Upon completion of the unpaid voyage and a negative drug test, a suitable candidate was offered a job if there was an opening on the vessel. Once hired, the new employee began work immediately in their assigned position. Current and former crewmembers stated that there was no formal training (company-wide or aboard the vessel) for new employees prior to getting under way as a paid employee. All training was on-the-job instruction by the vessel’s crew. New T regulations (all vessels) require the owner, operator, or master of a small passenger vessel to “instruct each crew member, upon first being employed and prior to getting underway for the first time on a particular vessel and at least once every three months, as to the duties that the crew member is expected to perform in an emergency including, but not limited to, the emergency instructions listed on the emergency instruction placard.” For small passenger vessels, the emergency instruction placard must include the actions to be taken in the event of fire, heavy weather, or man overboard. Training of crewmembers must be logged or otherwise recorded. Conception crewmembers stated that, with the exception of first aid and cardiopulmonary resuscitation (CPR) training, the captain conducted training with new employees individually, showing the new employee where various equipment was located, how to align the fire pump, and other normal operating and emergency procedures. Experienced crewmembers also conducted

NTSB Marine Accident Report 49 informal training with the new employees. Training was conducted when time allowed during normal commercial operations of the vessel. For first aid and CPR, Truth Aquatics provided training to company employees annually. Coast Guard inspectors told investigators that they validated compliance with periodic training regulations by reviewing the required training logs and evaluating proficiency during drills conducted at inspections. Coast Guard records show that, nationwide since 1991, fourteen small passenger vessel owners, operators, or charterers have been cited for failure to conduct or properly record crew training in accordance with regulations. Truth Aquatics was not among the cited operators. 1.9.2 Crew Licensing and Certification Captain. The 65-year-old captain of the Conception held a valid merchant mariner credential as a master of self-propelled vessels (not including auxiliary sail) of less than 100 gross register tons upon near coastal waters. He had worked for Truth Aquatics since 1984 (with a 3- year hiatus in the late 1990s), starting as a deckhand and then rising to captain in 1985 once he had obtained his 100-ton master’s credential. According to Truth Aquatics and Coast Guard documents, he had captained all three of the company’s vessels, but was primarily assigned to the Conception throughout his 3 decades of employment. The captain was in overall charge of the vessel. Crewmembers, both current and former, told investigators that the captain was the primary operator of the helm and engine controls, turning over to the second captain or first deckhand for two-hour periods when transiting at night, or for short periods during the day for breaks. Second Captain. The 28-year-old second captain held a valid merchant mariner credential, issued on March 19, 2019, as a master of self-propelled vessels (not including auxiliary sail) of less than 100 gross register tons upon near coastal waters. He told investigators that he had been hired by Truth Aquatics in late June or early July 2019 and that this was his first job as a credentialed mariner. Prior to this position, he had worked as a deckhand on several boats operating off the Southern California coast and the Channel Islands from 2017 to 2019. The second captain stated that, as a new crewmember, his duties were primarily deck related, including working with the deckhands to anchor the vessel, launch and recover the skiff, and conduct general cleaning. He said that on the accident voyage, the captain had allowed him to spend more time at the controls in the wheelhouse so that he could gain experience with maneuvering the vessel. First Deckhand. The 28-year-old first deckhand had been employed by Truth Aquatics on board the Conception since November 2018. He did not hold, nor was he required to hold, a merchant mariner credential. He told investigators that he held an American Sailing Association certification for bareboat cruising, and, for the 3 years prior to being hired by Truth Aquatics, he had worked aboard a 70-foot sailing vessel that conducted 2-hour passenger cruises in Monterey Bay, California. The first deckhand’s duties included line and anchor chain handling, monitoring engineering equipment and diving compressors, filling scuba diving tanks, monitoring and assisting divers, operating the skiff, minor maintenance, pumping bilges, general cleaning, and occasional turns at the helm.

NTSB Marine Accident Report 50 Second Deckhand. The 26-year-old second deckhand, who died in the fire, had been working on the Conception for about a week when the accident occurred. It was her second voyage aboard the vessel. She did not hold, nor was she required to hold, a merchant mariner credential. Prior to joining the Conception crew, she had worked for a couple months as a galley hand on another Truth Aquatics vessel. The second deckhand’s duties were similar to the first deckhand. According to other crewmembers, she was being trained on the various duties of the position during the previous and accident voyages. She was also designated as the safety diver, requiring her to stand by with a wetsuit on while divers were in the water. As such, she held certifications for advanced open water diving. First Galley hand. The 34-year-old first galley hand had been working on the Conception for about 3 weeks before the accident. He had no prior experience working on vessels; he did not hold, nor was he required to hold, a merchant mariner credential. The first galley hand had worked in the hospitality industry for about 11 years before being hired by Truth Aquatics. During an interview with law enforcement officials, he stated that he had made about five to six voyages on the Conception, the first two under the supervision of the first galley hand whom he eventually replaced. The first galley hand’s duties included purchasing food and stores for each voyage, developing the menu and preparing food, and supervising the second galley hand. Second Galley hand. The 58-year-old second galley hand had worked on the Conception since October 2017. He did not hold, nor was he required to hold, a merchant mariner credential. He stated that, prior to being hired by Truth Aquatics, he had worked in the restaurant industry for about 30 years. The duties of the second galley hand included food preparation, making coffee, washing dishes and silverware, and general cleaning in the galley and salon. 1.9.3 Toxicological Testing Company drug and alcohol testing program. As required by regulation, Truth Aquatics had a workplace pre-employment and random drug and alcohol testing program. During annual inspections by the Coast Guard, inspectors were required to verify that the company’s program was in place and being properly followed. According to Truth Aquatics’ Employee Education Program for the Drug and Alcohol Free Workplace, a document that was provided to employees when they were hired, employees were “prohibited from unlawful manufacture, distribution, dispensing, possession of, or use of a controlled substances without authority on Truth Aquatics, Inc.’s premises.” Further, the document stated that “The presence of any detectable amount of any illegal drug in an employee while performing Truth Aquatics, Inc.’s business or while on Truth Aquatics, Inc.’s premises is prohibited.” Surviving crewmembers told investigators that there was a strict no-alcohol/no-drugs policy for employees while on board the Conception, but passengers were permitted to bring aboard and consume alcohol. Postaccident toxicological testing. Just after 0800 on the accident date, upon the arrival ashore at Channel Islands Harbor, the second captain, first deckhand, and the second galley hand were administered required postaccident breathalyzer tests for alcohol. The captain was tested

NTSB Marine Accident Report 51 when he arrived at the harbor about 45 minutes later. All tests results were negative. The first galley hand was not tested prior to being transported to the hospital. On the day after the accident, all surviving crewmembers underwent required postaccident urine drug testing.31 The first galley hand tested positive for marijuana metabolites. He told law enforcement officials that he had smoked marijuana a few days before the accident voyage but not during the voyage. The urine results for the captain, second captain, and first deckhand tested negative for drugs; the second galley hand tested negative dilute.32 Toxicology testing was performed during the autopsy of the deceased second deckhand. Results were negative for alcohol and other tested-for drugs. 1.10 Waterway Information Platts Harbor is a rounded inlet surrounded by cliffs and steep hillsides on the north side of Santa Cruz Island that provides a partially protected anchorage for small vessels. The harbor lies on the Pacific Ocean within the Santa Barbara Channel, a 20-mile-wide waterway formed by the California Coast and the Channel Islands, including Santa Cruz. Water depths in Platts Harbor range from 20 to 54 feet at mean lower low water, with a tidal range of about 5.5 feet on the morning of the accident.33 The charted seabed type is rocky. 1.11 Meteorological Information The accident occurred during nighttime hours, with civil twilight beginning at 0608 and sunrise at 0633. At 0310, a remote weather observation site about 4 miles southeast of the accident site on Santa Cruz Island recorded an outside air temperature of 64.6°F and a wind speed of 6.4 knots, with gusts up to 9.6 knots from the east. The nearest marine data buoy from the National Data Buoy Center (buoy number 46053), located about 13 miles north-northwest from the accident site, recorded a water temperature of 64°F. At the anchorage in Platts Harbor, the deckhand from the Conception recalled that from the skiff, “there was no swell and no current really that I noticed at all.” According to the second galley hand, “the wind was light.” According to the owner of the Grape Escape, there was “absolutely no wind” or fog. 1.12 Postaccident Actions Shortly after the fire on the Conception, the Coast Guard issued an MSIB addressing passenger vessel compliance and operational readiness for small passenger vessels, MSIB 008-19. The MSIB recommended owners, operators, and masters of passenger vessels complete a review of the overall condition of the passenger accommodation spaces for unsafe practices and other

31 Urine drug testing is limited to identifying urinary metabolites of cocaine, codeine, morphine, heroin, phencyclidine (PCP), amphetamine, methamphetamine, methylenedioxymethamphetamine (MDMA), methylenedioxyamphetamine (MDA), methylenedioxyethylamphetamine (MDEA), tetrahydrocannabinol (THC), oxycodone, oxymorphone, hydrocodone, and hydromorphone. 32 A negative dilute sample can occur when the donor consumes a large quantity of fluids before providing the urine specimen. The urine results for the second galley hand were labeled negative dilute; both creatinine and specific gravity were out of range. No follow-up urine testing under direct observation was performed. 33 Mean lower low water is the average of the lower low water height of each tidal day observed over the National Tidal Datum Epoch.

NTSB Marine Accident Report 52 hazardous arrangements, and “reduce potential fire hazards and consider limiting the unsupervised charging of lithium-ion batteries and extensive use of power strips and extension cords.” The Coast Guard initiated a Concentrated Inspection Campaign for all Subchapter T- inspected vessels with overnight accommodation for passengers.34 On October 2 and November 1, 2019, the Coast Guard inspected the Truth Aquatics vessel Vision while it was not in operation and noted a total of 40 deficiencies. By comparison, during the previous annual inspection, carried out on April 2019, there were no deficiencies noted by the attending Coast Guard marine inspector. The concentrated inspection was conducted independent of the required regulatory inspections for certification and focused on firefighting, fire protection, means of escape systems, and crew proficiency/knowledge regarding the elements of firefighting, fire protection, and means of escape that rely on human intervention to successfully operate. Among the deficiencies documented aboard Vision was a requirement to provide a means of escape from the shower room that leads to an area that does not contain any source of fire (such as a galley stove). In the bunkroom, deficiencies were issued for an inoperable public address system speaker and for having a trash container without metal covering. The Coast Guard noted that the double bunks did not allow for free and unobstructed escape for the inside occupant as per the regulations. This bunk arrangement deficiency had never been cited during the previous 40- year history of the vessel. The Coast Guard also issued a “prior to carriage of passengers” order for the grease extraction hood, which was missing a heat detector (removed and taken as evidence by federal law enforcement during a search warrant served at the Truth Aquatics office and the Truth and Vision September 8–10, 2019), had a build-up of grease, and was missing a maintenance plan. After the fire on the Conception, Truth Aquatics voluntarily began modifications to the Vision and the Truth to improve safety aboard its two remaining vessels and address the deficiencies found during the Coast Guard’s inspections. The owner stated that, on each vessel, an integrated fire-detection system with manual call points was being installed, as well as an electronics-charging cabinet. The cabinet was equipped with self-closing doors and a fire- suppression system that vented to the exterior and was integrated with the fire-detection system. A relay for the fire detection system was designed to shut down all ventilation if smoke is sensed in any compartment on board each vessel. Additionally, the owner stated that the company was in the process of implementing a logging requirement for roving patrols. Fire escape ladders were procured for both wheelhouse wing stations, as well as Lipo-Safe bags for use while charging handheld VHF radios.35 Further, to improve the bunkroom egress on the Vision, watertight hatches leading from the bunkroom to the exterior walkways were installed on both the port and starboard side of the vessel, with ladders to assist with egress through the hatch (figure 32).

34 According to Coast Guard data, 383 vessels with overnight accommodations were inspected during the campaign, including 357 vessels under Subchapter T and 26 vessels under Subchapter K. 35 A Lipo-Safe bag is used for the charging and stowage of batteries. The bag has an inner lining made from a woven fire-retardant fiberglass material, which helps contain and reduce the risk of fires spreading outside the bag.

NTSB Marine Accident Report 53

Figure 32. Modifications made to the Vision after the accident on the Conception. Left: Ladders at the forward end on each side of the bunkroom lead directly to the weather deck. Right: Flush-mounted watertight hatches were installed in the deck, outboard of the galley. (Source: Truth Aquatics) Because the Coast Guard considered the Vision’s new egress to be a major modification, the new and existing emergency escapes were subject to New T regulations, even though the Vision was considered an existing vessel. New T regulations are more specific regarding emergency exit pathways, and as such, the owner of the Vision was required to submit the plans to the Coast Guard for approval. At the time of this report, the owner’s fire-detection system plans are also under review by the Coast Guard. 1.13 Similar Small Passenger Vessel Accidents and Related NTSB Safety Recommendations Previously Issued 1.13.1 Passenger Ferry Andrew J. Barberi – 2003 On October 15, 2003, the ferry Andrew J. Barberi struck a maintenance pier at the Staten Island Ferry terminal in Staten Island, New York. Fifteen crewmembers and an estimated fifteen-hundred passengers were on board. Eleven passengers died as a result of the accident, and seventy were injured. The NTSB determined that the probable cause of the accident was in part due to the failure of the New York City Department of Transportation to implement and oversee safe, effective operating procedures for its ferries. As a result of the investigation, the NTSB issued Safety Recommendation M-05-6 to the Coast Guard to “seek legislative authority to require all U.S.-flag ferry operators to implement [safety management systems] SMS, and once obtained, require all U.S.-flag ferry operators to do so.” The Coast Guard Authorization Act of 2010 authorized the Coast Guard to require the implementation of SMS on domestic passenger vessels, including domestic ferries, which satisfied the first part of Safety Recommendation M-05-6 (seek legislative authority to require all US-flag ferry operators to implement SMS).

NTSB Marine Accident Report 54 1.13.2 Passenger Ferry Andrew J. Barberi – 2010 On May 8, 2010, the Andrew J. Barberi was involved in a second accident when it struck a terminal structure at the St. George terminal in Staten Island, New York, after a loss of propulsion control. Eighteen crewmembers, two New York City police officers, two concessionaires, and two- hundred and forty-four passengers were on board. As a result of the accident, three passengers sustained serious injuries; forty-seven passengers, crew, and others reported minor injuries. The NTSB determined that the probable cause of this accident was a solenoid failure, which caused a loss of propulsion control of one of the vessel’s two cycloidal propellers. In its report, the NTSB noted that the New York City Department of Transportation had voluntarily implemented an SMS after the 2003 accident involving the vessel, which was evident in the response to the 2010 accident when personnel carried out their designated emergency procedures in a timely and effective manner. The NTSB expressed concern, however, that SMSs were still not required on US passenger vessels in domestic service. As a result, the NTSB superseded Safety Recommendation M-05-6 with Safety Recommendation M-12-3, which recommended that the Coast Guard require all operators of US-flag passenger vessels to implement SMSs, taking into account the characteristics, methods of operation, and nature of service of these vessels, and, with respect to ferries, the sizes of the ferry systems within which the vessels operate. 1.13.3 Seastreak Wall Street – 2013 The Seastreak Wall Street, a high-speed passenger ferry serving commuters traveling between New Jersey and New York City, struck a Manhattan pier at about 12 knots on January 9, 2013. Of the 331 people on board, 79 passengers and 1 crewmember were injured, 4 of them seriously. The NTSB determined that the probable cause of the accident was the captain’s loss of vessel control because he was unaware that the propulsion system was in backup mode. In addition, his usual method of transferring control from one bridge station to another during the approach to the pier did not allow sufficient time and distance to react to the loss of vessel control. Contributing to the accident, in part, was the operator’s ineffective oversight of vessel operations. In the report, the NTSB stated that it “continues to highlight the need for unambiguous, detailed operating procedures and believes they are prerequisite to managing a safe transportation system” and recommended that the operator implement an SMS. The report noted that regulations had yet to be implemented requiring SMSs for small passenger vessels, and thus the NTSB classified Safety Recommendation M-12-3 “Open-Unacceptable Response.” 1.13.4 Island Lady – 2018 On January 14, 2018, a fire broke out in an unmanned space on the small passenger vessel Island Lady near Port Richey, Florida, during a scheduled transit to a casino boat located about 9 miles offshore in the Gulf of Mexico. Fifty-three people were on board the Island Lady. After the captain beached the vessel, all crewmembers, employees, and passengers evacuated it by entering the water and wading/crawling ashore. Fifteen people were injured; one passenger died in the hospital several hours after the fire. The NTSB determined that the probable cause of the accident was the operator’s ineffective preventive maintenance program and insufficient guidance regarding the response to engine high-temperature conditions. In the report, the NTSB found that a requirement for an SMS would likely have ensured greater adherence to completing crew training drills, appropriate responses to emergencies such as alarms and fires, and failsafe record-keeping of training and maintenance-related documents. Therefore, the NTSB reiterated Safety Recommendation M-12-3.

NTSB Marine Accident Report 55 In the report on the Island Lady accident, the NTSB concluded that had the vessel been outfitted with fire detectors in the lazarette, the fire and its location would have been identified earlier, proving the opportunity for a swifter response. The NTSB issued Safety Recommendation M-18-13 to the Coast Guard to “require fire detection systems in unmanned spaces with machinery or other potential heat sources on board small passenger vessels.” The Coast Guard responded in October 2020, and the recommendation is currently classified “Open—Response Received.” 1.13.5 Vision – 2018 A small fire involving the charging of a lithium-ion battery took place on board the Truth Aquatics small passenger vessel Vision about a year before the fire aboard the Conception. On October 8, 2018, between 0415 and 0430 in the morning, a passenger, who was awake and in the galley, heard a “hissing” noise and then a loud “bang” that came from the bookshelf located at the aft starboard side of the salon (the Conception did not have a bookshelf in the same area). Another passenger, who was returning to the bunkroom after using the restroom on the aft deck, also heard the noise, which drew his attention to a fire on the bookshelf. He stated that the fire looked like a “torch” flame, and a battery charger (which was charging two lithium-ion batteries) was emitting smoke. The passenger in the galley grabbed a dry chemical extinguisher from the galley, and both passengers went to the battery charger. The passenger without the fire extinguisher unplugged the charger, grabbed the unburnt end of the charger, brought it out to the main deck, and threw it in to the rinse bin located under the stairs to the sun deck. The passenger with the fire extinguisher stated he discharged one “shot” on the bookshelf after the battery charger had been removed to extinguish the smoldering paper books on the shelf. He then grabbed a sponge and wetted the bookshelf and items on it to prevent reignition. Afterward, the passenger went to the wheelhouse and informed the captain, who in turn examined the batteries and charger in the rinse bin. The batteries and charger were removed from the rinse bin and thrown overboard. One of the passengers interviewed stated there was soot residue and scorch marks on the books and the shelf. The two batteries that caught fire were for an underwater diving light, and, according to the owner, the batteries had been removed from the light and were connected to a separate charger and plugged into a power strip on the bookshelf. The lithium-ion batteries were each 3.7 volts and capable of 5,000 milliamp hours. According to the captain on the Vision at the time, who was filling in as a relief captain, he photographed the charger and sent the photo to another captain in the Truth Aquatics fleet. Upon returning from the trip, he informed the owner of Truth Aquatics as well as the captain that took the Vision on its next trip. The owner of Truth Aquatics stated he was only made aware of the small fire on the Vision after the accident on the Conception. The owner noted that at the end of each trip, each captain was required to complete a “Trip Payment Report,” which required multiple handwritten entries Figure 33. Photograph taken of the battery charger that caught fire on the Vision (with the batteries removed).

NTSB Marine Accident Report 56 related to the voyage conducted, including the number of people on board, the amount of fuel used, and the number of engine running hours. At the bottom of the form, there was a “special comments about the trip section” where the captain on duty was required to enter any notable incidents that occurred during the trip, including “any accident, bad weather, notable rescues or incidents.” Investigators reviewed the completed form for the October 7–10 trip for the Vision and found no entries made in this section. There was no report to the Coast Guard of this incident, nor was there any requirement to do so, since the size of the fire did not meet the monetary damage threshold stated on the marine casualty reporting form (CG-2692), nor did it require treatment of injury beyond first aid or loss of life. 1.13.6 Red Sea Aggressor – 2019 On November 1, 2019, two months after the Conception accident, another dive vessel with overnight accommodations caught fire and sank. Just after midnight, the Egyptian-flagged, 120- foot, 247-gross-ton passenger, fiberglass-over-wood vessel Red Sea Aggressor (formerly named the Suzanna 1) caught fire while at a mooring off the coast of Port Ghalib, Egypt, with 19 passengers and a reported 12 crewmembers on board. All on board, except for one passenger, were able to abandon the Red Sea Aggressor. The passengers in the water were picked up by the crew in the vessel’s dinghy and brought to a dive vessel moored nearby. The passenger who did not escape, a female adult US citizen, was last seen in the lower deck accommodation space and was never found. She is presumed dead. The Red Sea Aggressor remained on fire until it sank. Passengers told investigators that they understood that there was a vessel-wide interconnected smoke detector system. Although the Red Sea Aggressor had fire detectors in the salon area—where the fire was suspected to have started—and in each of the staterooms, the passengers and crew sleeping below did not hear any alarms. Surviving passengers told investigators that they were informed there was a crewmember on watch during sleeping hours; however, none of the crew and passengers sleeping below deck were alerted to the fire by a crewmember. Surviving passengers stated they were either awakened by the smell of smoke or by other passengers. Similar to the Conception fire, the primary egress stairs to the main salon were blocked by smoke and fire. The below-deck passengers and crew escaped via an escape hatch that exited to a crew berthing area and up a ladder that led to the deck above, into a space separate from the primary stairway egress route. The passenger that opened the escape hatch, which was in his stateroom, recalled it was blocked on the other side by a mattress on which a crewmember was sleeping. The crewmember was awakened, and the mattress removed, allowing them to escape. Because US citizens were on board the vessel, and the fatality was a US citizen, the Coast Guard conducted an investigation related to the circumstances of the fire and subsequent sinking of the vessel by conducting interviews of witnesses and the surviving passengers. The NTSB was invited by the Coast Guard Office of Investigations and Casualty Analysis to participate in the investigation into the circumstances into the fire and subsequent sinking of the vessel. NTSB investigators were unable to interview the crew or management at Aggressor Adventures, the US- based company operating the Red Sea Aggressor, since they refused to be interviewed by the Coast Guard.

NTSB Marine Accident Report 57 2 Analysis 2.1 General The analysis first identifies factors that can be eliminated as causal to the fire aboard the Conception. The following issues are discussed next: • Origins and potential sources of the fire • Cause of death • Fire detection • Roving patrol • Means of escape • Search-and-rescue efforts • Oversight 2.2 Exclusions 2.2.1 Weather At the time the fire broke out on the Conception, weather and sea conditions were calm and did not contribute to the fire or hamper the crew’s attempted rescue efforts of the passengers and crewmember in the bunkroom. While conditions of reduced visibility were experienced by vessels responding to the accident, the weather and sea conditions did not impact their efforts to respond to the accident and fight the fire and did not have an effect on the survivability of those on board. The NTSB concludes that weather and sea conditions were not factors in the accident. 2.2.2 Alcohol and Other Drugs Surviving crewmembers stated that, in accordance with company policy, they had not consumed any alcohol during the accident voyage, nor had they seen any other crewmember consume alcohol. Following the accident, the captain, second captain, first deckhand, and second galley hand were tested for the presence of alcohol, and all results were negative. The surviving crewmembers were also tested for the presence of drugs, and results for the captain, second captain, and first deckhand were negative. The results for the second galley hand were negative dilute. The results of toxicology testing in association with the coroner’s examination of the second deckhand were also negative for alcohol and drugs. The first galley hand was not tested for alcohol because he was taken immediately to the hospital and treated for his injury upon arrival ashore. The first galley hand tested positive for marijuana metabolites in his urine. Metabolites for marijuana can remain in the body for up to 30 days, so the galley hand’s statement that he did not consume the drug while on the Conception is plausible. The NTSB concludes that the use of alcohol or other tested-for drugs by the Conception deck crew was not a factor in the accident. 2.3 Origins and Potential Sources of the Fire The fire aboard the Conception burned out of control with no intervention for about 1 hour and 41 minutes from the time of the captain’s initial distress call until firefighters arrived and began firefighting efforts. Due to the combustible nature of the vessel’s fiberglass-over-plywood

NTSB Marine Accident Report 58 construction, very little material above the main deck remained after the fire had been extinguished by the emergency responders. Examination of the recovered wreckage and debris did not yield any physical evidence relevant to the origin and cause of the fire. The surviving Conception crewmembers that investigators interviewed provided a snapshot of the state of the fire when it was first discovered. Their descriptions of the fire provide the basis for the analysis of the probable origin area of the fire. In addition to the crew interviews, an examination of a similar vessel in the Truth Aquatics fleet, the Vision, was performed to identify possible types of ignition sources available in the likely origin areas. Statements from previous passengers and crew on the Conception were also considered when evaluating the likely ignition sources for the fire. 2.3.1 Area of Origin None of the crewmembers interviewed by NTSB investigators reported any open flame or heat upon waking up from their bunks on the upper deck. The second galley hand did not report any fire on the open sun deck located aft of the accommodation and wheelhouse. During interviews, none of the crewmembers reported that they saw flames or felt heat coming from the anchor room located at the forward bow area below the main deck. Further, examination of the electrically powered winch motor and ropes recovered with the wreckage showed no signs of significant heat damage in that space. All galley appliances on board the Conception were electrically powered. The crew reported that the vessel’s refrigerators and freezers were the only equipment operating on the morning of the fire. As a precaution, and to prevent any accidental activation of an unattended burner, the vessel’s second galley hand opened the breakers for the flat-top griddle and the cooktop’s two burners the night before the accident. The second galley hand said that the only galley equipment running at the time of the accident were the refrigerators. Once the fire was discovered, crewmembers reported that they attempted to access the center galley window from the bow. The crewmembers saw smoke through the window and did not feel significant heat, allowing them to attempt to pry it open. Considering that all galley equipment was reported to be either de-energized or in good condition, the evidence indicates that the fire did not originate in the main deck galley at the forward section of the salon compartment. The fire also did not likely originate in the below-deck shower room or bunkroom. No fire or high heat were reported in the forward part of the galley, located above the shower room, and there was no heat, smoke, or flame sighted by a crewmember in the anchor room, which was adjacent to and forward of the shower room. With 33 passengers in the bunkroom and smoke detectors present, it is unlikely that an accidental fire could grow undetected in the bunkroom to the point where it would trap the occupants and preclude escape. While abandoning the vessel after the galley/salon and wheelhouse had been engulfed in flames, two surviving crewmembers opened the engine room hatch and described seeing the space filled with smoke. But neither described a presence of intense heat associated with a fire, nor did they recall hearing the alarm produced by the release of carbon dioxide from the heat-activated fixed fire-extinguishing system. Since the Conception was anchored with both main propulsion engines shut down, the smoke in the engine room was likely from the established fire, which entered the engine room via the main deck ventilation ducting.

NTSB Marine Accident Report 59 At night, it was normal procedure to operate the fan that was in the bulkhead between the engine room to the lazarette to help dry wet suits hanging in the lazarette. The fan likely would have drawn smoke in through the main deck ventilation ducting and filled the engine room and lazarette. Given that the lazarette was aft of the engine room, and the entrance was adjacent to where the two crewmembers had re-boarded the vessel, accessed the skiff, and passed en route to the engine room without feeling any heat, it is not likely there was any fire in the lazarette. The diesel generator had a history of overheating while running all three air compressors and operating the flat cooktop in the galley. However, at the time of the fire, none of the air compressors were operating, nor was the flat cooktop. Additionally, surviving crewmembers reported that electrical power was being supplied by the generator during the evacuation of the vessel, after fire had engulfed the salon. Electric lights in the engine room and lazarette were seen to be illuminated during the evacuation of the vessel, and the aft swim platform hydraulic-electric winch was used by the crew to lower the skiff into the water and escape the burning vessel, indicating that the generator was functioning at the time of abandonment. The aft portion of the salon compartment, and in particular the starboard side, was consistently identified in the crew interviews as having the most intense fire at the time they encountered it. When observed from the upper deck through the door to the crew berthing area, the crewmembers described an orange glow near the stairs at the aft starboard end of the sun deck. Approaching the stairs and looking down, the second galley hand described flames at the base of the stairs and the starboard toilet, preventing him from using the stairs to access the main deck. The crewmembers also described smoke coming up the sides of the sun deck on both the port and starboard sides. Crewmembers used the port side of the sun deck and the portside wing station of the wheelhouse to make their way down to the main deck after their initial assessment of the conditions. The crew described the fire as filling and effectively blocking the open doors to the aft portion of the salon and extending outward to where the restrooms were located. Smoke and some intermittent flames were also described as coming out the aftmost windows of the salon on the port side of the vessel. The second galley hand, who was the first crewmember to arrive on the main deck, was able to drop down from the port side of the sun deck. He was able to walk down the port side of the vessel to the open doors to the salon, where he witnessed the entire area engulfed in flames, including the escape hatch, before walking back up the port side to the bow. The other crewmembers dropping down to the main deck after him did not feel that they could walk down the port side of the vessel to access the stern due to the smoke and some flames that were exiting the aftmost portside windows of the salon. At the exterior aft of the salon, there was a large polyethylene trash can underneath the stairs to the upper deck. Polyethylene trash cans are highly combustible and cannot contain a fire originating from within. However, fire tends to spread vertically at a much greater rate than it does horizontally. If the fire had started on the exterior of the salon in the area of the stairs to the upper deck, it would be reasonable to expect that the fire would have spread vertically, igniting the stairs above and spreading to the upper deck before it spread horizontally and into the salon compartment. The descriptions given of the fire indicate more fire involvement internal to the salon and around the port and starboard restrooms of the entranceway to the salon than external and spreading up to the upper deck. The NTSB concludes that the origin of the fire on the Conception was likely inside the aft portion of the salon.

NTSB Marine Accident Report 60 2.3.2 Ignition Potential Sources. In the interior of the aft portion of the salon, the potential sources of ignition available included the vessel’s electrical system and the electronic devices and batteries being charged at the aftmost tables and aft bulkhead area. On the aft exterior of the salon, the potential ignition sources would likely be limited to improperly discarded smoking materials in the trash can. An energized electrical system has the potential to become a source of ignition when elements of the system age, are improperly installed, or are accidentally damaged. Crew interviews revealed that, on occasion, electrical work, such as the replacement of lighting electrical fixtures in the salon, was completed by crewmembers, who were not licensed electricians. Although examination of the Conception’s electrical system was not possible, the examination of the Vision and the similarity of the two vessels would suggest similar electrical installations and condition. On October 2, 2019, a Coast Guard inspection found 19 electrical system deficiencies throughout the Vision. Some of the deficiencies cited were a result of work being done at the time. Deficiencies in the salon and galley area included corrosion, improper connectors, and signs of overload on a power strip. Deficiencies of this type can lead to electrical system malfunctions capable of initiating a fire. Since the salon compartment was a critical element in the egress pathway from the passenger bunkroom, prudent fire safety planning would suggest that risky activities (unattended charging of batteries) and materials, such as the plastic chairs and polyethylene trash cans, that could contribute to a fire should have been minimized in this area. This was not the case on the Conception. Crew statements, as well as statements from previous passengers, indicated that the overnight, unattended charging of a large number of batteries was a normal practice in the salon compartment and was a risk that had not been considered. Each device and battery represented a separate potential source of ignition. The passengers on the Conception were recreational divers, so in addition to common types of electronic items, such as phones, tablets, digital cameras, and laptops, divers also used underwater cameras, flashes, strobes, and flashlights. Batteries (in particular, lithium-ion batteries) have a known and documented history of initiating accidental fires. In the past, the Consumer Product Safety Commission has issued numerous product safety recalls due to fires caused by electronic devices with defective batteries and chargers. The NTSB has investigated accidents in which battery failures led to fires, and, based on the history of incidents involving fires, the Federal Aviation Administration enforces regulations on the carriage of lithium-ion batteries aboard passenger aircraft.36 About a year prior to the fire on board the Conception, a small fire involving a charging lithium-ion battery took place on board the similar vessel Vision; a passenger was able to extinguish the fire by unplugging the charger and throwing it in a rinse bin. However, unlike in the incident on board the Vision, the fire aboard the Conception grew, and the vessel burned for almost four hours, thus destroying much of the materials in the salon and aft deck area. Further, based on past accidents that the NTSB has investigated, conclusive causal physical evidence identifying a thermal runaway of a lithium-ion

36 Recent NTSB investigations involving battery fires include Lithium-Ion Battery Truck Fire Following Aerial Transport, Brampton, Ontario, Canada, June 3, 2016 (HZB-20/01) and Auxiliary Power Unit Battery Fire Japan Airlines Boeing 787-8, JA829J, Boston, Massachusetts, January 7, 2013 (AIR-14/01). These reports and other information regarding investigations involving battery fires are available at www.ntsb.gov.

NTSB Marine Accident Report 61 battery is difficult to differentiate from a lithium-ion battery thermal runaway caused by exposure to fire. At the exterior of the aft portion of the salon (in the area where the stairs lead to the upper deck), the only potential sources of ignition would include transient types, such as discarded smoking materials. Based on the examination of the Vision and the statements from previous passengers, there was no evidence of electrical systems or electronic devices being charged in this area. There was, however, one large polyethylene trash can located aft of the salon underneath the stairs to the upper deck where one could potentially discard smoking materials. Old T regulations did not allow for the use of these trash cans in the passenger bunkroom but did not preclude their use in any other area of the vessel. New T regulations do not allow the use of these combustible trash cans in any areas of the vessel but do not retroactively apply to vessels built under the Old T regulations unless they are replaced. As stated earlier, polyethylene trash cans are highly combustible, making them susceptible to accidental fires that could be caused by the improper disposal of smoking materials or other unforeseen sources of ignition. The NTSB concludes that although a definitive ignition source cannot be determined, the most likely ignition sources include the electrical distribution system of the vessel, unattended batteries being charged, improperly discarded smoking materials, or another undetermined ignition source. Time of Ignition. Fires not involving accelerants (such as fuel) typically go through an incipient stage following the ignition and then transition into a growth stage. The rate of the growth stage is highly dependent on the type of materials burning and the geometry of the compartment in which the fire is taking place. Fires inside compartments such as the Conception’s salon, which had a low ceiling (about 7.5 feet), tend to have high growth rates due to the heat from the fire and products of combustion accumulating at the ceiling and thermally radiating down to the unburned materials. This radiative heating causes the materials to begin to thermally break down and emit flammable vapors. Once this happens, the compartment fire can enter a stage called flashover during which all the combustible materials start to become involved, and the compartment becomes filled with flames. At this point, the compartment is deemed untenable for human survival. Based on the crew interviews, the fire likely reached the flashover stage around the time or shortly after it was discovered. The crew interviews indicated that a window of approximately 30 minutes passed between the time the salon compartment was last visited to when the fire was discovered. Sometime within that 30-minute window, an incipient fire became established and transitioned into a fast-growing fire, followed by flashover. The construction materials of the vessel (fiberglass over wood) were not fire-resistant and are, in fact, known to burn quite freely. Additionally, the interior furnishings such as the wooden tables, plastic chairs, polyethylene trash cans, seat cushions, and FRP laminates would have added to the fast-growing fire. The compartment configuration would compound the ease of combustibility by trapping the heat and preheating the materials not yet involved. It is not unusual under these circumstances for a fire to reach the flashover point in a short timeframe. The unknown in this accident is the incipient stage of the fire, which depends on the ignition source, the location of the ignition, and the first materials to become involved. Therefore, the NTSB concludes that the exact timing of the ignition cannot be determined.

NTSB Marine Accident Report 62 2.4 Cause of Death NTSB investigators reviewed reports completed by the Santa Barbara Coroner’s Office for all 34 decedents. Autopsies were not completed due to severe thermal injuries, obvious trauma, and the circumstances of the accident. All deaths were attributed to smoke inhalation. On the similar Truth Aquatics vessel Vision, NTSB investigators examined the bunkroom ventilation equipment, which consisted of an air conditioning unit, an electric supply fan, and two electric exhaust fans. The combined air flow capacities of the Vision’s two exhaust fans exceeded the capacity of the single supply fan, and air was likely drawn into the bunkroom from the open stairs leading to the galley and salon area. The Vision’s bunkroom ventilation equipment was similar to the type and size of equipment on board the Conception. At the time of the fire, the larger combined capacity of the operating bunkroom exhaust fans could have drawn smoke and noxious gases from above in the salon down into the bunkroom via the open stairwell. The air conditioning unit circulation fan, which was operating at the time of the accident and took suction from a grille diffuser directly at the bottom of the stairs and discharged to vents located in each bunk and to the passageways between the bunks, would have further distributed the smoke and gas. The bunkroom ventilation system likely continued to operate during the initial stages of fire aboard the Conception, although the exact timing when the air conditioning unit and ventilation fans ceased operating could not be determined. Given the ventilation imbalance and that the one open exit led to the space with the fire, it is likely the bunkroom filled with smoke. Coroner reports and diver video also documented that 13 deceased passengers were wearing footwear, and the second deckhand had sandals on both of her feet, indicating that some of the passengers and the second deckhand were awake and attempting to escape prior to being overcome by smoke. In one case, the victim was wearing a sandal on one foot and a hiking boot on another, indicating that the victim was likely in a rush. Passengers also appeared to have prepared to escape the vessel, since two victims had cell phones, one had a flashlight, another had a backpack, and two were wearing jackets. Silhouette areas of protection were found on unburned, sooted wood in the forward bunkroom near the stairs to the galley and salon, indicating that some of the passengers were not in their bunks and were laying against those sections prior to the sinking of the Conception. The passengers who were awake would have likely awakened the other passengers before they attempted to escape the bunkroom. Therefore, the NTSB concludes that most of the victims were awake but could not escape the bunkroom before all were overcome by smoke inhalation. 2.5 Fire Detection The Conception was equipped with two modular smoke detectors in the bunkroom—one mounted in the overhead of each aisle (port and starboard). Coast Guard regulations required no additional smoke detectors aboard the Conception, and therefore the salon and crew quarters were not equipped with them. Truth Aquatics’ owner told investigators the smoke detectors in the bunkroom had hard-wired power supplies with a battery backup. Interviews with crewmembers and the owner of Truth Aquatics indicated that the bunkroom smoke detectors were likely operational. Contractors working on the air conditioning had inadvertently activated them about one month prior to the accident. The captain of the Conception unplugged the detectors while the contractor was soldering but plugged them back in and replaced the batteries and tested the

NTSB Marine Accident Report 63 detectors after the work was finished. Since the captain of the Conception was not able to be interviewed, investigators were unable to determine any specifics of the detectors being placed back in service, when he last tested them, or any routine tests and inspections the captain had for the detectors. Aboard the Vision, however, investigators found the smoke detectors’ hard-wired power supply disconnected, although the battery-powered detectors were functional and met the regulations. Smoke detectors sense products of combustion, which are hot and rise due to buoyancy, and activate an alarm. Smoke detectors mounted to ceilings therefore will encounter the products of combustion as early as possible. The smoke detectors in the passenger bunkroom would have provided early warning of a fire originating in the bunkroom only. When a fire in the salon (the compartment above the bunkroom) began to produce combustion products, those products would have risen to the ceiling and spread out along the length of the ceiling until they reached the bulkheads, creating a smoke layer at the ceiling that thickened and began to fill the compartment from the top down. The buoyancy of the smoke layer would have made it difficult for sufficient amounts of combustion products to migrate down to deck level, and even more difficult to migrate further down into the compartment below. A fire in the salon therefore would not have activated the smoke detectors in the bunkroom in a timely manner, allowing the fire time to grow. The NTSB concludes that the fire in the salon on the main deck would have been well developed before the smoke activated the smoke detectors in the bunkroom. In accordance with New T (all vessels) regulations applicable to the Conception, the only compartment that was required to be fitted with smoke detectors was the passenger bunkroom, since it was the vessel’s only overnight accommodation space. More robust fire-detection systems are required for larger US-flagged passenger vessels, such as those inspected under 46 CFR Subchapter K. On Subchapter K vessels, accommodation, control, and service spaces are required to have a “smoke actuated fire detection system” and “a manual alarm system.” New T regulations (all vessels), in contrast, only require a household-type smoke detector. A properly functioning fire-detection system with appropriately located smoke detectors is an effective means of early warning and detection of fire. Successful escape from fires is contingent on early warning, especially when occupants are asleep. The Conception had no smoke detectors anywhere in the main deck salon area where crewmembers reported seeing the fire. The nearest heat detector was well forward in the galley, a deck above the bunkroom, and was not intended to be utilized as a smoke detector for the entire salon. The NTSB concludes that although the arrangement of detectors aboard the Conception met regulatory requirements, the lack of smoke detectors in the salon delayed detection and allowed for the growth of the fire, precluded firefighting and evacuation efforts, and directly led to the high number of fatalities in the accident. The NTSB therefore recommends that the Coast Guard revise 46 CFR Subchapter T to require that newly constructed vessels with overnight accommodations have smoke detectors in all accommodation spaces. The NTSB likewise recommends that the Coast Guard revise 46 CFR Subchapter T to require that all vessels with overnight accommodations currently in service, including those constructed prior to 1996, have smoke detectors in all accommodation spaces. Regulations require fire detection in engine rooms on most Subchapter T vessels, including the Conception, which had heat detection and a fixed fire-suppression system in its engine room. In January 2018, a fire that started in the lazarette—a space that was not required to have fire detection—on board the Island Lady went undetected and grew out of control. After the fire was established and spread, it eventually engulfed the vessel. In its investigation of the Island Lady accident, the NTSB concluded that had there been a smoke detector in the lazarette, the fire and

NTSB Marine Accident Report 64 its location would have been identified earlier. The NTSB recommended that the Coast Guard require fire detection systems in unmanned spaces with machinery or other potential heat sources on board small passenger vessels. The smoke detectors aboard the Conception only sounded locally, meaning that once a detector was activated, it sounded only in the space it occupied (in this case, the bunkroom). None of the surviving crew heard the vessel’s detectors sounding during the fire, since the fire likely originated in the salon and not the bunkroom, where the smoke detectors were located. An interconnected fire detection and alarm system would sound alarms in all spaces when one alarm is activated; the system would incorporate all required smoke and fire detectors fitted on board the vessel, including those in the engine room, other machinery spaces, or the lazarette. In this accident, an interconnected system with smoke detectors in all accommodation spaces would have sounded throughout the vessel in the salon, bunkroom, and upper deck, alerting crew and passengers and giving the crew more time to fight the fire and assist the passengers below. Passengers sleeping in the bunkroom would have been awakened by the alarms going off throughout the vessel, including in the bunkroom, giving them a better chance to escape. The circumstances of this accident make clear that interconnected smoke detectors in all accommodation spaces would have given early warning of the fire to the passengers and crew and likely would have allowed time for the crew to fight the fire and assist passengers in evacuating the bunkroom. Currently, Subchapter K passenger vessels with overnight accommodations must have smoke detectors in accommodation spaces, but detectors are not required to be interconnected. Subchapter K vessels are typically larger than Subchapter T vessels, with more accommodation spaces and distance between those spaces. Additionally, Subchapter K vessels are allowed to carry more than 49 passengers overnight (or more than 150 passengers during the day). Therefore, interconnecting detectors on both Subchapter K and Subchapter T vessels is critical, since passengers and crew are subject to the risk of an undetected fire. The NTSB concludes that interconnected smoke detectors in all accommodation spaces on Subchapter T and Subchapter K vessels would increase the likelihood that fires will be detected early enough to allow for successful firefighting and the evacuation of passengers and crew. The NTSB therefore recommends that the Coast Guard revise 46 CFR Subchapter T and Subchapter K to require all vessels with overnight accommodations, including vessels constructed prior to 1996, have interconnected smoke and fire detectors such that when one detector alarms, the remaining detectors also alarm. (The system installed on Truth Aquatics’ remaining vessels after the Conception fire exceeds the minimum requirements recommended here.) The NTSB believes that it is imperative that operators of similar small passenger vessels learn about the circumstances of this accident and act without waiting for the Coast Guard to require action to install interconnected smoke detectors in all accommodation spaces to provide passengers and crew with early warning of fires. Therefore, the NTSB recommends to the Passenger Vessel Association, Sportfishing Association of California, and National Association of Charterboat Operators that, until the Coast Guard requires all passenger vessels with overnight accommodations, including vessels constructed prior to 1996, to have smoke detectors in all accommodation spaces, share the circumstances of the Conception accident with their members and encourage members to voluntarily install interconnected smoke and fire detectors in all accommodation spaces such that when one detector alarms, the remaining detectors also alarm.

NTSB Marine Accident Report 65 2.6 Roving Patrol The requirement to keep a watch at night while passengers are embarked on a vessel has been codified in US law for nearly 150 years. The law came into effect when vessels were primarily constructed of wood and the advent of steam power had greatly increased the threat of fire. The threat of fire has been reduced by modern engineering, fire detection, and fire extinguishing equipment, but the law has remained largely unchanged since it was originally enacted. While the probability of a fire is less, the consequences of a fire, particularly on a wood vessel carrying passengers, has warranted the continuation of the legal requirement for a watch at night. In the event that a space is not equipped with a smoke detector, or if a smoke detector fails to activate, the only means of detecting a fire aboard the vessel is limited to discovery by a crewmember or a passenger. The law (46 USC Section 8102) requires “a suitable number of watchmen in the vicinity of cabins or staterooms and on each deck to guard against and give alarm in case of fire or other danger.” For small passenger vessels subject to Subchapter T regulations, this requirement has been interpreted by the Coast Guard to be a suitable number of watchmen who “patrol throughout the vessel during the nighttime, whether or not the vessel is underway, to guard against, and give alarm in case of, a fire, man overboard, or other dangerous situation.” This interpretation is based partly on the size of vessels subject to Subchapter T allowing a single watchman to rapidly patrol the vessel on a periodic basis.37 On the Conception (and all other Subchapter T vessels visited by the NTSB during this investigation) the requirement for watchmen was included in the vessel’s COI, which stated “a member of the vessel’s crew shall be designated by the master as a roving patrol at all times, whether or not the vessel is underway, when the passenger’s bunks are occupied.” According to surviving crewmembers, all members of the crew had gone to sleep the night before the fire, after the Conception had anchored in Platts Harbor. No roving patrol was set. When the second galley hand awoke, the fire was well developed and beyond the capability of the crew to extinguish it. The crew was not able to warn passengers or aid in their escape. Had a crewmember been awake and actively patrolling the Conception on the morning of the fire, it is likely that they would have discovered the fire at an early stage, allowing time to fight the fire and give warning to the passengers and crew to evacuate. The NTSB concludes that the absence of the required roving patrol on the Conception delayed detection and allowed for the growth of the fire, precluded firefighting and evacuation efforts, and directly led to the high number of fatalities in the accident. The purpose of the Coast Guard inspections is to ensure that vessels are complying with applicable laws, regulations, and the terms of the vessel’s COI. The Conception was inspected as required by New T regulations (all vessels), and in the 5 years before the accident, inspectors found only minor discrepancies. Only one “prior to carriage of passengers” order was issued during that time, and it was cleared within a day. The owner of Truth Aquatics believed that the company’s fleet of three vessels was in compliance with the applicable regulations, based on satisfactory completion of the required Coast Guard inspections and examinations. Prior to the accident, the Conception and other Truth Aquatics vessels were regularly operating in contravention of the regulations and the vessel’s COI, which required a roving patrol at night and while passengers were in their bunks. Truth Aquatics encouraged passengers to board

37 54 Federal Register 4443-4444.

NTSB Marine Accident Report 66 their vessels the night before an early morning departure from their Santa Barbara dock, and passengers had already boarded the Conception before the first crewmembers—the second captain and galley hands—arrived between 2200 and midnight the night before the vessel got under way for the accident voyage. After boarding the vessel and stowing their gear, the crew went to sleep. No roving patrol was set, and there were no crewmembers awake on the vessel until the remainder of the crew arrived about 30–40 minutes before getting under way. A captain of another Truth Aquatics vessel stated that it was a regular practice for passengers to board his vessel the night before an early morning departure, but the crew was not required to be aboard until 30 minutes prior to getting under way. Once the Conception was under way en route to Santa Cruz Island during the accident voyage, the second captain and the deckhands went to their bunks (the galley hands had remained in their bunks while the vessel got under way), and the captain operated the helm in the wheelhouse. There was no roving patrol set during the early morning transit. Similarly, the deckhand told law enforcement officials that, when he had been assigned night navigation watches on previous voyages, he was the only crewmember awake and no other watches were set. Current and former crewmembers on the Conception, Vision, and Truth stated that roving patrols were not being maintained on any Truth Aquatics vessels. One captain told investigators that, although he believed that the legal and regulatory requirements for a roving patrol were not being met, it was the way he had been instructed when he joined the vessel. Another captain stated that the requirement for the patrol was a regulation, “but it wasn’t really followed.” During the investigation, NTSB staff visited other dive boats operating from Southern California ports and harbors and spoke with their owner/operators. During informal discussions, all owners/operators stated that night watches were assigned whenever passengers were aboard, but the procedures for the watches varied greatly. On some of the vessels, crewmembers assigned to the watch spent a majority of their time in a single location—either the wheelhouse or the salon—which does not appear to meet the intent of the regulation. When asked by investigators, Coast Guard inspectors stated that they could not verify compliance with the roving patrol requirement, since inspections were not conducted during overnight voyages with passengers embarked. There was no requirement for a log for the roving patrol, and thus no records existed to verify that the patrol was being properly implemented. Coast Guard inspection aids and checklists reviewed by the NTSB, such as those contained in the CG-840 TI inspection book and the MSD Santa Barbara “Small Passenger Vessel – T” checklist, did not include line items to verify or discuss regulatory watchstanding requirements or the terms of the COIs. Coast Guard records show that, since 1991, no owner, operator, or charterer has been issued a citation or been fined for failure to post a roving patrol. The NTSB concludes that the Coast Guard does not have an effective means of verifying compliance with roving patrol requirements for small passenger vessels. The NTSB recognizes that the resources necessary to conduct unannounced, overnight, underway inspections to positively verify roving patrol watchstanding compliance may be impractical. Therefore, other means need to be developed to verify compliance with the roving patrol requirements. For example, at the most basic level, a log containing the time of the roving patrol and the name and signature of the watchstander would give Coast Guard inspectors an indication of the level of compliance when reviewed during inspections. More advanced watchstander management systems are also commercially available and would provide greater credibility to the compliance verification process. A review of logs or watchstander management records during inspections would also provide inspectors the opportunity to discuss the

NTSB Marine Accident Report 67 requirement with owners, operators, and charterers and underscore the importance of the patrol for the safety of passengers. Given the importance of this patrol to the safety of passengers and crew, the NTSB recommends that the Coast Guard develop and implement a means to verify that small passenger vessel owners, operators, and charterers are conducting roving patrols as required by 46 CFR Subchapter T. 2.7 Means of Escape The Conception had two means of escape from the bunkroom, both of which led to the salon. The primary access was a spiral staircase from the starboard forward part of the main deck salon to the starboard forward corner of the bunkroom. Anyone trying to escape the bunkroom with a fire in the aft salon would have encountered heavy smoke in the stairway and low visibility conditions. Even if they succeeded in ascending the stairs, the main exit (open doors) from the salon was blocked by the fire. They would have had to find their way through a fire-filled space, with thick, dark smoke and zero visibility, to get outside through the emergency window exits. The secondary emergency exit for the bunkroom occupants was the square escape hatch on the centerline in the overhead. The Conception’s escape hatch was accessible from either port or starboard aisles by climbing into one of the top aftermost inboard bunks. This emergency exit opened into the aft part of the salon, where the fire was most intense. In fact, surviving crewmembers reported seeing the whole area around the escape hatch ablaze before abandonment, indicating it was not an option for escaping the bunkroom. As this accident clearly shows, having two emergency escape paths that exit into the same space provides the opportunity for a single hazard to block both. The NTSB concludes that the Conception bunkroom’s emergency escape arrangements were inadequate because both means of escape led to the same space, which was obstructed by a well-developed fire. The Conception was designed in accordance with the Old T regulations at the time of construction. As such, the vessel was required to have “not less than two avenues of escape from all general areas accessible to the passengers or where the crew may be quartered or normally employed, so located that if one is not available the other may be.” There were no additional requirements regarding size, egress times, vertical access, or obstructions. Therefore, the Conception’s two means of escape from the bunkroom (spiral stairs and escape hatch) leading to the salon met the means of escape requirements in Old T regulations (existing vessels). The New T regulations for emergency escape, which did not apply to the Conception as an existing vessel, require an escape path to be a minimum of 32 inches wide, and the route must facilitate easy movement of a person wearing a lifejacket. New T regulations (new vessels only) also prohibit ladders leading to deck scuttles as a means of escape for vessels this size. The regulations do not require that passengers and crew be able to evacuate within a specific timeframe. Instead, New T regulations (new vessels only) require escapes of a number and dimensions “sufficient for rapid evacuation.” Rapid evacuation is not further discussed or defined. When considering the fire safety aspects regarding the evacuation from occupied spaces both the exit capacity (number and size of exits) and the escape path to reach an area of refuge must be considered. If all escape paths are compromised, then the evacuation fails. The exits and the escape paths are equally important elements of the evacuation plan and must be given consideration as a system. The goal is to maintain a tenable evacuation pathway so that the occupants can make their escape. Coast Guard regulations applicable to the Conception do not address the escape path as an element of the fire safety plan. The regulations only consider the

NTSB Marine Accident Report 68 exits from occupied spaces. Although the regulations require vessels to have two exits from an occupied space, spaced as far apart as practicable, the regulations do not preclude having both exits lead to the same compartment, as was the case in the Conception. In this circumstance, the salon compartment was the only escape path to exterior (weather) decks. Therefore, because the fire was located in the salon, the passengers were trapped, and the crew was not able to reach them. If an escape hatch had exited to a space other than the salon, optimally directly to the weather deck, some of the occupants in the bunkroom may have been able to escape. By comparison, in the similar fire aboard the Egyptian vessel Red Sea Aggressor, the primary stairway exit was blocked by smoke and fire in the salon, but all of the surviving passengers and crew that were sleeping below deck were able to escape through the emergency escape hatch, which led to a different space than the primary stairs did. Aboard the Red Sea Aggressor, the escape led to a forward crew berthing area and up a ladder through a door to the weather deck. All but one of the passengers successfully escaped. The NTSB concludes that Subchapter T (Old and New) regulations are not adequate because they allow for primary and secondary means of escape to exit into the same space, which could result in those paths being blocked by a single hazard. Therefore, the NTSB recommends that the Coast Guard revise 46 CFR Subchapter T to require newly constructed small passenger vessels with overnight accommodations to provide a secondary means of escape into a different space than the primary exit so that a single fire should not affect both escape paths. Similarly, the NTSB recommends that the Coast Guard revise 46 CFR Subchapter T to require all small passenger vessels with overnight accommodations, including those constructed prior to 1996, to provide a secondary escape path into a different space than the primary exit so that a single fire should not affect both escape paths. The circumstances of this accident make clear that means of escape that exited to separate or outside spaces, such as the weather deck, may have provided the occupants in the bunkroom a greater opportunity to escape. The NTSB believes it is imperative that operators of similar small passenger vessels act to ensure that secondary means of escape exit to a different space than the primary exit. The NTSB therefore recommends to the Passenger Vessel Association, Sportfishing Association of California, and National Association of Charterboat Operators that, until the Coast Guard requires small passenger vessels with overnight accommodations to provide a secondary means of escape into a different space than the primary exit, share the circumstances of the Conception accident with their members and encourage members to voluntarily do so. Had the bunkroom escape hatch not been blocked by fire, there still may have been difficulties evacuating a large number of people through the hatch in a timely manner. The escape path through the hatch was impeded by the bunks below it. Passengers would have had to climb up a bunk’s ladder and onto a bunk to reach the escape, and therefore, the approach to the hatch did not facilitate easy movement of a person through it. The escape path would have been challenging for anyone to navigate without practice and would have been further complicated by low lighting and poor visibility due to smoke from the fire. Further, it would have been extremely difficult to evacuate an injured or unconscious person through the hatch. The Conception’s escape hatch met the requirement in the Old T regulations for a second emergency egress pathway from the bunkroom; Old T regulations did not stipulate the size of, egress times from, or vertical access to the hatch, or address the possibility of obstructions. The NTSB concludes that, although designed in accordance with the applicable regulations, the effectiveness of the Conception’s bunkroom escape hatch as a means of escape was diminished by the location of bunks immediately under the hatch. The NTSB recommends that the Coast Guard review the suitability of 46 CFR Subchapter T regulations regarding means of escape to ensure

NTSB Marine Accident Report 69 there are no obstructions to egress on small passenger vessels constructed prior to 1996 and modify regulations accordingly. 2.8 Search-and-Rescue Efforts The Conception’s captain was able to transmit only a quick VHF radio distress call before being overwhelmed by smoke and forced out of the vessel’s wheelhouse. The crew did not have the opportunity to collect and activate the EPIRB or visual distress signals prior to or after abandoning the Conception. The Coast Guard computed the Conception’s position based on VHF radio direction finders, and although the calculation was about 6.5 miles from the actual position of the Conception, it would have been close enough for any search and rescue unit to see the fire, and the position would have been updated with AIS and/or VTS information before any search and rescue unit arrived on scene. Coast Guard watchstanders heard the captain say he could not breathe and assumed there was a medical emergency, not a fire, on board. Coast Guard watchstanders alerted the closest small boat station at Coast Guard Station Channel Islands Harbor. The Station’s boats however, had no advanced life support equipment, so the crew requested assistance from the Ventura County Fire Department. The initial distress call was made at 0314, the call to the Station at 0323. Once the Command Center understood that the nature of the emergency was fire from the Grape Escape’s radio call at 0329, they relayed the information to the Station, where the first boat was launched at 0342. A second boat got under way, with an engine company from VCFD, at 0349. Additional resources followed. At the time of the call from the Conception’s crew on board the Grape Escape, the fire was reported to have “fully engulfed” the Conception. The first boats on scene were the Coast Guard’s two RB-Ms, making the 27-mile trip at full speed in about 50 minutes. Although outfitted with portable dewatering pumps that could be used for fighting fires, the boats were not capable of fighting a fire of this magnitude. The VCFD engine captain and RB-M coxswains chose to search for survivors in the water and along the shoreline, realizing their limited firefighting capability, and aware that a fire boat was en route. At 0441, the first fire boat arrived on scene. At 0508, the fire was first reported extinguished, although it did reflash at least twice after that report. Search efforts by both surface and air assets found no survivors. The location of the vessel fire, 27 miles from the California mainland, and the advanced nature of the fire at the time of reporting made for a challenging response. Further, Coast Guard watchstanders did not understand that the emergency was a fire until 15 minutes after the initial mayday call, which slowed the dispatch of firefighting assets. Even if they had known that the emergency was a fire, the location of the vessel prevented a speedy response. It took about 50 minutes to travel there at full speed, and reports from the Grape Escape indicated that the vessel was likely beyond saving at the time of the call for help. The NTSB concludes that the emergency response to the accident was appropriate but was unable to prevent the loss of life given the rapid growth of the fire at the time of detection and the location of the Conception. 2.9 Oversight Truth Aquatics was a well-respected operator among regulators, current and former crewmembers, competitors, and passengers. A Coast Guard representative stated that the company

NTSB Marine Accident Report 70 “had a good reputation for being good operators,” and a former captain of the Truth Aquatics dive boat Vision described the company’s vessels as “the safest boats on the coast.” Yet, despite its reputation, the NTSB found several unsafe practices on company vessels. NTSB investigators sought to understand how these practices became normalized in a company that, by most accounts, was considered to be a safe and effective operator. In reviewing the company’s policies and procedures, along with the Coast Guard regulations, it is clear that Truth Aquatics had been deviating from required safe practices for some time. As previously noted, current and former Truth Aquatics employees stated that required roving patrols were not conducted on company vessels, and although the captains and other crewmembers were aware of the requirement for the patrol, they ignored it. New T regulations (all vessels) require that a credentialed master or mate at all times direct and control the movement of a vessel when under way. However, on occasion, the Conception’s captain would assign one of the uncredentialed deckhands to helm watches at night while the vessel was under way when all other crewmembers were asleep, including the captain and second captain. The deckhands would be responsible for directing and controlling the vessel and were instructed to awaken the captain if the engines made unusual noises or if the Conception came within 2 miles of other vessels. Regulations also require that, “prior to getting underway for the first time and at least once every three months,” new crewmembers be instructed on the duties that the crewmember is expected to perform during emergencies, including fire, heavy weather, or man overboard. Truth Aquatics’ Loss Control Program document contained crew procedures for these emergencies, and the Conception second captain and an alternate second captain, both of whom had been hired in 2019, stated that they had received and reviewed this document prior to joining the vessel. However, the alternate second captain stated that no one verified that he had read and understood the emergency procedures prior to getting under way. The first galley hand, who had begun working aboard the Conception about 3 weeks before the accident, had also received the Loss Control Program document, but not until just prior to the accident voyage—his fifth or sixth on the vessel. He stated that he wrote down the headings to each of the emergency procedures and asked the captain about them the day before the accident, but the captain deferred discussion to a later time. Other current and former crewmembers stated that there was no formal training for new employees prior to getting under way, and all training was on-the-job, as time allowed. Regulations further required that the captain conduct sufficient fire drills to ensure that crewmembers were familiar with their duties. The drill logs for the Conception were lost in the fire, and thus could not be reviewed for completeness or currency. According to Coast Guard records, the drill log was not up to date during the vessel’s 2017 Coast Guard annual inspection. During interviews, the second captain, first deckhand, and second galley hand stated that they had never participated in a fire drill aboard the Conception. The second captain had only been aboard the vessel for 2 months, so it is feasible that a regularly scheduled drill had not yet been conducted. However, the first deckhand and the second galley hand had been aboard since November 2018 and October 2017, respectively, and thus should have been aboard for a fire drill. The first deckhand had participated in a drill aboard another Truth Aquatics vessel during a Coast Guard inspection, but he had never pulled out a fire hose or “done a dry run on anything” on the Conception. A passenger safety orientation was required by regulation to be conducted on a small passenger vessel “before getting underway on a voyage or as soon as practicable thereafter.”

NTSB Marine Accident Report 71 However, during voyages with early morning departures, passenger safety briefings on Truth Aquatics’ vessels were routinely conducted hours after getting under way once the passengers had awoken and the vessel had reached its first anchoring site. On the accident voyage, passengers boarded prior to many of the crewmembers and before the vessel left its berth in Santa Barbara. Between the time that the vessel got under way and when the briefing was conducted, the vessel transited open water in darkness for several hours while passengers were sleeping. Passengers were on board for up to 10 hours before they had been verbally briefed on critical information that might be needed in the event of an emergency on board the vessel. Because passengers boarded the vessel the night before departure, there was ample opportunity to conduct the briefing before getting under way. Instead, a laminated “Welcome Aboard” card was available on the Conception when passengers boarded, and, when combined with the lifejacket-donning instructions posted in each bunk, the card met the requirements of the safety pamphlet alternative to the orientation, with the exception that the location of emergency exits was not provided. However, the pre-underway announcement required in conjunction with the pamphlet was not conducted. A habitual disregard for rules, policies, and procedures predisposes the crew and passengers to an unsafe environment. Knowingly and routinely violating policies and procedures can be characterized as normalization of deviance, which occurs when people within an organization become so insensitive to deviant, or non-standard, practices that it no longer feels “wrong.” This insensitivity typically occurs over time and does not become apparent until all the critical factors line up and disaster occurs. The pathway to normalization of deviance often starts with shortcuts. People eventually begin to rationalize these shortcuts, particularly when negative consequences or penalties do not appear to exist. If there are no measures or attempts to verify rules and procedures are being followed appropriately, these rationalized shortcuts can be normalized for a long time.38 Oftentimes, the shortcuts go unnoticed on a large scale, normalizing the behavior and changing company/customer expectations and ultimately jeopardizing safety. This behavior is often related to the environment and conditions surrounding the work (time pressures, inadequate number of crew, insufficient crew training, prioritization of goals, or fatigue) and does not necessarily mean that the operator or person deviating from safety standards or policies was doing so intentionally or out of gross negligence. Additionally, each minor deviation does not necessarily result in an immediate negative consequence; however, over time, each slight deviation has a cumulative negative effect on safety.39 A person’s or organization’s deviation may become greater as they continue to push the limit over time because the potential negative consequence from the deviation has not materialized. Often, deficient behaviors and patterns are caused by varying environmental factors, which often start at the company—not hiring enough crewmembers to adequately complete the job, hiring crewmembers lacking the experience necessary to carry out their duties without the assistance of other crewmembers, or not providing adequate oversight to ensure the crew is working safely and effectively to company standards. The owner of Truth Aquatics stated that there were no company-wide operating procedures; these were left to the captains of each vessel to establish and

38 Dr. Rich Gasaway, Situational Awareness Matters, “The Normalization of Deviance,” https://www.samatters.com/the-normalization-of-deviance/. 39 A. Lebbon & S. Sigurdsson (2017), Behavioral Perspectives on Variability in Human Behavior as Part of Process Safety, Journal of Organizational Behavior Management, 37:3-4 261-282.

NTSB Marine Accident Report 72 manage. Watchstanding, crew training, and operating procedures, including hiring, training, and dismissal of crewmembers, were the responsibility of the captains of the company’s vessels. While this practice is not uncommon among small-scale operators, it does not absolve the company from its responsibility to ensure the safety of its passengers and crew. Entrusting the operation of the vessel to a single individual with little to no verification of compliance with regulations, policies, and procedures, can lead to non-conforming conditions on a vessel. The noted lax practices were not single incidents; they were common practice. If the company had been actively engaged in ensuring the safe practices required by regulations were being followed, most notably the requirement for a roving patrol, the fire would have been discovered earlier, and the consequences of this onboard fire likely would have been greatly diminished. The NTSB concludes that Truth Aquatics provided ineffective oversight of its vessels’ operations, which jeopardized the safety of crewmembers and passengers. When properly implemented, an effective tool for safety oversight is a safety management system (SMS), which is a comprehensive, documented system to enhance safety for a company and its vessels. Safety of operations and compliance with mandatory rules and regulations related to the safe operations is the objective behind every action and decision by both those who oversee procedures and those who carry them out. Regardless of the size of the company, an SMS ensures standardized and unambiguous procedures for each crewmember during both routine and emergency operations. Duties and responsibilities are specified, and supervisory and subordinate chains of command delineated. An SMS also calls for the creation of plans to respond to a range of possible emergency situations, with crewmember duties and responsibilities specified. Finally, an SMS requires procedures for the identification and correction of non-conformities and includes an audit process for management to ensure policies and procedures are being followed. The Coast Guard is required by regulation to ensure that US-flagged vessels engaged in oceangoing international service have an SMS, but there is no SMS requirement for the domestic passenger vessel fleet. Thus, Truth Aquatics was not required to have an SMS for its vessels. The company’s Loss Control Program contained some of the elements of an SMS. However, the company code did not have procedures for normal operations. While the company had procedures for identifying and correcting non-conformities, it did not have an audit process. Further, although the program included procedures for reporting accidents, there was no requirement to develop procedures to prevent future occurrences of accidents. Had an SMS been in place at Truth Aquatics, it would have likely included procedures for roving patrols that complied with regulations and a company-involved audit process for identifying and correcting non-conformities, when they existed, with the watch requirements. Also, following the battery fire that had occurred on the Vision about a year prior to the accident, SMS postaccident procedures could have led the company to identify battery charging as a potential risk and take measures to prevent such fires, as it has done in the wake of the Conception fire. The NTSB concludes that had an SMS been implemented, Truth Aquatics could have identified unsafe practices and fire risks on the Conception and taken corrective action before the accident occurred. Therefore, the NTSB recommends that Truth Aquatics implement an SMS for its fleet to improve safety practices and minimize risk. The NTSB has long advocated for the implementation of SMSs. Following the 2010 contact of the passenger ferry Andrew J. Barberi with a terminal at Staten Island, New York, in which 50 people were injured, the NTSB issued Safety Recommendation M-12-3 to the Coast Guard:

NTSB Marine Accident Report 73 Require all operators of U.S.-flag passenger vessels to implement SMS taking into account the characteristics, methods of operation, and nature of service of these vessels, and, with respect to ferries, the sizes of the ferry systems within which the vessels operate. After the Coast Guard initially responded that it was developing appropriate regulations for all US-flagged passenger vessels (part of Public Law 111–281), the NTSB classified Safety Recommendation M-12-3 as “Open―Acceptable Response” in May 2013. However, in April 2014, following the investigation into the 2013 contact of the passenger vessel Sea Streak Wall Street with a pier in Manhattan, New York, and after more than 3 years had passed since Congress authorized the Coast Guard to mandate SMSs, the NTSB reclassified the recommendation “Open―Unacceptable Response.” In its most recent correspondence, dated October 18, 2016, the Coast Guard wrote that it continued to work on developing the necessary regulations to implement the requirements for an SMS in all passenger vessels. On February 17, 2017, the NTSB replied that it had been over 6 years (at that time) since Congress authorized the Coast Guard to mandate SMSs, and it had been over 3 years since the Coast Guard indicated to the NTSB its intent to initiate rulemaking. Accordingly, Safety Recommendation M-12-3 remained classified “Open—Unacceptable Response.” The NTSB also requested that the Coast Guard expedite action to address this recommendation. The NTSB reiterated Safety Recommendation M-12-3 again in late 2019 following the investigation into the 2018 fire aboard the small passenger vessel Island Lady. To date, the Coast Guard has not issued the regulations authorized in the 2010 law, although the service has indicated an intention to develop the regulations and has issued guidance encouraging operators to voluntarily implement SMSs. The NTSB continues to believe that an SMS is an essential tool for enhancing safety on board all US passenger vessels and that the Coast Guard is the appropriate authority to ensure implementation and enforcement of such a system. In the case of the Conception and Truth Aquatics, a Coast Guard requirement for an SMS would likely have ensured greater adherence to watchstanding requirements, an appropriate response to a fire emergency, record keeping of watchkeeping and training documents, and the development of risk mitigation measures. The NTSB concludes that implementing SMS on all domestic passenger vessels would enhance operators’ ability to achieve a higher standard of safety. Therefore, the NTSB reiterates Safety Recommendation M-12-3.

NTSB Marine Accident Report 74 3 Conclusions 3.1 Findings 1. Weather and sea conditions were not factors in the accident. 2. The use of alcohol or other tested-for drugs by the Conception deck crew was not a factor in the accident. 3. The origin of the fire on the Conception was likely inside the aft portion of the salon. 4. Although a definitive ignition source cannot be determined, the most likely ignition sources include the electrical distribution system of the vessel, unattended batteries being charged, improperly discarded smoking materials, or another undetermined ignition source. 5. The exact timing of the ignition cannot be determined. 6. Most of the victims were awake but could not escape the bunkroom before all were overcome by smoke inhalation. 7. The fire in the salon on the main deck would have been well developed before the smoke activated the smoke detectors in the bunkroom. 8. Although the arrangement of detectors aboard the Conception met regulatory requirements, the lack of smoke detectors in the salon delayed detection and allowed for the growth of the fire, precluded firefighting and evacuation efforts, and directly led to the high number of fatalities in the accident. 9. Interconnected smoke detectors in all accommodation spaces on Subchapter T and Subchapter K vessels would increase the chance that fires will be detected early enough to allow for successful firefighting and the evacuation of passengers and crew.

1. The absence of the required roving patrol on the Conception delayed detection and allowed

for the growth of the fire, precluded firefighting and evacuation efforts, and directly led to the high number of fatalities in the accident.

1. The US Coast Guard does not have an effective means of verifying compliance with roving

patrol requirements for small passenger vessels.

1. The Conception bunkroom’s emergency escape arrangements were inadequate because both

means of escape led to the same space, which was obstructed by a well-developed fire.

1. Subchapter T regulations (Old and New) are not adequate because they allow for primary

and secondary means of escape to exit into the same space, which could result in those paths being blocked by a single hazard.

1. Although designed in accordance with the applicable regulations, the effectiveness of the

Conception’s bunkroom escape hatch as a means of escape was diminished by the location of bunks immediately under the hatch.

1. The emergency response by the Coast Guard and municipal responders to the accident was

appropriate but was unable to prevent the loss of life given the rapid growth of the fire at the time of detection and location of the Conception.

NTSB Marine Accident Report 75

1. Truth Aquatics provided ineffective oversight of its vessels’ operations, which jeopardized

the safety of crewmembers and passengers.

1. Had a safety management system been implemented, Truth Aquatics could have identified

unsafe practices and fire risks on the Conception and taken corrective action before the accident occurred.

1. Implementing safety management systems on all domestic passenger vessels would further

enhance operators’ ability to achieve a higher standard of safety. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of the accident on board the small passenger vessel Conception was the failure of Truth Aquatics, Inc., to provide effective oversight of its vessel and crewmember operations, including requirements to ensure that a roving patrol was maintained, which allowed a fire of unknown cause to grow, undetected, in the vicinity of the aft salon on the main deck. Contributing to the undetected growth of the fire was the lack of a United States Coast Guard regulatory requirement for smoke detection in all accommodation spaces. Contributing to the high loss of life were the inadequate emergency escape arrangements from the vessel’s bunkroom, as both exited into a compartment that was engulfed in fire, thereby preventing escape.

NTSB Marine Accident Report 76 4 Recommendations 4.1 New Recommendations As a result of its investigation of this accident, the National Transportation Safety Board makes the following ten new safety recommendations: To the US Coast Guard Revise Title 46 Code of Federal Regulations Subchapter T to require that newly constructed vessels with overnight accommodations have smoke detectors in all accommodation spaces. (M-20-14) Revise Title 46 Code of Federal Regulations Subchapter T to require that all vessels with overnight accommodations currently in service, including those constructed prior to 1996, have smoke detectors in all accommodation spaces. (M-20-15) Revise Title 46 Code of Federal Regulations Subchapter T and Subchapter K to require all vessels with overnight accommodations, including vessels constructed prior to 1996, have interconnected smoke detectors, such that when one detector alarms, the remaining detectors also alarm. (M-20-16) Develop and implement an inspection procedure to verify that small passenger vessel owners, operators, and charterers are conducting roving patrols as required by Title 46 Code of Federal Regulations Subchapter T. (M-20-17) Revise Title 46 Code of Federal Regulations Subchapter T to require newly constructed small passenger vessels with overnight accommodations to provide a secondary means of escape into a different space than the primary exit so that a single fire should not affect both escape paths. (M-20-18) Revise Title 46 Code of Federal Regulations Subchapter T to require all small passenger vessels with overnight accommodations, including those constructed prior to 1996, to provide a secondary means of escape into a different space than the primary exit so that a single fire should not affect both escape paths. (M-20-19) Review the suitability of Title 46 Code of Federal Regulations Subchapter T regulations regarding means of escape to ensure there are no obstructions to egress on small passenger vessels constructed prior to 1996 and modify regulations accordingly. (M-20-20) To the Passenger Vessel Association, Sportfishing Association of California, and National Association of Charterboat Operators Until the US Coast Guard requires all passenger vessels with overnight accommodations, including vessels constructed prior to 1996, to have smoke detectors in all accommodation spaces, share the circumstances of the Conception accident with your members and encourage your members to voluntarily install

NTSB Marine Accident Report 77 interconnected smoke and fire detectors in all accommodation spaces such that when one detector alarms, the remaining detectors also alarm. (M-20-21) Until the US Coast Guard requires small passenger vessels with overnight accommodations to provide a secondary means of escape into a different space than the primary exit, share the circumstances of the Conception accident with your members and encourage your members to voluntarily do so. (M-20-22) To Truth Aquatics Implement a safety management system for your fleet to improve safety practices and minimize risk. (M-20-23) 4.2 Recommendation Reiterated in this Report As a result of its investigation of this accident, the National Transportation Safety Board reiterates Safety Recommendation M-12-3, which is currently classified as “Open— Unacceptable Response”: To the US Coast Guard Require all operators of U.S.-flag passenger vessels to implement SMS, taking into account the characteristics, methods of operation, and nature of service of these vessels, and, with respect to ferries, the sizes of the ferry systems within which the vessels operate. (M-12-3)

BY THE NATIONAL TRANSPORTATION SAFETY BOARD ROBERT L. SUMWALT, III JENNIFER HOMENDY Chairman Member BRUCE LANDSBERG MICHAEL GRAHAM Vice Chairman Member

THOMAS B. CHAPMAN

Member Report Date: October 20, 2020

NTSB Marine Accident Report 78 Appendix A Investigation The National Transportation Safety Board (NTSB) learned of the accident from the US Coast Guard on the morning of September 2, 2019. A team of four investigators, NTSB Board Member Jennifer Homendy, and support staff arrived on scene in Santa Barbara, California, the evening of September 2 and the following day. The investigative team consisted of specialists in engineering, operations, survival factors and emergency response, and fire and explosions; the team was further supported by a staff meteorologist and an engineer specializing in electronic data. Investigators from the local offices of the Coast Guard Investigative Service (CGIS), Federal Bureau of Investigations (FBI), Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), and the Santa Barbara Fire and Police Departments, as well as the district attorney for Santa Barbara County and an Assistant US Attorney, were already on scene before NTSB personnel arrived. The NTSB investigated the accident under the authority of Title 49 United States Code (USC) 1131(a)(1)(E). The Coast Guard, Truth Aquatics, Inc., Santa Barbara County Sheriff’s Office, and Santa Barbara County Fire Department were named as parties to the NTSB investigation. At no time was the NTSB advised by any law enforcement agency, the Department of Justice, or other federal authority of any indication or suspicion that the accident was caused by an intentional act, and there was no request from either the Attorney General or any other federal agency to the NTSB to relinquish investigative priority under 49 USC 1131(a)(2)(B). Accordingly, the NTSB retained investigative priority for the Conception accident throughout. On September 4, while on scene, NTSB investigators, accompanied by other federal investigators, interviewed the owner and three of the surviving crew of the Conception. Following those interviews, the NTSB was informed by the Coast Guard of its intent to pursue criminal proceedings against the captain of the Conception based on the revelation during the three crew interviews that there was no roving patrol established on the Conception at the time of the accident, an operational condition on their Certificate of Inspection. The interview of the captain, who had voluntarily made himself available to NTSB investigators, was deferred to the morning of September 5. The Coast Guard and the Santa Barbara Sheriff’s Office and Fire Department representatives recused themselves from further NTSB interviews on scene to support the parallel criminal investigation. The following morning, on September 5, the captain of the Conception presented himself to be interviewed by NTSB investigators. The Assistant US Attorney assigned to the case requested the NTSB not interview the captain of the Conception out of concern that the interview could hinder his ability to bring criminal charges against the captain. Additionally, the Assistant US Attorney requested that NTSB investigators not interview the first galley hand, who was hospitalized at the time, or any Truth Aquatics employee responsible for operations. The NTSB obtained significant information from the other crewmembers; however, the Conception’s captain had many years of experience on the same vessel, and NTSB interviews with the owner of Truth Aquatics and current and past crewmembers indicated the captain was intimately familiar with the vessel’s history, operations, systems, and maintenance. The owner and surviving crewmembers therefore referred many of investigators’ questions to the captain, which remain unanswered. On September 5, NTSB investigators interviewed several first responders, including personnel from the Ventura County Fire Department, Coast Guard Station Channel Harbor Islands, and Channel Islands Harbor Patrol. On September 6, the Coast Guard inspector who most recently

NTSB Marine Accident Report 79 inspected the Conception was interviewed by an NTSB investigator. In the following days, multiple witnesses who submitted tips and information to the NTSB, current and former Truth Aquatics crewmembers, former passengers, contractors, and service providers were also interviewed by NTSB investigators. However, as local and national news spread related to the parallel criminal investigation, with the NTSB often erroneously being listed as a part of the criminal investigation, NTSB investigators found that many persons who had previously contacted the NTSB with historical and relevant information were later unwilling to speak to the NTSB or had already been interviewed by law enforcement investigators. From September 8 to 10, 2019, the Assistant US Attorney served search warrants on the offices and two remaining vessels of Truth Aquatics, which the NTSB did not attend. The search warrants resulted in the seizure of thousands of pages of documents and records. Computers, security camera servers, and items, such as fans, smoke detectors, and heat sensors, from each vessel were also seized. Truth Aquatics was not able to provide any record or information to NTSB investigators after that point. While recovery and salvage efforts of the Conception wreckage were ongoing, Truth Aquatics allowed NTSB investigators access to its two remaining vessels: the Truth and the Vision. NTSB investigators primarily examined the similar vessel, the Vision, inspecting construction material, furnishings, general arrangement, firefighting and lifesaving equipment, and escape and egress arrangements. Under the memorandum of understanding between the FBI and the NTSB, the FBI Evidence Response Team was tasked with the collection of all evidence, materials, and personal effects and the processing of items recovered from the wreckage site and the wreckage itself. There was good cooperation between the NTSB and the FBI Evidence Response Team. The wreckage of the Conception, along with equipment and debris recovered from the sea floor, was recovered by salvors on September 12 and was transferred by barge to Port Hueneme, California, where it could be examined on Naval Base Ventura County, a secure location. Once the wreckage was transferred to a secure lot on September 13, NTSB investigators were instructed to return to their duty stations to await completion of construction of securing apparatus and scaffolding around the hull of the Conception. Five NTSB investigators returned to the examination site on September 25–26 to commence examination of the wreckage and recovered debris. The US Attorney’s Office prohibited Truth Aquatics, a party representative to the NTSB investigation, from attending the wreckage examination. The owner of Truth Aquatics, who had intricate knowledge of the vessel and was a major contributor in the design and building of the Conception, would have been essential in assisting NTSB investigators in identifying pieces of wreckage and describing operations, the vessel layout, engineering components, and the differences between the Conception and the similar vessel Vision. At the examination site, NTSB investigators found that most loose items contained within the hull of the Conception had been removed, and items determined by law enforcement investigators to be non-relevant were placed into large plastic bags for disposal. Larger items, such as engine room components recovered from the seafloor, were placed back into the hull where they were known to have been fitted. The remaining relevant and large items and structural sections of the vessel, as determined by law enforcement investigators, were laid out on a tarp with measured markings. NTSB investigators were not invited to, nor did they participate in, the identification and removal of objects from the hull of the Conception and the determination of the materials of

NTSB Marine Accident Report 80 relevancy into the origin and cause of the fire. The owner of Truth Aquatics, who was permitted to inspect the wreckage at a later date with insurance investigators, advised the NTSB during the technical review of the fire and explosions factual report that there were “many parts of upper deck…discovered during [Truth Aquatics’] site visit in piles and trash bags off to the side.” Multiple personal electronic devices, including smart phones, tablets, and video and still cameras were either recovered with the wreckage or the victims or off the seafloor. Each device was photographed and documented by the FBI Evidence Response Team. Many of the devices recovered showed minimal signs of heat damage, although all had been exposed to sea water. The FBI retained custody of each device for examination and, if possible, extraction of any relevant photos, video, and information contained on the devices. At the time of this report, material had been extracted from only two devices: a tablet, which contained no relevant information, and a smart phone, which belonged to a passenger and contained pictures and video taken during the accident voyage. From November 18–21, NTSB investigators returned to Southern California to interview staff at Coast Guard Sector Los Angeles/Long Beach and Marine Safety Unit Santa Barbara. Additionally, NTSB investigators also visited three small passenger vessels with overnight accommodations and their owners and witnessed a Coast Guard small passenger vessel inspection. Coast Guard headquarters staff were also interviewed by NTSB investigators between November 2019 and February 2020. On February 13, 2020, the FBI provided NTSB investigators a hard drive with scans of all documents and records seized through the various search warrants. No electronic evidence recovered from computers and servers was provided to the NTSB. All scanned documents and photos taken from the FBI Evidence Response Team were accompanied by a letter stating that written consent must be given prior to any public release of evidence seized through the search warrants. A Coast Guard marine board of investigation (MBI) was established pursuant the authority contained in 46 USC 6301 requiring the board to convene as soon as practicable to inquire into all aspects of the Conception casualty. As of the date of this report, a formal MBI has yet to convene.

NTSB Marine Accident Report 81 Appendix B Consolidated Recommendation Information Title 49 United States Code (USC) 1117(b) requires the following information on the recommendations in this report. For each recommendation— (1) a brief summary of the Board’s collection and analysis of the specific accident investigation information most relevant to the recommendation; (2) a description of the Board’s use of external information, including studies, reports, and experts, other than the findings of a specific accident investigation, if any were used to inform or support the recommendation, including a brief summary of the specific safety benefits and other effects identified by each study, report, or expert; and (3) a brief summary of any examples of actions taken by regulated entities before the publication of the safety recommendation, to the extent such actions are known to the Board, that were consistent with the recommendation. To the US Coast Guard M-20-14 Revise Title 46 Code of Federal Regulations Subchapter T to require that newly constructed vessels with overnight accommodations have smoke detectors in all accommodation spaces. Information that addresses the requirements of 49 USC 1117(b), as applicable, can be found in section 2.5 Fire Detection. Information supporting (b)(1) can be found on pages 62–64; (b)(2) and (b)(3) are not applicable. M-20-15 Revise Title 46 Code of Federal Regulations Subchapter T to require that all vessels with overnight accommodations currently in service, including those constructed prior to 1996, have smoke detectors in all accommodation spaces. Information that addresses the requirements of 49 USC 1117(b), as applicable, can be found in section 2.5 Fire Detection. Information supporting (b)(1) can be found on pages 62–64; (b)(2) and (b)(3) are not applicable. M-20-16 Revise Title 46 Code of Federal Regulations Subchapter T and Subchapter K to require all vessels with overnight accommodations, including vessels constructed prior to 1996, have interconnected smoke detectors, such that when one detector alarms, the remaining detectors also alarm.

NTSB Marine Accident Report 82 Information that addresses the requirements of 49 USC 1117(b), as applicable, can be found in section 2.5 Fire Detection. Information supporting (b)(1) can be found on pages 62–64; (b)(2) and (b)(3) are not applicable. M-20-17 Develop and implement an inspection procedure to verify that small passenger vessel owners, operators, and charterers are conducting roving patrols as required by Title 46 Code of Federal Regulations Subchapter T. Information that addresses the requirements of 49 USC 1117(b), as applicable, can be found in section 2.6 Roving Patrol. Information supporting (b)(1) can be found on pages 65–67; (b)(2) and (b)(3) are not applicable. M-20-18 Revise Title 46 Code of Federal Regulations Subchapter T to require newly constructed small passenger vessels with overnight accommodations to provide a secondary means of escape into a different space than the primary exit so that a single fire should not affect both escape paths. Information that addresses the requirements of 49 USC 1117(b), as applicable, can be found in section 2.7 Means of Escape. Information supporting (b)(1) can be found on pages 67–69; (b)(2) and (b)(3) are not applicable. M-20-19 Revise Title 46 Code of Federal Regulations Subchapter T to require all small passenger vessels with overnight accommodations, including those constructed prior to 1996, to provide a secondary means of escape into a different space than the primary exit so that a single fire should not affect both escape paths. Information that addresses the requirements of 49 USC 1117(b), as applicable, can be found in section 2.7 Means of Escape. Information supporting (b)(1) can be found on pages 67–69; (b)(2) and (b)(3) are not applicable. M-20-20 Review the suitability of Title 46 Code of Federal Regulations Subchapter T regulations regarding means of escape to ensure there are no obstructions to egress on small passenger vessels constructed prior to 1996 and modify regulations accordingly. Information that addresses the requirements of 49 USC 1117(b), as applicable, can be found in section 2.7 Means of Escape. Information supporting (b)(1) can be found on pages 67–69; (b)(2) and (b)(3) are not applicable.

NTSB Marine Accident Report 83 To the Passenger Vessel Association, Sportfishing Association of California, and National Association of Charterboat Operators M-20-21 Until the US Coast Guard requires all passenger vessels with overnight accommodations, including vessels constructed prior to 1996, to have smoke detectors in all accommodation spaces, share the circumstances of the Conception accident with your members and encourage your members to voluntarily install interconnected smoke and fire detectors in all accommodation spaces such that when one detector alarms, the remaining detectors also alarm. Information that addresses the requirements of 49 USC 1117(b), as applicable, can be found in section 2.5 Fire Detection. Information supporting (b)(1) can be found on pages 62–64; (b)(2) and (b)(3) are not applicable. M-20-22 Until the US Coast Guard requires small passenger vessels with overnight accommodations to provide a secondary means of escape into a different space than the primary exit, share the circumstances of the Conception accident with your members and encourage your members to voluntarily do so. Information that addresses the requirements of 49 USC 1117(b), as applicable, can be found in section 2.7 Means of Escape. Information supporting (b)(1) can be found on pages 67–69; (b)(2) and (b)(3) are not applicable. To Truth Aquatics, Inc. M-20-23 Implement a safety management system for your fleet to improve safety practices and minimize risk. (M-20-X) Information that addresses the requirements of 49 USC 1117(b), as applicable, can be found in section 2.9 Oversight. Information supporting (b)(1) can be found on pages 69–73; (b)(2) and (b)(3) are not applicable.

NTSB Marine Accident Report 84 Appendix C Small Passenger Vessel Casualty Data Study The NTSB examined the frequency of marine accidents for small passenger vessels similar to the Conception and to assess the risk among different types of small passenger vessels operating domestically over the past two decades. A data report for incidents involving small passenger vessels was produced by analyzing vessel events (such as fires), personnel casualty (fatality and injury), and other incident data from the Coast Guard’s Marine Information for Safety and Law Enforcement (MISLE) database for the period 2002-2019, which included small passenger vessels regulated under Subchapters T and K.40 The report showed that, as of March 2020, there were a total of 9,554 active small passenger vessels of all types. Of these, 31 percent (3,002) had a hull constructed of fiberglass- reinforced plastic; 16 percent (1,503) were constructed of wood; and less than 1 percent (3) were fiberglass over wood, like the Conception (the remainder were primarily constructed of aluminum and steel, with some of rubber, or other materials). There were 1,583 individual small passenger vessels involved in 2,710 incidents captured in the personnel casualty files from 2002-2019. However, in order to build a more complete set of incident data for small passenger vessels, the NTSB appended all investigations that involved fatal and injury incidents in small passenger vessels from the personnel casualty data to those documented in an incident investigation data file provided by the Coast Guard, and identified a total of 10,729 unique incidents. Each incident can have multiple events but only one initial event. Of the 10,729 incidents, the most frequent initial event type documented was “material failure/malfunction,” which represented 43 percent (4,575 incidents) of events, while fire represented 2 percent (163 incidents). Of all the small passenger vessels involved in the incidents not linked to the initial event type “personnel casualty,” just over 1 percent (97 vessels) were attributed to vessels defined as diving boats, and the initiating event for 65 of these 97 diving boats was “hull/machinery/equipment damage” (table 5).

40 (a) Data Report: Incidents Involving Small Passenger Vessels (2002-2019), NTSB, Safety Research Division, August 17, 2020. This report and other additional information about the Conception accident investigation are available in the public docket by accessing the Docket Management System at www.ntsb.gov with the identification number DCA19MM047. (b) Vessels regulated under Subchapter T include small passenger vessels that carry 150 passengers or less, or that have overnight accommodations for less than 50 passengers. Vessels regulated under Subchapter K include the largest of small passenger vessels, which carry more than 150 passengers, or more than 49 passengers overnight.

NTSB Marine Accident Report 85 Table 5. Number of small passenger vessels by initial event type based on the NTSB classification’s ten most common vessel types NTSB Classification of Initial Event Types General Ferry Excursion/Tour Vessel Diving Vessel (Recreational) Charter Fishing Vessel Amphibious Vessel Sailing Vessel Crew Boat Offshore Supply Vessel Water Taxi All others Total Percent Hull/ Machinery/ Equipment Damage 3,593 710 421 65 157 291 85 92 266 92 266 5,837 67.0 Contact/ Grounding/ Stranding 1,204 16 157 20 39 21 70 76 40 29 108 1,900 21.8 Collision 202 20 26 4 8 2 4 19 16 16 11 328 3.8 Fire/ Explosion 108 10 14 1 6 1 4 10 4 2 12 172 2.0 Others41 109 7 8 4 3 0 1 9 8 2 10 161 1.8 Vessel Maneuver42 98 5 16 2 2 1 5 1 4 2 7 143 1.6 Flooding 88 7 10 1 7 4 3 4 4 1 8 137 1.6 Capsizing/ Listing 20 0 5 0 2 0 1 1 0 1 4 34 0.4 Total 5,422 985 657 97 224 320 173 212 141 145 426 8,712 100 Percent of Total 62.2 10.3 7.5 1.1 2.6 3.7 2 2.4 1.6 1.7 4.9 100

There were 668 deaths and 2,800 injuries (3,488 total) recorded over the 18-year period. Passenger casualties represented a much higher percentage than crew casualties, with 600 deaths and 2,232 injuries. However, the report stated that 836 of these casualties were not related to vessel-specific incidents, including: noncontact injury, existing medical condition event, overexertion injury, diseases, and assault, homicide, suicide, or self-inflicted injury. Of note, the report indicated that there were 155 deaths and 242 injuries due to “noncontact injury” associated with diving. The report provided fatality and injury data distributed by data file vessel type. Vessels defined as “General” represented over 60 percent of the total number of vessels, while “Diving Vessel (Recreational)” represented 9 percent of the total (table 6).

41 The category “others” included “abandonment,” “discharge/release – pollution,” and “sinking.” 42 The NTSB Office of Marine Safety categorizes “vessel maneuver” as either “collision,” “contact,” or “grounding/stranding.” In this table, staff kept the original initial event type.

NTSB Marine Accident Report 86 Table 6. Fatalities and injuries by vessel type Vessel Type Fatalities and Injuries Percent General 2,081 60 Excursion/Tour Vessel 345 10 Diving Vessel (Recreational) 324 9 Charter Fishing Vessel 135 4 Ferry 121 3 Sailing Vessel 115 3 Crew Boat 62 2 Water Taxi 61 2 Parasailing Vessel 60 2 Gaming Vessel 33 1 Harbor Cruise Vessel 33 1 Amphibious Vessel 30 1 Offshore Supply Vessel 27 1 All other types43 41 1 Total 3,468 100 Investigators sought to determine if data over the 17-year period indicated that diving vessels had a greater frequency of casualties or incidents than other small passenger vessel types, and if so, what the initiating events leading to them were. However, this could not be determined from the MISLE data, since in many cases, MISLE vessel event and personnel casualty data on small passenger vessels were incomplete and inconsistently recorded, making it impossible to compare small passenger vessel types by frequency of incidents or casualties over the period of interest (2002-2019). In addition, the Coast Guard was unable to provide a population of vessel types by year, which precluded any calculation of accident or fatal accident rates by vessel and event types. Further, the event types in many cases did not provide sufficient detail, and initiating events were sometimes incorrectly documented. Finally, missing or incomplete data made it impossible to reconcile the vessel event and personnel casualty data.

43 All other types include River Cruise Vessel, Ocean Cruise Vessel, Party/Head Boat (other than fish), Passenger Barge, Attraction Vessel, Fish Catching Vessel, Special Purpose Ship, Work Boat, Amphibious Vessel (DUKW, etc.), Lift Boat, Oil Recovery Vessel, and Small Watercraft. From 2002-2019, 41 fatalities and injuries occurred in these small passenger vessels.

NTSB Marine Accident Report 87 References Gasaway, Dr. Rich. “The Normalization of Deviance.” Situational Awareness Matters. https://www.samatters.com/the-normalization-of-deviance/. International Maritime Organization. “ISM Code and Guideline of Implementation of the ISM Code.” http://www.imo.org/en/OurWork/HumanElement/SafetyManagement/Pages/ISMCode.as px (retrieved April 6, 2020). Lebbon, A and S. Sigurdsson. “Behavioral Perspectives on Variability in Human Behavior as Part of Process Safety.” Journal of Organizational Behavior Management 37, no. 3-4 (2017): 261-282. National Fire Protection Association. NFPA 921 Guide for Fire and Explosion Investigation, 2017. Quincy, Massachusetts, 2016, page 263. National Transportation Safety Board. 2020. Incidents Involving Small Passenger Vessels (2002- 2019). Washington, DC: NTSB. Office of Management and Budget. “Spring 2020 Unified Agenda of Regulatory and Deregulatory Action, Department of Homeland Security Agency Rule List.” https://www.reginfo.gov/public/do/eAgendaMain. Puente, Mark, Richard Winton, and Leila Miller. “Before Conception boat fire, captains say Coast Guard safety rule was ignored.” The Los Angeles Times, December 30, 2019. Sportfishing Association of California. “About SAC.” www.californiasportfishing.org/about (retrieved April 28, 2020).

FD07274 ｜ 2003_美国_NTSB_MAB0402_Engineroom_Fire_on_the_US_Passenger_Vessel_Columbia_in_Wrang.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2003 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N National Transportation Safety Board Washington, D.C. 20594 Marine Accident Brief Accident Number DCA03MM033

Vessel: U.S. Passenger Vessel Columbia O.N. 557340, 418 feet long (LOA), 3,946 gross tons, inspected, built in 1974 Accident Type: Fire Location: Wrangell Narrows near Wrangell, Alaska Date: May 28, 2003 Time: 0144 local Owner: State of Alaska Property Damage: $125,000 Injuries: None Complement: Crew 43 Passengers 170 Accident Description About 0121 on May 28, 2003, the Alaska Marine Highway System ferry Columbia, with 170 passengers on board, departed Petersburg, Alaska, en route to Wrangell, Alaska. The ferry was equipped with three ship-service diesel generators, located in the auxiliary engine room, and the vessel’s electrical load required that two of the generators be online during normal underway operations. On this morning, the ship- service generators in use were Nos. 1 and 2. Shortly after the Columbia left port, an oiler on watch made his normal inspection rounds of the engineering spaces. While the oiler was in the auxiliary engine room, he noticed an odor suggesting that an equipment item was overheating. He said that he was unable to locate the source of the odor and, about 0135, went to the control room and informed the watch engineer and the chief engineer of his observations. The chief engineer said that he immediately went into the auxiliary engine room. He was searching for the source of the smell and standing between the diesel engines for the Nos. 1 and 2 generators when, about 0144, he heard an unusual noise and saw a burst of flames in the area of the No. 2 generator’s cooling fan ports. The vessel then lost electrical power, which shut down the electrically driven main engine fuel pumps. The main engines then shut down, leaving the ship without propulsion power and the ability to steer while it was in Wrangell Narrows (figure 1). NTSB/MAB-04/02 1

Figure 1. Wrangell Narrows, where the Columbia lost electrical power. The chief engineer stated that the emergency diesel generator then started automatically, supplying power for the emergency lighting, some navigation equipment, and the steering system. He said that he immediately returned to the control room and ordered the watch engineer to start the diesel engine that powered the ship’s omni- directional bow thruster, which gave the crew on navigation watch the capability to use the bow thruster and the vessel rudder to move out of the traffic lane and to drop anchor. The chief engineer noticed that the circuit breaker for the No. 2 generator had tripped on the main switchboard. He then ordered the shutdown of the No. 2 generator’s diesel engine remotely from the control room and returned to the auxiliary engine room, accompanied by the junior engineer. The chief engineer and the junior engineer observed a fire beneath the turbocharger of the No. 2 generator’s diesel engine. The junior engineer NTSB/MAB-04/02 2

put out the fire using a portable CO2 extinguisher; however, the smoke continued to increase and became so thick that the two men had to leave the auxiliary engine room. Upon returning to the control room, the chief engineer telephoned the bridge to report the generator fire and to request that the firefighting team be called out. The chief engineer then ordered all off-watch engineering personnel to report to assist with the emergency. The firefighting team reported to the engine control room. After being briefed about the fire by the chief engineer and the junior engineer, two men from the team (the chief mate and the third engineer), wearing fire-protective clothing and self-contained breathing apparatus, entered the auxiliary engine room about 0153. Once in the auxiliary engine room, the third engineer discovered that the air filter on the turbocharger of the No. 2 generator was on fire, producing billowing smoke that filled the space. The third engineer lifted the burning air filter out of the air intake, and the chief mate put out the fire using a portable CO2 fire extinguisher. The team then began inspecting the auxiliary engine room for other fires and damage. A short time later, the chief mate noticed that the air filter had reignited, and the team doused the filter with water to extinguish the fire. By 0207, the Columbia crew established that the No. 2 generator fire was extinguished and, in accordance with the company’s operating procedures, posted a reflash watch as a precaution. The Columbia’s engineers ventilated the engineering spaces and then started the Nos. 1 and 3 ship-service diesel generators. After electrical power was fully restored, the crew restarted the two main engines at 0230, and engine control was shifted to the bridge so that the navigation watch could resume the voyage to Wrangell. Rehabilitation of the Electrical Plant On May 28, 2003, the Columbia arrived in Ketchikan, Alaska, where Alaska Marine Highway System officials had the No. 2 generator removed so that it could be sent to an electrical repair facility. Consulting engineers also checked the other ship- service generators. The Columbia’s engineers told the consulting engineers that generators Nos. 1 and 3 had operated satisfactorily while en route to Ketchikan; however, megger1 tests revealed that the No. 3 generator had a short (low resistance to ground) on one phase and was not suitable to operate. Agency officials, therefore, also had the No. 3 generator removed from the engineroom so that it could be sent to the electrical repair facility to be examined further and repaired. Because the Columbia now lacked two operable ship-service generators, the ferry had to be taken out of service. On June 4, 2003, the Alaska Marine Highway System had a new generator installed so that the ferry could operate, and the Columbia was returned to service.

1 A test instrument used to measure insulation resistance and other high resistances. NTSB/MAB-04/02 3

According to agency officials, the Nos. 2 and 3 ship-service generators on the accident ferry had last been overhauled in 1999. The examination of generator No. 3 at the repair facility in early June 2003 revealed that the insulating varnish appeared to be in “excellent condition.” Examiners found no evidence of an insulation breakdown that could account for the low megger reading. The contract repair technicians then rewound the generator, and, on June 12, 2003, megger tests were conducted indicating that the generator was in proper operating condition. The tests on June 12 were witnessed by the port engineer for the Alaska Marine Highway System and a representative of the American Bureau of Shipping (ABS), the ferry’s classification society. On June 13, 2003, while the Columbia was in Bellingham, Washington, the repaired generator was loaded onto the ferry. Installation of the generator was completed while the ferry was underway. On June 20, 2003, the Columbia returned to Bellingham, where the repaired generator underwent a day of testing under the supervision of an ABS representative, who determined that the generator operated satisfactorily. The initial examination of ship-service generator No. 2 showed that the equipment unit had sustained heavy damage from the fire. Much of the copper wiring in the lower part of the generator had melted and vaporized. The Alaska Marine Highway System contracted for an in-depth failure analysis, which was conducted in July 2003. Consultant engineers removed the remaining windings and inspected them for evidence of improper assembly or insulation failures, but could find no failure condition. The examining contractor concluded that the insulation breakdown had occurred in the lower part of the generator, which had been mostly destroyed. He further concluded that an electrical event or events, possibly the switchboard fire of a few years ago or the indiscriminate application of Hi-Pot testing during the dip and bake process, caused aging or hard spots in at least one of the windings near the bottom of the generator. This caused a short between turns which increased the current in that coil. The heat was eventually enough to cause additional turns to become shorted and then to start the melting process in the winding. As the molten copper started to flow, it shorted windings phase to phase, and the event quickly became a catastrophic failure. The switchboard fire referred to by the contractor occurred on June 6, 2000.2 At the time, the Nos. 1 and No. 2 generators were in operation. The engineer on watch was making an inspection round of the engineering spaces when he observed that the No. 2 generator was surging “from a slower speed to a higher speed” and was moving erratically on its foundation. The engineer proceeded to the control room, where he observed fire coming out of the switchboard. The fire was subsequently extinguished by the crew. An investigation into the fire determined that it had been caused by a short circuit in the switchboard, and that the short circuit had caused “substantial damage” to the switchboard. The No. 2 generator was examined following the accident and found to be undamaged.

2 For more information, see National Transportation Safety Board, Fire On Board the U.S. Passenger Ferry Columbia, Chatham Strait, Near Juneau, Alaska, June 6, 2000, Marine Accident Report NTSB/MAR–01/02 (Washington, DC: NTSB, 2001). NTSB/MAB-04/02 4

NTSB/MAB-04/02 5 Probable Cause The National Transportation Safety Board determines that the probable cause of the fire and the destruction of the wiring in the No. 2 ship-service generator on the Columbia was a breakdown in the generator’s wiring insulation.

Adopted: April 19, 2004

FD07275 ｜ 2003_美国_NTSB_MAB0703_Boiler_Rupture_on_Bahamian_Cruise_Ship_SS_Norway.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2003 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N National Transportation Safety Board Washington, D.C. 20594

Marine Accident Brief Accident No.: DCA-03-MM-032 Accident Type: Boiler rupture Vessel: Bahamas-registered passenger vessel S/S Norway Location: Piers 1 and 2, Miami, Florida Date: May 25, 2003 Time: 0637 eastern daylight time1

Owner/Operator: Norwegian Cruise Line Property Damage: $20-$23 million Complement: 911 crew 2,135 passengers Fatalities/Injuries: Passengers: none Crew: 8 fatalities; 10 serious injuries; 7 minor injuries Introduction At 0637 on May 25, 2003, the Bahamas-registered passenger vessel S/S Norway (figure 1), with 911 crewmembers and 2,135 passengers on board,2 suffered a boiler rupture in the aft boiler room. The accident occurred about an hour after the vessel had moored in Miami, Florida, at the end of a 7-day Caribbean cruise. As a result of the accident, 8 crewmembers sustained fatal injuries, 10 suffered serious injuries, and 7 received minor injuries.3 No passengers were injured.

1 Times in this report are eastern daylight time, according to the 24-hour clock. 2 The crew was composed of Norwegian officers in the deck and engine departments. As is the case on most foreign-flag cruise ships operating in U.S. waters, members of the other shipboard departments comprised a variety of nationalities. 3 Title 49 Code of Federal Regulations section 830.2 defines a fatal injury as any injury that results in death within 30 days of an accident. It defines a serious injury as one that (1) requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; (2) results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages, nerve, muscle, or tendon damage; (4) involves any internal organ; or (5) involves second- or third-degree burns, or any burn affecting more than 5 percent of the body surface. In the Norway accident, all the deceased sustained second- and third-degree burns on 50 to 100 percent of their body area and died from

NTSB/MAB-07/03

Figure 1. In 2003, the 43-year-old Norway (originally the S/S France) was one of the last of the steam-driven cruise ships operating out of U.S. ports. After the accident, the ship was removed from service and later sold for scrap. The Norway, owned and operated by Norwegian Cruise Line (NCL), was a conventional welded, steel-hulled liner, certificated for unrestricted international voyages. The ship met the regulations of the International Convention for the Safety of Life at Sea, 1960 (SOLAS 60), and the International Convention on Load Lines, 1966. After various upgrades in 1980, the vessel met the standards of the 1974 SOLAS Convention (SOLAS 74). The Norway was built by Chantiers de l’Atlantique (Penhoët-Loire) in Saint- Nazaire, France, and originally sailed under the French flag as the S/S France. When launched in 1960, the France was the longest oceangoing liner in the world. The France operated primarily in the trans-Atlantic trade from the time of its construction until 1974. In 1979, the liner was sold to Klosters Rederi A/S,4 one of Norway’s oldest shipping companies. Klosters had the vessel overhauled for its Caribbean cruising operations, which was run by its subsidiary, Norwegian Caribbean Lines.5 Klosters renamed the vessel the S/S Norway in 1979 and registered it in Norway. Beginning in 1980, the Norway operated on Caribbean cruises that originated at Miami, and in 1987, the vessel was reflagged to the Bahamas flag. In October 2000, Star Cruises,6 NCL’s parent company, announced that the Norway would be relocated to the Asian market, a decision that was later reversed.

NTSB/MAB-07/03

2

The National Transportation Safety Board investigated the Norway accident under the authority of the Independent Safety Board Act of 1974 and according to Safety Board rules. The designated parties to the investigation were the U.S. Coast Guard; NCL; Bureau Veritas (BV), the classification society that inspected the Norway;7 Bahamas Maritime Authority, the vessel’s flag state; Siemens, the manufacturer of the vessel’s boiler control and monitoring system; and Lloyd Werft Shipyard, which performed or contracted out boiler repairs in Bremerhaven, Germany, in 1987 and 1990. In investigating the cause of the boiler rupture, the Safety Board reviewed the boiler repair history recorded in various company and classification society documents over the last 40 years (see “Boiler History” section). The Board also examined the operating practices and inspection procedures that affected boiler safety (see “Factors Affecting Boiler Life”). Representatives of the parties cooperated with the Board in its postaccident investigation (see “Postaccident Investigation and Findings”). Accident Description About 0400 on May 25, 2003, while the Norway was inbound through the channels leading to the Port of Miami (figure 2), the engineering watch changed. The second engineer, who was going off duty, said that he told his relief that there was nothing out of the ordinary to report about the boilers and that “all conditions were normal.” At 0529, the Norway moored at its berth at piers 1 and 2 on Dodge Island, the bridge watch ordered “finished with main turbines,” and the engineroom watch began to shut down the propulsion system in preparation for the ship’s port stay. The vessel’s four

NTSB/MAB-07/03

3

main propulsion boilers were located on the engine deck (deck No. 2; see figures 3 and 4), in the next-to-aftermost main vertical zone.8 By 0600, the Norway was secured alongside the pier and crewmembers were starting the in-port routine, which included rigging gangways, discharging garbage, fueling, provisioning, offloading passenger baggage, and disembarking passengers. In the aft engine/boiler room, the watch was reduced from seven to six crewmembers when one of the second engineers received permission to leave before the end of the watch.9 On the Biscayne deck (deck No. 5), the second engineer was monitoring the boiler gauges and instruments in the engine control room aft of the boiler room (figure 5). He later stated, “All was normal.” No alarms were indicated, and he heard only “normal engine/boiler room sounds.” At the time, boiler No. 21 was not operating and boiler Nos. 22, 23, and 24 were operating and providing steam to vessel systems. The remaining five boiler room watchstanders were in the aft boiler room or in spaces next to it.

Figure 2. Overall schematic of Port of Miami.

NTSB/MAB-07/03

4

NTSB/MAB-07/03

NTSB/MAB-07/03

5

NTSB/MAB-07/03

6

Figure 5. Layout of Norway’s aft boiler room, where boiler No. 23 ruptured (from copy of original drawing of S/S France boiler arrangement provided by NCL). Boilers were numbered to indicate whether they were in the forward (1) or aft (2) boiler room. Thus, No. 23 indicated the third boiler in the aft boiler room. The forward boilers were removed when the France was overhauled and renamed the Norway. About 0637, a boiler ruptured in the aft boiler room. The second engineer in the engine control room and other crewmembers said that they heard a “bang” and felt the vessel shake. Some crewmembers said they thought that something had struck the side of the vessel; others said they thought that a bomb had detonated. The second engineer who had gone off watch said that he was outside on the Olympic deck (deck No. 11) when he heard the bang, looked up to see “lots of black smoke from the aft smoke stack,” and knew that “something had gone very wrong in the boiler room.” Boiler No. 23, located on the starboard side of the boiler room, had ruptured. The boiler contained about 20 tons of water operating at a temperature of about 528º F under a pressure of about 60 bar (870 pounds per square inch [psi])10). In the normal atmospheric pressure of the aft boiler room (14.7 psi), the pressurized hot water rapidly expanded in volume about 1,260 times into steam.11 The expanding steam, mixed with smoke, soot, and debris, swept through the engineering spaces, fatally injuring four

NTSB/MAB-07/03

7

engineering crewmembers who were on watch or on duty in or near the boiler room, as well as four other crewmembers who were in the crew living spaces on the starboard side of the Caribbean deck, next to the boiler room. Because of the height of the boilers (about 30 feet), the aft boiler room space extended from deck No. 2 to deck No. 4 (Caribbean deck). The Caribbean deck was the first level having living quarters—in this case, crew rooms forward, immediately outboard, and aft of the boiler room (figure 4). The boiler casing continued upward through the remaining decks, allowing the exhaust from the boilers to vent to the outside air through the aft smokestack. As the steam rose through the aft boiler room, it broke through the bulkheads on the starboard side of the Caribbean deck (No. 4) and the Biscayne deck (No. 5), breaching the crew accommodation areas and scalding six crewmembers in their rooms or in the corridors of the accommodation spaces. Seven crewmembers were preparing to rig a garbage gangway out the side port12 of the Biscayne deck when the steam entered the corridor near them. They sustained thermal burns on 6 to 20 percent of their bodies before escaping the scalding vapor by jumping overboard toward the pier, which was about 8 feet below the Biscayne deck. Three crewmembers who jumped from the side port landed in the water and four landed on the pier; one suffered a broken leg when he landed on the dock. A crewmember on vessel security detail at an aft gangway on the Biscayne deck suffered minor burns from the smoke and steam before he escaped down the gangway to the pier. In the 15 minutes immediately after the boiler rupture, about 125 crewmembers exited the ship using the Biscayne deck gangway. At the time of the boiler rupture, a Miami-Dade police officer on routine patrol of the pier was within 100 feet of the Norway’s side port. He said that the blast momentarily stunned him, but that he recovered and immediately reported the accident and the injured crewmembers on the pier and in the water to his command, which alerted area response agencies. The police subsequently secured the pier area and did not allow anyone other than city response personnel to board the Norway, including crewmembers who had fled the ship and later attempted to reboard. In the meantime, on board the Norway, some of the injured crewmembers made their way to safety, including two men who took shelter in the main galley on the Atlantic deck (deck No. 6). The galley staff on duty immediately called the bridge to request medical help, thus alerting the bridge watch about the crew injuries. Within 5 minutes of the rupture, the bridge watch ordered the fire watch and emergency teams to muster.13 Ten minutes later, the master made a public address directing the passengers to their lifeboat muster stations. Table 1 chronicles the documented emergency response actions by shoreside agencies and shipboard personnel.

NTSB/MAB-07/03

8

NTSB/MAB-07/03

9

After the accident, the shoreside response agencies and NCL critiqued the emergency response activities of their personnel and made procedural changes based on the findings of their reviews. A discussion of their actions is found in the “Postaccident Actions by Parties” section of this brief. The damaged Norway was towed to Germany, arriving in Bremerhaven on September 23, 2003. The ship remained moored at Bremerhaven awaiting a decision on whether it would be repaired and returned to service or taken out of service. In March 2004, NCL announced that the Norway would not be returned to service and transferred ownership of the vessel to its parent company, Star Cruises, for eventual scrapping. The Norway was the only steam vessel operated by NCL. Boiler Information Operation The Norway’s boilers were water-tube, modified D-type14 units (figure 6). The boilers produced steam at about 60 bar (870 psi) pressure from water that was heated by oil-fired furnaces. The water was carried in tubes surrounding the furnace area (combustion chamber). Combustion air was routed from forced-draft fans to the five burners (fed with heavy fuel oil) fitted on the front of each burner. The Norway’s boilers had an upper steam drum, a lower water drum, and a waterwall header. The waterwall header (where the failure occurred in the accident) was about 29 inches in diameter and had manholes at each end. The drums and header connected the various banks of tubes surrounding the furnace area. The outer surfaces of the boiler were kept cool by waterwall tubes and refractory materials suitable for high temperatures,15 all of which were enclosed in an air-cooled steel casing. The steam drum served as the upper interface between the steam and the water. Steam traveled from the steam drum through an outlet pipe at the top to another set of tubes called the superheater. The superheater further raised the steam’s temperature and thus its energy level.16 Superheated steam went to the ship’s main propulsion turbines and auxiliary turbines. The turbines converted the thermal energy of the steam into mechanical energy and drove the Norway’s propellers and electrical generators. Steam at lower pressures and temperatures also heated the boiler’s fuel oil, produced distilled water, and warmed the ship’s living and work spaces, among other uses.

NTSB/MAB-07/03

10

NTSB/MAB-07/03

11

The steam output flow rate was regulated by controlling the fuel oil pressure to the burners and by varying the number of burners in operation. Combustion gases leaving the furnace were routed across screen tubes, superheater tubes, generating tubes, and economizer tubes before passing upward through the exhaust duct and away from the ship at the top of the smokestack. The boilers were fitted with an electronic automatic control system and an electronic boiler management system. Besides automatically lighting and shutting down the boilers and burners (the burners could also be started and stopped manually), the boiler management system would automatically shut down the boiler or burners when critical parameters (such as steam pressure or steam drum water level) exceeded safe limits or when a burner failed. The boilers were also equipped with a remote monitoring and alarm system, and each boiler had three safety valves—two at the top of the steam drum and one at the superheater outlet—to protect against overpressurization.17 The Norway’s boilers operated as part of the steam cycle—a closed cycle in which used steam is condensed and returned to the boilers as feedwater to generate more steam. The steam cycle has four phases: generation, expansion, condensation, and feed (figure 7). In the generation phase of the steam cycle, the chemical energy of fuel oil is converted into thermal energy (steam). In the expansion phase, the steam enters the turbines, which convert its thermal energy to mechanical energy. Having lost most of its energy, the steam leaves the turbines at a very low pressure and a much lower temperature than when it entered. The low-pressure steam then enters the condensation phase, in which a seawater- cooled condenser converts it from a vapor to a liquid at nearly vacuum pressure. The liquid goes to a condensate pump, which increases the pressure of the fluid and delivers it to a deaerating feedwater heater. Direct contact with steam heats the water and removes oxygen. The heated and deaerated water (feedwater) goes to a feedwater pump, then through economizer tubes in the boiler’s exhaust duct. The economizer tubes heat the feedwater before it passes into the steam drum, and the steam cycle begins again.

NTSB/MAB-07/03

12

Deaerating Feedwater Heater Steam Turbine Feedwater Pump Condensate Pump Condenser Superheater Generating Tubes Condensation Phase Feed Phase Economizer Steam Drum Water Drum Expansion Phase Generation Phase Exhaust Mechanical Output

NTSB/MAB-07/03

13

horsepower. The propulsion study report recommended that new, higher-capacity boilers and new booster propulsion units be installed to achieve the desired horsepower. About the same time, NCL also contracted with Harris Pye Marine, Ltd., a leading specialist in repairing marine boilers and associated steam systems, to assess the Norway’s boiler equipment. The contractor reported: Although these boilers are around 40 years old and are currently suffering from on-going tube failures, there is no report of the main components—i.e., headers or drums–having any Conditions of Class18 put on them. It is known that various defects have been noted in and attended to in the past, but we would not suggest that this precludes these components from many more useful years work, once the deteriorating tubes have been addressed. . . . In November 1997, the port engineer at the time wrote to the NCL executive vice president, cruise operations: “The boilers on the S/S Norway have reached a state where a decision must be made.” He recommended a number of options for addressing the problems, including, but not limited to, replacing the old boilers, completely retubing the old boilers with new economizers, and installing new automation. On November 19, 1997, NCL’s executive vice president, cruise operations, wrote in an interoffice memo that the company would begin a retubing program on the Norway “next year.” Major overhauls of the boilers began in November 1998 with the retubing of both the upper and the lower economizers. In May 1999, the tube bank in the furnace area was retubed, and in 2002, the secondary superheater was retubed. Defects and Repairs. To determine the nature and scope of past problems with the boilers, Safety Board staff obtained copies of various company and classification society documents over the previous 40 years to review the repair history of the boilers. Company reports and classification society surveys documented instances of cracking, corrosion, pitting, and tube failures throughout the history of the ship’s boilers (tables 2 and 3).19 The documents indicate that as early as December 1970, cracks were observed in the longitudinal welds of the waterwall headers, water drums, and steam drums of all four boilers. The documents also indicate that the longitudinal welds on the header of boiler No. 23 (the boiler that ruptured) were last weld-repaired in 1990.

NTSB/MAB-07/03

14

The boiler drums were periodically monitored by visual and nondestructive testing20 methods, and detected cracks were removed by grinding. When cracks extended below the minimum allowable wall thickness, they were ground off, and weld repairs built the walls back up. The engineering company Deutsche Babcock specified the welding procedure, which BV approved. Lloyd Werft or its subcontractor performed the weld repairs while the ship was in drydock in Bremerhaven in 1987 and 1990. Table 2. Documented boiler cracks and corrosion during vessel history. Date Source Condition Dec. 1970 Deutsche Babcock report Small flaws [cracks] in welded seams in water part of steam drums, maximum depth 1.5 millimeters (mm). Dec. 1973 Deutsche Babcock report 1- to 3.5-centimeter cracks found in water drum boiler No. 24; cracks were ground off up to 3 mm depth. Feb. 1974 Deutsche Babcock report Corrosion flaws found in way of internal longitudinal welded seams of water drums. Corrosion defects ground off. Maximum depth of defects ∼3 mm. 1982 NCL study Microcracks found in tubes. Conclusion: frequent boiler cycling very damaging to boilers. May/June 1982 Deutsche Babcock report Corrosion cracks in longitudinal and circumferential welds of boiler Nos. 21-24; defective areas rectified by grinding. July 1982 BV survey report Cracks found as follows: lower small header [waterwall header] boiler No. 23—whole length of outer longitudinal seam and about one-third of length of inner longitudinal seam, maximum depth about 1 mm. All cracks ground off. Sept. 1984 BV survey report Upper and lower drums found without new cracks. Lower small drum: cracks found in way of outer and inner longitudinal weld seams, maximum depth ∼2.5 mm. All cracks ground off. June 1985 BV survey report Erosion seen in lower areas of drums on circumferential weld seams. BV recommends rectifying defects by grinding. All drums of boiler No. 23 show strong corrosion pitting. Conclusion: heavy oxygen corrosion present. Sept. 1987 BV survey report Cracks and pitting in most drums of all boilers. Cracks repaired by grinding, except boiler No. 21, which was at minimum wall thickness and could not be ground further. Boiler No. 21 operation restricted until upper and side drum (header) cracks could be repaired. Nov. 1987 BV survey report Cracks on longitudinal seam and wastage in boiler No. 21 upper drum and side drum permanently repaired by welding. Sept. 1990 Deutsche Babcock test report Corrosion and pitting in almost all drums. Boiler No. 23 lateral drum had “crack-like” indications in longitudinal welds, but none in circumferential welds. Welding done on lateral drum of boiler Nos. 22 and 23. Longitudinal weld on boiler No. 21’s upper drum not reworked. Nov. 1990 Letter from Babcock Material Test Division to NCL Corrosion chip tested from upper drum of boiler No. 22. Corrosion attributed to oxygen corrosions during boiler standstill with lack of preservation coating, or during boiler operation with unsatisfactory water quality.

NTSB/MAB-07/03

15

Date Source Condition Jan. 1991 Letter from Lloyd Werft to Kloster Cruise Lloyd Werft points out problem with increased corrosion: “Regarding the increased occurrence of corrosion pittings inside the boiler drums and Babcock's report on this matter, we hereby point out to you again that the preservation of the boilers in shutoff condition should be given the utmost attention.” Sept. 1993 Deutsche Babcock service report Corrosion in all drums of boiler No. 24, including “severe corrosion pitting on both longitudinal welds” of intermediate drum. Oct. 1993 BV survey report Survey of boiler No. 24 finds corrosion in all drums. BV recommends “on shutdown of the boiler, it is however absolutely necessary to inspect the longitudinal welds of boiler 24 again." Aug. 1996 BV memorandum Miami BV office advises London BV office to check main boilers for cracks: "A particular attention has to be paid to the Main and Aux[iliary] Boilers. Some cracks were found since 87 on the various drums of the MB [main boiler] as indicated hereafter. Particular attention to be paid to monitor these details.” Sept. 1996 BV survey report Cracks and pitting in boiler Nos. 22 and 24. Scanning reveals cracks to be 5 to 6 mm deep and 1 to 1.5 mm wide. Nov. 2002 Harris Pye report Inspection of boiler No. 21 finds oxygen tubercles [areas of mineral buildup] in [generating] tubes. Report states: “[W]hat gives us cause for concern is the fact that we do not know what active corrosion is underneath the tubercles.” Jan. 2003 Harris Pye report Inspection of boiler No. 24 finds: “The amount of tubercle growth and pitting . . . indicates that oxygen corrosion is active in this boiler.” No documents were found indicating that cracks were found or repaired after

1. A former port engineer told investigators that his practice had been to have the

boilers periodically inspected for cracks, but that such inspections did not take place during the 1999 shipyard period, his last year of employment with NCL. NCL’s Miami port engineer at the time of the accident declined on the advice of legal counsel to be interviewed by the Safety Board. Table 3. Documented tube defects and corrective action during vessel history. Year Month Condition 1980 Apr. Leaks in two water tubes (boiler No. 21); contractor finds pitting in all water tubes of all boilers.

May Leaks in five water tubes (boiler No. 21).

1981

All boilers have significant tube failures when sulfamic acid from evaporator leaks into boiler feedwater system. 1982 Sept. Break in economizer tube (boiler No. 23); two holes in waterwall tube (boiler No. 21).

Oct. Evaporator tube on boiler No. 21 leaks and sprays water on a tube, damaging it.

Nov. Tube bursts (boiler No. 21).

NTSB/MAB-07/03

16

Year Month Condition

July Economizer tube failure (boiler No. 23).

Nov. Tube failure [boiler not identified]. 1988 June Tube failure (boiler No. 23).

Sept. Tube failure (boiler No. 23).

Oct. Two tube failures (boiler No. 22). 1990 Dec. Tube failure (boiler No. 22). 1996 Feb. Tube failure (boiler No. 21).

May Leaks in superheater tubes of two boilers.

June Tube failure (boiler No. 21).

July Tube failures on internal desuperheater and two tube leaks on economizer (boiler No. 22).

July During BV occasional survey (boiler No. 21), 23 generating tubes and riser tubes are plugged.

Sept. Drew Marine analyzes cause of tube failure. Attributes failure to “dual contributions of internal stress-assisted corrosion damage and creep void and crack formation, which was related to long-term metal overheading.” 1998 Oct. Harris Pye retubes economizer (boiler No. 23).

Nov.-Dec. Crew plugs main condenser tubes.

Nov. Harris Pye retubes economizer (boiler No. 22).

Dec. Crew plugs tube (boiler No. 22). 1999 Feb. Crew plugs superheater tube (boiler No. 22). 1999 Apr.-May Harris Pye retubes boiler Nos. 22 and 23. 2000 Jan. Tube leaks in boiler No. 24.

Feb. Tube leak in economizer (boiler No. 24).

June Crew plugs tubes on superheater and riser (boiler No. 24).

July-Aug. Crew plugs surge pipe and secondary superheater (boiler No. 24).

Aug. Crew plugs tube on riser (boiler No. 24).

Oct. Tube leaks in boiler Nos. 22 and 23 plugged.

Oct.-Nov. Tube leaks in boiler Nos. 21 and 23 plugged. 2001 Jan. Tube leak in boiler No. 23 plugged.

Feb. Economizer tube leak in boiler No. 23 plugged.

May Tube leak in boiler No. 21.

July Superheater tube leaks in boiler No. 24 plugged.

Aug. Economizer tube leak in boiler No. 21 plugged.

Oct. Superheater tube leaks in boiler No. 24 plugged.

Oct. Superheater tube leaks in boiler No. 21 plugged.

Dec. Superheater tube leaks in boiler No. 24 plugged. 2002 Feb. Superheater tube leaks in boiler No. 21 plugged.

NTSB/MAB-07/03

17

Factors Affecting Boiler Life Marine boilers have an estimated design life,21 and the degree of material fatigue they sustain is affected by how they are operated, how well they are maintained, and how often and how well they are inspected and repaired. The Safety Board reviewed the written operating practices of NCL and BV and interviewed past and present company representatives to determine the effectiveness of stated and actual operations. Investigators addressed a number of practices; the discussion below summarizes findings in the areas of written guidance, startup and shutdown protocols, cycling, water testing and treatment, maintenance and cleaning, and inspections. Written Guidance. The original boiler manuals issued by the vessel manufacturer22 included detailed instructions for operation and maintenance designed to minimize thermal stresses and the potential for material degradation, such as cracking and corrosive pitting, and component breakdown, such as water tube failures and leaks. NCL’s procedures for managing the Norway’s engineering equipment were formalized in 1998, as required by the International Management Code for the Safe Operation of Ships and for Pollution Prevention (International Safety Management Code, or ISM code).23 The stated objective of the NCL safety and environmental management system (SEMS) was “to ensure that conditions, activities, and tasks both ashore and onboard essential for the safety and protection of the passengers, crew, ship and the environment, are carried out under controlled conditions.” NCL SEMS procedure J100 stated: This ship is to be maintained in compliance with applicable Flag State, Classification, International and Local Rules and Regulations at all times. A Planned Maintenance System, AMOS-D, forms the basis for the onboard maintenance program for equipment and systems, additionally, there shall be an ongoing maintenance program kept up to date both for corrosion control purposes and to present the vessel in a first class condition at all times. NCL used AMOS, a computer-based preventive maintenance program, to plan and document maintenance actions for all equipment, including the boilers. The computer-based program did not contain a procedure for boiler inspection and cleaning. The original boiler manual states that the “frequency of cleaning cannot be laid down in any precise manner” but recommends that cleanings should not be carried out more often

NTSB/MAB-07/03

18

than every 3,000 hours.24 At the shipboard level, the chief engineer and his staff managed the Norway’s engineering equipment. The senior first engineer was responsible for maintaining AMOS.25 Startup and Shutdown Protocols. During the startup, also called “light-off,” and shutdown of a steam boiler, pressure and temperature changes cause bending and alternating stresses in the various boiler components, such as drums and headers. All marine boilers are designed to accommodate thermal and mechanical stresses. In the case of the Norway boilers, the waterwall header, the water drum, and the inboard side of each boiler had structural supports at the front and the rear. In addition, the structural foundation of each boiler was supported by a “sliding foot,” a design arrangement that allowed the boiler to expand as it heated up during light-off and to contract when it was cooling off during shutdown.26 Maintenance records indicate that the boilers had experienced problems with the condition of the sliding feet on at least two occasions before the accident. In January 2003, the Harris Pye inspector reported that “the sliding feet [of boiler No. 24] showed no indication of movement” and “no signs of lubrication.” A sliding foot that cannot move is termed a “frozen foot” and can cause high stresses on the boiler and the ship’s structure because it restricts boiler expansion. NCL records show that maintenance was performed on “not working” feet of unidentified boilers 2 weeks before the rupture. Major marine industry entities involved with steam boilers, including the U.S. Navy, classification societies, and boiler manufacturers, have published instructions indicating that care must be taken during light-off and shutdown to mitigate thermal stresses on a boiler. The machinery operation and maintenance guide issued by the vessel manufacturer specified proper procedures for starting up and shutting down its boilers.27 During light-off, the manufacturer’s manual indicated that one or more of the unit’s burners should be fired at intervals until the pressure reached 8 bar (116 psi), after which continuous firing was allowed until the boiler reached a pressure of 60 bar (870 psi).28 The manual states that reaching the recommended operating pressure requires “about 3 hours,” and that it is “advisable not to accelerate the procedure, and to allow the

NTSB/MAB-07/03

19

temperature to rise gradually.” The manual’s specified procedures for shutting down a boiler indicate that the superheater should not be filled with water until “the boiler has cooled down, about 48 hours after extinction [of fires].” The Norway’s chief engineer had posted the company’s light-off and shutdown procedures in the boiler room for the engineering crew’s reference. The posted procedures did not specify a period for raising the steam pressure or for cooling down a boiler. Safety Board investigators talked with several second engineers on the Norway. Their comments indicated that, in general, they followed the light-off procedures recommended by the manufacturer. A second engineer who had worked on board the Norway for about 4 years stated that he allowed a boiler to heat up “very slowly” by switching a burner on for 5 minutes and then off for 5 or 10 minutes during “the first hours,” and that this light-off process took about 10 hours. He stated, in part: We used to start heating the boiler when we are in St. Thomas . . . about 8:00 in the morning . . . We start the process for . . . eight to nine hours, till we have full pressure. We do it very slowly. So, I may . . . switch on the burner for five . . . minutes and switch off 10 minutes the first hours. Normally, we . . . have 60 bar on the boilers about 6:00 in the evening. . . . . Statements from several second engineers revealed, however, that none of them followed the manufacturer’s procedures for shutting down the boilers. They each employed one or more measures, such as opening vents and drains and running one or more of the boiler’s forced-air fans, in an attempt to speed the cooling of the boiler so that it could be shut down in less time, in some cases, in as little as 1 to 2 hours. One second engineer said that by using the forced-draft fans and opening the drain on the bottom of the water drum (the boiler bottom blow valve) for about 20 minutes “so [that] it loses a lot of pressure,” he estimated that the boiler pressure could be reduced from 60 bar (870 psi) to 0 bar in 1 to 2 hours. The boiler monitoring system had several strip chart recorders29 that recorded various boiler operating parameters, including steam pressure (for boiler data, see appendix A). The pressure chart data could be used to estimate the time it took for a boiler to warm up and cool down during light-off and shutdown, respectively. Investigators noted that the charted light-off profiles were consistent with intermittent firing of the burners. The data indicate that the boilers went from zero pressure to a full pressure of 60 to 62 bar (870 to 900 psi) in 1.5 to 5.5 hours; the average was 3.4 hours. According to the charts, the boilers were fired at 10-minute intervals and shut down for 10 minutes until the boilers reached pressure.

NTSB/MAB-07/03

20

The charted shutdown profiles showed a steadily decreasing curve, representative of a falling pressure rate over time—in most cases, a reduction from full pressure to zero pressure in about 3 hours. The rate of pressure drop from full to zero pressure ranged between 45 minutes and 4 hours, with an average of 2.8 hours.30 Between the late 1990s and 2002, several port engineers and chief engineers expressed concern about the effects on the boilers caused by the frequent light-offs and shutdowns required by the vessel’s operational schedule and route. In a 1998 e-mail to the NCL’s vice president of ship operations, an NCL port engineer stated: Since the S/S Norway started the itinerary to St. Maarten, St. John, St. Thomas, Great Stirrup Cay, the ship has been sailing on 2-3 boilers. This operation is causing a lot of stress to the boilers, because we are forced to shut them down frequently. After a few years of operating in this condition, and being the boiler shut down for more than 100 times, and light off every year, we can see that the steel is getting brittle and the reoccurrence of tube failures. If we want to continue the safe operations of the vessel with no mechanical interruptions, the retubing of all 4 boilers should be done soonest. During the last few years, we experienced numerous boiler tube failures, which caused shutting down the boilers for repairs. We must realize that we have reached a point where the operation of the vessel is not safe. Also we should take in consideration that the interior of the boilers [is] worn out due to sulfur-dioxide corrosion. In January 2002, a different port engineer (the port engineer at the time of the accident) sent an e-mail to NCL management, advising: Leaks on the boiler will happen again, and is–once in awhile, not particular[ly] abnormal. But with the frequency of leaks we have had lately, particular on boiler 24, it is all reasons for concern, and it has to be addressed. The reason for boiler-tube leaks on the Norway is well known; in and out with the third boiler every single week gives heavy thermal stresses of the boiler-tubes, economizers and brickwork. With the present itinerary, delays and/or cancellation of ports must be expected. Later that year, in July 2002, the port engineer e-mailed NCL management: The planned re-tubing of the superheaters [has] had some impact on the consumption; with only 3 boilers in operation, the chief engineer has been uncomfortable in shutting down the boiler on Saturdays, knowing he must light it up again before S. Martens. So three boilers have been in line until safe rest- speed to St. Martens has been obtained. Knowing how much stress this lighting up and shutting down has on the boiler, I support this when one boiler is out of service.

NTSB/MAB-07/03

21

Cycling. One boiler cycle is defined as the unit going from zero pressure to full pressure and back down to zero pressure. At the time of the accident, the Norway’s itinerary was a 7-day voyage that departed the Port of Miami, sailed to stops in St. Maarten (Netherlands Antilles), St. Thomas (U.S. Virgin Islands), and the Great Stirrup Cay (Bahamas), and then returned to Miami. After the Norway began that itinerary, the ship’s boilers were subject to more frequent cycling than when the vessel made trans- Atlantic voyages while under French flag. The Norway normally sailed using two or three boilers, depending on the speed needed to reach a port on the cruise schedule. Typically, one or more boilers were idle for periods lasting from a day to several weeks (see appendix A). Investigators examined the stoker (boiler operator) logbooks to determine the number and the duration of the cycles and the shutdown periods for the four boilers. For a 1-year period (July 1997 to July 1998) taken at random, the boilers had between 11 and 29 cycles, or an average of 23 cycles per year. For the 17-month period before the accident (January 2002 through May 2003), the boilers had between 18 and 26 cycles, or an average of 15.2 cycles per year. The logbooks show that a boiler’s cycle frequently lasted 1.5 days or less, and in many cases, less than half a day. The logbooks showed that between July 1997 and July 1998, the boilers were shut down for 10 or more days between two and seven times (appendix A, table 2). Pressure chart data confirmed that the Norway’s engineering crew typically brought a boiler’s pressure down to zero shortly after they shut it down. Three of the four boilers each were idle for periods lasting 20 or more days.31 Boiler No. 22 was shut down once for more than 20 days, boiler No. 23 was shut down twice for more than 20 days, and boiler No. 24 was shut down six times for more than 20 days. In the 17-month period before the accident, a boiler was shut down for 10 days or more between three and seven times. Boiler No. 23 was shut down once for more than 20 days, boiler No. 21 was shut down twice for more than 20 days, and boiler No. 24 was shut down for more than 20 days three times. The boiler records did not indicate whether the boilers were in a wet or dry condition32 during periods of idleness or what techniques, if any, were used to prevent oxygen corrosion during lay-up (see below). Water Testing and Treatment. An essential maintenance task associated with steam boilers is ensuring that the water in the system is free of contaminants and has the appropriate chemical and oxygen levels to prevent scale formation and corrosion. As discussed in the “Boiler History” section, the Norway’s boilers were found to have pitting and oxygen corrosion on multiple occasions during their lifetime. As noted in the “Postaccident Investigation and Findings” section, the fatigue cracks found on the water wall header fracture surface appeared to have originated at the base of corrosion pits.

NTSB/MAB-07/03

22

NCL had a chemical treatment program that included required procedures for water testing by onboard engineering personnel and a contract with Drew Marine Division of Ashland Chemical to supply test and treatment chemicals for the boiler water and to provide technical services. The water treatment manual used by Drew Marine recommends that the level of hydrazine33 in a boiler’s water be 0.03 to 0.01 parts per million (ppm) for normal operations and that it be increased to 150 to 200 ppm during periods of wet lay-up. The Drew Marine guidance also states that a wet lay-up (as opposed to dry lay-up) be used for “all but very extended lay-up periods.” However, the manual does not define “very extended lay-up periods.” The original operating manual from the French manufacturer recommended that if a boiler was to be “shut down for a prolonged period (5 days or more), completely fill the upper drums [with water] up to the air releases [drum vents], injecting hydrazine.”34 The NCL water treatment procedures required a second engineer to draw and test the water from the boilers each day and, if needed, to either add the appropriate chemical to control phosphate levels, alkalinity, pH levels, chloride levels, dissolved solids, and oxygen levels (as indicated by the amount of oxygen scavenger present in the water) or to skim the water to remove contaminants. An NCL second engineer documented the test findings. Although the water test and treatment logs indicated whether a boiler was in a steaming condition or shut down, they did not record whether it was in a dry or a wet lay- up status when idle. Consequently, the logs do not indicate whether the level of hydrazine was increased as part of the lay-up procedures for a boiler being idled (appendix A). The contract services with Drew Marine included a visit about once a month from one of its engineers, who would review the records of tests done by the vessel’s second engineer, independently test the boiler water, and, if necessary, train the crew in boiler- water-testing procedures. The service engineers also submitted reports of findings to the Norway’s chief engineer and to the port engineer. Available historical service reports indicate that a Drew Marine engineer repeatedly commented about deviations from the standard levels of chemicals and the need to maintain the levels within prescribed limits. However, the service technician did not state that NCL’s administration of the chemical program was deficient. According to a Drew Marine representative in Miami, the service engineers relied primarily on their reviews of tests done by the crew and on their own monthly tests to evaluate the effectiveness of the water treatment program. The service engineers did not examine the interiors of the boilers to determine whether or how well the chemical treatments controlled scaling, sludge, and corrosion inside the drums and tubes. Safety Board investigators examined the water chemistry logbook for the boilers and noted that the second engineers had recorded daily readings of parameters such as phosphate, hydrazine, conductivity, chloride, pH, and alkalinity. The logbook also

NTSB/MAB-07/03

23

showed the amounts of other chemicals, including the oxygen-scavenger hydrazine, that reportedly had been added to adjust the water chemistry.35 Investigators noted that no entries were logged for some boilers for several days at a time and subsequently determined that water chemistry readings were not taken when a boiler was not steaming. Closer examination of the data for a randomly selected year (January through December 2000) revealed the following about the levels of hydrazine: • In some cases, the levels of hydrazine were low during operation. For example, in boiler No. 24 from July 27 to September 28, 2000, hydrazine levels were almost always below the specified minimum, at approximately 0.01 ppm. • Almost every time a boiler came out of an idle period (lay-up), the hydrazine level was zero or near-zero for 1 or more days. After reaching the specified range, the levels typically stabilized and then were generally maintained within operational limits. • No records indicate that after a boiler was taken out of service, the hydrazine was increased to the level recommended by Drew Marine for idle conditions (150 to 200 ppm). • Boiler water chemistry readings were not taken on idle boilers in the wet condition to assess the levels of hydrazine present.36 Among the documents that Safety Board investigators reviewed were shipyard memoranda warning that action needed to be taken to address the suspected cause of the active corrosion found in the boilers, including the maintenance of idle boilers. A memorandum dated January 25, 1991, from a shipyard that had performed an inspection of the boilers stated: Regarding the increased occurrence of corrosion pittings inside the boiler drums and Babcock’s report on this matter, we hereby point out to you again that the preservation of the boilers in shutoff condition should be given the utmost attention. It would be recommended to make a provision for transfer pumping of the boiler water from the smaller side drums to the upper drum. Maybe, there should also be discussions with Drew Chemical about the dosage of hydrazine in boiler water and condensate. In July 1991, the same shipyard stated in a memo:

NTSB/MAB-07/03

24

Please find enclosed the report of the boiler water analysis for the S/S Norway . . . No major trace elements have been found in the analysis results. So there is every indication to suppose that the increase in corrosions is nothing else but the effect of shutdown corrosion. We would suggest the following measures to solve this problem: Installation should be done of a connecting steamline from the atomizer steam groups on each boiler to the respective two lower drums in each case . . . The steam as nozzled this way will keep the boiler under pressure and maintain temperature . . . The overall situation about the problems with combustion air and corrosion should be discussed in detail between Siemens, Babcock, the Owner, and Lloyd Werft. Investigators found no evidence that the shipyard’s recommendations were followed. In late 2002 (table 2), a contractor inspected boiler No. 21 at the request of NCL and found “oxygen tubercles present in the [generating] tubes.”37 The report further stated, “[W]hat gives us cause for concern is the fact that we do not know what active corrosion is underneath the tubercles.” Maintenance and Cleaning. On the basis of statements from the vessel’s engineering crew and other maintenance records for the 3 years preceding the accident, all four boilers had been cleaned and inspected about every 3,000 hours. The 3,000-hour maintenance tasks included cleaning the water economizer and water-washing the superheater and generating tubes. The original boiler manual noted that “if the treatment of the boiler water is correct, then as a rule no significant deposit should occur within the boiler tubes.” If necessary, a scaling device driven by compressed air could be used, but the manual advised against using it “frequently or regularly, unless large deposits are detected, as the mechanical scaling of the tubes destroys the protective coating formed by the phosphates.” The manual states that the drums should be cleaned at every inspection by washing with fresh water to remove mud deposits that “may have a rapid corrosive effect.”38 For boiler No. 23, the 3,000-hour cleanings and inspections had occurred in February 2000, November 2000, March 2001, September 2001, May 2002, July 2002, January 2003, and April 2003. Boiler No. 23 was off-line from April 19, 2003, until May 15 (10 days before the accident) while engineers repaired the furnace’s refractory material (blue-ram39). Inspections. As noted in the “Written Guidance” section, NCL had formalized the process for managing the Norway’s engineering equipment, listing the required procedures in the company’s SEMS and establishing a computerized preventive maintenance system (AMOS). Investigators reviewed the SEMS manuals and other

NTSB/MAB-07/03

25

materials and found no references to requirements or procedures addressing periodic inspection of the boiler interior areas for corrosion and cracks. Because of the limited access to the interiors of the waterwall headers (a manhole at each end of the 13-foot-long cylinders), inspection was best accomplished by the inspector actually entering the headers. However, access was difficult because the access manholes measured only about 12 by 16 inches (30 by 40 centimeters) and the drum was only 29 inches in diameter. In interviews, the second engineer in charge of boiler maintenance said that he could and did enter the waterwall headers to check the inside of the drums.40 The relief chief engineer, who was 6 feet 7 inches tall and weighed 340 pounds, said that it was impossible for him to enter the drums and headers.41 BV rules required a complete (internal) survey of boilers twice in 5 years, or about every 2 1/2 years. BV had internal procedures that provided guidance to its surveyors in the inspection of boilers. When questioned about his inspection of the internal areas of the drums and headers, the BV surveyor at the time of the accident stated that BV did not require its surveyors to enter the drums and that he could not get into the steam drum, the water drum, or the waterwall header because the access manholes were too small. He said, “You can look in . . . for corrosion or whatever, but it’s limited.” The previous BV surveyor stated that he had entered the steam and water drums of the boilers, but that he had not entered the waterwall header and had only viewed the interior of the header from the outside. He also stated that the BV guidelines required the surveyors to enter only the steam drum; the requirements did not stipulate that they should enter the water drum or the waterwall header. According to NCL’s previous Norway port (Miami) engineer, the BV surveyor who performed boiler surveys during the 1980s and until 1991 went inside the drums and headers during inspections. He indicated that a surveyor could not examine the drum by simply putting his head through the access opening and shining a flashlight inside the drum. He stated, “You have to go in . . . And it’s a very, very cramped space. Not everybody can get in there.” He said that he was aware that other BV surveyors had entered the drums to inspect them. According to BV survey rules and internal guidance provided to its surveyors before the accident and still in effect, if a boiler has not been fully surveyed internally, hydraulic tests are required.42 No specific test pressure is specified for the hydraulic tests, but 115 to 140 percent of working pressure is the typical pressure specified for such tests. Because the Norway boilers were certified to operate at 70 bar (1,015 psi), a 115 percent

NTSB/MAB-07/03

26

test pressure would have been about 80 bar (1,160 psi). According to BV survey documents, boiler No. 23 was last internally inspected in July 2002, at which time it was subjected to a 70 bar (1,015 psi), or working pressure, hydraulic test. During its previous internal examination in November 2001, the boiler was not subjected to a hydraulic test, and at its May 1999 internal examination, it was subjected to a hydraulic test of 80 bar (1,160 psi). Thus, BV did not appear to follow its own rules regarding hydraulic testing. Postaccident Investigation and Findings NCL assigned a metallurgist to assist a Safety Board metallurgist during the on- scene examination of the boiler room. The NCL metallurgist also participated in the follow-up examination and analysis of boiler sections that were removed and sent to the Board’s materials laboratory in Washington, D.C. On-Site Examination and Testing On June 6, 2003, Safety Board investigators conducted an on-site examination of boiler No. 23 and observed that a large outboard section of the waterwall header was liberated where fracture had occurred (figure 8). The waterwall header had been manufactured by longitudinally welding together two half-cylinder components—the tube sheet, so called because it contains openings for the waterwall tubes, and a thinner sheet called the wrapper sheet. Investigators noted that weld repairs had been made at the longitudinal welds between the two sheets and that large portions of the header fracture occurred at or next to the repair regions. Later laboratory tests found that the repairs appeared to have been made using the temper bead welding technique.43 The entire waterwall header, including the caps (“dished heads”), was about 16.5 feet long. The cylindrical portion of the header was about 13 feet long. The fracture along the upper longitudinal weld extended about 11 feet, and the fracture along the lower longitudinal weld extended about 8 feet. The weld repairs were approximately 1.5 inches wide along almost the entire length of the original longitudinal weld seams. The fractures along the weld seams were connected by overstress fractures through the wrapper sheet. The header’s upper longitudinal fracture had dark areas, indicating preexisting cracks that extended from the inner surface through about 40 percent of the wall thickness toward the outer surface of the header.

NTSB/MAB-07/03

27

NTSB/MAB-07/03

28

region, with the upper fracture on the tube sheet side of the weld repair region and the lower fracture on the wrapper sheet side of the weld repair region. Fatigue cracks on multiple longitudinal planes joined to form a larger crack front. The fracture features indicated that fatigue cracking began at the base of large corrosion pits and then propagated alongside the weld repair. The header material next to welded areas is known as the heat-affected zone. Heat from welding operations and subsequent recooling causes changes in the microstructure and mechanical properties of the base metal in the heat-affected zone. The welding process can also create residual stresses in and next to the weld areas. Residual stresses can lead to accelerated corrosion and cracking. Controlled welding procedures approved by the classification society are used for welds in stress-critical structures such as boilers to minimize the effects of welding. Industry codes for boilers also use substantial safety factors in design to account for uncertainties such as residual stresses. Visual examination of the fracture surface along the lower longitudinal weld repair showed fatigue cracks that reached a maximum depth of 0.55 inch in a section 0.933 inch thick. The remainder of the wall thickness fractured in overstress and was necked down (narrowed), reducing the overall wall thickness at the fracture to between 0.7 and 0.8 inch.44 Investigators prepared a transverse metallographic section through the forward end of the fracture at the wrapper sheet and lower longitudinal weld for examination in detail. This section showed cracking or pitting up to 0.1 inch deep in the wrapper sheet and up to 0.15 inch deep in the center of the weld repair, both on the header interior surface. Laboratory examination of part of the original weld (an area without weld repair) showed that portions of the original weld had been ground and the thickness of the wrapper sheet reduced. Where grinding had removed the most material, the wall was approximately 0.788 inch thick, slightly below the minimum thickness (0.791 inch) allowed before weld repair was required.45 Investigators found copper fragments on the surface of the fatigue crack portion of the fracture, next to the inner surface of the header. Fragments were not found elsewhere in the header material. The fragments were about 0.070 to 0.190 inch long, flat, and flush with the inner surface of the header, up to about 0.1 inch wide and 0.09 inch deep in the crack. The side of the copper fragments deepest into the cracks was rounded and contained longitudinal cracks. The fracture halves were put together to determine how well they matched. The shape of the fragments of copper closely matched the fracture contours (figure 9).

NTSB/MAB-07/03

29

Figure 9. View of matching fracture halves (above) and enlarged image of copper nuggets (below) at the edge of the fracture. Arrow points to area of enlarged image.

NTSB/MAB-07/03

30

Investigators determined the elemental composition of the copper fragments to be almost pure copper, with a wrought (hammered) structure similar to the composition of hammered copper refrigeration tubing. The inside surface of the nuggets had transverse marks associated with grinding, consistent with the copper material having been ground flush with the inner diameter of the header after being introduced into the open crack. Investigators considered the possibility that the copper had entered the boiler as the result of chemical reactions such as deposition induced by excess hydrazine.46 They discounted this mechanism as the source because of the mechanical features and shape of the copper nuggets. Safety Board investigators consulted with several experts in boiler operation and maintenance, none of whom could propose any theories that could adequately explain the origin of the copper nuggets. Investigators therefore concluded that the copper had most likely been deliberately introduced into the boiler waterwall header during a misguided maintenance action. A likely result of the introduction of the copper into the cracked areas of the water wall header would have been to mask the cracks, making their detection more difficult during inspections. Tests of Associated Equipment The Safety Board tested or arranged for the testing of various safety and control devices associated with the boiler system to determine whether their operation or failure might have caused or contributed to the rupture. Tests of the four safety valves on boiler No. 23 revealed no significant defects, indicating that they probably functioned properly at the time of the accident. The fuel burner management system was designed to detect abnormal operating parameters in the boiler and automatically shut it down if necessary. The control console for the system was located in the engine control room. The boiler rupture and release of steam therefore did not affect the system’s control components. However, the local actuators, sensors, and cabling were damaged to such a degree that a full system check was not possible. The Safety Board arranged for Siemens, the manufacturer of the system, and an independent systems specialist acting on behalf of the Board to do a functional check of the burner management system using simulated inputs. The check determined that the system worked as intended. NCL engineers conducted tests, witnessed by a Coast Guard representative, of the burners, retractable igniters, and fuel valves at the front of boiler No. 23. The tests indicated that the front hardware of boiler No. 23 operated properly.

NTSB/MAB-07/03

31

NTSB/MAB-07/03

32

• Continuously improve safety management skills of personnel, including preparing for emergencies. NCL adopted most of the committee’s recommended improvements or preventive measures fleetwide by the end of 2004 and included them as review items to be verified annually during internal audits. Most of the changes, several of which are described below, have been incorporated in the company’s SEMS. In the Norway accident, about 125 crewmembers exited the ship within minutes of the boiler rupture, and area police did not allow them to return to the vessel. As a result, some members of the vessel response teams and some crew monitors for the passenger muster were not on board the ship, which affected the timely accomplishment of some emergency tasks. NCL therefore added training and quarterly drill requirements for shoreside evacuations to all ship emergency plans. In some cases, the quarterly drills are conducted in cooperation with local response authorities, including those serving the Port of Miami. According to company officials, having multiple gangways rigged when the boiler ruptured facilitated evacuation from the Norway. NCL therefore reviewed other ships and ports to determine the feasibility of rigging multiple gangways so that emergency evacuation could be accomplished away from potentially hazardous ship areas. Ship emergency plans now include ongoing reviews of shoreside muster procedures following a ship evacuation. An NCL spokesperson indicated that the Norway accident highlighted the need for better hazardous material (hazmat) awareness, handling, and containment. In this instance, the Miami responders may not have been aware of the asbestos on the vessel.47 NCL has since removed vessels with asbestos from service. The company also reviewed and mapped onboard areas such as chemical lockers that pose potential explosion or release dangers and upgraded its training and response procedures for hazmat incidents. Emergency drills now include control of damaged areas after an accident, identification of hazmat contamination and personnel exposure, and other site safety measures. In addition, the company has arranged service agreements with hazmat incident response contractors at all U.S. ports where its ships call. Emergency preparedness measures now include ensuring that for emergency follow-up and investigation, responders and others can obtain extra copies of fire plans, either from a ship that has onboard plotting capability or from a port agent. For the safety of personnel, company officials researched what clothing and personal protective equipment (PPE) could safeguard crew (regular and response personnel) against hazards such as those that prevailed in the Norway accident and protect them from injury. In addition, ships are now required to carry additional PPE and portable communications for postaccident follow-up.

NTSB/MAB-07/03

33

NTSB/MAB-07/03

34

NTSB/MAB-07/03

35

Analysis of Boiler Rupture During the course of the investigation, it became clear that the header in boiler No. 23 ruptured because of extensive fatigue cracking and that a number of factors contributed to the initiation and propagation of the cracking. Cracks were detected at original welds beginning in the 1970s, and additional cracks were observed on later occasions. The cracks were monitored and ground away until the minimum allowable wall thickness was reached, at which time weld repairs were made to build up the material thickness. The cracks initiated at the base of corrosion pits at the original longitudinal welds when the boiler was exposed to excessive cycling (thermal and mechanical loading), with severe transients (rates of temperature change) from startup to cooldown and constraint from frozen support feet. The pitting most likely resulted from improper water chemistry (oxygen pitting) during lay-up periods. In 1987 and 1990, weld repairs were performed when the cracks extended below the minimum allowable grinding thickness. Cracking began again a few years later. The width and length of the weld repairs probably accelerated the pitting and cracking because of residual stresses in the weld repairs. The cracks then grew to critical size, causing the header in boiler No. 23 to rupture. Documents analyzed by the Safety Board showed no nondestructive testing or appropriate internal visual inspections after 1996 for the headers of boiler Nos. 22 and 24 and after 1990 for the headers of boiler Nos. 21 and 23. Fatigue Cracking The metallurgical analysis found that the material properties of the header steel were normal. In addition, the pressure readings at the time of the accident were within normal operating range. Therefore, the boiler was subjected to typical loads at the time of the rupture. Nevertheless, the boiler ruptured because preexisting cracks extended 40 to 60 percent through the wall thickness, which was already reduced by grinding. At the time of the rupture, there was insufficient cross-sectional area in the header to withstand the pressure, and the header failed catastrophically. It is thus clear that fatigue cracking ultimately led to the rupture of the header. Postaccident examination detected fatigue cracking in both the original welds and the weld repairs. The cracking initiated at the base of corrosion pits on the inner surface of the drums. The presence of pits localized stresses at the surface and favored the initiation of fatigue. The reduced wall thickness also contributed to fatigue initiation by concentrating local stresses. After the fatigue cracks initiated, they produced local stress concentrations at the crack tips, which most likely propagated with every firing cycle of the boiler. In a pressure vessel, cracking is expected to occur along the longitudinal weld seams because the hoop stress48 is twice the longitudinal stress, based on the internal

NTSB/MAB-07/03

36

pressure load (for a cylindrical vessel). Both longitudinal and transverse cracking was discovered in boiler No. 23, suggesting either that stress was elevated enough to initiate cracking in both directions or that additional stresses in the longitudinal direction, such as in reaction to the frozen boiler supports, were superimposed on the pressure loads to cause transverse cracking. Improper Water Chemistry Poor control of water chemistry is known to contribute to corrosion fatigue damage. According to the American Society of Mechanical Engineers (ASME) boiler code, corrosion in a boiler can occur either while the boiler is in service or while it is idle.49 When a boiler is idle, proper precautions need to be taken. Boilers are typically passivated, that is, protected from corrosion by an internal film of magnetite (Fe3O4). The film can be broken by oxygen pitting, acid dissolving the coating (acid attack), or concentrated alkali (caustic) conditions, all of which cause localized loss of boiler metal (corrosion). Localized corrosion has been noted to be the primary cause of boiler failure and can result from high chemical concentrations or uncontrolled oxygen in the system. Water chemistry records, the metallurgical characteristics of the damage, and historical documents indicate that oxygen corrosion was the most likely mechanism for the corrosion pitting observed in boiler No. 23. Oxygen corrosion, by definition, results from excess oxygen in the water system and is controlled by the use of deaerating equipment50 and chemicals such as hydrazine. According to the Drew Marine water chemistry dosing chart, the hydrazine levels for the Norway were to be maintained between 0.03 and 0.01 ppm during operation. If the levels of hydrazine were not sufficiently high, excess oxygen would be present in the water to facilitate or enable corrosion. Records show that oxygen pitting had plagued the Norway’s boilers for several decades and that the boilers had an ongoing problem with maintaining the proper hydrazine levels to prevent corrosion. The Safety Board therefore closely examined the historical levels of hydrazine in the boilers, as discussed earlier in the “Water Testing and Treatment” section (see also appendix A). Investigators found low levels of hydrazine for long periods during both operation and lay-up. Several warnings were given that oxygen corrosion was a problem and was likely the result of incorrect water chemistry during both operational and lay-up periods. It is apparent that efforts to address this issue were ineffective, since active oxygen corrosion was present, as documented in the Harris Pye reports on boiler Nos. 21 and 24 from November 2002 and January 2003. Active oxygen corrosion, as evidenced by tubercles, was also discovered during the postaccident examination of the boilers. The accident investigation determined that the Norway’s boilers were often shut down for longer than 10 days and sometimes for more than 40 days without proper water treatment.51

NTSB/MAB-07/03

37

According to the Drew Marine documents, hydrazine levels were to be increased during idle or lay-up periods, but the documents did not specify how many idle days had to pass before the boiler was considered in lay-up condition. The documents point to numerous boiler tube failures over the years. Boiler tube failure can occur because of direct pitting of the internal surfaces or because of sludge buildup on the interior surfaces. When deposits build up inside the tubes, heat transfer reduces and the tubes operate at higher temperatures because less energy is transferred to the water or steam in the tubes. Operation at higher temperatures can eventually lead to loss of material properties (creep damage), fracturing, and burn-through, requiring that the tubes be plugged at the ends and put out of commission. Deposits typically form because of improper water chemistry that leads to precipitation of minerals from the boiler feedwater or from internal corrosion of the boiler and steam system, leading to rust deposits. It is likely that the oxygen corrosion that was observed in the headers and elsewhere contributed to the observed boiler tube failures. Boiler Stresses Cycling. The greatest contributors to the initiation and propagation of the fatigue cracking in boiler No. 23 were the thermal and pressure stresses associated with starting up and shutting down the boilers. As described earlier (see also appendix A), the number of boiler cycles (pressure going from zero to full then back to zero) and the rate of pressure buildup in the Norway’s boilers were as follows: • From July 1997 to July 1998, the boilers averaged 23 cycles per year. • From January 2002 through May 2003, the boilers averaged 15.2 cycles per year. • The boilers took an average of 3.4 hours to go from zero to full pressure (60 to 62 bar). • The boilers took an average of 2.8 hours to drop from full pressure to zero. According to NCL’s former port engineer, the ship often had to shut down a boiler for some reason (such as leaking tubes), and when the engineers would restart the boiler, they would often raise the pressure too fast. The rate of drop from full to zero pressure ranged between 45 minutes and 4 hours, with an average of 2.8 hours. The time necessary to reduce boiler pressure was not specified in the operating manual or other records.52 Depending on how quickly they were started and cooled, the boilers could have suffered significant additional stresses from thermal transients. Multiple documents show that the boilers had frequent and significant damage to the boiler refractory materials, an indication that the boilers were heated and cooled too quickly.

NTSB/MAB-07/03

38

As noted earlier, when the ship was converted to Caribbean sailing, the four boilers in the forward engineroom were removed. The evidence indicates that two to three boilers operated at a time, with one usually being idle for maintenance. The original design documents were not available to show how the boilers were intended to be cycled. However, the actions taken by the classification society in 1987 when cracks were found, the statements from several of the engineers, and the numerous tube failures indicate that boiler cycling was damaging to the boilers and was known to be a problem on the Norway. Frozen Sliding Feet. Additional stresses on the boilers could have come from frozen sliding feet, which would have impeded the movement of the water drums and headers. Thermal stresses would have resulted when the pressure vessels sought to expand or contract during heating and cooling but were held in place by the frozen sliding feet. A January 2003 inspection by Harris Pye found that the feet of boiler No. 24 did not appear to be lubricated. According to NCL maintenance records, repairs were made to the frozen feet of unidentified boilers 2 weeks before the rupture. The Norway’s original boiler manual contains the following guidance regarding the sliding feet: “The free movement of the boiler feet should be checked periodically. If necessary, introduce grease through the oval holes.”53 The Navy’s inspection manual54 states that maintenance personnel should inspect the sliding feet movement indicators before each light-off, during warmup, and after a boiler comes on line. The manual further states that a boiler whose sliding feet cannot be verified as functional should be shut down for repair. The Navy document suggests that the presence of frozen feet is a serious condition that can stress the boiler and that should be corrected immediately. Welding Procedure The evidence (weld appearance, examination of metallurgical sections through various welds, and NCL documents) indicates that a temper bead welding technique was used to repair cracking and corrosion in the longitudinal welds of the header of boiler No. 23. Temper bead welding is used to reduce the detrimental effects of exposure to the very high temperatures associated with the welding process. Temper bead welding creates a weld that has a reduced hardness and lower residual stresses compared with welds created using conventional welding processes. Appendix B describes the temper bead welding technique, the weld procedure used by Lloyd Werft on the Norway’s boilers, and the procedure used by the Navy on its boilers. BV had approved the welding process used by Lloyd Werft. However, Lloyd Werft’s procedure was not specific and did not indicate that a qualification plan was used to show that the welders were capable of the job. Nevertheless, because boiler operations were sufficient to create cracking in the header of boiler No. 23 before the weld repairs

NTSB/MAB-07/03

39

were made, even if the weld repair had properties similar to the original weld, additional cracking would have still occurred because NCL did not take the steps necessary to eliminate the conditions that had originally caused the cracking. In addition, the weld location showed changes in geometry, grain size, and structure. Those factors, in particular the residual stress, created conditions that allowed subsequent cracks to initiate sooner and propagate faster than the original cracks. The fracture along the upper longitudinal weld in boiler No. 23 extended about 11 feet, and the fracture along the lower longitudinal weld extended about 8 feet. No evidence or substantiation of a welding procedure was found to show that weld repairs 11 feet long were acceptable and would not affect the life of the boiler. According to the Navy’s procedure (appendix B), weld repairs exceeding 6 inches in length require special approval. Inspection and Maintenance Boilers are typically inspected by a combination of internal visual inspection and nondestructive testing such as fluorescent magnetic particle inspection or ultrasonic inspection. The evidence suggests that lack of proper internal inspections, lack of appropriate nondestructive inspections, poor guidelines, and poor training of its surveyors by BV may have caused the cracks in the Norway’s boilers to remain undetected. Documents show that cracks were first detected in 1970 on the original welds and were monitored through a combination of internal visual inspections and nondestructive testing by boiler repair specialists and BV. From interviews, investigators found that from 1996 on, the surveyors changed their method of internal visual inspections of the headers. They began opening the manholes and looking inside with a flashlight rather than crawling inside and doing a thorough inspection (the condition of the boiler was assessed primarily by entering only the steam drum). According to the classification society rules, internal inspections were not required as long as pressure tests were performed. If visual internal inspections were performed, according to the guidelines to surveyors, inspectors did not need to enter the headers, only the steam drums. The visual inspection guide was vague and did not point out any specific areas to be inspected. The entire contents of the BV guidelines for inspecting the lower boiler drums consisted of the following:55 An internal inspection will not usually show much but any signs of pitting in the upper drum or tubes should be followed up by a further examination of the tubes via the lower drum. Manhole doors, their landings, joints and dogs should be carefully checked.

NTSB/MAB-07/03

40

After weld repair of the drums in 1987 and 1990, it appears that no further nondestructive testing was performed, except for the work done on boiler Nos. 22 and 24 in 1996, which indicated that cracking continued. From 1990 through 2003, it appears that no nondestructive testing was done on the weld seams of boiler Nos. 21 and 23, even though the history of cracking was well-documented and cracking was rediscovered on the weld seams of boiler Nos. 22 and 24 in 1996. The Safety Board’s metallurgical examination found large, isolated copper nuggets on the fracture surfaces near the surface of the header. The nuggets closely matched the contours of both fracture halves. Analysis of the nuggets revealed that the material was highly worked, with elevated hardness, and that its composition was pure copper. Similar characteristics were produced in the materials laboratory using highly worked copper tubing. The copper nuggets were found in only two areas of the fracture surface next to the weld repairs and not in other areas of the fracture surfaces or in the other boiler drums. The boiler contained no sources of pure, highly worked copper. Pure copper could have been produced by corrosion of the copper materials elsewhere in the steam system, such as in the condenser, but it would not have had the same size, microstructural features, ground-flat areas, and elevated hardness as exhibited by the nuggets. The Safety Board’s metallurgist concluded that the nuggets were not produced by corrosion. The metallurgist also discounted the possibility that the copper had been deposited in the boiler as a result of chemical reactions between excess hydrazine and copper alloys in the condenser and feedwater system. The width, overall shape, structure, and ground surface of the copper nuggets clearly indicate that the copper was worked into the cracks after they were largely formed. This means that when the copper was introduced into the fatigue crack portion of the fracture in boiler No. 23, the crack was approximately 0.1 inch wide. None of the several boiler experts interviewed had ever heard of a temporary fix using copper. From a metallurgical point of view, copper would offer no structural benefits and would not be considered a repair.56 The only explanation for the presence of the copper is that it was introduced to mask the crack, impede inspection, and avoid necessary repairs. In recent years, no formal inspection program appears to have been carried out for the boilers, even though it was known that they were susceptible to cracking and were in fact cracked in 1996. For the Norway’s last 6 to 7 years of operation, there is no record that either classification society surveyors or NCL personnel entered the headers to inspect them. Although NCL personnel apparently opened the drums and headers and looked into the boilers to assess their cleanliness during the required 3,000-hour inspections, it does not appear that they actively inspected the drum and header interiors for cracks. The presence of copper on the fracture surfaces indicates that NCL shipboard

NTSB/MAB-07/03

NTSB/MAB-07/03

42 engineers were aware of the cracking condition but did not take appropriate action to fix the problem. Summary The Safety Board determined that the following factors contributed to the rupture of boiler No. 23 on the Norway: • Lack of adherence to water chemistry composition limits and procedures by both the water chemistry subcontractors and NCL during wet lay-up periods, leading to pitting from oxygen corrosion. • Failure to take number of boiler cycles into account during maintenance. • Severe thermal transients from heating and cooling the boilers too quickly and from constraints created by frozen boiler support feet. • Use of questionable weld repair procedures. • Lack of appropriate nondestructive testing by the BV surveyors and NCL inspectors to determine whether cracks were present. • Inadequate survey guidance from BV to its surveyors. • Failure to repair cracks into which copper had been inappropriately introduced. Probable Cause The National Transportation Safety Board determines that the probable cause of the boiler rupture on the Norway was the deficient boiler operation, maintenance, and inspection practices of Norwegian Cruise Line, which allowed material deterioration and fatigue cracking to weaken the boiler. Inadequate boiler surveys by Bureau Veritas contributed to the cause of the accident. BY THE NATIONAL TRANSPORTATION SAFETY BOARD MARK V. ROSENKER

ROBERT L. SUMWALT Chairman

Vice Chairman DEBORAH A. P. HERSMAN

STEVEN R. CHEALANDER Member

Member

Adopted: October 29, 2007 Member KATHRYN O’LEARY HIGGINS voted to disapprove this brief.

43

Appendix A Boiler Data The raw data from several boiler logbooks (water chemistry logbook from January 2000 to May 2001,1 stoker’s logbook2 from July 1997 through May 2003, four printouts from pressure recorders for boiler Nos. 22 and 23) were examined and converted to tables and graphs for ease of analysis. The following describes the findings. Water Chemistry. The water chemistry logbook included daily readings on parameters such as phosphate, hydrazine, conductivity, chloride, pH, and alkalinity levels. The logbook also contained the amounts of GC,3 adjunct-B,4 Amerzine (hydrazine),5 and SLLC-A6 that were added to adjust the water chemistry. Only the levels of hydrazine were tabulated for this report. Table 1 shows the levels of hydrazine in all boilers for a randomly selected year (January through December 2000). The green cells at the top of the table show where no data were available from January 1 to 26, 2000. No data were also available for several individual days (March 13, May 13, July 17, and November 29) and for 6 consecutive days in December (December 13 to 18). The blank areas in days where data were collected show where water chemistry readings were not taken because specific boilers were idle or under repair. The required level of hydrazine was between 0.03 and 0.1 parts per million (ppm).7 Table 1 shows hydrazine levels within the specification limits in black, those above the limit in blue, and those below the limit in red. The far right column shows the monthly readings of water chemistry8 taken by Drew Marine personnel during their on-site examination at the ship. The green cells in the monthly data again indicate months for which no records were found. Reviewing the data, the following was noted: • Almost every time a boiler came out of an idle period (lay-up), the hydrazine level was zero or near zero for one or more days. After reaching the specified

1 Norwegian Cruise Line (NCL) logbook containing water tests from January 2000 through May 2001. 2 A record book containing information about when boilers are started, shut down, cleaned, skimmed, or blown-down and the fuel nozzles cleaned. Entries are made at each watch. 3 GC is a concentrated alkaline liquid that neutralizes acid and controls corrosion. 4 Adjunct B is a phosphate boiler water treatment chemical that works in conjunction with GC to control scale formation due to hardness. 5 Amerzine (hydrazine) is a liquid catalyzed oxygen scavenger used to minimize oxygen corrosion in boiler steam and condensate systems. Amerzine also promotes the formation of protective iron and copper oxide films. 6 SLLC-A is a condensate corrosion inhibitor made from a volatile liquid organic amine designed to minimize corrosion in steam and condensate systems by providing a pH environment, which neutralizes the effects of carbon dioxide. 7 Drew Marine Control and Dosing chart, BW-CS-4 (May 2003). 8 Drew monthly water chemistry service reports.

44

range, the levels typically stabilized and then were generally maintained within operational limits. • In some cases, continued low levels of hydrazine were observed during operation. For example, in boiler No. 24 from July 27 to September 28, 2000, hydrazine levels were almost always below the specified minimum, at approximately 0.01 ppm. • No records were found to show that hydrazine levels were built up before idle periods (for idle conditions, 150-200 ppm hydrazine was recommended). • It appeared that boiler water chemistry readings were not taken on idle boilers in the wet condition9 to assess the levels of hydrazine.10 According to interviews and documents,11 typically two boilers were operated on a routine basis, with the third boiler operated during peak demand. The fourth boiler was typically idle for maintenance. Examination of the data in table 1 (yellow areas) confirmed that two boilers were operated on a routine basis, with a third coming on line as needed. Cycles. The number of boiler cycles in a given period was quantified by collecting data from the stoker’s logbook for several periods: one was chosen randomly and was from July 10, 1997, to July 15, 1998 (1 year), and the other was from January 2002 to the failure date of May 25, 2003 (17 months). One boiler cycle was defined as going from zero load to a full load of 60-62 bar and back to zero. Tables 2 and 3 summarize the data for these two periods, showing the number of boiler cycles and the amount of time the boilers were on and off. Tables 4A through 4C, which show raw data from the stoker’s logbook in visual form, contain the following cycle data: • All boilers from July 1997 to July 1998 (table 4A). • Boiler No. 23 from April 2001 to December 2001 (table 4B). • All boilers from January 2002 to May 2003 (table 4C). Table 2 shows that, for a 1-year period from 1997 to 1998, the boilers accumulated between 11 and 29 cycles, with the average being 23 cycles that year or approximately one cycle every 2 weeks. Table 3 shows that from the beginning of 2002 through May 2003, the boilers accumulated between 18 and 26 cycles, with an average of 21.5 in about 17 months, or 15.2 per year. Pressure charts and interviews with personnel indicated that when the boilers were shut down, they were typically brought to zero pressure. Therefore, the boiler pressure cycles were from zero pressure to the operating

9 The wet condition was when the boiler was shut down but still sealed and full of water. 10 Based on when water chemistry readings were taken in the logbook and interviews. 11 NCL interoffice memo, March 16, 1998.

45

pressure of 62 bar (900 psi) and back to zero. It should be noted that the boilers were often started and shut down within 1.5 days or less, frequently in less than 0.5 day. Idle Periods. Tables 2 and 3 also show the amount of time the boilers were on and off. The red data indicate periods when the boilers were shut down for 20 or more days, and the blue data indicate periods when the boilers were shut down for 10 to 20 days. Table 2 (1997-1998) shows that the boilers were shut down for 10 or more days between two and seven times each in this period. Boiler No. 21 was not shut down for 20 or more days, boiler No. 22 had one instance where it was off for more than 20 days, boiler No. 23 had two instances, and boiler No. 24 had six instances. Table 3 (2002-2003) shows that in 17 months, the boilers were shut down between three and seven times each for 10 days or more. Boiler No. 23 had one instance where it was shut down for more than 20 days, boiler No. 21 had two instances, and boiler No. 24 had three instances. Startup and Cooldown. Four printouts from the boiler pressure recorders were examined to determine the rate of pressure buildup and dropoff. Table 5 summarizes the data. The question marks signify interrupted recordings, meaning that a full reading could not be obtained: either the recorders stopped before dropping to zero pressure or the boilers started back up in the middle of the cycle. The data indicate that the boilers went from zero pressure to a full pressure of 60-62 bar in 1.5 to 5.5 hours. The average ramp-up rate was 3.4 hours. According to the charts, the boilers were fired at 10-minute intervals and shut down for 10 minutes until the boilers reached pressure. That practice is consistent with the boiler startup procedure in the original operating manual.12 The rate of pressure drop from full pressure to zero ranged between 45 minutes (0.75 hours) and 4 hours, with an average of 2.8 hours. No expected pressure cooldown time was found in the original operating manual or other records.

12 Liner France, Propulsion Machinery, Operation and Maintenance Guide, vol. 3, “Boilers,” p. 26.

2000 MONTHLY January 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 22 21 0 0 0 0.01 0.05 22 0.05 0.05 0.07 0.07 0.07 23 0.05 0.05 0.05 24 0 February 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 19 21 0.07 0.07 0.07 0.07 0.07 0.07 0.07 0.1 0.1 0.07 0.07 0.1 0.1 0.07 0.07 0.1 0.1 0.07 22 0.07 0.07 0.07 0.07 0.07 0.07 0.07 0.05 0.1 0.1 0.07 23 0 0 0.03 0.07 0.07 0.07 0.07 0.1 0.07 0.05 0.1 0.07 0.07 0.06 24 0 0.01 0 0.03 0.01 0.01 0.01 0.03 0.07 0.07 0.07 0.07 0.1 0.1 0.05 0.07 0.07 0.07 0.07 0.07 0.07 0.03 0.07 March 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 25 21 0.01 0.01 0.01 0.01 0 0.03 0 22 0.3 0.07 0.07 0.07 0.07 0.07 0.1 0.1 0.07 0.03 23 0.2 0.07 0.07 0.1 0.07 0.07 0.1 0.1 0.05 0.3 0.2 0.05 ? 0.2 0.05 0.03 0.05 0.1 0.05 0.05 0.2 0.03 0.03 0.1 0.1 0.07 0.07 0.1 0.2 0.03 0.1 0.1 24 0 0.03 0.05 0.03 ? 0.1 0.07 0.05 0.05 0.1 0.05 0.05 0.03 0.03 0.07 0.1 0.07 0.07 0.1 0.1 0.03 0.1 0.1 April 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 22 21 0 0 0.03 0.03 0.05 0.05 0.07 0.1 0.05 0.05 0.03 0.03 0.03 22 0.01 0.01 0.03 0.01 0.03 0.05 0.03 0.05 23 0.1 0.1 0.1 0.3 0.2 0.05 0.07 0.3 0.03 0.03 0.1 0.1 0.03 0.1 0.2 0.07 0.07 0.1 0.07 0.07 0 0.01 24 0.1 0.1 0.1 0.2 0.2 0.05 0.07 0.2 0.03 0.03 0.1 0.1 0.03 0.1 0.1 0.07 0.07 0.07 0.05 0.02 0.1 0.07 0.07 0.1 0.07 0.1 0.07 0.07 May 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 21 0.03 0.07 0.07 0.07 0.1 0.07 0.05 0.05 0.1 0.05 0.03 0.03 ? 0.01 0.03 0.07 0.05 0.03 0.07 0.07 0.05 0.03 0.07 0.07 0.07 0.07 0.05 22 0.05 0.1 0.07 0.05 0.07 0.07 0.07 0.05 0.1 0.07 0.05 0.05 ? 0.07 0.07 0.07 0.05 23 0.01 0.01 0 0.01 0.03 ? 0.07 0.07 0.07 0.07 0.05 0.05 0.01 0.03 0.03 24 0.01 0.01 0.01 0.01 0.03 0.01 0.05 0.05 0.03 0.03 0.07 0.07 0.07 0.07 June 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 21 0.05 0.05 0.01 0.03 0.05 0.07 0.07 0.05 0.05 0.05 0.03 0.03 0.03 0.05 0.05 0.07 0.05 0.05 0.05 0.07 0.05 0.05 0.07 0.05 0.05 0.07 22 0.05 0.05 0.07 0.05 0.05 0.05 0.03 0.05 0.05 0.07 0.07 0.05 0.05 0.05 0.03 0.03 0.03 0.05 0.05 0.07 0.05 0.05 0.05 0.01 0.07 0.05 0.08 0.05 0.05 0.01 23 0.01 0.08 0.07 0.05 0.05 0.03 0.07 24 0.01 0.03 0 0.01 0.03 0.03 0.03 0.03 July 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 21 0.07 0.07 0.07 0.07 0.07 0.03 0.07 0.07 0.07 0.07 0.07 0.1 0.05 0.1 0.2 0.05 ? 0.05 0.07 0.03 0.05 0.1 0.05 0.07 0.07 0.07 0.05 0.03 0.07 0.05 0.05 22 0.07 0.07 0.07 0.07 0.07 0.05 0.07 0.07 0.07 0.07 0.07 0.07 0.05 0.1 0.1 0.05 ? 0.07 0.1 0.05 0.05 0.1 0.01 0.07 0.1 0.07 0.05 0.05 23 0.01 0.02 0.01 0.03 0.01 0.03 24 0 0.01 0.01 0.02 0.01 August 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 21 0.05 0.1 0.05 0.03 0.1 0.05 0.05 0.1 0.05 0.03 0 0.03 22 0.03 0.05 0.1 0.05 0.03 0.03 0.01 0.01 0.05 0.07 0.05 0.1 0.05 0.07 0.07 0.1 0.05 23 0.05 0.03 0.01 0.02 0.05 0.07 0.1 0.1 0.1 0.07 0.05 0.1 0.1 0.1 0.15 0.1 0.2 0.07 0.07 0.1 0.07 0.07 0.07 0.07 0.05 24 0.01 0.01 0.01 0.01 0.01 0 0.01 0.01 0.01 0.01 0.01 0.01 0.01 0.01 0.02 0.02 0.02 0.03 0.02 September 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 21 0.03 0.05 0.1 0.07 0.07 22 0.07 0.2 0.03 0.07 0.1 0.07 0.07 0.1 0.07 0.05 0.07 0.03 0.07 0.07 0.1 0.07 0.05 0.07 0.07 0.03 0.01 0.03 0.1 23 0.07 0.15 0.05 0.03 0.1 0.07 0.07 0.1 0.07 0.05 0.07 0.1 0.03 0.07 0.07 0.1 0.05 0.05 0.07 0.07 0.03 0.07 0.07 0.07 0.05 0.07 0.07 0.03 0.05 24 0 0.01 0.01 0.01 0 0.01 0.01 0.01 0.01 0.01 0.01 0.01 0.01 0.01 0.03 0.03 October 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 21 22 0.01 0.03 0.07 0.07 0.07 0.07 0.07 0.03 0.05 0.07 0.05 0.05 0.05 0.05 0.05 0.03 23 0.05 0.05 0.07 0.07 0.05 0.05 0.07 0.07 0.07 0.07 0.07 0.03 0.05 0.07 0.05 0.05 0.05 0.05 0.05 0.03 0.05 0.07 0.05 0.07 0.07 0.07 0.05 0.05 0.05 0.07 0.07 24 0.03 0.03 0.05 0.07 0.03 0.03 0.01 0.03 0.01 0.01 0.01 0.05 0.05 0.07 0.07 0.05 0.05 0.05 0.05 0.05 0.05 November 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 18 21 0.01 0.01 0.01 0.01 0.01 0.01 0.03 0.03 0.05 0.05 0.05 0.07 0.07 0.05 0.03 0.03 0.03 0.03 0.05 0.05 0.05 0.05 0.05 ? 0.03 0.07 22 0.01 0.01 0.03 0.07 0.05 0.05 0.05 ? 0.04 23 0.05 0.05 0.05 0.05 0.05 0.05 0.1 0.07 0.05 0.07 0.01 0.03 ? 0.01 24 0.07 0.05 0.05 0.05 0.05 0.05 0.1 0.07 0.05 0.01 0.05 0.05 0.05 0.05 0.05 0.05 0.07 0.03 0.05 0.03 0.03 0.03 0.01 0.05 0.03 December 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 16 21 0.06 0.06 0.06 0.05 0.06 0.05 0.05 0.05 0.06 0.06 0.07 0.07 ? ? ? ? ? ? 0 0.01 0.01 0.1 0.03 0.03 0.03 0.05 22 0.07 0.06 0.05 0.05 0.07 0.06 0.06 0.06 0.06 0.06 0.07 0.07 ? ? ? ? ? ? 0.05 0.05 0.03 0.05 0.07 0.05 0.05 0.07 0.1 0.05 0.05 0.05 0.05 0.1 23 0.04 0.04 ? ? ? ? ? ? 0.03 0.05 0.03 0.05 0.07 0.05 0.05 0.07 0.07 0.05 0.05 24 Hydrazine Content Limits 0.03-0.1 ppm Hydrazine 2000 Table 1: 2000 Hydrazine Content

ON OFF ON OFF ON OFF ON OFF cycle 1 0.5 2.5 1.5 12.5

17

1. 5

37

2 0.5 9.5 16.5 8 21 8.5 8.5 41 3 1.5 1.5 33.5 0 2 3.5 20 4.5 4 12.5 5.5 8 9 8.5 5.5 44.5 26.5 5 1.5 4.5 0.5 1.5 1.5 1.5 15.5 12.5 6 1.5 6.5 1.5 5.5 12.5 6.5 8 7.5 7 16 5 6 22 0.5 11 6.5 27 8 2 0 1.5 1.5 6.5 1.5 39.5 8.5 9 9.5 1.5 2.5 1.5 0.5 7.5 0.5 4 10 0.5 7.5 1.5 2 22.5 12.5 1 23.5 11 19.5 0 2 14.5 8.5 3 3.5 31 12 0.5 1 23.5 13.5 0.5 1.5

0.5

13 1.5 1.5 14.5 6.5 12.5 1.5 14 12.5 19.5 7.5 6 5.5 0.5 15 15.5 5.5 27 5.5 2.5 3 16 8.5 3 1 1 0.5 1.5 17 1 5 1.5 5.5 1.5 10.5 18 5 3.5 1.5 5.5 0.5 1.5 19 0.5 1.5 2 3 1.5 2.5 20 13.5 0 0.5 4.5 1.5 1.5 21 23 5.5 2 5.5 1.5 5.5 22 1.5 3.5 39 3 22.5 3.5 23 0.5 1.5 9 0.5 0.5 20.5 24 1.5 3.5 22

0.5

1. 5
2. 5

25 0.5 1.5 5.5 22.5 26 58 5 12 11 27 23 12.5 3 0 28 11 3 4

2

29 0 4 Summary Data AVG DAYS ON AVG DAYS OFF Cycles July 10, 1997 to July 15, 1998 29 24 28 11 4 6 6 19 8 9 7 15 BOILER OPERATION TIME (DAYS) BOILER 21 BOILER 22 BOILER 23 BOILER 24 CYCLE COUNT 97-98 Table 2: 1997-1998 Boiler Cycling Summary

January 2002 ON OFF ON OFF ON OFF ON OFF cycle 1

12

4

48

1 1.5 5.5

15

2 3.5 2 27.5 2.5 16 1.5 0 13 3 7.5 1 46.5 16.5 12 3 0.5 13.5 4 3.5 5.5 58.5 1 29 1 0 6.5 5 43.5 3.5 33.5 0 46 16.5 0 35.5 6 3.5 3.5 14.5 3.5 1.5 2 0 13.5 7 3.5 12.5 12.5 10 5 2.5 35.5 0.5 8 75 3.5 8.5 2.5 32.5 16.5 0.5 44.5 9 1 2 18.5 9.5 18.5 5.5 16 4.5 10 8 16.5 11.5 2.5 5.5 5 1.5 0.5 11 6.5 5.5 4.5 2.5 30 2.5 0.5 0.5 12 6.5 15.5 4.5 2.5 13.5 9.5 2.5 1.5 13 8.5 4.5 4.5 2.5 1.5 1.5 2 0.5 14 3 8 12 2 57.5 2 0.5 0.5 15 19 9.5 33 2 5.5 1 2 1.5 16 2 42 5 17.5 2.5 0.5 17 35 1.5 19.5 0.5 18 21 1.5 19 11.5 8.5 20 5.5 0.5 21 13.5 4.5 22 30.5 2.5 23 8.5 16.5 January 2003 1 5.5 0.5 40.5 1.5 3.5 2.5 18.5 19.5 2 12.5 2.5 13 2.5 1.5 1.5 1 5 3 2.5 29.5 25 12.5 85.5 26.5 29 23.5 4 50.5 0

37 9 51

5 7 0 6 9.5

8

Summary Data AVG DAYS ON AVG DAYS OFF 2002-2003 cycles January 1, 2002 to May 25, 2003 19 7 19 11 9 26 14 8 23 24 4 18 Failure 5/25/2003 BOILER OPERATION TIME (DAYS) BOILER 21 BOILER 22 BOILER 23 BOILER 24 CYCLE COUNT 02-03 Table 3: 2002-2003 Boiler Cycling Summary

1997 jul 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Boiler 21 1805 1130 1630 800 1830 1125 2135 Boiler 22 1800 1155 1750 Boiler 23 2150 Boiler 24 aug 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 1200 1800 1150 2020 440 1550 115 610 1750 1710 100 1135 sep 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 1830 1800 1300 1620 640 1545 1245 1600 730 940 2010 1120 1755 1100 1805 oct 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 910 1750 720 1250/18 1800 1025 1400 1500 720 1915 1200 1750 1300 1200 1610/2250 2200 1400 1120 1800 nov 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 1740 1235 1800 1040 2340 710 1800 1045 1030 650 1625 925 1800 dec 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 1800 1040 1805 705 1700 1030 1750 1020 1355 620 1815 1015 1998 jan 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 1010 800 728 745 1040 2245 725 1805 1050 415 715 1810 855 1802 1110 1525 800 1810 1110 1820 430 feb 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 915 930 1100 1120 1515 1200 1110 1700 720 1750 1110 2330 450 1800 1145 1810 1825 1530 750 2210 mar 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 1800 1030 1725 715 1850 1100 2010 555 1800 1150 1740 ?? 1030 1745 725 1805 apr 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 1755 1025 1800 1125 1800 1500 1410 730 1800 2130 1526 may 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 2100 155 340 700 1530 215 630 2100 700 430 725 jun 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 655 2245 140 440 820 1600 2145 2255 120 1100 jul 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 1835 1850/2045 2300 1630 1825 1900 2030 2320 1615 Boiler cycles 97-03 1 Table 4A: 1997-1998 Boiler Cycling Raw Data

2001 apr 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 Boiler 21 Boiler 22 Boiler 23 400 Boiler 24 may 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Boiler 23 1305 jun 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 Boiler 23 1800 1105 jul 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Boiler 23 1530 1155 aug 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Boiler 23 1755 1010 955 1215 1530 sep 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 Boiler 23 1110 oct 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Boiler 23 1955 945 nov 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 NOVEMBER 2001 DRYDOCK BREMERHAVEN 1700 dec 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Boiler 23 945 2105 950 Boiler cycles 97-03 2 Table 4B: 2001 Boiler 23 Cycling Raw Data

2002 jan 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Boiler 21 930 530 1610 1605 2200 2400 Boiler 22 was running end?? 1000 Boiler 23 1820 1010 1800 1915 830 Boiler 24 2000/2300 2010 1020 feb 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 1135 1735 2400 1800 1000 920 2010/2235 1200/1630 mar 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 1100 1630 1050 end? 1950 600/800 apr 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 1610 1145 1735 1100 0 1950 may 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 1810 1745 1135 1000 1200 200 345 1350 325 jul 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 305 2215 1220 940 Jul 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 1710 10 645 830 800 2140 1130 1750 1245 194550 1710 250 1525 1400 192545 1735 2345 aug 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 2010 415 2210 750 1300 1820 230 1640 1140 345 2220 2300 1700 500 1735 1040 2100 sep 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 1740 1030 300 230 700 520 415 1120 2220 310 1910 240 1900 1100 oct 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 1030 1630 2030 1110 2130 1125 1630 700 1700 530 1305 1730 1250 1850 nov 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 1130 1900 1015 1830 1115 1830 1100 1645 935 dec 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 2000 1210 1100 1245 1600 550 655 1020 1445 900 2000 jan 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 40 1645 905 1545 1125 800 30 1010 1630 735 1700 900 Feb 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 935 1730 545 305 2200 410 930 955 Mar 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 2020 140 1255 745 Apr 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 840 930 1045 1700 605 1650 May 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 830 1000 2300 1715 Boiler cycles 97-03 3 Table 4C: 2002-2003 Boiler Cycling Raw Data

Roll Boiler Ramp-Up Time (hrs) Cool-Down Time (hrs) NTSB D023 22 0.75 15-Dec-02 ? 1 ? ? 3 ? 3.5 2.5 3 3 2.75 ? 3 2.5 3 NTSB D024 23 4 ? 19-Oct-02 ? 2.75 ? 3 3 ? 3.5 2.75 ? ? ? NTSB D025 23 4 17-Mar-03 4 ? ? ? 3.5 ? 3 ? 5.5 ? ? NTSB D026 22 ? 31-Mar-02 ? 2.5 3 ? 1.5 2 3.5 Average 3.4 2.8 Boiler Transients Table 5: Boiler Transients

Appendix B Temper Bead Welding Temper bead welding is used to reduce the detrimental effects of exposure to the very high temperatures associated with the welding process. Using temper bead welding creates a weld that has a reduced hardness and lower residual stresses compared with welds created using conventional welding processes.1 Reducing hardness improves resistance to brittle fracture, stress corrosion, and fatigue. Temper bead welding does not reduce residual stresses in a welded joint as well as full postweld heat treatment. However, if postweld heat treatment cannot be performed, some of its benefits can be obtained by using the temper bead welding technique. In a typical weld bead, grain coarsening occurs in the parent metal2 next to the weld, while the parent metal slightly beyond experiences grain refining. The temper bead welding method was developed to reduce or eliminate the coarse-grain regions in the parent metal. Coarse-grained structures have poor resistance to fracture. Coarse-grained structures in the weld metal also reduce toughness, but not to the same extent as in the parent metal. In the temper bead welding method, first a layer of small weld beads with low heat input is laid to ensure minimum penetration of the parent metal. The technique entails using small electrodes, welding in the horizontal position, and adjusting the angle of the electrode or torch to minimize penetration, taking care to avoid cracking the metal from exposure to hydrogen and lack-of-fusion defects (incompletely fused spots). Successively larger weld beads are placed on top of smaller ones, such that the refined zone overlaps the coarse areas created by the original runs. Sometimes the first layer is slightly ground so that the refined zones of the successive layers line up correctly. The use of successive layers not only refines the grain structure of the parent metal, but each successive layer of weld beads tempers the previous weld bead. Often the top layers above the parent layer are ground off. The author of the “Gowelding” website states, “Unfortunately, whilst this may appear easy in theory, in practice it can be difficult to achieve. It requires the production of many test weld simulations and metallographic examinations, before sufficient confidence can be gained to perform the actual production weld.” According to the Navy repair manual,3

1 Further information on temper bead welding is found on the “Gowelding” website, which is maintained by a welding professional , and also on the website of the Welding Technology Institute of Australia . 2 The metal of parts to be welded is referred to as the “parent metal.” 3 Navy Technical Manual S9221-C1-GTP-010, 0910-LP-331-5300, “Repair and Overhaul Main Propulsion Boilers,” vol. 1, revised February 1991, section 1-4.5.5, p. 1-6.

53

Whenever stress relief is required by MIL-STD-278, the proper application of stress relief procedures will produce weld metallurgical properties superior to those resulting from the stringer bead or temper bead procedures allowed by this manual for some of the welding on boilers. Repair activities should also be aware that, considering the requirements for temper bead procedure qualification and welder mock up trials, stress relief may in some cases be the more cost effective and timely alternative. The Navy’s temper bead welding procedure for low-carbon steel material up to 1.5 inches thick (weld repair thickness 0.25 to 0.5 inch) is described in its technical manual (chapter 5) as follows: • Preheat joint to 350° F. • Use temper bead method, where no postweld heat treatment is required. If the repair area is over 6 inches in length, special approval is required. The procedure is as follows (see figure): Step 1: Perform first pass using 3/32-inch electrodes over entire joint that was ground and grind welds to produce smooth layer. Step 2: Deposit second full layer with 1/8-inch rods. Step 3. Deposit third and subsequent layers with 5/32-inch rods, making sure not to overlap tie-in points. Step 4: Grind off reinforcement until flush.

Step 4 Figure. Navy’s temper bead welding procedure, steps 1-3 (left), step 4 (right). According to Lloyd Werft working instructions dated October 26, 1987, the weld procedure used on the Norway’s boilers was as follows: The area of weld and a surrounding area of at least the drum wall thickness to be preheated to approximately 150° C [302 °F]. Such preheating will be done by

54

55 means of resistance heating. Temperature control will be effected with thermocouples at inner side of drum. Welding additive will be a welding rod “E Mo B” to DIN 8575 of the trade mark “SH Schwarz 3 MK.” Welding to be done in string layers. Once the prepared area has been filled up, so-called hardening layers will be welded using material different from the base metal. These hardening layers will subsequently be worked off again. The Lloyd Werft procedure does not mention the size of the rods, the heat input, or how the layers are to be deposited. Further, there is no indication that a qualification plan was used to show that the welders were capable of welding the boiler geometry, or that actual weld coupons were made to show that the welders could do the job. By comparison, when the boiler tubes were welded in place (in 1999 and 2002), the weld procedures were very specific, with evidence that qualifications trials were performed and passed. No evidence or substantiation of a welding procedure was found to show that repair welds 11 feet long were acceptable and would not affect the life of the boiler. (According to the Navy’s procedure, repair welds exceeding 6 inches in length require special approval.) Although the headers of boiler Nos. 21, 22, and 23 were welded, only header 21 appeared to have been ground flush.

FD07276 ｜ 2003_美国_NTSB_MAR0501_Allision_of_Staten_Island_Ferry_Andrew_J_Barberi.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2003 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Allision of Staten Island Ferry Andrew J. Barberi St. George, Staten Island, New York October 15, 2003 Marine Accident Report NTSB/MAR-05/01 PB2005-916401 Notation 7628A National Transportation Safety Board Washington, D.C.

this page intentionally left blank

Marine Accident Report Allision of Staten Island Ferry Andrew J. Barberi St. George, Staten Island, New York October 15, 2003 NTSB/MAR-05/01 PB2005-916401 National Transportation Safety Board Notation 7628A 490 L’Enfant Plaza, S.W. Adopted March 8, 2005 Washington, D.C. 20594

National Transportation Safety Board. 2005. Allision of Staten Island Ferry Andrew J. Barberi, St. George, Staten Island, New York, October 15, 2003. Marine Accident Report NTSB/MAR-05/01. Washington, DC. Abstract: This report discusses the allision of the passenger ferry Andrew J. Barberi with maintenance pier B-1 at the Staten Island ferry terminal on October 15, 2003. The ferry carried an estimated 1,500 passengers and 15 crewmembers. Ten passengers died in the accident and 70 were injured. An eleventh seriously injured passenger died 2 months later. Damages totaled more than $8 million, with repair costs of $6.9 million for the Andrew J. Barberi and $1.4 million for the pier. From its investigation of the accident, the Safety Board identified the following safety issues: actions of the assistant captain and captain, oversight of ferry operations by the New York City Department of Transportation, medical oversight of mariners, safety management systems, and the potential contribution of navigation technology to the safety of ferry operations. On the basis of its findings, the Safety Board made recommendations to the New York City Department of Transportation, the U.S. Coast Guard, the States that operate public ferries, and the Passenger Vessel Association. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2005-916401 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Marine Accident Report Contents Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Damages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Personnel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Regulatory Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Captain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Assistant Captain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Vessel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Construction and Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Propulsion System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Certification and Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Wreckage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Waterway Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Operations of New York City Department of Transportation . . . . . . . . . . . . . . . . . . . . . . . 24 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Passenger Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Toxicological Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Survival Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Crew’s Emergency Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Shoreside Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Emergency Plans . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Emergency Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Communication System Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Propulsion System Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Additional Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Staten Island Ferry Rules and Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Coast Guard Oversight of Staten Island Ferries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Medical Oversight of Mariners . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Safety Management Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Other Ferry Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Passenger Vessel Association . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Actions Since Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Assistant Captain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

Contents iv Marine Accident Report Medical Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 New York City Department of Transportation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Safety Management Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Response to Emergency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 On Board Andrew J. Barberi . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Shoreside . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Navigation Technology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 Appendixes A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 B: Standard Operating Procedures, Staten Island Ferry . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 C: Memorandum of Understanding Between New York City Department of Transportation and U.S. Coast Guard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 D: Contents Pages from Safety Management System Manuals, Washington State Ferries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 E: Example Procedures from Safety Management System, British Columbia Ferries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 F: Assessment of Staten Island Ferries by Global Maritime and Transportation School, U.S. Merchant Marine Academy . . . . . . . . . . . . . . . . . . . . . . 126

v Marine Accident Report Acronyms and Abbreviations AIS automatic identification system APTA American Public Transportation Association ARPA automatic radar plotting aid CFR Code of Federal Regulations COI certificate of inspection CPR cardiopulmonary resuscitation EMS emergency medical services EMT emergency medical technician FDNY New York City Fire Department GMATS Global Maritime and Transportation School GPS global positioning system ICAO International Civil Aviation Organization IMO International Maritime Organization ISM International Safety Management [code] MOU memorandum of understanding NVIC Navigation and Vessel Inspection Circular NYC DOT New York City Department of Transportation NYPD New York City Police Department OCMI Officer in Charge, Marine Inspection PCP phencyclidine PDR Physicians’ Desk Reference PVA Passenger Vessel Association REC regional examination center SOLAS International Convention for Safety of Life at Sea STCW International Convention on Standards of Training, Certification and Watchkeeping TIA transient ischemic attack U.S.C. United States Code VTS Vessel Traffic Service

vi Marine Accident Report Executive Summary About 1520 on October 15, 2003, the Staten Island Ferry Andrew J. Barberi, owned and operated by the New York City Department of Transportation, was near the end of a regularly scheduled trip from Manhattan to Staten Island when it allided with a maintenance pier at the Staten Island Ferry terminal. Fifteen crewmembers and an estimated 1,500 passengers were on board. Ten passengers died in the accident and 70 were injured. An eleventh passenger died 2 months later as a result of injuries sustained in the accident. Hundreds of emergency personnel and dozens of emergency vehicles, including several vessels, responded to the accident, dispatched by the New York City Police Department, the New York City Fire Department (including emergency medical services), the U.S. Coast Guard, and the U.S. Army Corps of Engineers. Damages totaled more than $8 million, with repair costs of $6.9 million for the Andrew J. Barberi and $1.4 million for the pier. The National Transportation Safety Board determines that the probable cause of this accident was the assistant captain’s unexplained incapacitation and the failure of the New York City Department of Transportation to implement and oversee safe, effective operating procedures for its ferries. Contributing to the cause of the accident was the failure of the captain to exercise his command responsibility over the vessel by ensuring the safety of its operations. The Safety Board’s investigation of this accident identified safety issues in the following areas: • Actions of assistant captain and captain. • New York City Department of Transportation oversight of ferry operations. • Medical oversight of mariners. • Safety management systems. • Potential contribution of navigation technology to the safety of ferry operations. As a result of its investigation, the Safety Board makes recommendations to the New York City Department of Transportation, the U.S. Coast Guard, the States that operate public ferries, and the Passenger Vessel Association.

1 Marine Accident Report Factual Information Accident Narrative About 1500 on October 15, 2003, the Staten Island Ferry Andrew J. Barberi (figure 1) departed Whitehall, at the south tip of Manhattan, on a regularly scheduled, approximately 22-minute trip to St. George, Staten Island (figure 2). The Andrew J. Barberi was a large passenger vessel owned and operated by the New York City Department of Transportation (NYC DOT) and certificated by the U.S. Coast Guard. The ferry had a maximum capacity of 6,000 passengers but carried a smaller load, estimated at 1,500 people, on the accident trip.1 The vessel was under the command of a captain and was staffed with an assistant captain, two mates, a chief engineer, an assistant engineer, two oilers, and seven deckhands. A ladies’ room attendant and two New York City Police Department (NYPD) uniformed officers were also on duty but were not part of the crew. 1 After the Staten Island Ferry stopped charging passengers in 1997 (see “Additional Information” section), the number of people riding the ferry was determined by rough estimation. The method, according to a police officer assigned to the ferry, was to watch the passengers boarding the vessel and observe the extent to which they filled the accommodation areas. The officer told investigators that ferries later in the afternoon (4 o’clock and after) might reach the maximum load. Figure 1. Andrew J. Barberi in New York Harbor after passing Statue of Liberty en route to St. George terminal. The ferry’s symmetrical design allows it to approach and leave its berth without turning around. The end that docks in Manhattan is known as the New York end, and the end that docks in Staten Island is called the Staten Island end. The sides of the ferry are referred to as the Brooklyn side and the New Jersey side. The starboard side on the trip to Manhattan is the Brooklyn side, while on the trip to Staten Island, the New Jersey side is starboard.

Factual Information 2 Marine Accident Report En route to St. George, the assistant captain was operating the controls in the pilothouse on the Staten Island end of the ferry. The navigation watch also included a deckhand who served as lookout. The lookout told Safety Board investigators that he sat on a stool next to the assistant captain and that they engaged in casual conversation. “He told me some tugboat stories,” said the lookout. “We were just having a regular Figure 2. Route of Andrew J. Barberi in New York Harbor from Manhattan to accident site at Staten Island. ANCHORAGE CHANNEL Governors Island Ellis Island Statue of Liberty STATEN ISLAND MANHATTAN BROOKLYN Hudson River NEW JERSEY UPPER BAY East River Battery St. George ACCIDENT SITE KV Buoy The Narrows Whitehall Newark Bay Elizabethport Kill Van Kull Ft. Wadsworth Verrazano Narrows Bridge N Jersey Flats Bay Ridge Flats

Factual Information 3 Marine Accident Report conversation.” Crewmembers estimated that the assistant captain was operating the vessel at the routine speed of 14 to 16 knots.2 About halfway into the trip, the senior mate entered the pilothouse. His station while passengers disembarked and embarked was on the main deck at the docking end. His other responsibilities included monitoring the deckhands on the main deck and on one side of the saloon deck and securing the New York end when the ferry docked in Manhattan.3 The senior mate first told Safety Board investigators that he went into the pilothouse to complete work orders for repairing broken doors on the saloon deck. In a later interview, the senior mate said that he was reading a newspaper while he was in the pilothouse. He said that he sat on a settee (padded bench) behind the controls, aft of both the assistant captain and the lookout. The senior mate further stated that he could not see out the pilothouse window, meaning that he could not observe the course of the vessel and its approach toward the Staten Island piers.4 According to witnesses, the trip was uneventful until the vessel passed the buoy at the entrance to the Kill van Kull waterway (the KV buoy), about 1,000 yards from the St. George terminal (and about 2 minutes away at a speed of 15 knots). The lookout told investigators that “somebody” had entered the pilothouse and was reading a newspaper on the bench behind the control platform. He said that when the ferry passed the KV buoy, he asked permission of the assistant captain to leave the pilothouse. He told investigators that his intent was to go down to the saloon deck and untie the handles of the broken exit doors5 in preparation for docking. He said that the assistant captain replied, “Okay, see you later.” The senior mate told investigators that he heard the lookout ask permission to go below and that he also heard the assistant captain agree to the lookout’s request. According to crewmembers, shortly after the ferry passed the KV buoy, the standard procedure was for the bridge deckhand on duty to go to the pilothouse on the docking end of the ferry and make an arrival announcement. Those interviewed stated that some lookouts always waited to leave the pilothouse until the bridge deckhand arrived; however, practices varied.6 On the day of the accident, the lookout left the Staten Island- 2 The ferry’s navigation equipment did not include any means to measure its speed through the water. See “Vessel Information” section for details. 3 Duty stations and responsibilities of the ferry’s crewmembers are detailed in the “Survival Factors” section. 4 The settee was lower than the navigation area, which was on a raised platform 4 inches above the pilothouse floor. 5 The senior mate told investigators that on the day of the accident, the doors on the second, or saloon, deck on the Staten Island end, New Jersey side, were broken and could not be latched. The senior mate told investigators that a deckhand had reported the broken doors the day before. Because the wind gusts exceeded 30 knots, the doors swung freely. The senior mate said that he gave a piece of line to the second lookout on that shift and instructed him to lash the door handles together to prevent inadvertent passenger injury from a swinging door. The doors were to be untied before arrival in Staten Island to allow passengers to disembark and embark. 6 For example, one deckhand told investigators that he made his arrival announcement from the nonoperating pilothouse.

Factual Information 4 Marine Accident Report end pilothouse before the bridge deckhand arrived. The lookout told investigators that when he left, the assistant captain, who had been sitting at the controls, stood up. Crewmembers indicated that the KV buoy was also the point where the ferry operators typically began slowing the vessels and applying small course corrections in preparation for docking. Deckhands and passengers told investigators that normally, though not on the accident voyage, they could hear when the engines “backed down” (slowed) and that the sound change would inform them that they were ready to dock. Another Staten Island Ferry captain said that the sound change ordinarily triggered a “chain reaction that people start walking forward . . . . They could be half asleep, as soon as they hear the throttle [slowing], they get up and get moving forward.” The senior mate told investigators that after the lookout left the pilothouse, he did not hear the assistant captain say anything. He recalled that the assistant captain was standing at the controls: “He basically never sat down. He would always gear the boat standing up.” The senior mate told investigators that it “did not surprise” him that the captain was not present in the pilothouse and did not come to supervise the docking. The senior mate said that he was still sitting on the settee when he heard a sound and felt a “heavy vibration” as if the vessel had struck an object in the water: “Nothing seemed out of the ordinary and bang.” He said that he looked up, heard the assistant captain exclaim, “Jesus,” looked out the window, and saw the ferry alliding with the concrete maintenance pier (pier B-1) south of the intended docking point. The chief engineer, who was in the engineroom, said that he saw from the console speed and pitch indicators that both the main engine speeds and the pitch of the propulsion drives were still at full ahead at the time of the allision.7 In the pilothouse immediately after the allision, the senior mate saw the assistant captain pull the throttle back to full pitch astern with his right hand and use his left hand to steer the ferry away from another vessel moored nearby. The mate said that the ferry stopped at a 45o angle between the moored vessel and two piers about 600 yards southeast of the intended docking point, slip 5. The director of ferry operations told investigators that he was in the St. George port captain’s office when a ferry employee alerted them that the Andrew J. Barberi was not turning toward slip 5. He said that the port captain ran to the radio and tried to contact the vessel.8 He himself ran toward the pier but arrived after the allision. Emergency call records indicate that the allision occurred about 1520. A crewmember of the tugboat Dorothy J, which was docked at the maintenance pier, told investigators that immediately after the allision, he saw “a person in an officer’s uniform” walk across the top deck and enter the pilothouse on the Staten Island end. According to the senior mate of the Andrew J. Barberi, the captain entered the pilothouse “very shortly after impact,” immediately moved the assistant captain away from the controls, and took control of the vessel. The captain maneuvered the vessel away from the 7 See “Vessel Information” section for a description of the ferry’s propulsion system. 8 The ferry was equipped with two ship-to-ship and ship-to-shore VHF radios (see “Vessel Information” section).

Factual Information 5 Marine Accident Report pier and sent the mate below to assess the damage and the extent of injuries. The assistant captain then left the pilothouse. As shown on a videotape from a Coast Guard Vessel Traffic Service (VTS)9 camera on Governors Island (3 miles from the accident site), the ferry drifted several hundred yards into the harbor southeast of the terminal. The director of ferry operations said that he instructed the port captain to have the ferry “get back to St. George [and] turn around.” The video recording (which started about 10 minutes after the accident) shows the ferry drifting a few minutes, then moving back toward the terminal and turning around (so it could dock by the undamaged New York end). While the ferry was drifting, the chief engineer told investigators that he tried to call both pilothouses from the engineroom’s sound-powered phone to discover what had happened, but no one answered.10 After he sent the assistant engineer and the oilers to survey the damage, he heard the sound-powered phone ring and determined by its distinctive sound that it came from one of the pilothouses. No one answered when he picked up the receiver. Leaving the assistant engineer to monitor the propulsion plant, the chief engineer went to the pilothouse to find the captain. The chief engineer said that when he entered the pilothouse, the captain immediately asked him to help transfer propulsion control to the New York-end pilothouse because the captain “couldn’t land the boat [at the] Staten Island end, it was destroyed” and two people were needed to transfer control.11 The chief engineer recalled the captain saying, “[The assistant captain] has lost it, he couldn’t focus—he was pacing in a daze.” The captain then left the pilothouse and entered the New York-end pilothouse to accept the transfer of propulsion control from the chief engineer at the other end. After the transfer was complete, the chief engineer saw the assistant captain outside the Staten Island-end pilothouse and asked him what happened. According to the chief engineer, the assistant captain said, “I passed out.” None of the crewmembers or passengers recalled hearing any warning announcements, alarms, or other alerts before the accident. Passengers who could see the impending allision estimated that they had seconds to move away or brace themselves for the allision. Other passengers took no action to lessen the effects of the accident, such as those who had no view of the pier or who were facing the opposite direction. Some passengers with cell phones called 911 to report the accident. 9 For further information on the VTS, see “Waterway Information” section. 10 A sound-powered phone has no external power supply. To make a call, the user selects the number of the destination station (each has its own line) and cranks a handle to ring a bell at that station. 11 According to ferry officials, captains typically controlled the ferry on the trips from Staten Island to Manhattan, and the assistant captains were at the controls on the returns to Staten Island. The operator who had controlled the vessel into the dock (the captain or assistant captain) would maintain propulsion control in the arriving pilothouse while passengers disembarked and embarked. Just before departure, that operator would transfer vessel propulsion to the operator in the departing pilothouse. For additional information on the ferry’s propulsion system, see “Vessel Information” section.

Factual Information 6 Marine Accident Report A Coast Guard enlisted man, who was a regular ferry passenger, used his cell phone to contact the Coast Guard’s New York command center at Ft. Wadsworth, Staten Island. Coast Guard records indicate that the command center logged the call at 1525. He reported that many passengers had been injured and would need medical help. An off-duty lieutenant with the New York City Fire Department (FDNY) called his dispatcher in Staten Island, described the accident, and advised sending multiple units and perhaps a boat in response. He described the scene after the allision as chaos, with people “screaming and yelling.” Passengers reported hearing no emergency instructions from ferry crewmembers after the allision. Crewmembers told investigators that they helped the wounded as much as they could, moved debris, and tried to keep uninjured passengers away from the vessel’s damaged areas. (For details of the crew’s actions in the emergency, see the “Survival Factors” section.) Emergency response records indicate that the ferry reached slip 5 at St. George at 1543, about 20 minutes after the allision. When the ferry docked, personnel from the FDNY, the NYPD, emergency medical services (EMS), and the Coast Guard immediately entered the vessel to help the injured. The director of ferry operations, who entered with the first responders, told investigators that he met the assistant captain on the saloon deck and that the assistant captain told him, “I’m sorry. I blacked out. It’s all my fault. I killed these people.” The assistant captain then pulled away and ran to the dock. After sending two NYC DOT employees after the assistant captain, the director of ferry operations entered the pilothouse. There, the captain told him that the assistant captain had slumped over the controls and that he had grabbed the assistant captain off and taken control of the vessel. However, by that time the allision had occurred. Injuries Ten passengers were killed and 70 passengers were injured as a result of the accident (table 1). One of the injured passengers died 2 months after the accident as a result of injuries received in the allision. (According to the provisions of Title 49 Code of Federal Regulations [CFR] part 830, section 2, that passenger was considered seriously injured.12) Injuries are categorized according to the criteria of the International Civil Aviation Organization (ICAO). For uniformity, the Safety Board uses the ICAO injury criteria in all its accident reports, regardless of transportation mode. 12 Title 49 CFR 830.2 defines a fatal injury as any injury that results in death within 30 days of the accident. It defines serious injury as that which requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; results in a fracture of any bone (except simple fractures of fingers, toes, or nose); causes severe hemorrhages, nerve, muscle, or tendon damage; involves any internal organ; or involves second- or third-degree burns, or any burns affecting more than 5 percent of the body surface.

Factual Information 7 Marine Accident Report Table 1. Injuries sustained in Andrew J. Barberi accident. Damages The Andrew J. Barberi struck the concrete maintenance pier at an oblique angle and continued to move forward, allowing the concrete to tear a 210-foot-long gash into the main deck on the vessel’s New Jersey side (figure 3). The vessel was repaired by a Staten Island company at the Brooklyn Navy Yard at a cost of $6.9 million. The ferry returned to service in July 2004. Injuries Crew Passengers Other Total Fatal 0 10 0 10 Serious 0 19a 0 19 Minor 0 57 0 57 None 16 1,414 4b 1,434 Total 16c 1,500d 4 1,520 a One seriously injured passenger died on December 16, 2003. b Includes 2 NYPD officers assigned to the ferry and 2 people working at the concession stand on the bridge deck. c Includes 15 crewmembers and 1 restroom attendant. d Passenger total estimated by the NYC DOT and NYPD. Figure 3. Postaccident view of Andrew J. Barberi.

Factual Information 8 Marine Accident Report Approximately 1,500 square feet of the surface of pier B-1 collapsed into the harbor after the Andrew J. Barberi struck its southeast corner (figure 4). The pier was repaired at a cost of $1.4 million. Personnel Information Regulatory Requirements Under 46 CFR parts 70-80, large passenger vessels (those measuring 100 gross tons or more13) that carry more than 12 passengers for hire14 may not be operated without a valid Coast Guard certificate of inspection (COI), which is issued by the Coast Guard Officer in Charge, Marine Inspection (OCMI), for the zone (in this case, New York). The COI stipulates a number of operating requirements, including minimum staffing needs. When determining the number and competencies of the crewmembers, the OCMI considers, among other things, the size of the vessel, its route, the type and horsepower of Figure 4. View of damage to maintenance pier caused by Andrew J. Barberi. 13 Gross tonnage is a measure of vessel volume, or overall size. 14 As defined in Title 46 United States Code (U.S.C.) section 2101(21)(21a), passenger for hire means “a passenger for whom consideration is contributed as a condition of carriage on the vessel, whether directly or indirectly flowing to the owner, charterer, operator, agent, or any other person having an interest in the vessel.” After the Staten Island Ferry stopped charging passenger fares in 1997, questions arose about the applicability of Federal regulations regarding required Coast Guard inspections. See “Additional Information” section for further discussion.

Factual Information 9 Marine Accident Report the vessel’s propulsion machinery, the number of passengers the vessel will carry, the type and location of lifesaving equipment installed on the vessel, and the hazards peculiar to the route and service. According to its COI, the Andrew J. Barberi was required to carry the following crew complement: 1 master with first-class pilot endorsement 1 first-class pilot 2 licensed mates 7 deckhands 1 chief engineer 1 licensed assistant engineer 2 oilers The COI states that “the required mate positions may be filled by holders of valid licenses endorsed for ‘non-navigating duties onboard the Staten Island ferries.’” Both the captain and the assistant captain were licensed as masters and first-class pilots (the COI required only one licensed master). The senior mate was licensed as a chief mate on oceans, which meant that he had passed more Coast Guard examinations than required for mates on inland waters such as New York Harbor. The junior mate held a first-class pilot’s license for Lake Erie (but not for New York Harbor). Captain Background. The captain, age 38, was born in Staten Island, New York, and graduated from high school in Staten Island in 1984. After graduating, he joined the Navy and was assigned to the submarine fleet. He was honorably discharged in 1988 at the rank of quartermaster second class, or E5. He received several decorations and commendations for performance, including a Meritorious Unit Commendation and letter of commendation from the Commander in Chief, Atlantic Fleet. In October 1990, he became a deckhand with the Staten Island Ferry, a position he held until January 1996, when he was promoted to mate. In February 1996, he was promoted to the provisional position of assistant captain.15 He was promoted to the permanent position of assistant captain in February 2002. At the time of the accident, the captain held an inland Coast Guard license issued on December 31, 2001, and valid until December 31, 2006. The terms of the license were as follows: 15 New York City personnel rules allowed employees to serve on the ferry in a position for which they were qualified and to earn the pay of someone in that position, but they could not be permanently assigned to those positions until a vacancy was posted, until they met the pertinent NYC civil service requirements for those positions, and until they then had been selected to fill those vacancies in accordance with NYC civil service requirements. Thus, employees often served for years in positions that were at higher levels than those to which they had been “permanently” assigned.

Factual Information 10 Marine Accident Report Master of steam or motor vessels upon inland waters of any gross tons. First class pilot of vessels of any gross tons upon NY Harbor the Upper Bay, from the Narrows to the Battery; the East River, from the Battery to the Execution Rocks; the Kill van Kull, from Robbins Reef to Elizabethport; the Hudson River from the Battery to the George Washington Bridge. Radar observer. Coast Guard regulations require a captain to hold a valid endorsement as a radar observer.16 The captain’s radar endorsement expired in March 2002, but the Coast Guard, under 46 CFR 10.480(k), allowed mariners’ radar endorsements to extend for up to 2 years beyond their expiration dates so that the renewal dates for licenses and endorsements could be synchronized.17 NYC DOT personnel records of the captain contained a total of nine performance appraisals between 1991 and 1998, the most recent appraisal form found in the records. The captain’s performance in the 1991 appraisal was rated as “very good,” which was second to the highest on a 5-point scale that ranged from “unsatisfactory” to “outstanding.” His performance in all subsequent appraisals was uniformly rated as “outstanding.” No letters of reprimand were found in the captain’s personnel records. On August 2, 1991, he received a letter of commendations for the “prompt action and professional manner” in which he helped rescue a passenger who had jumped overboard in New York’s Upper Bay. The Safety Board repeatedly attempted to interview the captain after the accident. The Board issued a subpoena to compel him to appear before its investigators, and Federal judicial authorities enforced the subpoena. He appeared before investigators on November 6, 2003, but he invoked his Fifth Amendment rights against self-incrimination and did not respond to questions except to give his name and date of birth. Schedule. In the month before the accident, the captain worked on a shift that typically began at 1330 and ended at 2130, although the actual start and stop times were an hour earlier on several days. In keeping with NYC DOT practice, the captain and assistant captain both worked 4 days and then had 3 days off. The captain was off work on October 11, 12, and 13. He reported for duty on the Andrew J. Barberi on October 14 at 1307 and worked until 2300, earning an hour and a half of overtime for working past 2130, the end of the scheduled shift. He reported for work on the day of the accident at 1245, although the shift did not begin until 1330. The Safety Board was unable to learn more from the captain about his activities in the days before the accident because of his unwillingness to cooperate with the investigation. 16 Title 46 CFR 15.815(b): “Each person who is employed or serves as pilot in accordance with Federal law on board vessels of 300 gross tons or over which are radar equipped, shall hold a valid endorsement as radar observer.” 17 Title 46 CFR 10.480(k): “The renewal date of a Radar-Observer endorsement may be extended beyond the normal 5-year duration to coincide with the renewal date of the license to which it pertains. This extension may not exceed 2 years and will be necessary only once, to synchronize the two renewal dates.”

Factual Information 11 Marine Accident Report Assistant Captain Background. The assistant captain, age 55, was born in Brooklyn, New York. From 1968 until 1970, he was on active duty in the Army, with a specialty in radar operations. In 1976, he briefly worked for Murphy Pacific Marine Salvage Company as a deckhand. From 1976 until late 1985, he worked as a deckhand and tankerman for Poling Transportation Corporation of Staten Island, New York, a tugboat and barge operator. There he received training in vessel navigation in New York Harbor. According to the assistant captain’s résumé, on file with the NYC DOT, he operated “on the waters of the Atlantic Ocean from Maine to Virginia up to 200 miles offshore, including the entrance to New York Harbor” while employed at Poling. He began his employment with the Staten Island Ferry on September 16, 1985, as a deckhand. He was promoted to assistant captain on May 11, 1987. NYC DOT personnel records indicate that on March 24, 1986, he completed instruction in radar use and interpretation at Marine Simulation, Inc. On February 9, 1996, he completed “Radar Observer Recertification-Any Waters” at the Center for Maritime Education, Seamen’s Church Institute of New York and New Jersey. The assistant captain was promoted to the provisional position of assistant captain on May 11, 1987, to the provisional position of captain on July 21, 1996, and to the permanent position of assistant captain on February 2, 2002, the position he held at the time of the accident. According to the director of administration for the Staten Island Ferry, the assistant captain acted to gain a higher seniority, which would protect him against the layoffs the NYC DOT was planning in spring 2003 because of anticipated budgetary shortfalls. The assistant captain held an inland Coast Guard license issued on September 14, 2000, which was valid until September 14, 2005. The terms of the license were as follows: Master of steam or motor vessels of any registered tons (domestic) upon inland waters. First class pilot of vessels of any gross tons upon: New York Harbor Upper Bay, from the Narrows to the Battery; Hudson River from the Battery to the George Washington Bridge; the East River from the Battery to Hart Island; Kill van Kull from Robbins Reef to Elizabeth Port. The assistant captain’s radar endorsement expired in February 2001.18 NYC DOT personnel records for the assistant captain contained 13 performance appraisals between 1987 and 2001. His performance in the first two appraisals (1987 and 1988) was rated as “superior” (second to highest) on the NYC DOT’s 5-point performance scale. His performance was uniformly rated in all subsequent appraisals as “outstanding.” The assistant captain’s personnel records contained no letters of reprimand or other negative assessments. The records contained two letters of commendation, dated March 9, 1990, and April 28, 1995. The first concerned his performance as the assistant captain on 18 See previous note.

Factual Information 12 Marine Accident Report the Andrew J. Barberi when it experienced a propulsion control failure while docking in Manhattan, when his actions helped minimize potential injury to passengers and crew and damage to the vessel. The second letter noted his “outstanding leadership and dedication to duty” as the captain of the Andrew J. Barberi when it experienced a mechanical failure while docking in Staten Island. Schedule. The assistant captain could not be interviewed in the immediate weeks after the accident because he had been hospitalized after a suicide attempt (see below). Nonetheless, his wife and daughter cooperated with Safety Board investigators and provided information about his activities in the days preceding the accident.19 After the assistant captain had recuperated, Safety Board investigators tried repeatedly to interview him. His attorney informed the Board, however, that the assistant captain would invoke his Fifth Amendment rights against self-incrimination and would not respond to questions from the Board. According to his personnel records, the assistant captain worked the same shift continuously for at least 2 months before the accident, a 1330 to 2130 shift that began on a Tuesday and ended on a Friday. However, he almost always worked an additional 30 minutes to 2 hours, beyond 2130, in overtime during that period. On October 7 and 8 he worked until 2230. On October 9 he worked until 2330, and on October 10 he worked until 2200. He was off work on October 11, 12, and 13. On October 14, he worked on the Andrew J. Barberi until 2300. He reported for work on the day of the accident at 1315. According to his wife, 2 days before the accident, on October 13, the assistant captain awoke at 0730. On the day before the accident, October 14, he was asleep when his wife left the house at 0815. The night before the accident, October 14, he went to sleep between 0115 and 0130. On the day of the accident, he was asleep when his wife left the house about 0815 and arose sometime thereafter. She returned home for lunch about 1220 and found him working around the house. She told investigators that he seemed fine when she left the house before 1300. Actions After Accident. After the allision, the assistant captain telephoned his wife at her workplace to inform her of the accident. According to other witnesses, the assistant captain drove home, saw his daughter and grandson, went into a bathroom on the second level of his house, and refused to leave despite his daughter’s entreaties. Shortly after 1600, the assistant captain’s wife arrived home. She also could not persuade him to unlock the door. The two NYC DOT employees who had been sent by the director of ferry operations arrived about 1630, forced open the locked door, and found the assistant captain bleeding from lacerations to his wrist and from a gunshot wound to his chest. They saw a pellet gun nearby. The NYC DOT employees immediately called 911 and requested medical assistance. An ambulance arrived about 1640 and the assistant captain was transported to a nearby hospital, where he was admitted at 1703. His injuries were considered life 19 On advice from her legal representative, the assistant captain’s wife did not provide Safety Board investigators with information about statements that her husband made to her.

Factual Information 13 Marine Accident Report threatening and he was sent to the operating room, where he underwent emergency surgery to repair the effects of the gunshot wound and wrist lacerations. On November 13, 2003, following recuperation from the surgery and after psychiatric treatment in response to his suicide attempt, the assistant captain was discharged from the hospital. Medical Status. To determine the assistant captain’s medical status at the time of the accident, the Safety Board obtained records of his medical care before the accident, as well as dental, employer, and pharmacy records. The Safety Board also obtained records from the hospital that treated the assistant captain after his suicide attempt. The Safety Board obtained a record of prescriptions for the assistant captain at a Staten Island branch of a national chain of pharmacies.20 According to the pharmacy records, the assistant captain’s primary physician prescribed most of the medications. Many of the prescriptions, however, were not listed in the primary physician’s medical records that corresponded to the prescription dates. Further, except for the assistant captain’s dental treatment and a few instances when he got a “disability certificate” for work, the medical records contain no references to limitations on his work because of medical conditions or treatment. The records of his primary physician included information on the assistant captain’s occupation. No evidence of the assistant captain’s use of prescribed medications was found in the records of either the NYC DOT or the Coast Guard, nor was documentation of the use of medications required by either agency. According to medical and pharmacy records, at the time of the accident the assistant captain had been diagnosed with and continuously prescribed medications for multiple medical conditions, including high blood pressure, high cholesterol, insomnia, and chronic back pain. In particular, his physician had prescribed 10 milligrams of zolpidem (a prescription sedative marketed under the trade name Ambien®), to be taken at bedtime for insomnia,21 and 50 milligrams of tramadol (a prescription narcotic-like analgesic marketed under the trade name Ultram®), to be taken every 4 to 6 hours for back pain. According to the Physicians’ Desk Reference (PDR),22 the drug manufacturers specify that the total daily dose of zolpidem should not exceed 10 milligrams and that the total daily dose of tramadol should not exceed 400 milligrams. Common side effects of 20 The Safety Board is confident that it has a complete record of the assistant captain’s prescriptions, because prescriptions at all the chain’s branches were examined, the chain had numerous branches in Staten Island, and few pharmacies not associated with the chain were in the area. All the medical and dental practitioners were located on Staten Island. Although it is possible that the assistant captain had been treated by physicians outside Staten Island, several factors suggest that this was unlikely: the comprehensiveness of the records, both in the diagnoses and treatments described; the length of time he had been treated; the interrelationships between the physicians noted in the records; and the statements of his spouse. 21 The assistant captain’s wife indicated that he would often take half a tablet, or 5 milligrams, at bedtime. 22 A reference manual for physicians published yearly by Medical Economics Company, Atlanta, Georgia. The drug manufacturers whose products are listed in the reference prepare the information.

Factual Information 14 Marine Accident Report tramadol include dizziness and sleepiness,23 and seizures have been reported in patients both after receiving their first tramadol prescription and after using the drug over time.24 The assistant captain had been taking both zolpidem and tramadol regularly since

1. He had been prescribed medication for high blood pressure since at least 1989.

Since at least 1998, he also had multiple prescriptions filled for different psychoactive medications (medications that can alter mood, anxiety, behavior, and cognitive processes) for dental work. NYC DOT attendance records indicate that the assistant captain was on sick leave on the days he received dental treatment that involved psychoactive medication and was off work afterward on regularly scheduled days. The assistant captain underwent cardiovascular surgery and cardiological, neurological, and psychiatric examination and treatment while hospitalized after the accident. Among the tests administered to him were the following: carotid color duplex Doppler examination, which can detect abnormalities in the carotid arteries in the neck; echocardiography, which can detect abnormalities in the walls and valves of the heart; 24- hour Holter monitoring, which can detect abnormal heart rhythms; computerized tomography of the head, which can detect abnormalities in the brain; and cardiac catherization, which can detect abnormalities in the coronary arteries (whose function is to supply blood to the heart). The assistant captain was found to have significant narrowing of his coronary arteries (for which he underwent stent placement to open the arteries), but he had no significant abnormal heart rhythms on 24-hour monitoring. Echocardiography noted an interatrial septal aneurysm (a bulging of the wall between the two upper chambers of the heart) and patent foramen ovale (a persistence after birth of an opening in the wall between the two upper chambers of the fetal heart). According to a note in the medical records, a week after the accident the assistant captain told a cardiologist that “he was exhausted at the time [of the accident, but] no more exhausted than usual.” The cardiologist’s note states that “when the boat hit the pier [the assistant captain] was sitting in a chair.” The records of a neurology consultation state that the assistant captain had “no recollection of what happened on the boat . . . he suddenly passed out, [and] when he regained consciousness there was chaos.” Further, he denied “any prior history of loss of consciousness.” The assistant captain was discharged from the hospital with a diagnosis of and treatment for depression. Coast Guard medical records of the assistant captain include the results of four required medical evaluations. The partner of the assistant captain’s primary physician in a two-physician medical practice performed the evaluations on March 31, 1986, October 4, 1989, September 14, 1995, and August 14, 2000; the partner had occasionally treated the assistant captain. The results, as noted on the completed examination forms (after the first examination, this was the 1995 version of Coast Guard form 719K), included notations 23 T. Hummel and others, “Assessment of Analgesia in Man: Tramadol Controlled Release Formula vs. Tramadol Standard Formulation,” European Journal of Clinical Pharmacology, vol. 51 (1996), pp. 31-38. 24 J. S. Gardner and others, “Tramadol and Seizures: A Surveillance Study in a Managed Care Population,” Pharmacotherapy, vol. 20, no. 12 (2000), pp. 1423-1431. Seizures were noted in 0.9 percent of patients after they received their first tramadol prescription.

Factual Information 15 Marine Accident Report corroborated by the examining physician and (as required for the last two examinations) by the assistant captain with their signatures, that the assistant captain had not been taking prescribed medications. For each examination, the physician noted that he considered the assistant captain “competent” to perform the duties of a merchant mariner. For example, on Coast Guard form 719K, dated August 14, 2000, under the question, “Does the applicant have or has he/she ever suffered from any of the following?” “no” was written next to “high blood pressure,” “impaired range of motion,” and “other illness or disability.” Under “medications taken,” the word “none” was written, and the box next to the indication “no prescription medications” was checked. Under “comments on findings,” the box next to “no significant medical history” was checked. In response to the item, “Considering the findings in this examination, and noting the duties to be performed by the applicant aboard a merchant vessel of the United States of America,” the physician noted that he considered the applicant “competent.” The applicant’s signature appears below the statement: “I certify that all information provided by me is complete and true to the best of my knowledge.” Making false or fraudulent statements to a Federal agency such as the Coast Guard is a crime.25 In August 2004, the assistant captain pleaded guilty in U.S. District Court in Brooklyn, New York, to Federal charges that he knowingly made a false report to the Coast Guard on his medical evaluation form that he did not suffer from any illnesses and had not taken any medications.26 He told the court that he “just didn’t want the Coast Guard to know” because he was afraid that reporting his medications would jeopardize his job. Vessel Information Construction and Equipment The Andrew J. Barberi was built by Equitable Shipyards of New Orleans and delivered in 1981. Its overall length was 310 feet, its beam was 70 feet, it had a draft of 12 feet, 6 inches, and it displaced 2,721 long tons.27 Data from sea trials conducted by George G. Sharp, Inc., of New York in 1981 showed that the vessel could come to a complete stop, from full ahead, in about 420 feet and within about 43 seconds.28 Normal vessel speed at 25 The Coast Guard website http://www.uscg.mil/STCW states: “Title 18 U.S. Code (U.S.C.), Section 1001 states that intentionally making false or fraudulent statements or representations in any matter within the jurisdiction of any department or agency of the United States is a Federal crime punishable by not more than five years in jail and/or a fine of up to $250,000 for individuals or $500,000 for organizations. When signing the application and forms to apply for an MMD [merchant mariner’s document], License, Certificate of Registry, or STCW [International Convention on Standards of Training, Certification and Watchkeeping] you acknowledge awareness of the meaning of the statute in 18 U.S.C. 1001. If there is evidence that an application was submitted fraudulently, the application may be denied and the case will be forwarded to the local U.S. Attorney for appropriate action.” 26 The physician who performed the assistant captain’s medical evaluations was indicted in the same jurisdiction on similar charges. 27 One long ton = 2,240 pounds. 28 George G. Sharp, Inc., “Trial Report—Staten Island Ferry-Andrew J. Barberi,” New York (1981), p. 94.

Factual Information 16 Marine Accident Report full ahead was 16 knots. Postaccident testing indicated that the Andrew J. Barberi required about 5 seconds, from either pilothouse, to generate 100 percent thrust from zero thrust (see “Tests and Research” section for further information). The Andrew J. Barberi’s symmetrical structure, both above and below the waterline, allowed it to perform equally well in both directions. Thus, the ferry could approach and leave the dock without turning around. The vessel had four decks, from high to low called the hurricane, bridge, saloon, and main decks (figure 5). Passengers were not permitted on the hurricane deck, which held the two pilothouses. A concession stand was situated on the bridge deck. Passengers embarked and disembarked on the main deck and on a platform midway between the main and the saloon decks, referred to as the upper embarkation level. Enclosed stairs led from the saloon deck to the upper embarkation levels, and ramps led from the upper embarkation levels to the bridge deck. The ferry had seating for 3,672 passengers;29 passengers in excess of that number had to stand. The hull was of steel, all-welded construction, transversely framed on 30-inch centers and subdivided by watertight bulkheads. The hull was symmetrical about the midships transverse section. Frame numbers ran in either direction from frame 0, located midships, to frame 56 at either end of the vessel. Watertight bulkheads were located on both ends at frames 12, 39/40, and 52. Partial watertight bulkheads, interrupted by the shaft tunnels, were located at frames 20 and 31. The hull was generally single-bottomed, with a 4-foot-high inner bottom at the shaft tunnels. Figure 5. Profile of Andrew J. Barberi. 29 The main deck could seat 1,630 passengers, the saloon deck, 1,258, and the bridge deck, 784. Pilothouse Pilothouse Propeller Propeller Hurricane deck Bridge deck Saloon deck Main deck Stack

Factual Information 17 Marine Accident Report Navigation equipment in the pilothouse consisted of short-range (3 centimeter) and long-range (10 centimeter) radar30 (equipped with an automatic radar plotting aid [ARPA] that automatically provided information on other vessels’ course, speed, and closest-point-of-approach), a gyrocompass, and a magnetic compass. The equipment did not include any means of determining the ferry’s speed (speed had to be estimated on the basis of elapsed time over the 5.2-mile run) or projected path, water depth, or wind speed. Two radar screens were located behind the operator’s chair, out of his or her field of view. A repeater screen for the 3-centimeter radar was mounted above the navigation controls, in full view of the operator (see below). Each pilothouse was also equipped with devices for communicating with both the engineroom and the passengers. The devices included an engine-order telegraph for quickly communicating commands to the engineers; a sound-powered telephone; and a lever that rang a cowbell in the engineroom, to signal an emergency in which the engineers should take over propulsion control. A microphone was on the console behind the operator for making announcements over the public address system. Other communication equipment included a general alarm that rang bells throughout the ship in case of emergency, two VHF radios for ship-to-ship or ship-to-shore transmissions, and a UHF radio for the crew’s walkie-talkies. Both mates had walkie-talkies, and according to the director of ferry operations, each of the three passenger decks was supposed to have one. One of the deckhands told investigators that he had a walkie-talkie and heard it “crackling” after the accident but ignored it. Another deckhand said that he had a working walkie-talkie but that it would not function in the engineroom. Propulsion System Characteristics. Four General Motors 1,700-horsepower EMD 16-645E6 diesel engines powered the vessel. The engines were coupled to a Voith-Schneider cycloidal propeller at either end of the vessel that provided both propulsion and steering. The Voith- Schneider cycloidal propeller had five titanium blades, each mounted on a vertical shaft and attached to the outside of a large circular plate (figure 6). As the blades rotated, they applied force to the water and pushed the ferry in the desired direction. An automatic control system maintained the speed of the main engines at about 750 rpm while the vessel was under way. The vessel operator was positioned in the center of the pilothouse, with two steering directional handwheels on the left and two forward/aft thrust levers (one for each end’s propulsion drive) on the right (figure 7). By using a combination of the levers for ahead/astern thrust and the handwheels for port and starboard motion, the operator could quickly and precisely maneuver the vessel in any direction. The operator controlled the engine speed using levers farther to the left, at the forward end of the console. 30 The designation in centimeters refers to the wavelength of the transmission signal the radar emits. The signal reflects off a target and thereby detects it. In general, the shorter-wavelength radar is more suitable for close-in navigation, while the longer-wavelength radar is used for distant targets.

Factual Information 18 Marine Accident Report Both forward and aft propulsion systems could be controlled from either pilothouse or from the engineroom. Two operators were needed to transfer control from one pilothouse to the other. The operator in the controlling pilothouse activated a “send” button on the console. The operator in the other pilothouse then pushed an “accept” button to receive and take control. The engineer could single-handedly take control over either propulsion system from the engineroom. Operating Condition At Time of Accident. During the week before the allision, the Andrew J. Barberi’s crew tested the vessel’s engines and propulsion units. All were found to be satisfactory, with no faults in either the machinery or the alarm circuits. The engineering logbook contained no entries that suggested engineroom problems either before or during the accident. The ferry’s chief engineer told investigators that the propulsion plant and associated machinery were in satisfactory operating condition the day of the accident, and that the chief engineer on the previous watch told him that he had experienced no problems in the engineering spaces. The assistant engineer on watch during the accident stated that the vessel’s two propulsion systems and engineroom machinery performed as expected and that he had a “very normal watch” before the accident. After the accident, an NYC DOT port engineer boarded the vessel and observed that the propulsion units were operating normally and that they held the ferry against the Figure 6. One of Andrew J. Barberi’s two Voith-Schneider cycloidal propellers.

Factual Information 19 Marine Accident Report dock for an hour or more. (The ferries were not tied to the docks during loading and unloading, but rather were hooked into recessed cleats31 on the dock and held in position by the propulsion units.) Certification and Inspection The Andrew J. Barberi was certificated as a large passenger vessel by the U.S. Coast Guard and was inspected by the Coast Guard under a memorandum of understanding (MOU) with the NYC DOT (see “Additional Information” section for details). The American Bureau of Shipping issued classification documents to the vessel on November 29, 1996, and May 14, 2002. The Coast Guard issued a certificate of documentation on September 11, 2003. The Coast Guard conducted its last annual inspection of the Andrew J. Barberi before the accident on January 15, 2003, and issued a COI. The Coast Guard also 31 Fasteners, usually with two projecting horns, around which a line (rope) can be secured. Figure 7. Pilothouse controls on ferry’s Staten Island end. Thrust levers are on right of operator’s chair, handwheels on left. Behind operator’s chair (outside his field of view) is monitor for 10-centimeter radar display with automatic plotting aid showing other vessels’ course, speed, and closest-point-of-approach. Data (blips) on 3-centimeter radar display (smaller screen behind operator) are repeated on monitor hanging above controls.

Factual Information 20 Marine Accident Report conducted quarterly inspections on April 17 and July 25 during the year before the accident. The Safety Board noted only minor deficiencies in the inspection records, such as missing locks, loose wires, or cracked casings. The ferry was due for another quarterly inspection on October 16, 2003—the day after the accident. Wreckage After the accident, the ferry’s propulsion system was found undamaged. The vessel’s main deck sustained the bulk of the damage, with some tearing of the deck into various voids, machinery, and ballast tank spaces below (figure 8). The leading edge of the starboard passenger cabin on the main deck (Staten Island end), at frame 54, appeared to have taken the brunt of the allision. The bulkhead at frame 54 was fully torn from the deck, from the starboard deck edge inboard through to a point about 12 feet to the left of the centerline. All bulkheads and associated frames, structural support columns, and saloon deck support frames between frames 54 and 44 on the starboard side were missing. The stairs between the main deck and the saloon deck were fully collapsed (figure 9). The centerline support column at frame 36, the forwardmost support column (that is, closest to the Staten Island end) for the pilothouse remained intact and appeared to have provided the main support for the forward pilothouse after the starboard support columns were destroyed. The deck around the cleat on the starboard side (forward of the cabin) was found largely intact but with a 15-inch longitudinal and 8- to 10-inch transverse tear that created an opening to the ballast tank space below. Four tears that exposed the propulsion room below the main deck were also found. The first, of approximately the same dimensions as the forward tear, was found aft of the cleat. The second, about 4 feet aft of the cleat in the area of the bunker (fuel) station, was associated with numerous flattened and bent pipes leading to the propulsion room (lubrication oil fill connections, fire main connections, fuel oil fill pipes, water tank fill pipes, and tank vents). The third tear was 12 feet inboard of the bulkhead, where a ventilator trunk had been ripped out. The fourth tear was aft of the vent trunk, where a pipe duct had been torn off. Vertical steel support columns for the frame member that supported the forward superstructure were sheared off on the Staten Island end aft of frame 54 to frame 4. The outboard attachment point of the column at frame 20 was sheared off, but the inboard attachment point was intact. The saloon deck sagged 2 to 3 inches near the forward starboard corner of the pilothouse because of the damage to the supports. The side shell was peeled back from frame 54 at the Staten Island end to frame 25 at the New York end. Bulkheads, seating areas, bulkhead trim, ceiling panels, lighting cables, fixtures, and plumbing systems were destroyed from the bow to about frame 20, inboard of a point about 12 feet left of the centerline.

Factual Information 21 Marine Accident Report Figure 8. Plan view of ferry’s main deck highlighting damaged areas. STATEN ISLAND END NEW YORK END Frame 4 Frame 20 Frame 36 Frame 54 Frame 25 Torn decking Cleat Destroyed stairway to saloon deck Torn decking Frame 0 Damaged area Destroyed support column

Factual Information 22 Marine Accident Report Waterway Information The Port of New York and New Jersey is the largest port complex on the East Coast of North America32 and was the world’s eighteenth busiest port in 2002.33 Its harbor is divided at the Narrows into the Lower Bay and the Upper Bay (figure 2). The Verrazano Narrows Bridge crosses the Narrows to link Staten Island with Brooklyn. The anchorage channel, the main passage through the center of the bay, runs west of Governors Island at the Upper Bay entrance to the East River. A shallow area with depths of 8 to 20 feet lies east of the anchorage channel, and a shallower area lies to the west, off the New Jersey shore.34 Lighted buoys mark the anchorage channel. Figure 9. View of damage to New Jersey side of main deck showing collapsed stairway to saloon deck, destroyed columns, crushed seats, ruined ceiling panels, dislodged cables and fixtures, debris, and other destruction. 32 Source: http://www.panynj.gov/commerce/marmain.htm (accessed April 26, 2004). 33 In tonnage of annual cargo passing through it (Information Please Almanac http://www.infoplease.com/ipa/A0104779.html [accessed March 22, 2005]). 34 National Oceanic and Atmospheric Administration, National Ocean Service, United States Coastal Pilot, vol. 2 (Atlantic Coast: Cape Cod to Sandy Hook), 2003, p. 372.

Factual Information 23 Marine Accident Report The route of the Andrew J. Barberi was between St. George, Staten Island, and Whitehall Street, Manhattan, in the Upper Bay of the harbor (figure 2). The Whitehall Street terminal was on the East River side of the Battery, located at the southern tip of Manhattan, where the East River and the Hudson River meet. Because of the terminal’s location, ferry operators were required to execute a 90º left turn to enter the ferry slips, and conversely, a turn right on the return to Staten Island. Beyond the Battery, the route to Staten Island continued past the west side of Governors Island on a south-southwesterly course in the anchorage channel. The route continued past Ellis and Liberty islands toward the KV buoy, which marked the north side of the entrance channel into the Kill van Kull.35 After passing the KV buoy on the vessel’s starboard side, the route continued past the Kill van Kull and turned toward the designated ferry slip. The distance from the KV buoy to the ferry slips was about 1,000 yards, and the distance from Whitehall to the KV buoy was about 4 miles. The Coast Guard operated and maintained a VTS to facilitate the orderly flow of vessels on the waterways in the Port of New York and New Jersey.36 The vessel traffic center was located at Ft. Wadsworth on Staten Island and was staffed continuously. The center used a VHF-FM radiotelephone network to obtain and disseminate vessel traffic information to vessel operators, as well as radar and low-light closed-circuit television to confirm and supplement this information. Low-power, remote VHF-FM sites were located throughout the New York/New Jersey waterway environment. Staten Island Ferry operators routinely called the VTS center when they left the dock but did not call when they arrived at their assigned slip, according to the VTS operator. The VTS system had limited video and radar recording capability. The operator at Ft. Wadsworth told investigators that, after being notified of the accident, he focused the VTS camera on Governors Island toward the Andrew J. Barberi. The camera recorded approximately 11 minutes of the ferry’s postaccident actions while it maneuvered in the harbor before it docked. As of December 31, 2004, certain domestic vessels that use the New York VTS, including passenger vessels of 100 gross tons or more, were required by the Maritime Transportation Security Act of 2002 to have an installed, operational automatic identification system (AIS).37 AIS is a shipboard broadcast system, operating in the VHF maritime band, that can send and receive ship information such as identity, position, course, and speed. 35 Kill van Kull is a 4-mile channel that connects the Upper Bay of New York Harbor to Newark Bay and the channels on the west side of Staten Island. Vessels entering or departing the waterway pass through the same area the ferries use between the KV buoy and the St. George ferry slips. 36 Vessel Traffic Service New York User’s Manual (accessed April 28, 2004). 37 The AIS carriage requirements were established by the Maritime Transportation Security Act of 2002 (Public Law 107-295, November 25, 2002). The Coast Guard published the final rule for implementing the act on October 22, 2003 (Federal Register, vol. 68, no. 204, pp. 60559-60570). The final rule became effective on November 21, 2003.

Factual Information 24 Marine Accident Report Operations of New York City Department of Transportation According to information published on its website,38 the NYC DOT manages much of the city’s transportation infrastructure, including city streets, highways, sidewalks, and bridges. DOT is responsible for installing and maintaining street signs, traffic signals, and street lights, resurfacing streets, repairing potholes and other street defects, installing and maintaining parking meters, managing municipal parking facilities, and operating the Staten Island Ferry. DOT supervises the city’s franchise agreements with seven private bus companies, oversees private ferry operations on city-owned piers, manages the city’s contracts with companies that provide transportation to pre-kindergarten special education children, issues parking permits to people with disabilities, not- for-profit agencies and governmental entities, and commercial vehicle permits for trucks, issues construction permits for work in city streets, and manages the city’s Adopt-a-Highway program. DOT also promotes safe travel by bicyclists and pedestrians, and offers programs to foster traffic safety education. The Staten Island Ferry, a division of the NYC DOT, had been a municipal service since 1905, and at the time of the accident carried over 19 million passengers a year. The ferry division operated seven vessels in three ferry classes of different design and capacity (Kennedy, Barberi, and Austen), as well as two passenger terminals, a maintenance facility, and a fuel storage and transfer facility. As many as five ferries operated at any one time, depending on time and day. The division had an annual budget of $452 million and 430 to 450 employees. Of those, 19 were captains and 16 were assistant captains. The NYC DOT had no established minimum requirements for its personnel to qualify as ferry assistant captain or captain. Ferry operating personnel began as deckhands and then qualified as either mates (nonnavigating officers) or assistant captains, who could then be promoted to captains. The NYC DOT required both assistant captains and captains to have masters’ and first-class pilots’ licenses, with extensions to the Upper Bay of New York Harbor, the East River from the Battery to Execution Rock, the west river (Hudson River) from the Battery to the George Washington Bridge, and Fresh Kills from the KV buoy to Elizabethport, New Jersey. No Coast Guard documentation was required of deckhands on the Staten Island ferries. The deckhands reported to the mates, who reported to the captain during vessel operations. The assistant captain and the captain both reported to two port captains. The port captains were the immediate supervisors of the ferry officers who oversaw day-to-day ferry operations and who wrote the officers’ performance appraisals. The port captains reported to the director of ferry operations, who oversaw ferry operations and maintenance. 38 “DOT: Who We Are & What We Do” http://www.nyc.gov/html/dot/html/about/dotdoes.html (accessed March 8, 2004).

Factual Information 25 Marine Accident Report The director of ferry operations, along with the director of terminal operations and the director of administration, reported to the assistant commissioner, who oversaw all aspects of ferry operations (operations, maintenance, terminals, ferry personnel, budgeting). The assistant commissioner reported to the NYC DOT deputy commissioner, who reported to the NYC DOT first deputy commissioner, who then reported to the NYC DOT commissioner. In September 2000, construction began on a new Whitehall ferry terminal, with the NYC DOT as one of the project overseers; renovation of the St. George terminal had gotten under way the year before.39 In April 2003, the mayor of New York announced his fiscal year 2004 budget. Among other cuts the mayor proposed in the face of the city’s $3.8 billion budget deficit were reductions in rush-hour services on the Staten Island Ferry and the elimination of over 200 NYC DOT jobs.40 Meteorological Information According to National Weather Service data, on the day of the accident, a low- pressure system, with a central pressure of 976 millibars, was located just north of New York State. Data from the immediate vicinity of the accident site indicate winds from the west at 25 to 30 knots, with scattered to broken sky conditions and a temperature of 64º F (18º C). Observations at the three weather stations closest to the accident site (Newark Liberty International Airport, 6 nautical miles away; New York Central Park, 11 nautical miles away; and John F. Kennedy International Airport, 14 nautical miles away) were similar, although they indicated stronger peak winds and stronger wind gusts.41 Visibility was 10 miles in the area. National Ocean Service data for the New York and New Jersey harbor, recorded at Battery Park, New York, and Sandy Hook, New Jersey, indicate that at 1530, winds were from the west at 35 to 40 knots, atmospheric pressure was approximately 998 millibars, and the air temperature was about 60º F (15.5º C). The water level was approximately 2 feet above the mean, with an outgoing tide, and the water temperature was 62º F (16.6º C). 39 Archives of the Mayor’s Press Office, New York City, June 9, 1999, and September 25, 2000 http://www.ci.nyc.ny.us (accessed January 24, 2005). 40 “Leaving No City Service Intact: The Mayor’s Executive Budget(s) for Fiscal Year 2004” (New York: City Project, May 8, 2003), p. 10. 41 Kennedy Airport recorded the highest wind speeds, with peak winds of 47 knots and gusts of 41 knots at 1451. Newark Airport recorded peak winds of 40 knots at the same time.

Factual Information 26 Marine Accident Report Medical and Pathological Information Passenger Injuries Most furnishings and seating areas and most supporting structures of the vessel about the midships sections on the main deck New Jersey side were severely damaged or destroyed by the allision and by the vessel’s continued momentum against the pier as the concrete decking passed through the passenger cabin. The resulting debris entangled many passengers who were gathering in the primary impact area to disembark. Ten passengers were found dead by emergency response personnel who met the vessel after it docked.42 Emergency personnel identified the locations of the fatally injured passengers several days after the accident. All the fatally injured passengers were found on the New Jersey side of the vessel’s main deck (figure 10). The cause of death of the fatally injured was blunt force trauma and its consequences, with numerous severe injuries to head, torso, and extremities. About 70 passengers were injured in the accident. The injuries of those admitted to area hospitals ranged from minor ones requiring observation to more serious ones such as bone fractures, internal organ damage, limb amputations, and other injuries requiring major surgery. Thirty-five passengers were taken to Staten Island University Hospital; 10 were admitted and 25 were treated for minor injuries and released. Between October 16, the day after the accident, and October 31, an additional 13 passengers were treated at Staten Island University Hospital for injuries they received in the accident. None was admitted overnight. Three passengers were taken from the accident site to Staten Island University Hospital South. One was admitted and two were treated and released. On October 16, an additional passenger went to that hospital for the treatment of injuries sustained in the accident. He was treated and released. Thirty passengers, and later the assistant captain, were taken to St. Vincent’s Hospital on Staten Island. Eight passengers were admitted and 22 were treated and released. The assistant captain was admitted, underwent emergency surgery, and remained in postsurgical and, later, psychiatric care through mid-November 2003. Six passengers were taken to hospitals in Brooklyn. Three were transported to Kings County Hospital, where they were treated and released. Three were taken to Lutheran Medical Center, where they too were treated and released. Toxicological Testing Shortly after the accident, the Andrew J. Barberi crew, except for the assistant captain, submitted blood and urine specimens to the Coast Guard and to the NYPD for toxicological testing in response to a combined NYPD/Coast Guard request. For all crewmembers, the results were negative for alcohol and the five drugs of abuse that the 42 An eleventh passenger died in December 2003 from injuries she received in the accident.

Factual Information 27 Marine Accident Report Figure 10. Locations on main deck where emergency personnel recovered bodies of fatally injured passengers. When emergency personnel arrived on board, some bodies had been moved from where fatal injuries occurred. STATEN ISLAND END NEW YORK END Brooklyn Side New Jersey Side

Factual Information 28 Marine Accident Report U.S. Department of Transportation screens for in postaccident testing (marijuana, cocaine, opiates, amphetamines, and phencyclidine [PCP]). The Safety Board requested and obtained blood and urine samples of the assistant captain that St. Vincent’s Hospital had obtained on his admission. The Board sent the samples to the Federal Aviation Administration’s Civil Aerospace Medical Institute for toxicological analysis. The results were negative for alcohol and illegal drugs. The analysis found 0.76 micrograms/milliliter of tramadol in the blood and diphenhydramine (a sedating antihistamine43) in the urine. Survival Factors Crew’s Emergency Actions Safety Board investigators interviewed the Andrew J. Barberi’s senior and junior mates, the seven deckhands, and the four crewmembers in the engineroom (chief engineer, assistant engineer, and two oilers). The investigators also interviewed two crewmembers of the Dorothy J, the tugboat that assisted after the accident. The senior mate (mate No. 1) was sitting on the settee in the Staten Island-end pilothouse when the ferry struck the pier. According to the standard operating procedure, his station during docking was on the main deck at the ferry’s inshore end. His duties were to secure the New York end and supervise deckhands on the main deck and the New Jersey side of the saloon deck. After the accident, the senior mate, as instructed by the captain, went below to assess the situation. The mate told investigators that when he walked out of the pilothouse, he confronted panicky passengers and tried to assure them that everything was all right. He made his way to the New York end and down the stairs. On the main deck, he witnessed two deckhands assisting the injured and applied what he could remember of his emergency medical technician (EMT) training from 20 years before to help injured passengers. He told investigators that he attempted triage and used his belt and the straps from a lifejacket as tourniquets. He “instructed crew members as they came by,” sending one for a defibrillator and telling others to move everyone to the saloon deck who was not involved in helping or was not critically injured. He directed EMS personnel to the most seriously injured passengers when they came on board. The standard operating procedure called for the junior mate (mate No. 2) to be on the upper embarkation deck at the inshore end of the ferry during docking. His duties were to secure the Staten Island end and to supervise deckhands on the bridge deck and on the Brooklyn side of the saloon deck. The junior mate told investigators that he was making his way toward the Staten Island end of the ferry’s main deck, Brooklyn side, and was about 15 feet from the doors when the ferry struck the pier. He thought they had hit another vessel and had no idea that the ferry was close to the dock. After they hit the pier, he ran to the New Jersey side, where all the damage was, and helped injured passengers. 43 Found in such over-the-counter medications as Nytol®, Benadryl®, and Tylenol PM®.

Factual Information 29 Marine Accident Report Because the damaged area looked unsafe to him, he had deckhands direct passengers who could walk to the saloon deck or toward the New York end. He directed other deckhands and an off-duty Staten Island Ferry mate to assist the approaching tug he could see “through the hole in the hull.” Next, he went down to the engineroom to see why the vessel was not moving. The chief engineer told him that he had no communication with the pilothouse, so the junior mate gave the chief engineer his radio, then ran up to the pilothouse to inform the captain. The assistant captain asked for his cell phone and the junior mate gave it to him. Then he went back to the main deck, where he witnessed the senior mate and a nurse applying a tourniquet to an injured passenger. When the rescue workers came on board, the junior mate said that he showed a fireman where the deck needed to be shored up and took detectives to the pilothouse to see the captain. Deckhand No. 1 was on the main deck at the time of the accident, on his way to the restroom near the engineroom. His duty station was the bridge deck, New Jersey side. He was also responsible for making departure and prearrival announcements from the pilothouse. He told investigators that after the accident, he rushed up to the bridge deck, telling passengers to don lifejackets on his way. He said, “People were going . . . crazy. There was chaos going on.” Then, he said, he realized that the saloon deck might fall on the main deck, so he ran down to the saloon deck and told passengers to move to the Brooklyn side. After a passenger told him there were many wounded on the main deck, he ran to the pilothouse to inform the captain. Then he went back to the main deck to help with the injured, but he told investigators that after he saw body parts and corpses, he was “no good.” He said the crewmembers were “running all over the place.” He said he heard no emergency announcements. Deckhand No. 2 was at his duty station on the saloon deck, Brooklyn side, at the time of the accident; his assignment was to attach and release the safety chain at the gates, look after passengers, and clean. He told investigators that after the allision he made sure that passengers who could walk stayed away from the damaged end and helped the junior mate attend to the injured. Deckhand No. 3 was the lookout assigned to the accident trip. The standard operating procedure listed no specific duties for the lookout, stating only that deckhands were to “act as a lookout as assigned.” The lookout left the pilothouse shortly after the ferry passed the KV buoy. His duty station was the New Jersey side of the saloon deck, where he had the same responsibilities as deckhand No. 2. The lookout told investigators that he had just untied the saloon-deck doors and was at the top of the staircase between the saloon and main decks at the time of the accident. He said that when he realized that the ferry had not slowed down, he chased passengers to the other end of the boat, then grabbed a man and held onto the stair rail when the ferry hit the pier. After that, he kept people away from the collapsed stairway. He said he saw the assistant captain descend what was left of the stairs, climb over the wreckage, and “go around the side.” He said, “People were panicking, putting on lifejackets and everything.” He said he heard no alarms or other danger signals before the accident. Deckhand No. 4 was sweeping the men’s rooms on the saloon deck at the time of the accident. His duty station was all the men’s rooms and the crew’s locker room. The

Factual Information 30 Marine Accident Report impact knocked him down. He went outside, helped a fallen passenger, then ran to the bow, which he could not see because of the debris. He saw dead and injured passengers and yelled to the bridge for a police officer. Then he ran to the pilothouse to tell the captain not to move the ferry because the bow was not intact. He went down again and heard the captain yell to get a line to the tugboat. He said he tried to move passengers to the stern and assured them that the ferry was not sinking. He then went back to the pilothouse, where the captain was trying to contact the engineroom. The deckhand said he grabbed a radio and ran down to the engineroom, where he determined that the crew was uninjured but that the radios and phones were not working. He said that he tried to make an announcement on the public address system but that it also was not working. He told investigators that he did not try to call either of the mates on his radio and that he could not think of where his emergency station was.44 Deckhand No. 5 was walking toward the Staten Island end of the main deck at the time of the accident. His duty station was the New York half of the main deck. He told investigators that he ran to the New York end, making his way among passengers who were grabbing and putting on lifejackets. Then he went to the bridge to find out what the captain wanted the crew to do. The captain told him to find the chief engineer. On his way to the engineroom, he said he saw other deckhands controlling the crowd and helping passengers. He told investigators that he heard no alarms and no announcements to put on lifejackets. Deckhand No. 6 was sitting on the main deck, amidships on the Brooklyn side, at the time of the accident. His duty station was the Staten Island half of the main deck. He told investigators that he had been trying to keep the doors closed, which the wind kept blowing open. After the ferry hit the pier, he said he ran to the bow, than ran back, encountering dead and injured passengers. The senior mate asked him to find the defibrillator, which he did. He said, “I did the best as I could to help people.” When the ferry docked at slip 5, he helped fasten the hooks. Deckhand No. 7, the utility bridge deckhand, was cleaning out a lifejacket locker at the time of the accident. His duty station was the Brooklyn side of the bridge deck, the ramps to the upper embarkation area, the New York-end pilothouse, and the officer’s locker room. He told investigators that he had his back to the windows when the ferry hit the dock and was not paying attention to the vessel’s location but was waiting for the engines “to back down.” He heard no alarms before the accident and thought the ferry had run aground. He ran toward the bow, went to the saloon deck, and saw the lookout moving people back. He said the captain yelled at him from the pilothouse to go get the engineer, but he saw that the engineer was already on his way up. He continued to move people on the saloon deck to the New York end, then went to the main deck to help shift debris out of the way and to move people to the New York end. The engineering staff were all in the engine control room at the time of the accident. The chief engineer told investigators that he was sitting in front of the control board when the ferry started shaking as if it had gone aground. He looked at the engine speed indicators and said, “How come he is not slowing down?” Then he heard crunching 44 See “Emergency Plans,” below.

Factual Information 31 Marine Accident Report “like something going under the hull and being caught in the wheel.” He told investigators that he tried to call both pilothouses but got no response, so he sent the assistant engineer and the two oilers to the deck to find out what had happened. As the assistant engineer and oilers were leaving, debris fell into the engineroom. The phone was ringing from the bridge, but when the chief engineer picked it up, he got no answer. Meanwhile, the engines had slowed and the pitch had been taken off. The assistant engineer and the oilers came back and the chief engineer said he put the assistant engineer in front of the controls and went on deck himself. He said it looked like a bomb had gone off. He went to the Staten Island pilothouse, where the captain told him that the assistant captain “had lost it.” The captain then went to the New York end and the engineer transferred power to him there. The chief engineer told investigators that the ferry did not lose power when it hit the pier, that no alarms went off, and that “nothing blinked.” The Staten Island propeller was still turning but the engineers shut it down because the FDNY needed to enter the shaft housing. The assistant engineer told investigators that he was looking at the electrical panel in the engineroom when he heard “a violent crash.” He told investigators that he heard no ship’s whistles or alarms beforehand: “It was a very normal watch preceding the accident.” He said that after the crash the chief engineer sent him with the oilers to check for damage at the ends of the ferry. At the top of the stairs they saw what had happened and as a former advanced EMT, he tried to help one person but had to leave the accident area because he felt so disturbed. He went back to the engineroom to inform the chief about the situation on deck. After the chief engineer left the engineroom, the assistant engineer closed the water lines because water was coming in and also closed a surface air line and double-checked the boiler because he thought the steam lines might be broken. He told investigators that the generator lights flickered but the vessel’s lights never went out. He said he stayed in the engineroom the rest of the time. Both oilers were in the engine control room at the time of the accident. One was sitting across from the assistant engineer and the other was standing. One of the oilers said that he thought the ferry had hit something in the middle of the harbor. He told investigators that he heard no alarms or bells or changes in the engine sounds before the accident. Both oilers went on deck, as instructed by the chief engineer, to check for damage to the propulsion system. One oiler told investigators that he helped pull debris off an injured passenger. The engineer of the Dorothy J told investigators that no deckhands were available to help with the lines, and that as a result, he jumped back and forth from the tugboat to the ferry three times to tie and untie lines. He said that one of the ferry’s passengers helped him with the lines. The tugboat’s mate said that the deckhands stopped passengers from getting on the tugboat while it was attaching lines to the ferry. Shoreside Emergency Response New York City’s 911 emergency notification system was first notified of the accident at 1522 by a caller who informed the operator that the Andrew J. Barberi had

Factual Information 32 Marine Accident Report struck a dock. In response, the FDNY dispatched three engine companies, two hook-and- ladder companies, and a battalion chief to the St. George terminal. Subsequent callers to 911 provided information about the scope of the accident and the consequent injuries. One caller reported a passenger in the water. In response to that information, the FDNY dispatched a fireboat to the scene. Early callers also gave inaccurate information about the accident, such as a report that an explosion had occurred on the vessel. At 1526, the first of two EMS life support ambulances was dispatched.45 At 1527, the first FDNY personnel arrived on scene. Under existing agreements between New York City first responders, the FDNY was responsible for overseeing the response to multiple casualty incidents and accidents. FDNY personnel established an incident command system to oversee rescue efforts. Also at 1527, the FDNY received reports of numerous injured on board and a minute later, it learned of at least one fatality on board. At 1529, the first EMS unit arrived on scene. The ferry had not yet arrived at the terminal. At 1530, a second life support ambulance and an EMS supervisor were dispatched to the scene. Two minutes later, scuba-trained and tactical support personnel were dispatched. At that time, the incident commander also transmitted a notification signal alerting all personnel dispatched to the scene that they would be needed to participate in the response and automatically dispatching another engine company, another ladder company, and two more battalion chiefs. As described in a memo to the Safety Board after the accident, FDNY on-scene operations were organized as follows: Operations were conducted under the incident command system, utilizing chief officers as sector or function commanders, each being assigned the number of units required to accomplish the task assigned. Operating units were rotated to avoid fatigue. [As a result] . . . additional units were called to the scene either individually or by transmitting multiple alarms. At 1536, the FDNY was informed that more than one person was in the water near the accident scene. In response, a second fireboat, a water rescue unit from another ladder company, and additional support and supervisory personnel were dispatched. Three minutes later, the off-duty FDNY lieutenant who was on board the ferry as a passenger called dispatchers with information about conditions on board, including information about multiple casualties. The FDNY then dispatched an additional rescue company, a squad company, a special operations chief, and a safety chief. FDNY records indicate that the Andrew J. Barberi arrived at the terminal at 1543. When the ferry docked, emergency personnel entered the vessel from two levels simultaneously, searching for victims and providing them with initial medical care. Those in need were stabilized and transported to area hospitals. Other emergency personnel located and extricated trapped victims and helped brace the upper decks of the vessel on the New Jersey side. As the severity of the accident became clear, information was relayed to the incident commander, who transmitted a major emergency signal that automatically brought more FDNY and EMS assets to the scene. 45 Life support ambulances carry many of the materials found in a hospital emergency room.

Factual Information 33 Marine Accident Report All told, the FDNY dispatched 213 personnel to the accident, including 2 staff chiefs, 3 deputy chiefs, 16 battalion chiefs, 16 engine companies, 10 ladder companies, 3 rescue companies, 2 fireboats, a squad company, a tactical support unit, a hose wagon, a fireground rehabilitation unit, a field communications unit, a technical response unit, and a collapse rescue unit. In addition, 59 EMS personnel, 24 ambulances, 15 advanced life support and 9 basic life support units, and 2 logistical support units participated in the response. After responding to the first 911 call, units from the NYPD continued to arrive. Over 311 NYPD personnel assisted during the afternoon and evening of October 15— helping the injured and taking witness statements, interviewing crewmembers and passengers, organizing crowd control and traffic control, and forming a protective area around the ferry terminal. The local Coast Guard operational field command facility, Coast Guard Activities New York, was notified of the accident at 1525, as noted previously, by a Coast Guard enlisted person who was a passenger on the Andrew J. Barberi. At 1533, Coast Guard Station New York, the local Coast Guard search-and-rescue facility collocated with Coast Guard Activities New York, launched a 25-foot small response boat and a 27-foot utility boat to the St. George terminal, located 3 miles from the Coast Guard facilities at Ft. Wadsworth. At 1535, Coast Guard Station New York launched a 41-foot utility boat to the ferry. At 1537, personnel from the Coast Guard’s 27-foot boat reported that the Andrew J. Barberi had sustained major damage to its New Jersey side above the waterline. At 1545, Coast Guard Activities New York dispatched a safety officer and an investigating officer to begin the Coast Guard’s investigation of the accident. At 1553, Coast Guard on-scene personnel established a 250-yard security zone around the ferry and broadcast to vessels in the waterway that an approximately 400-yard debris field was moving through the waterway, as a result of the ebb tide and westerly winds. At 1559, Coast Guard Activities New York halted all Staten Island Ferry operations. A ferry under way from Manhattan was ordered to return. During this period, three organizations involved in the waterborne response—the Coast Guard, the NYPD, and the U.S. Army Corps of Engineers—sent additional rescue and response vessels to the scene. By 1700, 15 vessels in addition to the FDNY boats were participating in the waterborne response—6 from the Coast Guard, 5 from the NYPD, and 4 from the Army Corps of Engineers. Coast Guard vessels searched for people in the water between St. George and the Verrazano Bridge until 2040. Because no accurate count was made of the number of passengers, rescue personnel had no indication of how many people might be missing and in the water. Only one person, it turned out, had to be rescued from the water. Coast Guard personnel remained on scene throughout the evening to assist with the investigation, search the areas next to the ferry terminal, keep water traffic not involved with the accident away from the terminal, and monitor possible hazards in the water. Their numbers increased the next morning before ferry operations resumed at 0500. Altogether, 15 Coast Guard officers, 6 enlisted personnel, and 4 Coast Guard Investigative Service agents responded to the emergency.

Factual Information 34 Marine Accident Report Emergency Plans The ferry’s station bill (list of crewmembers’ duties in emergencies such as fire or abandon ship) stated that during an emergency, the crew was to be notified in the following manner: The ship’s whistle and general alarm would be continuously sounded for at least 10 seconds. Additional signals on the whistle and general alarm (one to five blasts and rings) would designate the location of the emergency. According to the station bill, general alarm controls were in the pilothouse and control room, and the ship’s whistle controls were in the pilothouse, along with controls for the public address system. When they heard the emergency alarm, crewmembers were to report to their assigned stations. Each crewmember (captain, assistant captain, senior mate, deckhand No. 1, and so forth) had designated duties or assignments. In case of fire in the engineroom, for example, the deck crew was directed to arrive on scene with emergency equipment such as fire hoses, axes, and fire extinguishers and wait for instructions from the chief engineer. Mates were instructed to act under the direction of the master, deckhands under the direction of the mate. The captain or assistant captain was expected to make announcements over the public address system. Crewmembers were instructed to “stay calm, listen for instructions and signals . . . and remember that instruction(s) to the passengers will minimize panic and confusion.” The station bill was posted outside the pilothouse and at other locations on the ferry. The station bill required crews to participate in weekly fire and rescue drills. According to ferry crewmembers, the same drills were conducted every week: fire and emergency, abandon ship, and emergency anchoring. The drills were conducted after hours without passengers, with crewmembers working an hour or two extra before or after a shift to participate. The drills began with the ferry captain or assistant captain sounding the ship’s whistle to initiate the general alarm bell. The crew would then gather to simulate actions taken during an emergency, according to the type of drill signaled. New deckhands were given verbal training, informally conducted on the job. No training was given for a mass casualty event, such as the type that the Andrew J. Barberi experienced. The station bill contained general instructions for crewmembers on (1) recognizing and responding to emergency events, (2) required emergency announcements, (3) duties during emergencies, and (4) station locations during emergencies. Crewmembers did not receive, nor were they required to receive, training or procedures in such areas as crowd control or bridge resource management. The six officers of the Andrew J. Barberi (captain, assistant captain, two mates, chief engineer, assistant engineer) received training in first aid and cardiopulmonary resuscitation (CPR) as a condition of being licensed by the Coast Guard. Crewmembers received no training in first aid or basic lifesaving techniques. At the time of the accident, automated external defibrillators were present on the ferry and the crew was being trained in their use (they were not used in the accident). The defibrillator training included CPR instruction.

Factual Information 35 Marine Accident Report Emergency Equipment Lifesaving. According to the vessel’s COI, the Andrew J. Barberi was required to have the following lifesaving equipment: Notices were stenciled on the lifejacket lockers (located along the bulkheads and under seats), indicating whether they contained children’s or adults’ lifejackets. Other notices directed passengers to the locations of lifejacket lockers. According to the COI, the ferry was not required to be equipped with lifeboats, immersion suits, portable lifeboat radios, or an emergency position indicating beacon. Firefighting. The COI lists the following firefighting equipment on the ferry: • Two fire pumps. • Four fire hoses, each 50 feet long. • Two fixed carbon dioxide fire-extinguishing systems: a 3,100-pound-capacity system in the engineroom, and a 200-pound-capacity system in the emergency generator room. • Thirty-seven portable or semiportable fire extinguishers: 17 class A-II, 9 class B-II, 3 class B-V, and 8 class C-II.46 Tests and Research Two days after the accident, the Safety Board participated in tests of the Andrew J. Barberi’s communication and propulsion systems. Rescue boats/platforms 4 Inflatable rafts 4 (32 people) Life floats/buoyant apparatus 20 (400 people) Adult life preservers 6,022 Child life preservers 603 Ring buoys with lights 8 Ring buoys with lines 4 46 Class A extinguishers are for fires involving ordinary combustibles, such as wood, cloth, and paper. Class B extinguishers are for fires involving flammable liquid, grease, or gas. Class C extinguishers are for fires involving energized electrical equipment, such as appliances, switches, panel boxes, and power tools (these extinguishers are also rated for class A and class B fires). According to the Coast Guard classification system, type A-II portable extinguishers hold 5 pounds of dry chemical; class B-II, 10 pounds; class B-V, 50 pounds; and class C-II, 10 pounds.

Factual Information 36 Marine Accident Report Communication System Tests New York–End Pilothouse. The engine-order telegraphs, both thrust and steering, were tested in the New York-end pilothouse. An individual in the pilothouse sent orders to another in the engine control room via the telegraph system. A VHF radio was used to communicate between stations for verification that the orders were being received at both stations properly. Both engine-order telegraphs were found to work satisfactorily. The sound-powered phone systems were tested by phoning from the pilothouse to an individual in the engineroom. Calls made to the engineroom were completed satisfactorily, while calls made to the other pilothouse would ring in the pilothouse but the audio circuit was not completed. The public address system was tested and found to perform satisfactorily. It was heard clearly throughout the vessel. The pilothouse ship’s whistle was tested using two methods. One involved depressing a console pushbutton, which in turn opened a solenoid admitting air to sound the whistle. The other involved manually pulling an overhead pull cable in the pilothouse, which was mechanically linked to the valve at the whistle itself, thereby sounding it. The whistle performed satisfactorily irrespective of the method used. The “cowbell system,” essentially a pull lever in both pilothouses that connected directly to a cable that was attached to two cowbells in the engine control room, was tested in the pilothouse. The system performed satisfactorily. Staten Island–End Pilothouse. Tests found that the public address system, the cowbell signaling system, and the whistle from the pilothouse worked satisfactorily, similarly to the systems in the New York end. Several deficiencies, however, were found in the sound-powered phone system. All calls initiated from the pilothouse, regardless of the location being called, had no audio circuit. The ringer would ring at the selected call destination, but no audio connection was made. Calls from the engineroom or the New York-end pilothouse met with the same results—the phones would ring but the people could not talk to each other. Tests of the engine-order telegraph also found deficiencies. When a command was ordered from the pilothouse, the engine-order telegraph rang in the engineroom but the telegraph needle did not move to indicate the speed change being ordered. Engine-order telegraph commands from the engineroom showed the same results in the pilothouse—a ring indicating an incoming engine-order telegraph command was heard but no corresponding needle movement was observed. This test was performed in both directions, for each speed from stop to full astern, and from stop to full ahead, with the same results. Propulsion System Tests The propulsion system was tested without applying rotational drive from the main engine to the unit’s gearboxes. That was because of concern about the effect of vibrations from the main engine and propulsion system on the structural integrity of the upper deck,

Factual Information 37 Marine Accident Report which had been weakened by the accident. The tests were intended to demonstrate the operation and response of the propulsion units themselves, not of the driving medium. The hydraulic drive pumps were started and the system was brought to operating pressure. Investigators were positioned at the pilothouse controls and at the propulsion system’s actual location. Control was transferred from the engine control room to each of the two pilothouses, and the investigators in the pilothouses varied both the thrust and the steering from zero to 100 percent in both directions. The results showed that the propulsion system performed satisfactorily in both end units, through all phases of thrust and steering testing. Units in both ends were found to have a response time from zero to 100 percent thrust of approximately 5 seconds in any direction, and a response time from full ahead to full astern of between 7 and 8 seconds. The investigative team tested the transfer of propulsion control from the engineroom to the pilothouse stations, as well as between pilothouses. All propulsion transfers from operating station to operating station in each pilothouse, and from each operating station to the engineroom, were completed satisfactorily. Additional Information Staten Island Ferry Rules and Policies The NYC DOT required deckhands (the starting ferry operations position) to have 2 years of sea time or related experience before being hired. After personnel were hired as deckhands, the NYC DOT had no minimum or maximum time intervals in which they were to serve at each step before they could be promoted. According to the director of operations, deckhands could serve as little as 6 months before being promoted to assistant captain, provided they met the Coast Guard licensure requirements. The NYC DOT required assistant captains and captains to demonstrate knowledge of ferry procedures and ferry routes, including markers, buoys, and other navigational features. Applicants for the assistant captain or captain position submitted their résumés and were subsequently interviewed by the port captains and the director of operations, who then made the final selections. The NYC DOT had no formal curriculum for training deckhands or mates for assistant captain positions. When new deckhands reported for duty, they were given verbal instructions and trained on the job. Those selected for the assistant captain position would begin training by steering the vessel under the supervision of the captain, before taking the civil service examination for the position. At the time of the accident, no formal safety management system was in place, nor was one required to be, and management directives were communicated verbally to crewmembers. Emergency information listed in the vessel’s station bill covered alarm signals and announcements for fire, man overboard, and abandon ship emergencies, and listed fire stations and boat stations for crewmembers.

Factual Information 38 Marine Accident Report According to the director of ferry operations, “directives [and] memos” delineated standard operating procedures that were made available to ferry personnel. No system was in place to document crewmembers’ receipt of the directives and memos. Safety Board investigators, as a routine part of their investigation, asked the NYC DOT for a copy of the operating procedures. The NYC DOT provided the Board with an 8-page, undated document, “Standard Operating Procedures for Captains, Assistant Captains, Mates, Deckhands, and Female Attendants While the Boats Are Loading, Off Loading and Underway” (appendix B). According to that document, the captain was required to be in the operational pilothouse “upon docking” and to be in the “off shore” pilothouse “upon undocking to receive the signal from the assistant captain that the boat is let go.” According to the procedure, the captain was responsible for operating the boat safely and for emergency and rescue operations. The assistant captain, in addition to assisting the captain in the operation of the ferry, was responsible for advising the captain of any dangers to navigation. This officer also observed passenger embarkation and disembarkation and when the boat had cleared the dock, was directed to go to the operating pilothouse. According to the director of operations, no single procedure explicitly directed the captain or assistant captain to remain at certain locations during the voyages. Rather, he said, “You have to kind of put them [the procedures] together.” By doing so, the director said, “You see that they’re to be together [captain and assistant captain]. In weather, absolutely, positively together all the time.” He told investigators that he would talk to operators who were discovered not to follow this procedure. If they refused to follow the procedure, he would discipline them according to the NYC DOT’s disciplinary procedures (which he did not specify). The two port captains disagreed on the existence of an NYC DOT requirement for both the captain and assistant captain to be present in the pilothouse after propulsion control had been transferred from one end of the ferry to the other. One said that such a procedure was in place and that captains and assistant captains were expected to follow it. The other said that the decision was up to the captain of the vessel: “If he doesn’t want to be in the pilothouse, if he has to go do something, he can do it, as long as he knows a qualified person is in the pilothouse.” In addition, Safety Board investigators could find no evidence that the NYC DOT had a procedure that required crewmembers to signal or otherwise sound an alert to indicate that docking preparations were to be made. According to the director of ferry operations, the two port captains would regularly ride in the ferry pilothouses during their duty hours and observe the performance of crewmembers, although there was no standard inspection procedure mandating this practice or describing how the observation was to be carried out. The observations enabled the port captains to determine the extent to which the crewmembers followed the required procedures. According to the director, he or the port captains would document unusual situations or instances in which crewmembers did not follow procedures. Coast Guard Oversight of Staten Island Ferries Under 46 U.S.C. 3301, the Coast Guard has inspection authority over U.S.-flag vessels that charge passengers a fare to board. Coast Guard Activities New York was the

Factual Information 39 Marine Accident Report local Coast Guard office in charge of vessel oversight. The OCMI of Activities New York had final authority for vessel inspection, licensing, and investigation of marine casualties and accidents, among other responsibilities (33 CFR 1.01-20). The Coast Guard’s inspection authority was defined in terms of passengers paying for their passage. On July 1, 1997, the NYC DOT eliminated the fares that it had been charging its passengers, to integrate the Staten Island Ferry into the New York City mass transit system’s “One City, One Fare” program. As a result, a question arose whether the ferries would continue to be inspected by the Coast Guard. On May 19, 1998, the Coast Guard and the NYC DOT signed an MOU to maintain the Coast Guard’s inspection of the ferries, in light of their “mutual interest and concern for the safe operation of the Staten Island Ferries.”47 The document stated, “The parties have entered into this MOU to formalize procedures for developing standard operating procedures and agreements between OCMI NY and the NY City DOT to achieve the following goals: (1) improve passenger safety, (2) improve the quality of Ferry maintenance and operations, and (3) expedite the Coast Guard inspection process.” The MOU called for quarterly meetings “to exchange information and discuss issues of mutual concern.” Further, any agreements specifying procedures or operations would be “formalized in writing” and the MOU would be “thoroughly reviewed periodically by each party.” At the time of the accident, no agreements amending the MOU had been reached and no other written agreements had been added to it. The Coast Guard continued to examine the Staten Island ferries and issue COIs. Safety Assessment. In November 1998, new Coast Guard rules went into effect under 46 CFR 199 (subchapter W) that required vessel operators to install additional survival equipment, including lifeboats, liferafts, rescue boats, and associated appliances, which had been originally intended for oceangoing passenger vessels. Subchapter W consolidates the lifesaving regulations for U.S. inspected vessels and implements chapter 3 of the International Convention for Safety of Life at Sea (SOLAS), 1974, as amended.48 The new regulations gave operators until October 1, 2003, to install the lifesaving equipment. Under the provisions of 46 CFR 199.630(f), however, operators were allowed to obtain an approved safety assessment as an alternative to equipping their vessels with the additional survival craft. The regulations required the alternative safety assessment to address (1) the navigation and vessel safety conditions in the vessel’s planned operating area, and (2) a comprehensive shipboard safety management and contingency plan that was “tailored to the particular vessel,” “easy to use,” “understood by vessel management personnel both on board and ashore,” and “updated regularly.” In February 2003, the Coast Guard issued a Navigation and Vessel Inspection Circular (NVIC 01-03) describing the alternative safety assessment and giving guidance for having it approved.49 A previous 47 See appendix C. 48 SOLAS is an international treaty concerning the safety of merchant ships. The first version of SOLAS was adopted in 1914 after the Titanic sinking. A new Convention was adopted in 1974 and is sometimes referred to as SOLAS, 1974, as amended, because of its numerous updates and amendments. 49 U.S. Coast Guard, “Guide to the Subchapter W Safety Assessments Under 46 CFR 199.630(f),” NVIC 01-03 (Washington, DC: U.S. Department of Transportation, 2003).

Factual Information 40 Marine Accident Report Coast Guard circular described shipboard management and contingency plans, focusing on emergency procedures.50 In June 2000, George G. Sharp, Inc., in accordance with 46 CFR 199.630(f) and at the request of the NYC DOT, completed a safety assessment of the Staten Island ferries.51 The results of the Sharp assessment were submitted to the Coast Guard. The assessment included a description of the ferry fleet’s safety equipment and scope of operation. It described vessels, routes, crew requirements, schedules, vessel traffic characteristics, and environmental factors, and outlined basic emergency procedures and drills. The report noted that “the navigating risk is highest near the two terminals,” where “the ferry crosses perpendicular to the prevailing vessel traffic flow.” Appendix A to the report (“Contingency Planning”) detailed procedures to be followed in case of collision, flooding, grounding, abandon ship, loss of power or steering, fire and explosion, bomb threat, and oil spill. According to section A.1.1, “only collision carries a significant potential of passenger injury.” Section A.1.2.1 identified the bridge team as the most important element in preventing collisions and assuring safe vessel operation, with the Coast Guard’s VTS as the next most important element. On August 7, 2000, the Commanding Officer of Coast Guard Activities New York informed George G. Sharp by letter that its safety assessment provided the ferries “a satisfactory alternative to the installation of primary lifesaving gear” that was required under the new regulations. The letter added, however, that final approval of the substitution of “risk-reducing features” for lifesaving gear would “be determined after reviewing crew training and witnessing safety drills.” An amended version of the Sharp safety assessment received final approval on March 30, 2004. It was much longer than the original version (250 pages, largely unnumbered, versus the original’s 38 pages) and contained a shipboard safety management and contingency plan for each of the three vessel classes (not, however, as stand-alone documents). A crew safety training manual had been added, including information about emergency signals, basic firefighting, lifesaving equipment, and basic first aid. Training materials for supervisors dealing with drug and alcohol testing had also been added. The risk assessment section had been augmented with a risk matrix that considered the following accident scenarios: fire, collision/allision, grounding, security threat, and loss of power or propulsion. All scenarios were rated as having a low risk of requiring vessel evacuation. Inspections. Coast Guard safety oversight was limited to inspections of the ferries’ hulls, establishing and overseeing crew medical standards and licensing of ferry operating personnel, and enforcing rules of the road and environmental regulations. The Coast Guard inspected each vessel quarterly and conducted more in-depth inspections of the vessels annually. 50 U.S. Coast Guard, “Shipboard Management and Contingency Plans for Passenger Vessels,” NVIC 1-97 (Washington, DC: U.S. Department of Transportation, 1997). 51 George G. Sharp, Inc., “New York City Ferry Safety Assessment,” prepared for NYC DOT, June 2000.

Factual Information 41 Marine Accident Report As stated at 46 CFR 71.25-10, annual Coast Guard vessel inspections entail the following: The annual inspection shall include an inspection of the structure, boilers, and other pressure vessels, machinery and equipment. The inspection shall be such as to insure that the vessel, as regards the structure, boilers and other pressure vessels, and their appurtenances, piping, main and auxiliary machinery, electrical installations, life-saving appliances, fire-detecting and extinguishing equipment, pilot boarding equipment, and other equipment is in satisfactory condition and fit for the service for which it is intended, and that it complies with the applicable regulations for such vessels, and determine that the vessel is in possession of a valid certificate issued by the Federal Communications Commission, if required. The lights, means of making sound signals, and distress signals carried by the vessel shall also be subject to the above-mentioned inspection for the purpose of ensuring that they comply with the requirements of the applicable statutes and regulations. Coast Guard rules that apply to international passenger vessels call for a comprehensive safety management system under SOLAS. (For details, see “Safety Management Systems,” below.) Because the Staten Island Ferry operated in domestic service, it was exempt from the SOLAS requirement. As a result, the Coast Guard did not refer to or assess the quality of the NYC DOT’s operating procedures. After the September 11, 2001, attacks on the United States, the Coast Guard, in its capacity as the Federal agency overseeing the security of U.S. waterways,52 required numerous changes to Staten Island Ferry operations to increase the level of both vessel and port security. The director or ferry operations worked closely with the Coast Guard to upgrade security on the ferries. Among the changes, car ferries were not allowed to carry vehicles and police officers were posted to each ferry while under way. Medical Oversight of Mariners The NYC DOT had no independent medical standards for ferry operators. Coast Guard standards governing medical evaluations and Coast Guard–maintained medical records were the only medical standards and medical record-keeping system that applied to ferry operators. The NYC DOT did, however, track the number of absences of individual employees to ensure that the absences were within the number permitted by established NYC DOT policy. When employees exceeded the limits, they were required to present physicians’ notes explaining the reason for their absence. Mariners holding Coast Guard licenses are required to undergo a physical examination once every 5 years, or when their licenses are upgraded, to determine that they are in sound health and have no physical limitations that would hinder or prevent performance of duties. A licensed physician, physician assistant, or nurse practitioner can perform the Coast Guard-required examination for license holders, as indicated on form 52 The Coast Guard retained this responsibility after its transfer to the Department of Homeland Security, although some aspects of its security oversight were assigned to the Transportation Security Administration.

Factual Information 42 Marine Accident Report 719K. Mariners then submit proof of their fitness to the Coast Guard, according to regulations at 46 CFR 10.209(d) or (e). Form 719K provides information to the examining health practitioner on the medical evaluation and on general duties required of licensed mariners. The Coast Guard requires mariners with pilot endorsements, which includes captains and assistant captains on the Staten Island Ferry, to be examined annually (46 CFR 10.709). Form 719K does not apply to the annual pilot medical evaluation, and the regulations and other published material do not provide additional information on the medical evaluation or the documentation necessary after the evaluation is completed. Mariners with pilot endorsements do not have to submit proof of their medical examinations outside the 5-year or license-upgrade interval. The regulations require pilots to possess such proof, however, and make it available to Coast Guard personnel on demand (46 CFR 10.709[e]).53 Neither Coast Guard Activities New York nor representatives of the Coast Guard’s New York regional examination center (REC), the office responsible for overseeing and approving mariner licensing in the New York area, requested proof of compliance with the annual medical evaluation requirement from either the captain or the assistant captain of the Andrew J. Barberi. Coast Guard personnel also did not ask any Staten Island Ferry captain or assistant captain for such proof in the 12 months before the accident. The Safety Board was unable to establish that the Coast Guard enforced compliance by ferry operating personnel with the annual examination requirement in that interval or at any other time. Medical standards differ according to the general assignment of applicants (deck or engineering). For example, deck officers are required to have vision correctable to 20/40 in each eye, engineering officers to 20/50 in each eye. After completing the examination, the health practitioner signs Coast Guard form 719K and indicates whether the applicant is considered medically qualified. (The Coast Guard makes the final determination of a mariner’s qualifications.) Other forms may be used, provided that the examination is carried out in accordance with the standards listed in form 719K. At the end of the examination, the examiner provides the applicant with form 719K or, if warranted, with a certificate that the applicant is in good health and otherwise meets the physical requirements at 46 CFR 10.209(d) or 12.02-27(d). Applicants can choose whether to submit the evaluation results to the Coast Guard. 53 “Upon request, a first class pilot shall provide the Coast Guard with a copy of his or her most recent physical examination.”

Factual Information 43 Marine Accident Report In January 2002, the Coast Guard revised form 719K. Four and a half years earlier, on June 26, 1997, as a result of its investigation of the grounding of the passenger vessel Star Princess north of Juneau, Alaska,54 the Safety Board had issued the following Safety Recommendation to the Coast Guard: M-97-42 Review, in consultation with experts in occupational health, your medical standards, guidelines, and examination forms to ensure that they require the disclosure and appropriate evaluation of the history or presence of any medical conditions, symptoms, or medication use that would affect an individual’s fitness to pilot a vessel. According to the commander of the Coast Guard’s National Maritime Center, physicians experienced in the physical evaluation of mariners provided guidance for the revisions published in 2002. The revised form explains a mariner’s duties and contains a section where applicants and physicians are to list all medications being taken, dosages, possible side effects, and relevant medical conditions. The form includes a medical history section and requires a signed statement by the physician as to whether the applicant is competent, not competent, or in need of further review. The applicant certifies that the information is complete and true. In light of these revisions, on February 3, 2003, the Safety Board classified Safety Recommendation M-97-42 as “Closed—Acceptable Action.” Before it revised the evaluation form, the Coast Guard published NVIC No. 2-98,55 “Physical Evaluation Guidelines for Merchant Mariner’s Documents and Licenses,” which is available from any Coast Guard REC, the Coast Guard’s Washington, D.C., headquarters, or from the Coast Guard website. The 10-page document describes general physical demands that mariners may be expected to meet, and provides guidance to physicians and applicants on mariner medical qualifications. The NVIC’s list of “Potentially Disqualifying Conditions” includes impaired vision (uncorrected vision worse than 20/800), impaired color vision, or impaired hearing; poorly controlled diabetes; lung disease such as chronic or active asthma or tuberculosis; chronic/recurrent pancreatitis; chronic renal failure; multiple or recent myocardial infarctions; psychiatric disorders such as psychosis, suicidal behavior, drug or alcohol addiction; convulsive disorders; conditions that seriously limit balance such as Parkinson’s disease; narcolepsy; somnambulism; infectious diseases; and medications such as anticoagulants or psychotropics; or “any other disease, constitutional defect, medication (side effects), sleep disorders or therapy which would result in gradual deterioration of performance of duties, sudden incapacitation or otherwise compromise shipboard safety, including required response in an emergency situation.” In short, any condition that poses a risk of incapacitation or debilitating complication, and any condition requiring medication that 54 Grounding of the Liberian Passenger Ship Star Princess on Poundstone Rock, Lynn Canal, Alaska, June 23, 1995, Marine Accident Report NTSB/MAR-97/02 (Washington, DC: National Transportation Safety Board, 1997). 55 Also listed in Coast Guard references as COMDTPUB.P16700.4.

Factual Information 44 Marine Accident Report impairs judgment or reaction time, is potentially disqualifying and requires a detailed evaluation before the mariner will be considered fit to qualify for a license. Mariners who develop disqualifying physical conditions before their next scheduled physical examinations are not required to inform the Coast Guard. However, if the Coast Guard becomes aware that a licensed mariner has developed a disqualifying physical condition, it would investigate the situation and possibly begin suspension and revocation proceedings. The Coast Guard has no formal mechanism that allows physicians or other interested persons to notify them of a mariner who has a disqualifying physical condition. Because of the manner in which data from medical evaluations are maintained, the Coast Guard cannot examine trends in form 719K results. Limitations in the data storage system prevent the Coast Guard from categorizing the results to determine trends in the findings of examining physicians, the number of applications completed by a single health practitioner, or the percentage of applicants found physically qualified by individual health practitioners. In addition, the Coast Guard does not compare the results of reviews by its own RECs to determine the extent of commonalities or differences in the review process. Coast Guard personnel engaged in the review of mariner medical evaluations indicated to Safety Board investigators that the RECs may not be consistent in their approval or denial decisions for identical medication use. Applicants who choose to provide the results of the examinations to the Coast Guard send them to the nearest REC. There, evaluators review the results of the completed evaluations according to policy, regulations, and guidance published in the Coast Guard’s Marine Safety Manual and in NVIC No. 2-98. According to personnel at the National Maritime Center, after receiving the results of the medical evaluations, REC evaluators place the results into one of three categories, in which applicants are found to be (1) physically qualified—a medical approval would thus be granted, (2) not qualified— approval would thus be denied, or (3) not qualified but by a “very minor” disqualifying factor. Applicants with “very minor” disqualifying conditions may be granted waivers after demonstrating that they can perform the job safely. Personnel at the National Maritime Center said that REC examiners would forward applications from mariners with “very minor” disqualifying conditions to the National Maritime Center, with the recommendation that a waiver be granted. Examiners at the National Maritime Center would then further review the application and, if still uncertain, would forward the application to one of two medical officers, who would make the final determinations. Of the 50,000 to 60,000 applications that the Coast Guard is estimated to receive annually, National Maritime Center personnel estimated that 1,200 to 1,400 are sent to the center for further review. The Coast Guard keeps no central record of the number of applications that are denied. National Maritime Center personnel informed the Safety Board that the Coast Guard plans to centralize the medical evaluation process, with a hoped-for date of 2007 to implement the change. The Coast Guard retained two physicians, both permanently employed by the Public Health Service but assigned to the Coast Guard’s National Maritime Center, to

Factual Information 45 Marine Accident Report make the final determination regarding the approval of a mariner’s physical condition. The physician in charge of these determinations was the Coast Guard personnel command senior medical officer. The senior medical officer told Safety Board investigators that he had no formal training in occupational medicine.56 He stated that if he had questions regarding whether to grant a waiver for a mariner, he relied on the mariner’s health care provider for guidance. If the health care provider considered the condition not debilitating and one with which the mariner was able to perform his or her job, he would grant the waiver. The senior medical officer said that he would almost always follow the guidance of the examining or treating physician. The Coast Guard does not maintain a list of prohibited medications. REC examiners referred to the PDR for guidance when considering medication use. In general, however, as long as the treating physician believed that the medication was controlling the condition without side effects, the senior medical officer indicated that the Coast Guard would grant a waiver. The senior medical officer considered the use of certain medications to be disqualifying. For example, medications for sleep such as Ambien® or Sonata® were disqualifying because a mariner taking these pharmaceuticals might not be able to function if performing nighttime duty. Similarly, use of any kind of narcotic would disqualify a mariner because of the likelihood of drowsiness. The senior medical officer said that he would send the request of an applicant who had been using the pain reliever tramadol back to the treating physician to determine whether the applicant was drowsy as a result of the medication. Unless such information was provided, or unless he had information from his employer or others that they observed the person in a drowsy state, he told Safety Board investigators that he would grant the waiver because, in his opinion, it would be very difficult to assess a potential risk of sudden incapacitation due to medication such as tramadol. Two weeks after Safety Board investigators met with the personnel command senior medical officer and others at the National Maritime Center, its commanding officer wrote to inform the Safety Board that the senior medical officer “misspoke at the meeting and asked to clarify his statement.” The commanding officer stated that the physician said: When I was asked at the NTSB Inquiry about a waiver possibility for Tramadol, I was under the mistaken opinion that Tramadol was not a narcotic. Since the meeting, I have checked the PDR . . . and realized that it is a narcotic. If possible, you may want to inform the board attendees that I was mistaken and had responded too quickly to their question. You might also add that I do refer to the PDR when a mariner is on a medication with which I am unfamiliar. Coast Guard personnel informed the Safety Board that the Coast Guard was planning, in the near future, to revise the medical standards that mariners would be required to meet. As of the date of this report, the Coast Guard had not yet issued proposed revisions to its medical standards for licensing mariners. 56 Training in occupational medicine can range from a multiweek course to residency and board certification.

Factual Information 46 Marine Accident Report Safety Management Systems A safety management system is a structured, documented system developed to enhance the safe operation of vessels, prevent human injury or loss of life, and avoid damage to the environment. With a safety management system, ship owners and operators are encouraged to resolve safety problems before casualties or incidents occur (“self- regulate”), rather than simply comply with regulations imposed from outside, which usually means waiting for notification of defects before taking corrective action. Background. International safety management standards were developed in the early 1990s in response to a number of serious marine casualties whose cause was identified as human error or management failure and that occurred despite improvements in engineering and technology designed to prevent them. One of the most serious was the March 1987 capsizing of the passenger/car ferry Herald of Free Enterprise off the Belgian coast, which killed 193 people. The investigating British justice described the ferry management’s failures as “the disease of sloppiness.”57 In the aftermath of that disaster, the International Maritime Organization (IMO), a specialized agency of the United Nations, began developing guidelines for safe ship management, focusing at first on roll-on, roll-off ferries such as the Herald of Free Enterprise. In May 1991, work began on what became the International Safety Management (ISM) code,58 whose stated purpose is “to provide an international standard for the safe management and operation of ships and for pollution prevention.” In 1993, the IMO decided to make the ISM code mandatory, and in May 1994, IMO members, including the United States, adopted the ISM code as chapter 9 of SOLAS. Chapter 9 of SOLAS went into force on July 1, 1998. On that date, the ISM code became mandatory for the following vessels on international voyages: passenger ships, high-speed craft (passenger and cargo) of 500 gross tons or more, tankers, and cargo carriers. For other cargo ships, the code came into force on July 1, 2002. U.S. Regulations. The ISM code has the force of law in countries that are signatories to SOLAS. In October 1996, Congress revised 46 U.S.C. chapter 32 (“Management of Vessels”) to incorporate the ISM code into the laws of the United States. In May 1997, the Coast Guard published a Notice of Proposed Rulemaking setting out Federal regulations for safety management systems for U.S. vessels “engaged on a foreign voyage.”59 The proposed regulations included standards that would allow companies to satisfy international certification requirements for safety management systems and also to seek voluntary certification of safety management systems for U.S. domestic vessels. On December 24, 1997, the Coast Guard issued final regulations for implementing the ISM code (33 CFR 96, “Rules for the Safe Operation of Vessels and Safety Management Systems”); the final rule became effective on January 23, 1998. 57 Department of Transport (United Kingdom), MV Herald of Free Enterprise, Report of Court No. 8074—Formal Investigation, Hon. Mr. Justice Sheen, Wreck Commissioner (London: Her Majesty's Stationery Office, 1987). 58 The full name of the code is International Management Code for the Safe Operation of Ships and for Pollution Prevention. 59 Federal Register, vol. 62, no. 84 (May 1, 1997), p. 23705.

Factual Information 47 Marine Accident Report Objectives. The objectives of a safety management system, as given in 33 CFR 96.230, are as follows: (a) Provide for safe practices in vessel operation and a safe working environment onboard the type of vessel the system is developed for. (b) Establish and implement safeguards against all identified risks. (c) Establish and implement actions to continuously improve safety management skills of personnel ashore and aboard vessels, including preparation for emergencies related to both safety and environmental protection. (d) Ensure compliance with mandatory rules and regulations. Main Elements. A safety management system aims to create a “culture of safety” throughout an organization by documenting a vessel owner’s operational policy, chain of authority, and operational and emergency procedures; specifying the responsibilities of the owner or operator, managers, and masters; and outlining procedures for management review, internal audits, and correction of nonconformities (failure to adhere to procedures or regulations). Procedures are compiled in a safety management manual and a copy is kept on board the vessel. A person or persons are designated in writing to monitor the safety management system, and managers conduct regular audits to ensure that employees follow the procedures. Checklists are supplied for critical areas. When deficiencies are noted or an accident or a nonconformity occurs, corrective action is taken until the problem is resolved, and the problem is documented from start to finish. Application. The Federal regulations for safety management systems apply to U.S. vessels “engaged on a foreign voyage” that carry more than 12 passengers or that are tankers, bulk freight vessels, or mobile offshore drilling units of 500 gross tons or more (33 CFR 96.210). The regulations do not apply to barges, recreational vessels not engaged in commercial service, fishing vessels, vessels operating only on the Great Lakes or its tributary and connecting waters, or public vessels. The Staten Island Ferry was not required to comply with the regulations because it operates on a strictly domestic route. Requirements. Operators whose vessels fall under the Federal regulations must prepare internal audit reports that demonstrate compliance with the ISM code (33 CFR 96 subpart B). They must also hold a valid Document of Compliance certificate and a Safety Management Certificate as evidence of compliance with the ISM code (33 CFR 96 subpart C). Organizations can be authorized by the Coast Guard to act on behalf of the United States to perform safety management audits and certification (33 CFR 96 subpart D). A complete list of documents required for a safety management system under the Federal regulations is found at 33 CFR 96.250. Briefly, they include the following: (a) Safety and environmental impact statements, which are to be carried out and kept current at all levels. (b) Statements of responsibilities and authority. (c) Designation in writing of a person or persons to monitor the safety management system.

Factual Information 48 Marine Accident Report (d) Written statements defining the master’s responsibilities and authorities. (e) Written statements that the master has overriding responsibility and authority to make vessel decisions. (f) Personnel procedures and resources available on shore and on board ship. (g) Vessel safety and pollution prevention operation plans and instructions for key shipboard operations. (h) Emergency preparedness procedures. (i) Reporting procedures on required actions. (j) Vessel maintenance procedures. (k) Safety management system document and data maintenance. (l) Safety management system internal audits that verify the vessel’s safety and pollution prevention activities. Audit Procedures. The ISM code requires companies to demonstrate how safety is managed on shore and on its vessels, through both internal and external audits. Internal audits allow companies to measure the effectiveness of their own systems. Companies prepare their own internal procedures for auditing their safety management systems, setting out the objectives, scope, and responsibilities involved. They develop an audit schedule that specifies which ships and office locations to audit and target dates for carrying out and completing the audits. Reporting lines are clearly defined and reports are distributed to all relevant personnel.60 External audits are performed at the request of the operating organization by an approved outside organization, usually a marine classification society, for a fee paid to the auditor by the requestor organization. The external auditor reviews the results of the operating organization’s internal audits and all elements of its management system. The auditor questions management and vessel crews about their knowledge of the system, examines safety records, and verifies that procedures are followed. It may take an entire day to audit one vessel. If the audit is successful, a Safety Management Certificate is issued and the ship can continue operations. If critical areas have deficiencies, a vessel operator can lose its Document of Compliance. Voluntary Compliance. Under 33 CFR 96.110(b), vessel operators that are not required to comply with the ISM code can voluntarily meet the standards and have their safety management systems certificated. Guidance for voluntary compliance is provided in Coast Guard NVIC 5-99.61 As stated in the NVIC, “33 CFR 96 is the basis for the requirements of a voluntary safety management system.” However, as outlined in the 60 For further information, see Guidelines on the Application of the IMO International Safety Management (ISM) Code, 3rd ed. (London: International Chamber of Shipping and International Shipping Federation, 1996), pp. 34-51. 61 U.S. Coast Guard, “Guidance Regarding Voluntary Compliance with the International Management Code for the Safe Operation of Ships and for Pollution Prevention (International Safety Management [ISM] Code),” NVIC 5-99 (Washington, DC: U.S. Department of Transportation, 1999).

Factual Information 49 Marine Accident Report Coast Guard’s Marine Safety Manual, an equivalent to ISM code compliance has been established for small passenger vessels, certificated under 46 CFR subchapter T, for which full accordance with 33 CFR 96 would be “too extensive.”62 The Coast Guard has prepared guidance documents (booklet and computer disc) for use in developing equivalent safety management systems. Vessel operators must apply in writing to participate in the equivalent safety management program. Conclusion. The Coast Guard concluded from its casualty studies that “in excess of 80 percent of all high consequence marine casualties may be directly or indirectly attributable to the ‘human element.’” The Coast Guard stated that “the use of safety management systems by all U.S. commercial vessels would result in significant benefits and we will support the development of such programs.” However, it also noted that “46 U.S.C. 3202 . . . does not provide the Coast Guard with the authority to require such safety management systems on these U.S. domestic vessels.”63 Other Ferry Systems Nationwide. According to the National Ferry Database, ferry systems operate in 40 of the 50 States, plus Puerto Rico, the Virgin Islands, and the Northern Mariana Islands.64 The American Public Transportation Association (APTA) counts about 30 metropolitan areas and small cities in the United States that offer transit ferry service across rivers or bays or to offshore islands, where bridges or other modes of transportation are nonexistent or impractical.65 In Alaska, ferries operated as part of the Alaska Marine Highway System connect areas along 8,000 miles of coastline that are not linked by roads. Some of the ferries are privately owned, some publicly owned, and some represent public/private partnerships—usually, a public transit authority contracting with a private company that owns and operates the vessels. The vessels include vehicle ferries, which carry both vehicles and passengers; passenger-only ferries, which may carry bicycles in addition to pedestrians; and water taxis, which are very small passenger-only ferries that operate on fixed routes or provide on-demand service. APTA statistics show that ferries operated by 42 transportation agencies carried nearly 58 million passengers in 2002, with an average trip length of 5.8 miles and total passenger miles of 333 million. According to APTA, the largest number of ferry operators are found in New York/New Jersey, San Francisco Bay, and the Boston area. In the San Francisco area, voters have approved funding for a major ferry expansion that, it is hoped, 62 U.S. Coast Guard, Marine Safety Manual, vol. II, section E, chapter 3, “Safety Management Systems (SMS)” (revised May 2000), pp. E3-13–E3-15. 63 The Coast Guard published these statements in its discussion of the final rule for 33 CFR 96 (Federal Register, vol. 62, no. 247 [December 24, 1997], pp. 67492 and 67503). 64 National Ferry Database, U.S. Department of Transportation, Bureau of Transportation Statistics http://www.transtats.bts.gov/Tables. The database lists 224 ferry operators, including those that operate small ferries, many cable-operated, that carry 4 to 6 cars or farm equipment across rivers or canals on backroads not served by bridges. 65 Information obtained from APTA website http://www.apta.com/research/stats/ferry/fbagency/cfm (accessed December 12, 2004).

Factual Information 50 Marine Accident Report will relieve traffic congestion on bridges and highways. By 2025, the San Francisco Bay Water Transit Authority plans to triple annual ferry ridership to 12 million, adding 31 new ferryboats and 7 new ferry routes.66 As shown in table 2, annual ferry ridership exceeds 1 million in five urban areas of the country, with the largest ferry operation being the Washington State Ferries. Table 2. Largest U.S. urban ferry operations (annual ridership over 1 million). SOURCE: APTA website http://www.apta.com/research/stats/ferry/fbridership; also, for Seattle http://www.wsdot.wa.gov/ferries; San Francisco , personal communication, San Francisco Bay Area Water Authority; New Orleans http://www.dotd.state.la.us; Boston http://www.bostonharborcruises.com, http://www.harborexpress.com, personal communication, Massachusetts Bay Transportation Authority, Boston Harbor Cruises. a San Francisco Bay Area Water Transit Authority, charged with expanding transportation service, has no authority over existing commuter ferry operations: city of Alameda/Port of Oakland, city of Vallejo Baylink Ferry, Blue and Gold Fleet, and Golden Gate Bridge, Highway and Transportation District. Washington State Ferries. The largest ferry system in the United States, in terms both of ridership and vessel size, is the Washington State Ferries, owned and operated by the Washington State Department of Transportation. The ferries carry over 26 million passengers a year across Puget Sound and its inland waterways, serving eight counties in Washington State and in British Columbia, Canada. One of the largest vessels in the Washington fleet, the Wenatchee in the Jumbo Mark II class, is 450 feet long and carries 2,500 passengers on 35-minute commuter runs in the harbor between Seattle and Bainbridge Island, Washington. The ferry system has over 1,800 employees, 20 terminals, and 29 vessels of various sizes. All but one of the routes carries cars. The ferries charge fares for passengers and cars. 66 http://www.watertransit.org/about_us.shtml (accessed December 30, 2004). Transit Authority/Operator Area Served Annual Ridership (million) Number Vessels Maximum Vessel Capacity (passengers) Waterway Primary City Washington State Ferries Puget Sound Seattle 26 29 2,500 Staten Island Ferry New York Harbor New York City 19 7 6,000 (a) San Francisco Bay San Francisco 4 14 788 Louisiana Department of Transportation, Crescent City Connection Division Lower Mississippi River New Orleans 3.1 5 1,000 Massachusetts Bay Transportation Authority (Harbor Express and Boston Harbor Cruises) Boston Harbor Boston 1.3 11 400

Factual Information 51 Marine Accident Report All mariners employed by the Washington State Ferries are documented by the Coast Guard. Deck officers all have pilotage endorsements for Puget Sound and crews receive basic safety training, including advanced firefighting. The ferry management uses a comprehensive computer system that tracks employee qualifications and ensures that certificates are up to date. Deck officers, for example, receive letters 90, 60, and 30 days in advance of the due date for their required annual physicals. Washington State Ferries operate under a comprehensive safety management system that specifies procedures for the entire fleet, for each particular vessel, and for each route (appendix D reproduces the tables of contents for the various safety management system manuals). The procedures include bridge manning and approach speeds to the dock. For example, on the Wenatchee run, the ferry is required to slow 0.7 mile from the terminal and the quartermaster is required to steer until 0.3 mile from the dock, when either the captain or the chief mate takes manual control. At the terminal, the second mate, bosun, and able-bodied seaman attend to the discharge of vehicles and loading of vehicles and passengers. Time at the terminal is about 15 minutes, and after the gates close, a strict sequence of commands begins. Once under way, the second mate plays a recorded safety briefing for passengers. New radar equipment is installed on the Washington State Ferries every 5 years. The newest radars have AIS technology integrated into the display. The ferries have a 24- hour communication system that is always manned. Ships are tracked by means of AIS every 3 minutes and monitor a single VHF frequency. Management is exploring a new vessel-tracking system that will capture AIS data from all nearby traffic, and is also investigating a wireless radio network and a computerized intranet that could be used in conjunction with the safety management system. British Columbia Ferries. The British Columbia Ferries of Canada is one of the largest ferry services in the world, with 25 routes, 35 ships, 47 terminals, and 4,500 employees. All vessels in the fleet carry both passengers and cars, transporting 21 million passengers and 8 million vehicles a year. The ferries make over 500 runs a day. The two largest vessels, the Spirit of Vancouver Island and the Spirit of British Columbia, can carry 2,100 passengers and crew and 470 cars. The fleet includes eight other vessels with a capacity of between 1,000 and 1,700 passengers and crew. Most of the large vessels have runs that last nearly 2 hours. British Columbia Ferries have served British Columbia’s coastal communities for 44 years. In 2003, the company converted from a Crown corporation (corporation owned by the government) to an independent, regulated company, which in 2004 announced a long-term plan to introduce 22 new vessels over the next 15 years. British Columbia Ferries began implementing a safety management system in 1995 after an accident in Departure Bay that resulted in passenger fatalities. The safety management system, which is not mandatory because the ferries run inside Canadian waters, includes a bridge watch table that specifies the number of persons in the pilothouse for various vessels, routes, and conditions (see appendix E for a sample procedure). Specific procedures for arrival and departure are detailed, even stipulating the precise words to be used in radio transmissions.

Factual Information 52 Marine Accident Report Two of the largest British Columbia ferries are now equipped with electronic chart systems, and the ferries are considering a 24-hour communication center like that of the Washington State Ferries. For emergency medical care on board, the ships have a full emergency kit with a trauma kit, drugs, and defibrillator. On some longer runs in remote areas, a doctor or paramedic is carried on board. Passenger Vessel Association The Passenger Vessel Association (PVA) is an association of small passenger vessel owners and operators in the United States. The organization serves the interests of more than 350 vessel owners and operators in the domestic passenger vessel industry, which represents about 65 percent of the industry nationwide. Association members operate more than 1,100 passenger vessels in the United States carrying up to 200 million passengers annually. Members offer services including dinner cruises, tour and excursion services, car and passenger ferries, private charters, whale-watching trips, overnight cruises, and riverboat gaming. According to the National Ferry Database, about 45 ferry companies across the United States are PVA members. The PVA has a committee responsible for reviewing, developing, and implementing programs to encourage enhanced training and safety among its members. The programs are designed to improve the loss record for the industry. The PVA publishes risk management and training manuals to help its member companies improve the safety of their passenger vessel operations. Actions Since Accident After the Andrew J. Barberi accident, the NYC DOT requested the Global Maritime and Transportation School (GMATS) at the U.S. Merchant Marine Academy to conduct an assessment of the Staten Island Ferry with respect to vessel operations, human factors, safety, and management. The GMATS assessment was completed in February 2004 (appendix F). Among its recommendations, the assessment called for the establishment of a safety management system; standard manning with three licensed deck officers, so as to provide certainty that two licensed deck officers would be in the pilothouse at all times; significant increases in personnel; greater emphasis on technical training and professional development; the creation of specific operating procedures; the use of technology to assist in navigation; and an immediate upgrade in the system’s ability to respond to emergency conditions or mass casualty events. Staten Island Ferry officials informed the Safety Board by letter on July 9, 2004, that they had changed or planned to change various aspects of the ferry operations. According to the letter, “most of [the planned improvements] revolve around the establishment of a Safety Management System.” At the time, officials estimated that it might take 2 years to develop and implement such a system. The system would address “all aspects of vessel operations, safety and emergency response, and maintenance.” Improvements already implemented were listed as installation of global positioning system (GPS) units, ARPA collision avoidance equipment, and automated

Factual Information 53 Marine Accident Report passenger announcement systems. Training programs had been established for the new equipment, according to the letter. Further, new procedures designated specific stations and responsibilities for crewmembers, both while under way and while docked. Ferry management was reportedly reviewing scheduling and medical response capabilities. Rest periods had been established for deckhands and crewmembers had been issued walkie- talkies and uniforms. In an update received on February 11, 2005, the NYC DOT informed the Safety Board that it intends to follow the GMATS recommendations.67 According to its letter, the agency has embarked on “an aggressive hiring program,” has installed safety equipment on ferries, and has retained a firm to develop its safety management system. The NYC DOT further stated that it has already revised manuals and that new policies and checklists have been drafted, with some already in place. Currently, October 1, 2005, is set as the date for completion of the safety management system, with a target of December 2005 for receiving a Document of Compliance from the American Bureau of Shipping. Bridge team procedures already stipulate the use of three licensed officers, with two in the pilothouse at all times. All ferries are now equipped with GPS, ARPA, and AIS capabilities. 67 Discussions between the Safety Board and NYC DOT personnel indicate that certain of the automated equipment recommended by GMATS actually requires manual activation, including the prerecorded passenger announcements (already installed) and the “vessel speed indicators with alarm functions” (planned for installation).

54 Marine Accident Report Analysis General The analysis first identifies factors that can be readily eliminated as causal or contributory to the Andrew J. Barberi accident. It then discusses what the Safety Board’s investigation revealed about the actions of the assistant captain and the captain, NYC DOT oversight of ferry operations, medical oversight of mariners, safety management systems, and the potential contribution of navigation technology to the safety of ferry operations. Exclusions The evidence indicates that the Andrew J. Barberi’s propulsion systems, propulsion system controls, and main engines functioned without defect before, during, and after the accident. The assistant engineer on watch during the accident stated that the vessel’s two propulsion drives and related controls performed without fault and that he had a “very normal watch” before the accident. No plant alarms sounded to indicate a propulsion problem before the allision. After the accident, the captain had complete control of the propulsion system in maneuvering the vessel to slip 5, and the propulsion system effectively held the vessel tight against the dock there for an hour or more. Further, the transfer of control from pilothouse to pilothouse was carried out without incident, and the Safety Board’s postaccident testing found that the ferry’s propulsion systems responded correctly to commands from both pilothouses. National Ocean Service data for the New York/New Jersey harbor indicate that the tide was ebbing, and according to the National Weather Service, visibility was at least 10 miles in the area. The wind was strong—nearby winds were from the west, measured at 20 knots with gusts of up to 35 knots. Nonetheless, the wind velocity had no adverse effect on the ship’s handling ability or on the ability of the ship’s operators, both the captain and assistant captain, to control it. According to the senior mate in the pilothouse, he heard “no complaints” from either operator about the wind affecting control of the ferry. Except for the assistant captain, the ferry’s crew submitted blood and urine specimens to the Coast Guard and to the NYPD for toxicological testing shortly after the accident. The Safety Board obtained a blood and a urine sample taken from the assistant captain when he was admitted to the hospital about an hour and a half after the accident. Results for all Andrew J. Barberi crewmembers were negative for both alcohol and the five illicit drugs that U.S. Department of Transportation regulations require screening for. Therefore, the Safety Board concludes that none of the following were factors in the accident: the vessel’s propulsion systems, environmental conditions, alcohol, or illicit drugs.

Analysis 55 Marine Accident Report Accident The vessel departed Manhattan at 1500 and struck the pier about 1520. According to both crewmembers and passengers, the ferry was operating at full speed when it allided with the maintenance pier. Witnesses stated that the vessel never slowed down or altered direction, and that the engine sound changes that crewmen and regular passengers routinely heard when the engines slowed down before docking were not heard. The chief engineer stated that the pitch was at 100 percent at both ends of the vessel and never changed before the ferry hit the pier. The Safety Board, therefore, concludes that the Andrew J. Barberi was operating at full speed when it struck the maintenance pier. According to the lookout and the senior mate, the lookout and the assistant captain were in the Staten Island–end pilothouse when the senior mate joined them halfway through the transit. Both the lookout and the senior mate reported that the assistant captain had been conversing with the lookout during the transit until just before the ferry reached the KV buoy, when the lookout left the pilothouse and while the mate was reading a newspaper. The mate told investigators that the captain entered the pilothouse after the accident. Neither the lookout nor the senior mate recalled seeing the captain in the pilothouse before that, from the time the ferry left Manhattan until after the accident. From the circumstances of the accident and the statements of the crew and other witnesses, the evidence indicates that the captain was not in the pilothouse until after the allision. Therefore, the Safety Board concludes that at the time of the accident, the assistant captain was at the controls, the senior mate was seated in the aftmost section of the pilothouse reading a newspaper, and no one else was in the pilothouse at the ferry’s Staten Island end. The evidence is clear that the assistant captain made no changes before the impact to slow or change the ferry’s course for the approach to the terminal, as he should have done near the KV buoy. Immediately after the accident, he told the chief engineer that he had “blacked out” and then told the ferry director that he had “passed out.” His postaccident medical records noted that he told hospital physicians that he “suddenly passed out,” although the records also indicated that he had no recollection of the events surrounding the allision. In addition, he told physicians that he was “exhausted,” though “no more exhausted than usual” at the time of the accident. According to the senior mate, immediately after the impact he observed the assistant captain standing, making an exclamation, and actively manipulating the controls to maneuver the vessel away from the dock. In the estimated 1- to 2-minute period after the ferry passed the KV buoy, when speed and course should have been changed, visual cues to the impending allision would have been unmistakable. The assistant captain would have needed no information other than the increasing proximity of the maintenance pier to tell him what he needed to do to avoid the accident. The mate’s description of the assistant captain as standing and alert immediately after the impact indicates that the assistant captain was conscious at that time. Had he lost consciousness, he most likely would have fallen. Even though he was aft in the pilothouse reading, the senior mate would most likely have noticed such a fall because people perceive a change, such as someone falling, more readily than they do the absence of change. Therefore, the Safety Board concludes

Analysis 56 Marine Accident Report that the assistant captain was apparently upright but unresponsive to his surroundings and the visual cues of the impending allision for an estimated 1 to 2 minutes before the accident. The distance between Manhattan and the Staten Island pier is 5.2 miles (9,152 yards). At the vessel’s normal crossing speed of between 14 and 16 knots, the ship would travel roughly a quarter of a mile (440 yards) in 1 minute. The normal length of a transit is about 21 minutes and the accident voyage lasted approximately 20 minutes, an elapsed time that was within the routine range for the transit. According to what they told investigators, mates and deckhands typically prepared for docking at Staten Island on hearing the sounds associated with the engines slowing down, which generally occurred near the KV buoy, about 1,000 yards from the dock. Although one of the deckhands would ordinarily have made an arrival announcement, on the accident voyage no crew announcement was made. Passengers and crew typically recognized the impending docking by the changes in the sounds associated with the engines. In the absence of the engine sound changes and a prearrival announcement, only one crewmember recognized the projected path of the vessel. Thus, only one deckhand warned passengers of the impending allision. The other crewmembers were unaware of the impending allision and took no action to warn either passengers or other crew or to prepare them for the accident. Therefore, the Safety Board concludes that the crew did not recognize that the ferry was in danger because of the absence of changes in sounds that they typically used as cues for arrival, because they were not attending to visual cues outside the vessel, and because of the absence of any crew announcement or alert. Assistant Captain The Safety Board examined the nature of the assistant captain’s unresponsiveness to clear visual cues that the vessel was about to crash in an attempt to determine why he failed to prevent the allision, given his consistent, superior employment history with the NYC DOT. Although he did not agree to cooperate with the Safety Board, the Board obtained considerable information about his work history because his wife agreed to be interviewed, his daughter provided the Board with information, and coworkers and supervisors gave information about his work habits and history. In addition, the Board examined pertinent NYC DOT personnel records and medical, dental, and pharmaceutical records. The Safety Board sought to determine whether a medical or behavioral explanation could account for the assistant captain’s episode of unresponsiveness on the day of the accident, in light of the absence of any similar documented episode in his years with the NYC DOT. The senior mate, the only person present during the period of the assistant captain’s unresponsiveness, told the Safety Board that when he looked up immediately after the allision, the assistant captain was standing at the controls. The lookout who had left the pilothouse near the KV buoy described the assistant captain as fully responsive and effectively performing the duties of vessel operator while he was in

Analysis 57 Marine Accident Report the pilothouse. The senior mate and the lookout were the only two crewmembers to have seen the assistant captain just before the accident. None of the other crewmembers who saw him on the day of the accident remarked to Safety Board investigators on anything unusual about the assistant captain’s behavior. His wife, who saw the assistant captain about 3 hours before the accident, said that his behavior was normal and unremarkable at that time. The Safety Board studied the assistant captain’s sleep, work, and medical history to determine whether fatigue contributed to his actions. Several factors, such as his medication use, history of insomnia, and chronic back pain may have been associated with fatigue. On the other hand, the assistant captain’s work and sleep schedule were not consistent with someone who was fatigued, making it difficult to determine whether his actions were affected by fatigue. The assistant captain had been diagnosed with chronic back pain and had been taking a prescribed pain reliever, tramadol, for several years. A side effect of this medication, as documented by the manufacturer, is an increased risk of seizures. The episode that the assistant captain experienced was potentially consistent with a brief, nongeneralized seizure, with symptoms such as the temporary inability to maintain normal awareness of and contact with the environment. Episodes such as these are usually followed by a full recovery of alertness after a transition that can last anywhere from seconds up to an hour. However, other factors, such as the lack of information regarding when the assistant captain had last taken tramadol, the lack of a previous reported seizure, and the absence of supporting evidence from extensive neurological and cardiovascular tests, do not support such a determination. A postoperative cardiac examination after the assistant captain’s suicide attempt found a congenital heart abnormality (patent foramen ovale). The defect, which would not have been detected in routine cardiac examinations and would not have affected his day- to-day activities or his job performance, increased the likelihood of a transient ischemic attack (TIA) or “mini-stroke,” a condition that might have matched the symptoms that the assistant captain manifested at the time of the accident. TIAs by definition do not result in lasting changes to the brain. Both seizures and TIAs cause similar effects—a temporary loss of responsiveness, with or without concurrent physical manifestations—and both leave no evidence of their presence afterward. Given the absence of evidence from the extensive cardiological and neurological examinations that the assistant captain underwent following his suicide attempt, as well as the absence of evidence to allow a determination of fatigue or other physiological or behavioral condition, the Safety Board is unable to determine what, if any, medical or behavioral factor, alone or in combination, led to the assistant captain’s failure to respond to the cues of the impending allision. Although these medical events are somewhat consistent with the assistant captain’s actions in the minutes preceding the accident, none is especially compelling, and there are insufficient data to determine which, if any, might have occurred. Therefore, the Safety Board concludes that the cause of the assistant captain’s unresponsiveness to cues clearly indicating an impending allision could not be determined.

Analysis 58 Marine Accident Report Yet, several of the assistant captain’s known medical conditions and medications should have called into question his ability to pilot a vessel safely. In particular, the assistant captain had chronic back pain, continuously treated with tramadol, a potentially impairing medication that had the additional risk of increasing the likelihood of seizures. In addition, he was being treated for a variety of other ailments (high blood pressure, high cholesterol, insomnia) by several physicians and dentists and had regularly taken medications prescribed by those health practitioners. Although the assistant captain performed effectively before the accident and consistently received good evaluations of his performance as a ferry captain and assistant captain, some of his medical conditions and medication use increased the likelihood of incapacitation or impaired performance. In a safety-critical system such as the Staten Island Ferry, operator performance without medical oversight is unacceptable; the associated risk of a potentially catastrophic accident is too high. At the time of the accident, the NYC DOT took no role to ensure the continued medical fitness of its ferry captains and assistant captains, but instead, relied entirely on the Coast Guard regulations covering licensed mariners and Coast Guard enforcement of those regulations. Nonetheless, the assistant captain and his physician omitted critical information regarding details of the assistant captain’s medical conditions and treatment on form 719K used for Coast Guard medical evaluations. Consequently, the Coast Guard was effectively prevented from performing the requisite evaluation of the assistant captain’s medical fitness to serve as ferry operator. In each of the evaluations submitted to the Coast Guard, the assistant captain and the examining physician indicated that the assistant captain was not taking medication and had no medical condition that required the use of medication. As a result of their false information, the Coast Guard was never afforded the opportunity under its current medical oversight system to evaluate the compatibility of the assistant captain’s medical conditions and medication use with his duties. In his appearance before a Federal judge over a year after the accident, the assistant captain pleaded guilty to knowingly submitting false medical information to the Coast Guard.68 Therefore, the Safety Board concludes that because accurate medical information about the assistant captain was not provided to the Coast Guard by the assistant captain and his physician, the Coast Guard had no opportunity to evaluate his fitness to maintain his mariner’s license. Medical Oversight The Coast Guard has the responsibility to oversee compliance with regulations governing the medical qualifications of licensed mariners. Licensed deck and engineering officers are required to undergo medical evaluations every 5 years. Able-bodied seamen, ordinary seaman, food handlers, and those without critical responsibility for vessel operation need only meet a partial list of medical requirements. For pilots of vessels over 1,600 gross tons, Coast Guard regulations at 46 CFR 10.709 require “thorough physical 68 The false information was that the assistant captain did not suffer from any illnesses and was not taking any medication. As noted earlier, the examining physician was indicted for his role in providing false information about the assistant captain on the Coast Guard form.

Analysis 59 Marine Accident Report examinations each year while holding the license or endorsement.” The regulation applies to all NYC DOT ferry captains and assistant captains because they are required to hold pilot endorsements to their Coast Guard licenses, but there is no requirement for pilots subject to the regulation to report the results of their annual medical appraisal, either to the Coast Guard or to their current employer. The Coast Guard regulation merely calls for mariners to provide the Coast Guard with a copy of their most recent physical examination on request. In the absence of any interval reporting requirements, a mariner’s medical status is reviewed only every 5 years, during which time he or she could experience new medical symptoms, see a health care provider, take new medications, or be hospitalized. The Coast Guard maintained no record of annual medical evaluations of mariners in its New York jurisdiction, and the NYC DOT did not maintain records of its employees’ compliance with this requirement. In addition to the absence of any review of the annual physical examination required of licensed pilots, the Coast Guard does not provide guidance on acceptable methods of meeting its requirements for the annual review. The Coast Guard does not provide information on the thoroughness of the examination, nor does it give guidance to examiners performing the annual evaluation. The Safety Board is concerned that the lack of specificity in fulfilling the annual evaluation requirements, compared with the thorough requirements delineated in form 719K for the 5-year evaluation, may inhibit effective compliance. Therefore, the Safety Board believes that the Coast Guard should revise regulation 46 CFR 10.709 to require that the results of all physical examinations be reported to the Coast Guard, and provide guidance to mariners, employers, and mariner medical examiners on the specific actions required to comply with these regulations. The Safety Board further believes that the NYC DOT should require its licensed pilots to provide proof of compliance with the Coast Guard medical certification requirements. In attempting to determine the medical status of the assistant captain, the Safety Board found additional shortcomings in the Coast Guard’s system of medical oversight of mariners. For example, headquarters Coast Guard personnel overseeing the medical evaluation process knew little about the quality of regional reviews of medical evaluations—the initial, and for most mariners, the final evaluator of the results of medical examinations. Consequently, differences between regions in their reviews and determination of fitness may be present and undetected, potentially having an adverse effect on the reliability of the medical oversight system. The Safety Board also noted potential difficulties with the Coast Guard’s storage of medical data. The data maintained in the medical data storage system could provide the Coast Guard with valuable information about changes in mariners’ medical fitness over time, across regions of the country, between different health care providers, or in any number of other critical areas. However, deficiencies in the data storage system make it impossible for the Coast Guard to discern even these most basic measures of medical oversight or mariner medical status. Coast Guard representatives informed the Safety Board that they hoped to modernize and centralize the data storage system within 4 years

Analysis 60 Marine Accident Report of this accident. The Board hopes that the Coast Guard meets this objective at the earliest opportunity. Finally, the Coast Guard’s senior medical officer, the final authority in the Coast Guard’s mariner medical oversight process, told Safety Board investigators that he had no formal training in occupational medicine. Given the importance of his responsibility as the final determiner of a mariner’s medical qualification to obtain a license, this lack of formal training is discouraging. Despite the number of shortcomings in the Coast Guard system of medical oversight identified during the investigation, the Safety Board determined that none of the problems played a role in the Andrew J. Barberi accident. The Safety Board, therefore, concludes that while the Coast Guard’s system of medical oversight has deficiencies, they were unrelated to the accident. Nevertheless, the Safety Board found the elements necessary for an effective system of medical oversight within the Coast Guard medical oversight system: • Evaluation form with specific guidance for examiners. • Actual authority over certification of medical fitness, rather than delegation of such authority to examiners. • Retention of the data from the exams that mariners submit. Form 719K provides considerable information to examiners and, if read thoroughly before an examination, should facilitate the examiner’s task. The Coast Guard also makes the determination regarding the medical fitness of mariners, rather than delegating this decision to the examining health care practitioner. In addition, it retains the data from the evaluations. Thus, the Coast Guard has the foundation on which to build an effective medical oversight system. Therefore, the Safety Board recommends that the Coast Guard, in formal consultation with experts in the field of occupational medicine, review its medical oversight process and take actions to address, at a minimum, the lack of tracking of performed examinations; the potential for inconsistent interpretations and evaluations between medical practitioners; deficiencies in the system of storing medical data; the absence of requirements for mariners or others to report changes in medical condition between examinations; and the limited ability of the Coast Guard to review medical evaluations made by personal health care providers. New York City Department of Transportation The Safety Board sought to determine whether this accident reflected a set of operating deficiencies unique to this trip, or whether the accident resulted from a systemic weakness in NYC DOT ferry operations. The evidence indicates that numerous deficiencies were present in the Staten Island Ferry in the form of ferry operating procedures that were poorly understood, ineffectively disseminated, inconsistently applied, and inadequately overseen. These deficiencies adversely affected the safety of the

Analysis 61 Marine Accident Report ferry system. Largely because of them, the assistant captain permitted the lookout, the only other crewmember who would have been in a position to be aware of the impending allision, to leave the pilothouse shortly before docking. Further, because the captain failed to inform other crewmembers of his location on the ferry, did not establish communications with other crewmembers, was absent from the pilothouse until after the accident, failed to specify a watch in his absence, and did not exercise the oversight responsibilities of the captain of the vessel, neither he nor any other crewmember was in a position to prevent the accident. Throughout the accident voyage, two qualified operators—the captain and the assistant captain—were on duty. Yet, the evidence indicates that the captain was not in the operating pilothouse until after the accident. Further, for a substantial part of the accident trip, three NYC DOT employees—the assistant captain, the lookout, and the senior mate—were in the pilothouse, but none of them remarked on the captain’s absence. Given the circumstances, it is probable that (1) the captain considered it acceptable, both operationally and in terms of the evaluation of his performance, to be absent from the pilothouse for almost an entire voyage without informing any other crewmember of his location, and (2) his absence was sufficiently commonplace to have been accepted by those individuals without comment. As master of the vessel, the captain had a duty to oversee its safety. This responsibility required him to properly oversee its crew and ensure that they performed in a safe manner. Although he could not have realistically anticipated the assistant captain’s episode of unresponsiveness, he should have been prepared for the possibility, no matter how unlikely. Had he properly exercised his command responsibilities, he either would have been present in the pilothouse, informed other crewmembers of his location, established communications with other crewmembers to enable him to exercise his command responsibilities immediately if needed, briefed the crew on actions to take during his absence, or taken any number of other actions that would have enhanced the safety of the vessel. Because he did not do so, he was absent from the pilothouse and unavailable during the assistant captain’s unresponsiveness and therefore, was not in a position to prevent the allision or to mitigate its severity. Therefore, the Safety Board concludes that the captain failed to exercise his command responsibilities over the Andrew J. Barberi. NYC DOT operating procedures for the ferries in its fleet, to the extent that they were in effect, were contained in an 8-page handout. The procedures called for the captain “upon docking . . . to be [present] in the inshore pilothouse.” The Safety Board found that, in addition to the lack of specificity regarding the captain’s actions and the precise time or point in the voyage at which he or she was to be present in the pilothouse, this requirement was poorly understood by ferry crewmembers and ineffectively enforced by its managers. The two supervisors responsible for the enforcement of the procedures offered conflicting interpretations of the policy itself. One said that the captain was required to be present in the pilothouse, the other said that the captain could determine where he or she should be located. By contrast, the Safety Board’s examination found that procedures employed by

Analysis 62 Marine Accident Report another large-scale ferry operator, British Columbia Ferries, unambiguously describe tasks and statements that crewmembers critical to vessel operations are to use. The Safety Board sought to determine why the captain was not present in the pilothouse until after the accident, and why none of the other three NYC DOT employees remarked about his absence. The captain refused to cooperate with Safety Board investigators in the investigation of this accident. The Board asked numerous ferry personnel about their understanding of NYC DOT procedures, interviewed NYC DOT managerial personnel, and examined NYC DOT procedural documentation. Safety Board investigators received conflicting interpretations of the existence of a requirement for the vessel master to be present in the pilothouse after propulsion control had been transferred. The conflicting viewpoints extended to the highest levels of ferry management. These conflicting views were consistent with, and enabled by, the sparse documentation and dissemination of organizational procedures. NYC DOT operational procedures were not specific to particular phases of operations. They were not housed in a single manual or in a readily accessible reference location at headquarters. There was no systematic method to disseminate procedures to operating personnel and no mechanism to record who received the procedures and when. Further, the NYC DOT had no effective method to determine the extent to which operators understood the procedures and implemented them during vessel operations. NYC DOT oversight of ferry operations consisted primarily of the two port captains riding in the pilothouses during daylight voyages, without a formal method of assessing individual crew performance. The NYC DOT ferry operating procedures that were provided to the Safety Board, which purported to cover the entire conduct of a ferry voyage, were in the form of eight sheets of paper with no dissemination date. Although some procedures were written, they were general and did not assign locations and specific duties to key personnel (captains, assistant captains, and mates) for critical phases of ferry operations. To illustrate, no procedure: • Prohibited lookouts from leaving the pilothouse just before docking. • Required the captain to enter and remain in the pilothouse for the duration of the voyage once the transfer of propulsion control was complete. • Specified duties that the senior mate was to accomplish as the vessel approached the dock. By contrast, procedures of other passenger-carrying ferry organizations69 contain explicit instructions regarding actions that crewmembers are to take through all phases of ferry operations and specific words crewmembers are to say in response to precise commands during selected operating phases. In the Safety Board’s opinion, unambiguous, detailed operating procedures are a prerequisite to managing a safe transportation system. Explicit procedures provide the guidance operators need to operate the systems as 69 See appendixes D and E.

Analysis 63 Marine Accident Report intended and ensure that regardless of the individual, the system will be controlled as appropriate for each phase of operation. In any ferry system, each crewmember should have duties delineated in the procedures for all operational phases, for both routine and emergency conditions. Because people vary in their experience, training, and perceptions, explicit operating procedures reduce the likelihood of variation in operator control of the system. Without specific, formal procedures, effective dissemination, and operational validation through systematic oversight, the NYC DOT could not be certain that the ferries would be operated as intended throughout all phases of the voyages, and that crewmembers would respond appropriately to emergency situations. Transportation systems such as the Staten Island Ferry, in which the consequences of operator error or equipment failure can be catastrophic, must develop and implement “system defenses”70 to (1) minimize the opportunity for operators to commit errors, and (2) mitigate, to the extent possible, the consequences of those errors that are committed. Redundancy is the hallmark of all safe system operation, because it can help prevent a single-point failure, such as the error of a lone operator, from easy translation into system failure. The stationing of two qualified operators in the pilothouse is just such a system redundancy. Although the NYC DOT appears to have recognized its value by mentioning in its standard operating procedures that the captain was to be present in the inshore pilothouse “while docking,” this was not pursued with the systematic rigor that is required in repeated operations where, over time and with deceptive monotony, the need for redundancy may not appear necessary. Because a redundancy requirement had not been implemented or enforced, the captain was absent from the pilothouse and unavailable to all crewmembers until after the allision, and the assistant captain permitted the lookout to leave the pilothouse without clearing his absence with the captain and without securing effective backup in the lookout’s place. As a result, no one was in the pilothouse attending to vessel operations when the assistant captain became unresponsive and the allision occurred. Therefore, the Safety Board concludes that the NYC DOT failed to implement and oversee safe and effective operating procedures for its ferries. Safety Management Systems In organizations that lack proactive risk reduction measures, deterioration in safety margins in operations may go unnoticed. Organizational complacency, attention to the economic necessities of operation rather than to the safety aspects, and the absence of external audit and accountability can lead organizations, from the operators themselves to the very highest organizational levels, to fail to recognize and act on risks to safe operations until an accident occurs. In operations such as the Staten Island Ferry, where risks can lead to catastrophic loss of life, there is little room for such complacency. Chief among the countermeasures against organizational complacency, or system defenses as described previously, measures that are recommended by maritime authorities (and 70 J. T. Reason, Human Error (New York: Cambridge University Press, 1990).

Analysis 64 Marine Accident Report required of oceangoing vessels), is an aggressive safety management system. Such a system entails a top-to-bottom risk assessment, the development of safety-centered practices and procedures for which documents and training are provided, and internal and external audits to ensure consistent performance. The NYC DOT had performed a safety assessment before the accident, commissioning George G. Sharp to conduct an assessment in lieu of a Coast Guard requirement for additional lifesaving equipment on its new vessels and eventually, on all existing vessels. That report was never intended, nor did it provide, the type of systematic, thorough examination of operational risks necessary to lay the foundation for effective safeguards against safety-related risks. A safety management system necessitates a cultural change in an organization, where the safety of operations is the objective behind every action and decision by both those who oversee procedures and those who carry them out. The system leads to standardized and unambiguous procedures for each crewmember, during both routine and emergency operations. Duties and responsibilities are specified and supervisory and subordinate chains of command delineated, again for standard and emergency operations. Each crewmember, as a result, understands precisely what he or she is to do, and say, in critical phases of operations. In addition, safety management systems call for the creation of plans for responding to a range of possible emergency situations, with crewmember duties and responsibilities specified. As discussed previously, despite a Coast Guard requirement that vessels engaged in oceangoing service implement safety management systems, inland ferry operators are not required, but are encouraged, to do so. Ferries operated by the State of Washington and the Province of British Columbia, two of the largest ferry operators in North America, have implemented safety management systems to enhance the safety of their operations. Comparing the documented procedures of such systems with the broad generalities and vague responsibilities included in the NYC DOT procedures before the accident is instructive. As illustrated in appendix E, the operating practices under such a system include exact location of crew, specific crewmember duties and responsibilities, and even precise language to use during critical phases of operation. By contrast, the NYC DOT procedures were so ambiguous as to be of little use in addressing potential risks to safety. After the accident, the NYC DOT commissioned GMATS to assess its ferry operations. Among other recommendations, GMATS recommended that the NYC DOT adopt a safety management system for its continued operations, and, in a July 9, 2004, letter to the Safety Board, the NYC DOT indicated that it agreed with this recommendation and planned to implement such a system. The NYC DOT updated the Safety Board on its progress in a February 11, 2005, letter. It indicated that it had retained an organization to develop its safety management system, and that it expected to have its system completed by October 2005, with the receipt of a Document of Compliance in December 2005. The Safety Board supports the decision and subsequent actions of the NYC DOT to implement a safety management system and believes that they are in the best interests of the safety of its operations. Therefore, the Safety Board believes that the NYC DOT should adhere to its October 2005 target for implementation of a

Analysis 65 Marine Accident Report comprehensive safety management system, incorporating all matters recommended by the GMATS assessment, and ensuring medical fitness oversight (requiring, minimally, assurance of compliance with Coast Guard requirements). Within the United States, recent data indicate that 42 ferry organizations transported 58 million passengers annually. Despite the total size of this industry and the very large carrying capacity of individual vessels, only organizations that operate internationally or that have voluntarily adopted the approach operate under safety management systems. Given the thousands of passengers who daily ride ferries on U.S. waterways, both those that are subject to Coast Guard oversight and those that are not, the Safety Board is concerned that the absence of a requirement to implement safety management systems could result in the type of safety-deficient operations found in the Staten Island ferries. With the proper legislative authority, the Coast Guard could mandate that all ferries that carry members of the public implement a safety management system, thereby ensuring that they maintain the high standards of safety that the Coast Guard requires of U.S. oceangoing vessels. Therefore, the Safety Board believes that the Coast Guard should seek legislative authority to require all U.S.-flag ferry operators to implement safety management systems, and once obtained, require all U.S.-flag ferry operators to do so. The Safety Board believes that the Passenger Vessel Association should encourage its member ferry operators to voluntarily request application of the Federal requirements at 33 CFR 96 for implementing a safety management system, if they have not already done so. The Safety Board also believes that the States operating public ferries should encourage their public ferry operators to voluntarily request application of the Federal requirements at 33 CFR 96 for implementing a safety management system, if they have not already done so. Response to Emergency On Board Andrew J. Barberi After the vessel struck the maintenance pier, an undetermined interval passed before the captain entered the pilothouse and assumed control of the vessel. With the chief engineer’s assistance, the captain shifted propulsion control from the Staten Island to the New York pilothouse, maneuvered the vessel to the dock, and docked it with the ferry’s undamaged New York end heading into its intended slip. He also directed the senior mate to assess the damage and report back to him. The mate, however, failed to return until after the vessel docked, and the captain did not follow up on his direction to the mate. The Safety Board evaluated the appropriateness of the captain’s actions in moving the ferry to its intended berth after the accident rather than using the maintenance pier as the docking pier, and the effectiveness of the crew’s response to the aftermath of the accident. The maintenance pier is long and narrow, with dimensions that would have interfered with the ability of numerous responding vehicles to approach the vessel and

Analysis 66 Marine Accident Report quickly exit. In contrast, the vehicle ramp at the ferry terminal is horseshoe-shaped, designed to allow traffic to flow smoothly and with ample space for the vehicles of the emergency responders. Further, the ferry had no gangways other than the open-ended ramps, so passengers would have had no means of egress to the maintenance pier and would have had to remain on board the ferry until an alternate means of disembarking could be found. Maneuvering the vessel to its intended dock thus allowed responders safer and quicker access to the victims than if the vessel had docked at the maintenance pier, and also allowed safer and quicker disembarkation of the passengers. Finally, the maintenance pier itself was damaged, with no quickly accessible locations where the vessel could be moored. Given the many advantages to docking at the regular slip, even at the expense of the additional time it took, the Safety Board concludes that the captain’s maneuvering the ferry back to its intended berth was appropriate. The Safety Board also examined the effectiveness of the crewmembers’ response to the accident. Passengers and crewmembers told Board investigators that before and immediately after the accident, they heard no warning sounds or public address announcements offering information about the accident or actions to take in its aftermath, or other information potentially useful to both passengers and crew. The ferry’s station bill states that, in the event of an emergency, crewmembers are to be alerted by the sounding, for at least 10 seconds, of the ship’s whistle and general alarm, with additional signals and alarms designating the location of the emergency. However, the captain did not sound the requisite 10-second alarm, made no emergency announcements over the public address system, gave no commands or directions to crewmembers over the walkie-talkies or the public address system, and did not inform passengers of the vessel’s situation. The evidence indicates that crewmembers reacted individually to what each immediately saw, rather than performing a coordinated response to the emergency. However, had crewmembers attempted to coordinate a response, they would have been hampered by the lack of communication devices. Some crewmembers had walkie-talkies, but others did not. Without access to immediate information, even the best command and control system would not have been maximally effective. Since the accident, NYC DOT has issued walkie-talkies to all ferry crewmembers. Without hearing the 10-second alarm or comparable spoken alert from the captain, the crew did not have the signal they had been repeatedly trained to rely on to initiate a response to an emergency. Because of the lack of an alarm or alert, some crewmembers were unaware of the accident and did not respond until they either directly saw the need for a response or heard from passengers or crew of the accident and the location of the injured. The Safety Board, therefore, concludes that the failure of the captain to sound an alarm or provide a spoken alert calling for the initiation of crew actions in response to the emergency adversely affected the quality of the crew’s response. During the approximately 20-minute period between the allision and the docking, rather than awaiting instructions, three different crewmembers independently went to the pilothouse to obtain information about the accident or the response. The captain sent two

Analysis 67 Marine Accident Report to the engineroom because he was unable to contact the chief engineer by phone and needed to coordinate the shift in propulsion control with the engineer. At the time of the accident, the engineers and oilers remained in the machinery spaces while the remainder of the crew was dispersed throughout the vessel. According to both passengers and crewmembers, deckhands reacted to the accident according to what they could see and immediately assess. Some directed passengers back to the New York end on the saloon deck of the vessel. Others tended to the injured they encountered as best they could, then moved on to other injured passengers. Crewmembers who were located away from the damage were unable to assess its severity unless they walked to the affected area and saw the damage for themselves. Some had no immediate knowledge of the allision with the pier and therefore did not immediately respond. Only one crewmember foresaw the impending allision and warned passengers of the accident just seconds before it occurred. The Safety Board recognizes that the crew faced an emergency that was considerably beyond anything they had been prepared or trained for, and one for which no guidance was available. Many of the individual responses were ineffective, albeit well intentioned. For example, two crewmembers ran to retrieve defibrillators, despite the fact that they were of little use in response to the traumatic injuries the victims sustained. The nature of many of the injuries was also beyond anything for which the crew had been prepared, either in training or with equipment. Several injured passengers required tourniquets to stanch severe bleeding; one deck officer applied a tourniquet to an injured passenger using a belt and a lifejacket strap. In addition, while attempting to attend to the injured, crewmembers also had to manage the vessel’s operation, thus limiting their ability to perform either activity effectively. Crewmembers had minimal, if any, emergency medical training. Officers were required to take a CPR and an advanced first aid course to be licensed. One of the mates had received advanced emergency medical training 20 years earlier. However, because of the extensive severe injuries the fatally injured passengers received, even the timeliest medical treatment would not have substantially improved the likelihood of survival. As a result, given the severe nature of several of the injuries, any shortcomings of the crew response had little effect on the overall survivability of those most severely injured. Although the shortcomings did not adversely affect the survivability of the injured in this accident, had the accident occurred during rush hour, considerably more passengers would have been on board and many more injured passengers may have needed prompt emergency response services. The Safety Board is concerned that without improvement, crew response to potential future accidents could compromise passenger survivability. Moreover, no single command and control source guided crewmembers in responding to the emergency. Crewmembers responded as best as they could, but no single individual directed the crew response to the accident, unlike the system that managed the response of the shoreside emergency personnel. Consequently, crewmember response was uncoordinated, made up of individual crewmember actions to individual passengers who were within view. Other than the single 10-second alarm, the NYC DOT had no procedures calling for a single source to guide the crew in assessing the emergency, and then using that information to respond in a coordinated and effective manner.

Analysis 68 Marine Accident Report Further, the training that the crew received was inadequate to provide for a coordinated response to a mass casualty event. Ferry crews held weekly drills to practice responding to an onboard fire or emergency. The drills were invariant and, over time, elicited rote responses to predictable scenarios. Given the sameness in the scenarios they repeatedly encountered, the crew’s preparedness to respond to a scenario that was outside the inflexible parameters used in the practice drills, let alone one of the magnitude of this accident, was limited at best. The Safety Board found that individual crewmembers responded appropriately to the emergency, given limitations in resources, inadequate training, and poorly delineated procedures, which limited the quality of their response. However, the evidence indicates that overall, the crew’s response to the accident was uncoordinated. Therefore, the Safety Board concludes that although a superior crew response would most likely have made no difference in the survivability of the injured, deficiencies in the NYC DOT procedures, training, and equipment could compromise the survivability of passengers and crew in other potential accident scenarios. Shoreside Many passengers used cell phones to notify emergency personnel of the allision. The first 911 call was recorded at 1522. Dispatchers notified the FDNY within 2 or 3 minutes of that, and within 5 minutes of the accident the first FDNY personnel arrived at the terminal. Two minutes after that, the first EMS unit arrived. Even before the ferry docked, requests for additional FDNY and EMS personnel and equipment were made as the magnitude of the accident became apparent to some on the ferry, including an off-duty FDNY officer. The FDNY dispatched over 200 personnel to the accident, plus nearly 60 EMS personnel, 24 ambulances, and 26 fire engine or ladder companies, plus rescue companies and support units. Contributing to the timeliness and effectiveness of the response was the presence of the off-duty FDNY officer who repeatedly contacted FDNY dispatchers with updates on the nature of the emergency, and with requests for specific types of assistance. A Coast Guard enlisted person on board the vessel notified the Coast Guard incident command center of the accident at 1525, and Coast Guard personnel arrived on scene before the ferry arrived at the dock. The Coast Guard response included six vessels of various sizes that were used to search for people in the water, patrol the harbor, and monitor the debris field created by the allision. In addition, over 300 NYPD personnel responded, including a dive team. A total of 17 vessels from a variety of agencies, including the NYPD, the FDNY, the Coast Guard, and the Army Corps of Engineers, participated in the waterborne response. By 1543, the time the Andrew J. Barberi docked at the pier, numerous emergency response vehicles and vessels and trained paramedics were in place to deal with the emergency. Injured passengers and crew were promptly attended to, and those in need were quickly transported to nearby hospitals. Given the scope of the emergency and the timeliness and effectiveness of the response, the Safety Board concludes that shoreside emergency response was effective.

Analysis 69 Marine Accident Report Navigation Technology The Safety Board noted that, at the time of the accident, the pilothouses of the Staten Island ferries lacked many of the common technological innovations that can assist operators during restricted visibility conditions in determining vessel location, heading, speed, approaching vessels, and other key navigational parameters. Modern equipment is also available to monitor vessel condition and alert operators to recognize out-of-profile or unsafe conditions. Vessels lacked even such basic instrumentation as speed indicators. Further, bridge layout was found to be suboptimal in presenting critical information to operators. For example, radar target information was presented behind the operator, requiring him or her to leave the controls, turn around, and lose external visual references to see the information. These potential deficiencies, which can lead to deficient operator performance, were noted by the GMATS assessment that was performed after the accident at the request of the NYC DOT. The assessment suggested that the NYC DOT acquire equipment such as ARPA, AIS, and electronic chart display and information systems, as well as digital, multidirectional vessel speed indicators with alarm functions that provide vessel speed information to vessel operators, including approach speed to berths. The GMATS assessment concluded that the installation of integrated navigation bridge systems “will be crucial to provide enhanced safe navigation of the vessels.”71 GMATS also recommended the accelerated installation of prerecorded, automated safety and emergency announcements, to be delivered over the public address system before the ferries depart and when they approach the pier. As noted earlier, on February 11, 2005, the NYC DOT informed the Safety Board that it agreed to follow the GMATS recommendations, and that it already had installed GPS receivers, ARPA, and AIS units on its vessels. The Safety Board is encouraged by the NYC DOT’s acceptance of the GMATS recommendations with regard to navigation technology. However, the full integration of the advantages of technology into navigation practices and system monitoring requires careful evaluation and thorough review. The GMATS assessment indicated that navigation technology should be fully operable at all times and that navigation personnel should receive initial and then periodic training in the effective use of navigation technology. The Safety Board agrees with these judgments. However, Board discussions with NYC DOT personnel indicate that the prerecorded announcements that have already been installed are not automatic but require manual activation, and that the alarm functions related to speed indicators that are planned for installation will also require manual activation. In the Safety Board’s opinion, manual activation is not consistent with the GMATS recommendations. The GMATS assessment did not call for the type of systematic evaluation that regularly assesses the effectiveness of existing bridge navigation technology in light of new technologies that become available. Such a system of regular technological assessment would help ensure that NYC DOT vessels take maximum advantage of available technology to enhance the safety of ferry operations. Therefore, the Safety 71 See appendix F.

Analysis 70 Marine Accident Report Board recommends that, as part of its response to the GMATS assessment, the NYC DOT should fully comply with the technology-related recommendations of GMATS, and establish a recurrent evaluation process to assess the use of navigation technology.

71 Marine Accident Report Conclusions Findings 1. None of the following were factors in the accident: the vessel’s propulsion systems, environmental conditions, alcohol, or illicit drugs. 2. The Andrew J. Barberi was operating at full speed when it struck the maintenance pier. 3. At the time of the accident, the assistant captain was at the controls, the senior mate was seated in the aftmost section of the pilothouse reading a newspaper, and no one else was in the pilothouse at the ferry’s Staten Island end. 4. The assistant captain was apparently upright but unresponsive to his surroundings and the visual cues of the impending allision for an estimated 1 to 2 minutes before the accident. 5. The crew did not recognize that the ferry was in danger because of the absence of changes in sounds that they typically used as cues for arrival, because they were not attending to visual cues outside the vessel, and because of the absence of any crew announcement or alert. 6. The cause of the assistant captain’s unresponsiveness to cues clearly indicating an impending allision could not be determined. 7. Because accurate medical information about the assistant captain was not provided to the Coast Guard by the assistant captain and his physician, the Coast Guard had no opportunity to evaluate his fitness to maintain his mariner’s license. 8. While the Coast Guard’s system of medical oversight has deficiencies, they were unrelated to the accident. 9. The captain failed to exercise his command responsibilities over the Andrew J. Barberi.

1. The New York City Department of Transportation failed to implement and oversee

safe and effective operating procedures for its ferries.

1. The captain’s maneuvering the ferry back to its intended berth was appropriate.
2. The failure of the captain to sound an alarm or provide a spoken alert calling for the

initiation of crew actions in response to the emergency adversely affected the quality of the crew’s response.

Conclusions 72 Marine Accident Report

1. Although a superior crew response would most likely have made no difference in the

survivability of the injured, deficiencies in the New York City Department of Transportation procedures, training, and equipment could compromise the survivability of passengers and crew in other potential accident scenarios.

1. Shoreside emergency response was effective.

Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the assistant captain’s unexplained incapacitation and the failure of the New York City Department of Transportation to implement and oversee safe, effective operating procedures for its ferries. Contributing to the cause of the accident was the failure of the captain to exercise his command responsibility over the vessel by ensuring the safety of its operations.

73 Marine Accident Report Recommendations As a result of its investigation of the Andrew J. Barberi allision, the National Transportation Safety Board makes the following safety recommendations. To the New York City Department of Transportation: Require your licensed pilots to provide proof of compliance with the Coast Guard medical certification requirements. (M-05-01) Adhere to your October 2005 target for implementation of a comprehensive safety management system, incorporating all matters recommended by the Global Maritime and Transportation School assessment, and ensuring medical fitness oversight (requiring, minimally, assurance of compliance with Coast Guard requirements). (M-05-02) As part of your response to the Global Maritime and Transportation School assessment, fully comply with the technology-related recommendations of the Global Maritime and Transportation School, and establish a recurrent evaluation process to assess the use of navigation technology. (M-05-03) To the U.S. Coast Guard: Revise regulation 46 CFR 10.709 to require that the results of all physical examinations be reported to the Coast Guard, and provide guidance to mariners, employers, and mariner medical examiners on the specific actions required to comply with these regulations. (M-05-04) In formal consultation with experts in the field of occupational medicine, review your medical oversight process and take actions to address, at a minimum, the lack of tracking of performed examinations; the potential for inconsistent interpretations and evaluations between medical practitioners; deficiencies in the system of storing medical data; the absence of requirements for mariners or others to report changes in medical condition between examinations; and the limited ability of the Coast Guard to review medical evaluations made by personal health care providers. (M-05-05) Seek legislative authority to require all U.S.-flag ferry operators to implement safety management systems, and once obtained, require all U.S.-flag ferry operators to do so. (M-05-06) To the States Operating Public Ferries: Encourage your public ferry operators to voluntarily request application of the Federal requirements at 33 CFR 96 for implementing a safety management system, if they have not already done so. (M-05-07)

Recommendations 74 Marine Accident Report To the Passenger Vessel Association: Encourage your member ferry operators to voluntarily request application of the Federal requirements at 33 CFR 96 for implementing a safety management system, if they have not already done so. (M-05-08) BY THE NATIONAL TRANSPORTATION SAFETY BOARD ELLEN ENGLEMAN CONNERS Chairman CAROL J. CARMODY Member MARK V. ROSENKER Vice Chairman RICHARD F. HEALING Member DEBORAH A. P. HERSMAN Member Adopted: March 8, 2005

75 Marine Accident Report Appendix A Investigation The Safety Board was notified of this accident by its communication center about 1600 on October 15, 2003. The Board immediately notified the Coast Guard of its selection to lead the investigation under the Safety Board–Coast Guard memorandum of understanding. The Board then dispatched a team of investigators from Washington, D.C., to the accident site, and an investigator from its Parsippany, New Jersey, Aviation Regional Office to control the scene until the team arrived. The team, consisting of an investigator-in-charge and specialists in deck operations, marine engineering, human factors, survival factors, and vehicle recorders, arrived at the Staten Island ferry terminal about 2300 on October 15. The Chairman of the Safety Board joined the team at the accident site, as well as representatives from the Safety Board’s Office of Transportation Disaster Assistance. The on-scene investigation concluded on October 25, 2003. The Safety Board investigated the accident under the authority of the Independent Safety Board Act of 1974, according to Safety Board rules. The designated parties to the investigation were the U.S. Coast Guard, the New York City Department of Transportation, and the New York City Fire Department.

76 Marine Accident Report Appendix B Standard Operating Procedures, Staten Island Ferry

Appendix B 77 Marine Accident Report

Appendix B 78 Marine Accident Report

Appendix B 79 Marine Accident Report

Appendix B 80 Marine Accident Report

Appendix B 81 Marine Accident Report

Appendix B 82 Marine Accident Report

Appendix B 83 Marine Accident Report

Appendix B 84 Marine Accident Report

85 Marine Accident Report Appendix C Memorandum of Understanding Between New York City Department of Transportation and U.S. Coast Guard

Appendix C 86 Marine Accident Report

Appendix C 87 Marine Accident Report

88 Marine Accident Report Appendix D Contents Pages from Safety Management System Manuals, Washington State Ferries

Appendix D 89 Marine Accident Report

Appendix D 90 Marine Accident Report

Appendix D 91 Marine Accident Report

Appendix D 92 Marine Accident Report

Appendix D 93 Marine Accident Report

Appendix D 94 Marine Accident Report

Appendix D 95 Marine Accident Report

Appendix D 96 Marine Accident Report

Appendix D 97 Marine Accident Report

Appendix D 98 Marine Accident Report

Appendix D 99 Marine Accident Report

Appendix D 100 Marine Accident Report

Appendix D 101 Marine Accident Report

Appendix D 102 Marine Accident Report

Appendix D 103 Marine Accident Report

Appendix D 104 Marine Accident Report

Appendix D 105 Marine Accident Report

Appendix D 106 Marine Accident Report

Appendix D 107 Marine Accident Report

Appendix D 108 Marine Accident Report

Appendix D 109 Marine Accident Report

Appendix D 110 Marine Accident Report

Appendix D 111 Marine Accident Report

Appendix D 112 Marine Accident Report

Appendix D 113 Marine Accident Report

Appendix D 114 Marine Accident Report

Appendix D 115 Marine Accident Report

116 Marine Accident Report Appendix E Example Procedures from Safety Management System, British Columbia Ferries

Appendix E 117 Marine Accident Report

!"

# $ %&!!" '#()*$

$ !

#+ '

,-.*

)/#.0-'#

.#(1#

!

" # $% &#$%'

#$% #$%

( )

)

+

$ ,-%

.

Appendix E 118 Marine Accident Report

!"

# $ %&!!" '#()*$

$ !

#+ '

,2#'##,

$

)

/

/

)

0

%1" 2

*

+

3

%1"

# .) "

!

%1"

) !

""# $$ "%

""#& '

%" "()

Appendix E 119 Marine Accident Report

"

!"

# $ %&!!" '#()*$

$ !

#+ '

!" "%)

%1"

!

""#'" "%)

!" "%) - !*&

&'" "%)

%1"

# .) " # 4

$ 3 %1"

!

)

!+

",&& ""#%)

55

%1"

!" "%)

6 !

!

%1"

"

"

Appendix E 120 Marine Accident Report

3

!"

# $ %&!!" '#()*$

$ !

#+ '

--0.,

"

"

"

%1"

!" "%)

3 %1"

!&& ""#%" "%)

3%1"

Appendix E 121 Marine Accident Report

!"

# $ %&!!" '#()*$

$ !

#+ '

'##,4-05#6'#5-.,#(#.7

$

)

/

%"

%1 "

"

!" ")

-6'##, ,,#2-6 "

7

"

Appendix E 122 Marine Accident Report

8

!"

# $ %&!!" '#()*$

$ !

#+ '

2#6#,

3

(8 7

%8

! 6

• ./

$

$

&$9:;

'

"

#

"

Appendix E 123 Marine Accident Report

!"

# $ %&!!" '#()*$

$ !

#+ '

" #

#

Appendix E 124 Marine Accident Report

Appendix E 125 Marine Accident Report

126 Marine Accident Report Appendix F Assessment of Staten Island Ferries by Global Maritime and Transportation School, U.S. Merchant Marine Academy

Appendix F 127 Marine Accident Report Global Maritime and Transportation School At the United States Merchant Marine Academy

Assessment of Staten Island Ferry Operations

Prepared for: New York City

Department of Transportation

Prepared by: Global Maritime and Transportation School

At the United States Merchant Marine Academy

Kings Point, New York, USA

Telephone: +1 (516) 773-5120

Facsimile: +1 (516) 773-5353

E-mail: gmats@usmma.edu

Date: February 12, 2004

Appendix F 128 Marine Accident Report Assessment of Page 1 Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu Table of Contents 1

Executive Summary 2-5

Long-term Areas of Focus 6-11

Specific Comments and Observations for Immediate Consideration 12-17

APPENDICES

A – Job Description for Chief Operations Officer (COO) B – Sample Short-term Management Organization Matrix C – Sample Long-term Management Organization Matrix D – Job Description for Senior Port Captain E – Job Description for Senior Port Engineer F – Job Description for Safety Manager/Designated Person

Note that comments and remarks provided in this report are based on observations made during on-site assessments and reflect conditions as they existed at that time. Specific conditions discussed in this report may not exist in a similar condition today. This report is a review and assessment of Staten Island Ferry operations only as they existed at the time of observation. It is not a comprehensive safety inspection or accident investigation. This report shall not imply any form of certification or approval of any operation or indicate compliance with any applicable international, federal, state, or local laws or regulations. It is also critical to understand that the comments and remarks provided herein may be subject to modification and/or change based on further and more thorough examination of ferry operations as this assessment continues to evolve and proceed.

Appendix F 129 Marine Accident Report Assessment of Page 2 Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu Executive Summary

Following the tragic Staten Island Ferry accident on October 15, 2003, the New York City Department of Transportation (NYC DOT) requested the Global Maritime and Transportation School (GMATS) at the United States Merchant Marine Academy (USMMA) develop a proposal to conduct an assessment of Staten Island Ferry Operations. By the end of October 2003, the GMATS and the NYC DOT had agreed in principal for the GMATS to conduct the assessment in four main topical areas: vessel operations, human factors, safety, and management.

On November 3, 2003, the NYC DOT signed a Letter of Intent/Notice to Proceed for assessment of the Staten Island Ferry Operations. GMATS began work on the project immediately and commissioned two assessment teams to conduct an initial review of operations, management, policies, procedures, manuals, and other documents related to the operation of the Staten Island Ferry. Both assessment teams performed on-site surveys (including discussions with ferry crews and shore-based management as well as observations aboard underway ferries) during November 2003 through mid-January 2004. The first team focused on overall operations and management; engineering; safety; and conformity with regulatory schemes and maritime industry best practices and standards. The second assessment team focused primarily on human factors and bridge team management.

Based on these assessments, the goal of this report is to provide a framework and suggested guidance for operation and management of a world-class Staten Island Ferry system that is safe, secure, fiscally sound, and environmentally sensible.

To its credit, the Staten Island Ferry system appears to be a good operation overall considering 1) the limited levels of funding and human resources the organization has at its disposal and 2) the existence of a corporate culture within the ferry organization which may not be conducive to operating a first-rate marine transportation system.

GMATS feels the NYC DOT is committed to operating a ferry service that inspires public confidence in that system and is dedicated to making improvements and changes in the following areas:

ñ Safety Management System (SMS) - The foundation of the revitalization of the Staten Island Ferry system will be the establishment of a Safety Management System (SMS) – in accordance with the International Management Code for the Safe Operation of Ships and for Pollution Prevention (more widely known as the International Safety Management (ISM) Code). Implementation of a SMS has become a maritime industry standard around the world and critical in making the Staten Island Ferry system mainstream with its best passenger-carrying contemporaries in the global arena. SMS application within the Staten Island Ferry system will forge a new era of safety and environmental protection benefiting

Appendix F 130 Marine Accident Report Assessment of Page 3 Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu passengers, crew, and the City of New York. The functional requirements of a SMS (as outlined in the ISM Code) for the Staten Island Ferry system will incorporate:

a) a safety and environmental protection policy; b) instructions and procedures to ensure safe operation of ferries and protection of the environment in compliance with relevant international, national, and local laws and regulations; c) defined levels of authority and lines of communication between, and amongst, shore-based and ferry personnel; d) procedures for reporting accidents and non-conformities with the provisions of the SMS; e) procedures to prepare for and respond to emergency situations; and f) procedures for internal audits and management reviews.

The goal of a Staten Island Ferry SMS is to assure that ferry system best practices are clearly defined, that documented practices conform to regulatory requirements, and the opportunity for continuous improvement is available to all who are covered by the Staten Island Ferry SMS. Refer to Long-term Areas of Focus section (pages 6-7) for further information.

ñ Bridge Team Management – GMATS recommends establishment of a new 3- member bridge team comprised of licensed deck officers to 1) provide enhanced safe navigation of Staten Island Ferry vessels, suitable rest breaks, and support for more comprehensive watch relief procedures; 2) meet new vessel security officer and other maritime security statutory requirements to be implemented by July 1, 2004; and 3) incorporate additional tasks and responsibilities mandated under the SMS (all while maintaining a minimum of 2 licensed deck officers in the pilothouse at all times when underway). Additional personnel (from the existing on-watch crew) may be required to support the 3-member bridge team during operations in foul weather and adverse environmental conditions.

As part of this bridge team program, all personnel required to be present on the navigation bridge while underway will be assigned specific duties and responsibilities so that all human resource capacity is effectively engaged in a coordinated, managed, and more efficient manner. Each bridge team member will also be adequately trained and qualified in the operation and capabilities of all navigation, communication, and other pilothouse equipment and technologies.

Further assessment and development of the bridge team management structure specific to the Staten Island Ferry system will be required in order to formulate the best practices in this area. The first step in this process will be to conduct an inventory of all bridge team tasks required for operation of the ferries in various conditions and situations. The second step will be to develop a formal, bridge team

Appendix F 131 Marine Accident Report Assessment of Page 4 Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu operations manual which will be part of the SMS. The final phase in this process will be to develop and deliver a bridge resource management course. This curriculum will be customized to meet the unique operational characteristics of the Staten Island Ferry system. Refer to Specific Comments and Observations for Immediate Consideration Section (page 15) for further information.

ñ Organizational Structure and Human Resources – GMATS feels the immediate hiring of a Chief Operations Officer (COO) to provide leadership and direction for the operation of the Staten Island Ferry system is absolutely critical in guiding the organization through this period of renewal, transition, and implementation of a Safety Management System. GMATS recognizes a person of this caliber (refer to Appendix A for a detailed job description) serving as COO in a comparable maritime organization would typically be compensated with an annual salary of $160,000 to $180,000 per annum. In order to attract the best person for this position, NYCDOT may have to authorize relocation benefits as well. Further, GMATS feels a long-term commitment (e.g. 5 years) for the COO position would serve the NYCDOT well.

Further, it is clearly evident, based on this initial review of documents and observations, the operations function of the ferry system is 95 persons short of staffing levels required to implement a safety management system and to provide for other enhancements. These staffing shortfalls result in large overtime expenditures as well as a potential for increase in fatigue, reduction in safety, decline in service, or any combination of all four of these issues. This recommendation for additional staffing was based on three central issues: 1) the ferry system is currently not staffed to support a safety management system, 2) more senior personnel need to be on board the vessels in command positions, and 3) as people are sent for training and compliance issues there will be a need for additional personnel in the system to offset any fatigue, hours of labor issues, etc. that will come up during the training process. Refer to Long-term Areas of Focus section (pages 7-10) for further information.

ñ Technical Training and Professional Development – The need for a comprehensive technical training and professional development program for vessel crews and shore- based personnel will be an integral component of the SMS. The Staten Island Ferry should establish and maintain procedures for identifying training which may be required in support of the SMS and ensure that such training is provided for all personnel concerned. Professionally trained personnel are an asset to the SMS and the Staten Island Ferry system. Maintaining one of the Kennedy-class vessels (in a fully-operational status) after delivery of the new ferries will be crucial in meeting the needs of this comprehensive training program. Refer to Long-term Areas of Focus section (page 10) and Specific Comments and Observations for Immediate Consideration Section (page 16) for further information.

Appendix F 132 Marine Accident Report Assessment of Page 5 Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu

ñ Operations Procedures –

° Staten Island Ferry needs to conduct a full review of at-sea casualty and emergency response plan (including search and rescue operations) and plan coordinated, table-top and other exercise scenarios with external response assets (NYPD Harbor Units, FDNY Marine Units, U.S. Coast Guard, NJ State Marine Police, private harbor tugs, etc.). ° Develop operational checklists (vessel departures, arrivals, foul weather, emergencies, etc.) required to be used by afloat personnel. ° Establish formal, internal policies and procedures for and publicize an alternate ferry service operational schedule for foul weather and adverse environmental conditions (i.e. reduced visibility, high winds, excessive wave and/or current action, etc.).

Refer to Specific Comments and Observations for Immediate Consideration Section (pages 16-17) for further information.

ñ Security - Begin planning for implementation of Vessel and Facility Security Plans as soon as practicable and provide related training to appropriate vessel crew and shore-based staff. Vessel and Facility Security Plans have been submitted to the Coast Guard for approval. Changes and/or modifications may have to be made to the plans based on feedback from the Coast Guard. *** Implementation and subsequent changes/modifications (post U.S. Coast Guard approval) may result in a requirement for hiring of additional crew and shoreside personnel to put the facility and the vessel security plans in effect by July 1, 2004 as required. ***

ñ Utilization of Advanced Marine Technologies – Equipment to be updated or newly installed aboard Staten Island Ferries include RADAR, Automated RADAR Plotting Aids (ARPA), Electronic Chart Display and Information System (ECDIS), Automatic Identification System (AIS), and digital, multi-directional vessel speed indicators with alarm functions (which allows vessel personnel to monitor vessel speed fore/aft and athwartships including approach speeds to berths). Installation of integrated navigation bridge systems aboard all ferries will be crucial to provide enhanced safe navigation of the vessels.

Appendix F 133 Marine Accident Report Assessment of Page 6 Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu Long-term Areas of Focus (12 –36 months)

GMATS recommends the following organizational strategies receive the highest priority in way of design, development, formalization, and implementation.

ñ Safety Management System (SMS)

The foundation of the revitalization of the Staten Island Ferry system will be the establishment of a Safety Management System (SMS) – in accordance with the International Management Code for the Safe Operation of Ships and for Pollution Prevention (more widely known as the International Safety Management (ISM) Code). The main objectives of a SMS (as outlined in the ISM Code) for the Staten Island Ferry system are to:

a) provide for safe practices in ferry operations and a safe working environment; b) establish safeguards against all identified risks; and c) continuously improve safety management skills of personnel ashore and aboard ferries, including preparing for emergencies related both to safety and environmental protection.

Implementation of a SMS has become a maritime industry standard around the world and critical in making the Staten Island Ferry system mainstream with its best passenger-carrying contemporaries in the global arena. SMS application within the Staten Island Ferry system will forge a new era of safety and environmental protection benefiting passengers, crew, and the City of New York. The functional requirements of a SMS (as outlined in the ISM Code) for the Staten Island Ferry system will incorporate:

a) a safety and environmental protection policy; b) instructions and procedures to ensure safe operation of ferries and protection of the environment in compliance with relevant international, national, and local laws and regulations; c) defined levels of authority and lines of communication between, and amongst, shore- based and ferry personnel; d) procedures for reporting accidents and non-conformities with the provisions of the SMS; e) procedures to prepare for and respond to emergency situations; and f) procedures for internal audits and management reviews.

On November 4, 1993, The International Maritime Organization adopted Resolution A.741(18), the International Safety Management (ISM) Code for the Safe Operation of Ships and for Pollution Prevention. An integral part of the Code is the requirement that vessel operators establish a Safety Management System (SMS). The goal of a SMS is to assure the best practices are clearly defined, that documented practices conform to regulatory requirements, and the opportunity for continuous improvement is available to all who are covered by the Safety Management System. The SMS is to provide “best practice”

Appendix F 134 Marine Accident Report Assessment of Page 7 Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu guidelines for all members of the Staten Island Ferry system (employees) in a standardized approach to routine, critical and emergent activities. SMS policies and procedures provide a structure within which managers and employees are expected to use sound judgment in the performance of their duties. An effective SMS will ensure safety, prevention of human injury or loss of life and avoidance of damage to the environment, in particular to the marine environment and to property. The SMS will incorporate crisis management, incident response, training and standard operating procedures covering every aspect of operation and maintenance of the vessels and terminals. The Staten Island Ferry system and the traveling public will both benefit from its creation by:

a) ensuring that all industry standards and best practices are complied with; b) helping to prevent accidents from occurring; c) ensuring procedures are in place for dealing with any emergency situation aboard the ferries; d) ensuring there are adequate communications between ferry and shore-based personnel; e) ensuring that all individuals know their role and responsibility and are adequately trained and have the appropriate resources to do their job; and f) ensuring that all activities and operations are planned, controlled, and verified.

ñ Organizational Structure

GMATS feels the immediate hiring of a Chief Operations Officer (COO) to provide leadership and direction for the operation of the Staten Island Ferry system is absolutely critical in guiding the organization through this period of renewal, transition, and implementation of a Safety Management System. The COO candidate (refer to Appendix A for a detailed job description) needs to be the strongest advocate of a SMS.

The Safety Management System will establish a corporate culture that is committed enthusiastically to the policy’s success from the highest level of Staten Island Ferry management. The management should define and document the responsibility, authority and interrelation of all personnel who manage, perform and verify work relating to and affecting safety and pollution prevention. Management will be responsible to ensure that adequate resources and shore-based support are provided to enable all levels of the organization to carry out their functions under the SMS. A short-term management organization matrix conducive to this goal might look like the chart in Appendix B. A long-term organizational matrix might look like the chart in Appendix C.

Prior to implementation of the short-term management organization matrix, several key shore-based management personnel need to be hired or realigned in order to introduce a new SMS. These position descriptions are outlined in Appendices D-F.

Appendix F 135 Marine Accident Report Assessment of Page 8 Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu ñ Human Resources

In broad terms, ferry personnel who were interviewed by the assessment teams put their best foot forward and had the desire to do well in the workplace. However, without the proper funding, staffing, and professional training programs, these inherent individual aspirations will not be sufficient and little will change to improve safety.

A similar situation exists for shore-based management staff. During on-site interviews and observations, it was a rare moment when a manager being interviewed was not being paged or responding to telephone calls. The pace is such that decisions are being made reactively instead of proactively; long term planning appears to be a luxury, not a staple. Again, the prevalence of inadequate staffing and funding levels seems to have contributed to the apparent erosion of the overall ferry system organization.

Originally GMATS was tasked with observing and making recommendations. We made our recommendations based on the existing labor contracts (which incorporate a 30-hour work week). A change of work hours, from 30 to 40, should make an impact on these recommendations. However, the impact may be smaller than expected. The first category of new hires (24 of the recommended 95 new personnel additions) will enable the Staten Island Ferry system to run all vessels under the current operating schedule without requiring crew members to work inordinate amounts of overtime in order to meet minimum vessel manning requirements. The remaining 71 new personnel are needed to create a labor pool to provide critical support to:

ñ the design, development, and implementation of the SMS (this may take as long as 24 months utilizing existing vessel personnel); ñ surge training and professional development requirements as a result of the implementation of the SMS (this may take as long as 36 months and require vessel crew members to be withdrawn from their regular watchstanding duties to attend training sessions – on-call crew personnel will be required to fill-in these positions); ñ a new 3-member bridge team structure incorporating enhanced bridge team management functions; ñ increased crew responsibilities to meet maritime security regulations; ñ work/rest break rotations and watch reliefs; and ñ increased interaction between vessel crew members and ferry passengers (i.e. customers).

GMATS feels that following implementation of the new safety management system and after surge training requirements are fulfilled, there may or may not be a need for maintaining the recommended overall crew staffing levels discussed above (i.e. 71 of the 95 new positions). There most likely will be a gradual “weaning” process take place within the ranks of the afloat personnel over the next several years. In GMATS’ estimation, 1) some current employees will not feel comfortable with the new system and will retire or move on, 2) some current employees will find that in the new way of doing things they will want to become

Appendix F 136 Marine Accident Report Assessment of Page 9 Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu part of the management structure instead of the crew, and 3) normal attrition. In the same vein, some of the “new hires” will not work out and will not be retained. A thorough analysis of afloat personnel staffing needs should be conducted following SMS implementation and completion of surge training requirements (in 24-36 months) to determine appropriate crewing requirements at that point.

Additional Personnel Requirements (as soon as practicable)

First Category (24 of 95 total personnel) - to enable the Staten Island Ferry system to operate all vessels under the current operating schedule without requiring crew members to work inordinate amounts of overtime in order to meet minimum vessel manning requirements.

1 x Captain 1 x Assistant Captain 1 x Mate 1 x Ferry Terminal Supervisor 15 x Deckhands 1 x Chief Marine Engineer 4 x Marine Oilers

Second Category (71 of 95 personnel) – develop labor pool vital to accomplishing SMS, training, and other areas of critical support noted previously.

8 x Assistant Captains 10 x Mates 13 x Deckhands 1 x Marine Engineer 1 x Senior Port Captain (shore-based, non-union) 1 x Senior Port Engineer (shore-based, non-union) 4 x Relief Captains 4 x Relief Assistant Captains 4 x Relief Mates 9 x Relief Deckhands 4 x Relief Chief Marine Engineers 4 x Relief Marine Engineers 8 x Relief Marine Oilers

The Senior Port Engineer and Senior Port Captain are to be utilized for day-to-day management of the ferries. This will allow for long-term planning and proactive decision- making by upper management staff.

Appendix F 137 Marine Accident Report Assessment of Page 10 Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu GMATS feels that appropriate opportunities be given to well-qualified personnel from within the Staten Island Ferry system to fill these positions. The Deckhands will be brought in from outside the Staten Island Ferry system as this is an entry-level position.

Specifically, the Relief positions will be utilized to allow the permanent crew to be focused on their 1) training while maintaining a level of safety on the boats, and 2) to allow regular personnel to be utilized for any “Special Projects” where their expertise may be better utilized for the benefit of the Staten Island Ferry system.

Whatever decision is made concerning the employment of these additional personnel, GMATS strongly believes that due consideration be given to upgrading licensed employees from within the fleet. This may mean the waiver of existing civil service testing and hiring procedures for current employees. New hires filling upgrades could be tested as per usual. The reason for this is to improve morale within the fleet. The cooperation and enthusiastic acceptance by Staten Island Ferry employees of a new SMS system is key in the success of that system.

**Note, additional staffing beyond what is noted above may be required to implement facility and vessel security plans as required by the International Ship and Port Facility Code (ISPS Code), the Maritime Transportation Security Act of 2002 (MTSA), and United States Coast Guard’s maritime security regulations by July 1, 2004.**

ñ Technical Training and Professional Education

The need for a comprehensive technical training and professional development program for vessel crews and shore-based personnel is obvious. The desire among ferry system personnel to participate in educational programs is apparent. Additionally, the need for an infusion and acceptance of “new blood” is equally evident as it appears the corporate culture has prevented professional growth in the ferry system’s workforce.

The Staten Island Ferry system needs to ensure that each vessel is manned with qualified, certificated, and medically fit personnel with the implementation of the Safety Management System. The SMS will establish procedures so that new personnel and personnel transferred to new assignments related to safety and protection of the environment are given proper familiarization with their duties. The Staten Island Ferry system should establish and maintain procedures for identifying any training which may be required in support of the SMS and ensure that such training is provided for all personnel concerned. Professionally trained personnel are an asset to the SMS and the Staten Island Ferry system. As such, all costs pertaining to the professional education of its workforce should be the burden of the Staten Island Ferry System. Ferry personnel should not be required to use vacation time to attend needed training.

Appendix F 138 Marine Accident Report Assessment of Page 11 Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu

ñ Work Schedules and Employee Compensation

During negotiations with labor unions, every effort should be made to eliminate built-in overtime. It is imperative to move to a standard forty (40) hour week for employees to reduce labor costs. Failing a compromise, vessel schedules can be arranged to accomplish this goal. In hiring new employees, NYC DOT needs to provide professionally documented, certified, medically fit, and qualified personnel to the Staten Island Ferry system.

A marine industry salary survey should also be undertaken to ensure the Staten Island Ferry system compensation structure is closely aligned with similar domestic ferry operations (e.g. Washington State Ferries). This will help to positively impact recruiting, retention, and morale.

ñ Budget and Finance

New revenue sources need to be found to carry out the mission of Staten Island Ferry system. This could include new vessel and terminal concession contracts or other alternative revenue sources. Long-term recommendations in this report are going to require long term funding sources dedicated to Staten Island Ferry operations and maintenance. Capital programs need to be clearly defined for both the short- and long-term and managed directly by the Staten Island Ferry system.

Software systems need to be acquired that link management to the budget and provides for real-time reporting on expenditures of labor and materials. Each division head within the Staten Island Ferry system should formulate a fiscal year budget he or she is directly accountable for managing.

Appendix F 139 Marine Accident Report Assessment of Page 12 Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu Specific Comments and Observations for Immediate Consideration

Safety

ñ Strengthen relations with United States Coast Guard (USCG) Sector New York (previously known as Activities New York) wherein USCG marine inspection elements recognize Staten Island Ferry vessels as 46 CFR Subchapter H – Passenger Vessels.

ñ Conduct a full review of at-sea casualty and emergency response plan (including search and rescue operations) and plan coordinated, table-top and other exercise scenarios with external response assets (NYPD Harbor Units, FDNY Marine Units, U.S. Coast Guard, NJ State Marine Police, private harbor tugs, etc.).

Current emergency contingency plans rely too heavily on external resources, the ability to conduct a vessel-to-vessel transfer at-sea, and the capacity to bring a ferry in the harbor back to one of the ferry landing piers. While the existence and close proximity of extensive and very capable external response resources are critical and should remain an integral component of any ferry contingency plan, it is prudent to have the internal capacity to deal with all possible emergency scenarios as a “first responder.” Circumstances may dictate that a ferry-to-ferry transfer of passengers, moving a vessel to a pier, or use of external response resources does not provide for a practical, safe, or timely response scenario.

ñ Increase lifesaving resources (lifeboats, liferafts, rescue craft, and inherently buoyant apparatus) on all vessels sufficient for 80% of passenger carrying capacity (this amount would be above and beyond what is required for similar types of passenger vessels subject to Coast Guard inspection).

These resources are currently not required for the Staten Island ferries by the U.S. Code of Federal Regulations, but may be critical to prevent loss of life and/or serious injury to passengers and crew in certain emergency contingencies. Also, consider replacing existing davit-launched, antiquated, low-freeboard, manually-powered rowboat with a quick–launching, Zodiac-type rigid hull inflatable with a 50- horsepower outboard propulsion motor.

ñ Install marine evacuation slides on all vessels.

In conjunction with the increase of lifesaving resources listed above, installation of marine evacuation slides may greatly decrease the risk of loss of life and/or serious injury to passengers and crew in certain crisis scenarios by keeping people out of the water during these events.

Appendix F 140 Marine Accident Report Assessment of Page 13 Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu ñ Install additional Personal Flotation Device (PFD) storage compartments on car deck tunnels of Kennedy class vessels.

During some emergency scenarios, passengers and crew may need to assemble on the car deck and PFDs should be accessible in that location as well -- provided a comprehensive risk assessment is completed considering safety versus security issues in allowing passengers easy, open access to the car decks – see related comment below regarding removal of metal gates/fencing/screen on car decks.

ñ Confirm each vessel has enough PFDs to meet or exceed 100% passenger and crew carrying capacity.

During testing for alternate compliance (wherein a simulated transfer of passengers between ferries took place), GMATS observed PFDs from different vessels on the crew members. It is possible that PFDs assigned to a particular vessel may be utilized aboard other vessels in the fleet.

ñ Replace scissor-type gates currently used for crowd control aboard the vessels with rolling, expanded metal gates to afford additional protection for children.

These gates currently are approximately 14” above the deck. This gap opens the possibility for a child to “scoot” out over the side without any protective barrier.

ñ Move passengers away from the bow “picklefork” areas while vessel is docking.

This has already been partially implemented. A small rope has been installed. Passengers outside are exposed to risk of injury should a collision or hard landing occur. Passengers should be prohibited from “picklefork” area while vessel is landing to prevent injury or loss of life.

ñ Remove expanded metal gates/fencing/screen on car decks of Kennedy class ferries.

This allows for assembly of passengers prior to evacuation. *** A comprehensive risk assessment must be conducted to consider an appropriate balance between safety and security in allowing passengers easy, open access to the car decks in the event of an emergency situation. Removal of these security measures may not be viable.***

ñ Provide complete set of blueprints, vessel plans, and engineering equipment manuals for each engine room.

Currently there are no plans in the engine room. In case of an emergency, the engineers would not have the availability to utilize prints for damage control or manuals to conduct underway diagnosis, maintenance, and repairs.

Appendix F 141 Marine Accident Report Assessment of Page 14 Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu

ñ Post fire and emergency control plan/schematic in the engine room and on the navigation bridge of each vessel.

Regulations require and accepted industry practice dictates a Fire and Emergency Plan be posted in these areas.

ñ Confirm fire main shore connections on all vessels are appropriately marked and easily accessed and identifiable by New York City Fire Department (FDNY) as well as other regional fire emergency response personnel that may respond to an emergency situation aboard the ferries.

Currently, markings for the FDNY shore connection are located on a large, bolted panel well above the actual shore connection device. This could lead to confusion or delay in an emergency situation. Also, both shore connections aboard the Kennedy- class vessels are located behind the locked gates referred to previously. Further, it appears that the shore connection is co-located with an individual fire station and may not directly tie into the central fire main piping as required.

ñ Provide Self-Contained Breathing Apparatus (SCBA) aboard each vessel enough for each crew member below the rank of Captain.

Accepted industry practice dictates proper firefighting resources be provided to crew members to include SCBAs.

ñ Accelerate installation of pre-recorded, automated safety and emergency announcements for delivery over public address systems prior to departure and while approaching pier landing area before docking.

These formalized safety announcements may be critical in saving lives prior to an emergency.

ñ Improve medical response and first aid capabilities aboard ferries.

Increase crew medical knowledge and training and supply sufficient equipment to provide adequate first response to a wide-range of possible medical-related emergencies and non-emergency situations.

ñ The NYC DOT and the US Coast Guard should work together to examine all the safety recommendations listed above to determine appropriateness for each particular ferry. The table top exercises described on page 12 may be helpful in this activity.

Appendix F 142 Marine Accident Report Assessment of Page 15 Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu Bridge Team Management

ñ Create multiple, standardized watchstanding conditions requiring extra manning during adverse environmental and weather situations.

ñ Require and enforce that all navigation bridge electronics and communications gear be energized and fully operational at all times while underway regardless of weather conditions and sea state unless special circumstances exist.

ñ Update navigation bridge equipment and improve layout.

Existing layout of navigation bridge equipment does not provide for the most efficient monitoring of critical sensor, communications, and navigation gear by persons responsible for the safe navigation and piloting of the ferries. Equipment to be updated or newly installed include RADAR, Automated RADAR Plotting Aids (ARPA), Electronic Chart Display and Information System (ECDIS), Automatic Identification System (AIS), and digital, multi-directional vessel speed indicators with alarm functions (which allows vessel personnel to monitor vessel speed fore/aft and athwartships including approach speeds to berths). Consider installation of integrated navigation bridge systems aboard all ferries.

ñ Develop operational checklists (vessel departures, arrivals, foul weather, emergencies, etc.) required to be used by afloat personnel.

Use of formal operations checklists will be part of the safety management system and reduces potential for complacency, tedium, and creates error traps.

ñ Provide specific navigation bridge equipment operations training.

All vessel personnel with responsibility for the safe navigation and piloting of the ferries should have initial as well as periodic refresher training in the capabilities, limitations, and operation of all navigation bridge equipment.

Appendix F 143 Marine Accident Report Assessment of Page 16 Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu Training

ñ Establish a formal process and methodology for documenting mariner and shoreside personnel training and qualifications.

This is to promote qualified training and to eliminate the possibility of nepotism and discrimination.

ñ Provide formal Situational Awareness and Human Factors training to all personnel responsible for ferry operations including shoreside personnel.

These programs will be part of a comprehensive, long-term training and education plan which will be an integral component of the safety management system.

ñ Provide crisis management training (including crowd management and control training) to all vessel personnel including galley employees in accordance with U.S. and international regulatory requirements and accepted industry practices.

Currently, vessel personnel have no formal training in crowd control procedures and techniques. This training may be critical to saving lives in an emergency.

Operations

ñ Establish formal, internal policies and procedures for and publicize an alternate ferry service operational schedule for foul weather and adverse environmental conditions (i.e. reduced visibility, high winds, excessive wave and/or current action, etc.)

U.S. navigation law requires that foul weather and other adverse environmental operating conditions be considered when determining a safe vessel speed. Normal ferry service speed while operating in these conditions is not appropriate. Making sure the riding public is made aware of the impacts of these factors on ferry operations including necessitated changes to the schedule is crucial in order for customers to make the most informed decisions about their travel.

ñ Institute constant and continuous safety and security rounds by the deckhands while ferries are underway.

GMATS observations indicate that deck crews do not make routine rounds for safety, security, and to enforce posted policies (e.g. smoking and alcohol consumption).

ñ Expand the content and delivery method of the existing passenger survey program.

Appendix F 144 Marine Accident Report Assessment of Page 17 Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu ñ Accelerate schedule to uniform deckhands and all engine room employees; make distinction between oilers and CME/ME with traditional maritime uniforms.

At present time, crew members are difficult to distinguish from passengers. In a crisis, the passengers will look for clear direction from uniformed crew members.

ñ Modify existing work schedules and crew exchanges for afloat personnel to provide for proper amounts of rest and to reduce fatigue.

Current watch rotations and work schedules may be negatively impacting ability for crew to gain appropriate rest time to maintain the highest levels of alertness.

ñ Establish formal procedures and standing orders and develop methods for monitoring to ensure compliance with these procedures and orders.

This will be part of the safety management system and subject to change based on a more thorough assessment and implementation of a bridge team organization. However, development of standing orders and procedures and a system to monitor compliance can be done now.

ñ Limit radio communications aboard the ferries (especially during approach, docking, and undocking evolutions) to operational necessities.

GMATS observed communication exchanges between shoreside staff and afloat crew during critical operational periods described above. The substance of these conversations related to overtime and other administrative topical matters.

Other Areas

ñ Provide public safety and security resources for all vessels and terminals in the Staten Island Ferry system through formal arrangements with agencies to facilitate utilization of federal, state, and local law enforcement elements.

Appendix F 145 Marine Accident Report Assessment of APPENDIX A Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu Management Position Description

Title: Chief Operations Officer – Staten Island Ferries

The Chief Operations Officer (COO) – Staten Island Ferry reports directly to the Deputy Commissioner, Passenger Transport Division, New York City Department of Transportation (NYCDOT). The COO provides the leadership and direction for the operation of Staten Island Ferry vessels and terminals. A key role of the COO is to ensure the Staten Island Ferry operates as a first-class marine transportation system that is safe, secure, fiscally sound, and environmentally sensible while providing superb customer service for the citizens of the City of New York and others who utilize the Staten Island Ferry marine transportation system.

Principal Duties and Responsibilities

1) Overall management and control of Staten Island Ferry system and NYCDOT terminal operations. 2) Direct activities of and provide policy direction and guidance to senior Staten Island Ferry management personnel, specifically, subordinate Directors of Finance, Human Resources, Maintenance, Marine Operations, and Terminal Engineering. 3) Manage appropriated funding to successfully accomplish Staten Island Ferry mission statement. a) Ensure adequate resources are made available to provide for an effective safety management system (SMS) and proper maintenance of vessel fleet and shore-side facilities, infrastructure, and equipment, and other NYCDOT-controlled assets. b) Protect existing funding sources and recommend alternative sources to ensure proper funds required to maintain and upgrade the Staten Island Ferry system. c) Identify areas of operational cost reductions, when feasible. 4) Provide overall direction for and ensure compliance with established safety management system (SMS). 5) Ensure safety, security, health, and environmental standards are met throughout the operation. 6) Promote and maintain a workforce culture of good order, discipline, high morale, and ethical soundness within the Staten Island Ferry system. a) Ensure NYCDOT policies and procedures are applied consistently and fairly within the Staten Island Ferry organization. b) Ensure all Staten Island Ferry system employees have working knowledge and understanding of all applicable NYCDOT policies and procedures. c) Meet with employees as necessary to clarify and discuss policy, procedures, and rules issues.

Appendix F 146 Marine Accident Report Assessment of APPENDIX A Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu 7) Facilitate continuous professional growth of Staten Island Ferry system employees through professional education, technical training, and mentorship programs. 8) Manage the Staten Island Ferry system in accordance with all applicable laws, regulations, and industry best practices. a) Maintain close liaison with the NYCDOT legal staff and obtain legal opinions on decisions as necessary. 9) Translate broad goals articulated by the NYCDOT Commissioner into Staten Island Ferry action plans. 10) Provide customer service levels commensurate with demand and goals. 11) Act as senior advisor on maritime matters to the NYCDOT Commissioner and/or Deputy Commissioner as well as other individuals or organizations as directed by the Commissioner. 12) Apprise the Commissioner of significant events and potential problem areas within the Staten Island Ferry system in a timely manner. Coordinate Staten Island Ferry system activities with key NYCDOT staff. 13) Promote and maintain close working relationships with federal, state, and local government agencies, including the U.S. Coast Guard and the Metropolitan Transportation Authority (MTA) – Staten Island Ferry system’s intermodal connections. 14) Prepare and deliver testimony and reports as directed by the Commissioner. 15) In close coordination with the NYCDOT Offices of the Commissioner and Public Information, serve as primary representative of the Staten Island Ferry system to the public. a) Provide fast, factual, and frank information for response to media inquires. b) Speak at public functions representing the Staten Island Ferry system. c) Maintain liaison and facilitate positive working relations with key citizen and other stakeholder groups.

Knowledge, Skills, and Abilities

Education: Requires a college degree in operations management, business management, marine transportation, nautical science, marine engineering, or related discipline. Industry relevant work experience may be substituted for college degree.

License: United States Coast Guard license as Master or Chief Engineer.

Experience: Requires at least seven to ten years experience with a large passenger ferry system in a management capacity with significant experience in labor relations and contract negotiations. Requires at least five to ten years experience serving as either Captain and/or Chief Engineer aboard large passenger ferries.

Appendix F 147 Marine Accident Report Assessment of APPENDIX A Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu Specialized Knowledge:

• Must have extensive knowledge of ferry terminal and ferry operations. This includes

marine engineering and vessel maintenance and repair.

• Must have a working knowledge of proven managerial and leadership principles, with the

ability to influence other management team members and lead a department of technically proficient individuals.

• Must have extensive knowledge of safety, health, and environmental issues as they affect

the workplace, including all applicable regulatory schemes. Must be familiar with maritime and admiralty law.

• Must have knowledge of safety management system principles, policies, and procedures

and the ability to effectively implement them.

• Must have working knowledge of budget preparation, financial management, and their

applications. This includes an understanding of basic accounting, statistics, problem solving, goal setting, and business applications. Skills:

• Must be able to demonstrate strong leadership, influencing, and motivation skills.
• Must have demonstrated negotiation skills.
• Must be able to exercise sound business judgment in order to set direction and establish

priorities.

• Requires excellent managerial skills, including planning, organizing, and directing work.
• Requires advanced level verbal and written communications skills in English, in addition

to effective interpersonal skills.

• Requires excellent analytical skills, including the ability to extract and analyze data.
• Requires exceptional time management, due to fast-moving, demanding work

environment.

• Must be able to create and deliver effective presentations.
• Must be able to exercise discretion and good judgment, with an ability to understand the

effect of decisions in the overall organization.

• Must be able to use a desktop and laptop computer and standard business software

applications with ease.

• Requires the ability to successfully represent the Staten Island Ferry system to the public,

the City of New York, government agencies, and other stakeholders.

• Requires the ability to positively interface with customers and employees with tact and

courtesy.

• Must be adept in corporate communications and public relations.

Appendix F 148 Marine Accident Report Assessment of APPENDIX B Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu

Sample Short-term Management Organization Matrix

Director of Municipal Ferry Operations Vessel Maintenance & Repair Terminal Maintenance Senior Port Captain (Shore-based, non-union, management) Senior Port Engineer (Shore-based, non-union, management)

Safety – Designated Person

Appendix F 149 Marine Accident Report Assessment of APPENDIX C Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu

Sample Long-term Management Organization Matrix

Chief Operations Officer Director of Finance Director of Marine Operations Director of Terminal Engineering Affirmative Action Officer Confidential Secretary Director of Maintenance Director of Human Resources Accounting Administrative Services Contracts/Legal Private Ferries Budget Auditing Information Technology Planning Employee Development Human Resources Services Labor Relations Payroll Senior Port Engineer Vessel Maintenance Vessel Preservation Senior Port Captain Operations Center Customer Service Terminal Construction Terminal Maintenance Terminal Design Safety – Designated Person Operations Planning Material Management

Appendix F 150 Marine Accident Report Assessment of APPENDIX D Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu Management Position Description

Title: Senior Port Captain

Position Objective

Manage day to day marine operations including vessel traffic, licensed and unlicensed deck personnel, and facilities, to assure ferry system reliability and efficiency. Set standards for safety of crew and passengers in accordance with all applicable safety rules, regulations, industry standards, and best practices. Directly supervise and provide leadership to all deck department ferry personnel. Coordinate regulatory interaction with ferry system. Develop budget for input to Director of Municipal Ferry Operations.

This position reports to the Director of Municipal Ferry Operations

Qualifications

The Senior Port Captain must possess a wide range of operating knowledge of all the ferry systems. The position calls for inspired leadership to motivate shipboard and shore side personnel with an emphasis on regulatory agency compliance. Possess a strong background in a Safety Management System environment. Experienced in labor relations, negotiations and grievance resolution. Must be able to work within the community to develop good community relations.

Must possess a United States Coast Guard License as Master.

Nature and Scope

This is a mission critical position responsible for the day to day management of the Staten Island Ferry deck departments and deck personnel. This position supervises all phases of deck operations and personnel. As Senior Port Captain, responsible to coordinate all activities of vessels and operating personnel from an operational perspective. Candidate will interact with regulatory agencies and civil authorities to keep vessels and personnel in compliance with all known regulations. Will be the lead technical advisor to Director of Municipal Ferry Operations for labor negotiations. Will prepare budgets and supervise expenditures related to the deck department. Will directly oversee all operational functions including, but not limited to, certification of personnel. Is the first point of contact for issues relating to the deck department.

Appendix F 151 Marine Accident Report Assessment of APPENDIX D Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu

Principal Responsibilities

Manage day to day ferry system deck operations.

Maintain deck department crewing schedules within the framework of a Safety Management System.

Supervise deck department personnel and staffing on a 24 hour a day basis.

Approve labor, materials, supplies, equipment and parts within vessel deck department operating budgets.

Evaluate routine deck department work orders, stores requests and labor expenditures to assure they comply with budgetary constraints.

Manage vessel regulatory compliance for nautical and radio areas.

Be the technical advisor to the CEO for corporate communications involving the deck department.

Appendix F 152 Marine Accident Report Assessment of APPENDIX E Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu Management Position Description

Title: Senior Port Engineer

Position Objective

Manage day to day engine department operations and maintenance, including facilities and personnel, to assure vessel propulsion system reliability and efficiency. Maintain vessels for safety of crew and passengers in accordance with all applicable safety rules, regulations, industry standards, and best practices. Directly supervise and provide leadership to licensed and unlicensed engine department professional marine engineers and oilers. Schedule vessel maintenance with Staten Island Ferry repair yard or commercial yards and direct routine vessel maintenance programs. Coordinate regulatory interaction with vessel engine departments.

This position reports to the Director of Municipal Ferry Operations

Qualifications

The Senior Port Engineer must possess a wide range of operating knowledge of engine room operation and maintenance practices of a large marine passenger ferry operation. The position calls for shipyard contract management experience with an emphasis on regulatory agency compliance. Possess a strong background in a Safety Management System environment. Experienced in labor relations, negotiations and grievance resolution.

Must possess a United States Coast Guard License as Chief Engineer.

Nature and Scope

This is a mission critical position responsible for the day to day management of the Staten Island Ferry engine rooms and personnel. This position supervises all licensed and unlicensed engine room personnel. As Senior Port Engineer, responsible to coordinate all maintenance items related to the vessels, to include commercial yard and repair facilities. First point of contact in dealing with regulatory agencies to keep vessels and personnel in compliance with all known regulations. Ensure vessels are crewed, stored and maintained to meet and complete Staten Island Ferries scheduled runs.

Appendix F 153 Marine Accident Report Assessment of APPENDIX E Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu Principal Responsibilities

Manage day to day engine operations and maintenance.

Maintain vessels within the framework of a Safety Management System.

Supervise engine room personnel and staffing on a 24 hour a day basis.

Approve labor, materials, supplies, equipment and parts within vessel engine department operating budgets.

Evaluate routine work orders, stores requests and labor expenditures to assure they comply with budgetary constraints.

Manage vessel regulatory compliance.

Appendix F 154 Marine Accident Report Assessment of APPENDIX F Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu Management Position Description

Title: Safety Manager/Designated Person

Position Objective

Directs the Safety Management System (SMS) for Staten Island Ferries and oversees the Corrective Action Reporting (CAR) Program and the SMS internal audit system. Manage the day to day coordination of the Safety Management System to ensure the Staten Island Ferries are in full compliance with the International Safety Management (ISM) Code for the Safe Operation of Ships and for Pollution Prevention. Supervise compliance with 46 CFR Subchapter W, Part 199.630, Alternatives for Passenger Vessels. Develops and supervises formal training of vessel personnel to comply with alternative provisions of the ISM Code.

This position reports to the Director of Municipal Ferry Operations and to the Deputy Commissioner as required by the ISM Code.

Qualifications

Thorough knowledge of all international and domestic regulatory requirements, application of marine safety management system programs and must possess a Master’s or Chief Engineer’s license. Knowledge of policies and procedures in the operation and maintenance of a large marine passenger ferry organization. Ability to plan strategic and effective positions for a successful and safe operating program.

Nature and Scope

This mission critical position is responsible for identifying and recommending solutions for SMS policy issues across the organization and has access to the CEO for SMS policy issues that demand the highest level of organizational action.

Appendix F 155 Marine Accident Report Assessment of APPENDIX F Staten Island Ferry Operations February 12, 2004

Global Maritime and Transportation School

Telephone: +1 (516) 773-5120 At the United States Merchant Marine Academy

Facsimile: +1 (516) 773-5353 Kings Point, New York, USA

Email: gmats@usmma.edu Principal Responsibilities

Functions as the Designated Person for Staten Island Ferries and directs the Safety Management System.

Is the key link between vessel and shore in Staten Island Ferries SMS program, holding authority to inspect all SMS records and work sites, hold drills and bring SMS problems to the attention of appropriate personnel.

Directs labor and non-labor budget planning and management for the Safety Office.

Participates in vessel casualty investigations.

Participates in investigations involving injury to passengers or crew.

Participates in investigations involving pollution of the environment.

Supervises the content of SMS documentation and advises the CEO of SMS matters that require the highest level of attention.

Oversees the Corrective Action Reporting System and conducts timely audits of vessels and terminals.

Keep current all formal training of Staten Island Ferry personnel to comply with SMS requirements.

this page intentionally left blank

FD07277 ｜ 2003_美国_NTSB_MAR0502_Capsizing_of_US_Small_Passenger_Vessel_TakiTooo.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2003 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Capsizing of U.S. Small Passenger Vessel Taki-Tooo, Tillamook Bay Inlet, Oregon June 14, 2003 Marine Accident Report NTSB/MAR-05/02 PB2005-916402 Notation 7582B National Transportation Safety Board Washington, D.C.

this page intentionally left blank

Marine Accident Report Capsizing of U.S. Small Passenger Vessel Taki-Tooo, Tillamook Bay Inlet, Oregon June 14, 2003 NTSB/MAR-05/02 PB2005-916402 National Transportation Safety Board Notation 7582B 490 L’Enfant Plaza, S.W. Adopted June 28, 2005 Washington, D.C. 20594

National Transportation Safety Board. 2005. Capsizing of U.S. Small Passenger Vessel Taki-Tooo, Tillamook Bay Inlet, Oregon, June 14, 2003. Marine Accident Report NTSB/MAR-05/02. Washington, DC. Abstract: This report discusses the June 14, 2003, accident in which the U.S. small passenger vessel Taki- Tooo capsized while attempting to cross the bar at Tillamook Bay, Oregon. A master, deckhand, and 17 passengers were on board the charter fishing vessel when it was struck broadside by a wave and overturned. The master and 10 passengers died in the capsizing; the deckhand and 7 passengers sustained minor injuries. The Taki-Tooo, with a replacement value of $180,000, was a total loss. From its investigation of the accident, the Safety Board identified the following major safety issues: decision to cross the bar, Tillamook Bay operations, and survivability. On the basis of its findings, the Safety Board made recommendations to the U.S. Coast Guard, the National Marine Charter Association, and the owners and operators of charter fishing vessels operating out of Tillamook Bay, Oregon. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2005-916402 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Marine Accident Report Contents Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Damages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Personnel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Master . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Deckhand . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Vessel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 General Construction and Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Lifesaving Apparatus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Certification and Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Wreckage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Waterway Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Bay Entrance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Tide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Water Temperature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Tillamook Bar Restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Company Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Medical Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Toxicology Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Search and Rescue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Cold Water Immersion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Coast Guard Safety Alert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Propeller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Chart Plotter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Coast Guard Surf Stations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Coast Guard Authority Regarding Unsafe Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Coast Guard Regulations on Wearing of Lifejackets . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Actions After Taki-Tooo Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Condition of Tillamook Bar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 National Marine Charter Association . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Contents iv Marine Accident Report Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Decision to Cross the Bar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Personal Factors Potentially Affecting the Taki-Tooo Master’s Decisions . . . . . . . . . 41 Decision of the Charter Operators to Leave Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Tillamook Bay Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Navigational Conditions at the Bar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Bar Restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Survivability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 Appendixes A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 B: Accident Chronology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 C: Boating Safety Pamphlet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 D: Coast Guard–Approved Lifejackets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

v Marine Accident Report Acronyms and Abbreviations A-VIP Accredited Vessel Inspection Program CFR Code of Federal Regulations COI certificate of inspection COTP Captain of the Port EMS emergency medical service EPIRB emergency position indicating radio beacon GPS Global Positioning System ICAO International Civil Aviation Organization IFR interim final rule MLB motor lifeboat NMCA National Marine Charter Association NPRM notice of proposed rulemaking NWG Natural Working Group OHSU Oregon Health and Science University PFD personal flotation device SNPRM supplemental notice of proposed rulemaking WAAS Wide Area Augmentation System

vi Marine Accident Report Executive Summary On June 14, 2003, the small passenger vessel Taki-Tooo, a U.S. charter fishing vessel with 2 crewmen and 17 passengers on board, was en route from the marina at Garibaldi, Oregon, to the Pacific Ocean for a day of fishing. A small craft advisory was in effect for the northern Oregon and southern Washington coasts, and personnel at U.S. Coast Guard Station Tillamook Bay had activated the rough bar warning signs based on their assessments of existing hazardous conditions. At the Tillamook Bay inlet, the Taki- Tooo operator waited in the channel for an opening in the ocean swells so that he could cross the bar. After the Taki-Tooo exited the inlet and turned northward around the north jetty, a wave struck and capsized the vessel. As a result of this accident, the master and 10 passengers died; the deckhand and 7 passengers sustained minor injuries. The vessel, which had a replacement value of $180,000, was declared a total loss. The Safety Board’s investigation of this accident identified the following major safety issues: • Decision to cross the bar • Tillamook Bay operations • Survivability The National Transportation Safety Board determines that the probable cause of the capsizing of the Taki-Tooo was the decision of the master to attempt to cross Tillamook Bay bar despite the hazardous sea state that existed at the time. Contributing to the severity of the accident was the failure of the Taki-Tooo master to ensure that he, the deckhand, and the passengers donned lifejackets before crossing the bar. Also contributing to the severity of the accident was the failure of the U.S. Coast Guard to enforce the regulatory requirement at 46 Code of Federal Regulations 185.508, which stipulates that vessel masters shall require passengers to wear lifejackets when transiting a hazardous bar. As a result of this investigation, the Safety Board makes recommendations to the U.S. Coast Guard, the National Marine Charter Association, and the owners and operators of charter fishing vessels operating out of Tillamook Bay, Oregon.

1 Marine Accident Report Factual Information Synopsis About 0605 the morning of June 14, 2003,1 the U.S. charter fishing vessel Taki- Tooo departed the marina at Garibaldi, Oregon, with 17 passengers and 2 crewmembers on board. The vessel proceeded to an area near the seaward entrance to Tillamook Bay, where the master waited for an opening in the ocean swells to navigate the hazardous shoal area.2 About 0715, the Taki-Tooo left the inlet, turned to the north, and encountered a wave that capsized the vessel. The master and 10 passengers died (two persons were missing and were declared dead). The deckhand and seven passengers either washed or swam ashore on a nearby beach and survived. Accident Narrative The day before the accident—Friday, June 13, 2003—the National Weather Service in Portland, Oregon, had issued marine forecasts3 containing a small craft advisory4 for coastal areas of southern Washington and northern Oregon, which included Tillamook Bay (see figure 1). For most of the day, the U.S. Coast Guard Station at Tillamook Bay (Station Tillamook Bay) did not place any vessel restrictions on marine traffic into or out of the bay. At 1645, the National Weather Service updated the area small craft advisory, predicting heavy seas with wind waves of 4 feet and 10-foot swells. According to its station log, Station Tillamook Bay immediately restricted vessel passage across Tillamook bar, the sandy shoal at the mouth of Tillamook Bay, which is flanked by jetties on the north and south (figure 2). 1 All times are Pacific daylight time, based on the 24-hour clock. A complete accident chronology is found in appendix B. 2 On the West Coast, the open expanse of the Pacific Ocean permits the wind energy to build, generating large swells, or waves created over a long distance. Wave conditions at the estuary at Tillamook Bay are compounded by the wave action caused by the prevailing winds in the immediate area. Navigation at the site is further complicated by the complex current characteristics at the bay inlet. 3 Marine forecasts for ocean-coastal zones. In the case of the coastal zone that included Tillamook, coastal waters are 20 nautical miles from shore. Thus, the 11-foot swells predicted for coastal waters could have improved or worsened by the time they reached the bar area and shore. 4 A small craft advisory is issued to alert vessel operators whenever sustained winds of 20 to 33 knots inclusive, or seas of 7 feet or greater, are either ongoing or forecast to develop in the next 12 hours. The National Weather Service has no official definition for the term “small craft.” However, the U.S. Coast Guard considers any vessel less than or equal to 33 feet to be a small craft.

Factual Information 2 Marine Accident Report Station Tillamook Bay broadcast the bar restriction via VHF-FM channels 16 and 22A5 and on citizens band channel 9. In addition, Coast Guard personnel raised a small- craft advisory flag at the station and activated the yellow lights on the rough bar advisory signs at both the station and the 68-foot-high Coast Guard observation tower on the north side of the Tillamook Bay inlet, about 900 yards east of the north jetty tip. The restriction Figure 1. Location of Tillamook Bay and accident area. 5 Channel 16 (156.8 MHz), which the Coast Guard monitors continuously, is the international calling and distress frequency. Channel 22A (157.1 MHz) is the Coast Guard’s primary working channel, which it uses to broadcast severe weather warnings, hazards to navigation, and other maritime safety warnings to recreational and commercial mariners. Seattle WASHINGTON P a c i f i c O c e a n Tillamook Astoria Portland OREGON Garibaldi Tillamook Bay Cape Disappointment Manzanita 0 0 100 Miles 100 Kilometers Accident Site N Columbia River Columbia River OR WA ID MT WY NV CA UT CO AZ 0 0 1 km 1 mile Tillamook Bay Bay City Garibaldi Tillamook Miami Cove P a c i f i c O c e a n Rockaway Beach

Factual Information 3 Marine Accident Report established by the Coast Guard station applied only to all recreational boats and uninspected small passenger vessels; it did not apply to inspected charter or commercial fishing vessels in the area.6 At 0330 the morning of the accident (Saturday, June 14), the National Weather Service issued another small craft advisory for the northern Oregon and southern Washington coasts, this time forecasting wind waves of 3 feet and northwest swells of 11 feet at 11-second intervals. At 0445, a Coast Guard seaman began duty in the observation tower to monitor vessel traffic. He was equipped with a VHF radio, handheld binoculars, and tripod- mounted “big-eye” binoculars with a 25 × 150 millimeter lens. At first light (0446), a 47- foot motor lifeboat (MLB) left Station Tillamook Bay to assess conditions at the Tillamook bar.7 The MLB was manned by a crew of four, including a coxswain.8 Coast Figure 2. Looking southeast from Pacific Ocean toward Tillamook Bay, with inlet between north jetty (left) and south jetty (right). The Tillamook bar, not shown, is west of the jetty tips. The Taki-Tooo capsized outside the tip of the north jetty and washed up on the sandy beach on the left of the photo. 6 To restrict the waterway to all vessel traffic required that the Coast Guard authority for the zone, in this case, the Captain of the Port in Portland, Oregon, order the closure. Additional information related to Coast Guard procedures regarding bar closures appears in the “Waterways” section of this report. 7 The Coast Guard’s 47-foot MLBs are high-speed craft especially designed for use in severe weather and rough seas. 8 A coxswain is the authority in charge of a boat and its crew while under way. The coxswain in question was a qualified MLB coxswain who had undergone special training to direct the 47-foot MLB. He was training to be a surfman (a coxswain certified by the Coast Guard to perform rescues in surf and heavy, breaking seas) but had not attained that qualification by the time of the accident. See “Coast Guard Surf Stations” section for further information on surfmen. U.S. Army Corps of Engineers photo U.S. Army Corps of Engineers photo

Factual Information 4 Marine Accident Report Guard logs indicate that, at 0512, the MLB coxswain notified Station Tillamook Bay that he recommended continuing the bar restriction because of turbulent (sloughing and plunging) seas at the ends of the jetties and 8- to 10-foot swells outside the jetties. The staff duty officer and officer of the day concurred with the coxswain’s assessment and at 0514, the Coast Guard rebroadcast the previous day’s bar restriction. The MLB then remained on patrol in the waterway to prevent any recreational boats or uninspected small passenger vessels from attempting to transit the bar. Shortly before 0530, the Taki-Tooo master left his home in Garibaldi, Oregon, for Garibaldi harbor, where the vessel was moored (see figure 3).9 The Taki-Tooo was a charter fishing vessel inspected by the Coast Guard under Title 46 Code of Federal Regulations (CFR) parts 175-185 (subchapter T). The master had been scheduled by the couple who owned Garibaldi Charters to take a fishing party of 17 into the Pacific Ocean for 6 hours of bottom fishing10 that morning. The master had checked the weather forecast posted on computer websites the evening of June 13. The following morning, he continued to monitor the weather and bar conditions on his VHF radio at home. He also had a VHF radio in his truck that he typically listened to while en route to the harbor. The manager of the charter company office stated that the Taki-Tooo master “bounced in the door that morning. . . . he was joking with people and laughing.” The 9 Except as noted otherwise, the actions of the Taki-Tooo master are based on his wife’s recollection as told to Safety Board investigators. Figure 3. Approximate route of the Taki-Tooo from Garibaldi marina to accident site. 10 Dropping or casting a weighted, baited hook to the bottom of a body of water and waiting for a bite from bottom fish such as ling cod, flounder, and rockfish. P a c i f i c O c e a n South Jetty North Jetty Site of capsizing N Coast Guard lookout tower Coast Guard station Miami Cove Marina Barview Garibaldi Channel Tillamook Bay

Factual Information 5 Marine Accident Report deckhand of the Taki-Tooo, one of the survivors of the accident, told Safety Board investigators that when the master arrived at the charter company office shortly after 0530, she and he agreed that because of weather conditions at the bar, they would not set crab pots11 as originally planned. At the Garibaldi marina, vessels were preparing to depart for a day’s fishing in the ocean. The Taki-Tooo was a 32.5-foot-long vessel having a single 250-horsepower diesel engine. The other commercial vessels that sailed early that morning and their characteristics were as follows: • Small passenger vessel Oakland Pilot (44.4-foot-long, 730-horsepower, twin- engine charter fishing boat). • Small passenger vessel Norwester (41.8-foot-long, 420-horsepower, twin- engine charter fishing boat). • Small passenger vessel D & D (32.4-foot-long, 230-horsepower, single-engine charter fishing boat built by the same manufacturer as the Taki-Tooo and having the same molded hull and virtually the same size). • Uninspected commercial fishing vessel Amanda (23 feet long, single engine). Two other small charter boats, the Bullfrog and the Kerri Lin, had scheduled fishing trips for the day. However, the operator of the Bullfrog, a six-passenger uninspected vessel that fell under the Coast Guard’s bar restriction, cancelled the fishing trip. His two passengers then elected to go on other vessels, with one being assigned to the Taki-Tooo and the other to the D & D. The owner of the Kerri Lin, a 29.4-foot-long small passenger vessel having a single 330-horsepower engine, later told investigators that he decided to cancel his day’s charter because he had a policy of not operating once the sea swell reached “double digits,” meaning 10 feet. At 0530, the Oakland Pilot left the Garibaldi marina and headed for Tillamook Bay inlet. Shortly afterward, the Taki-Tooo master and deckhand went to their boat and boarded the 17 passengers. According to the deckhand, the master gave a safety briefing informing the passengers that lifejackets were stored inside the cabin in labeled bins under the table, and that if anybody wanted to put one on, “it was up to them” and that passengers should “just ask us if they needed help getting them on or anything.” The deckhand stated that the master also told passengers that the vessel was equipped with a liferaft and a throw ring, and that the cabin had an emergency flare kit and a first aid kit. She said that the master described his personal rules against alcohol, drugs, throwing trash overboard, or being sick in the cabin, and told the passengers that they were not going to take crab pots out because of the rough seas. The safety briefing did not include a demonstration of how to don a lifejacket. According to Federal regulations at 46 CFR 186.506, as an alternative to a demonstration, 11 Crab pots are wire-mesh cages that contain bait, such as fishheads, to attract crabs. Crab-fishing (“crabbing”) from a boat involves setting the pots in the water attached by a line to a buoy so they can be pulled up later. Charter boats often set crab pots on the way out to the fishing grounds and retrieve them on the return trip.

Factual Information 6 Marine Accident Report passengers can receive a card or pamphlet containing the required lifejacket information before the vessel gets under way. The deckhand told Safety Board investigators that the Taki-Tooo’s cabin had a placard showing how to don a lifejacket. About 0600, the Taki-Tooo, the Norwester, the D & D, and the Amanda departed the marina. The Taki-Tooo master assumed control of his vessel from the flying bridge12 and proceeded toward the entrance to the inlet. The deckhand described the master as being happy and joking, “just like normal.” By 0645, the Taki-Tooo had arrived at the north jetty, along with the Norwester, the D & D, the Amanda, and the Oakland Pilot, which had been there nearly an hour. At this time, the tide was ebbing, which, according to a boating safety pamphlet for recreational vessels jointly published by the Oregon State Marine Board and the Coast Guard, makes the Tillamook Bay bar especially dangerous to cross.13 The pamphlet indicates that vessels should cross the bar during “slack water,” that is, during the time at high or low tide when no appreciable current is flowing in a body of water. On this morning, the low tide (minus 2.1 feet) was predicted at 0721. The slack water would occur at the same time. Federal regulations at 46 CFR 185.508 stipulate “the master of a vessel shall require passengers to don lifejackets when possible hazardous conditions exist, including, but not limited to . . . when transiting hazardous bars and inlets.” (See “Coast Guard Regulations on Wearing of Lifejackets” section for further information.) None of the vessel operators preparing to cross the bar, including the master of the Taki-Tooo, directed his passengers to don lifejackets. Several of the masters later told Safety Board investigators that if the conditions were so dangerous that they needed to ask passengers to wear lifejackets, they would not, or should not, take their vessels out. Meanwhile, the MLB coxswain moved his boat up to the jetty tips to observe each charter vessel go across the bar and then repositioned himself next to the tower so other vessels could pass him. The tower watch prepared to maintain visual contact with the vessels until he observed that they had safely crossed the bar and made it out to calmer seas. Other witnesses to the crossings included the Amanda master, who later told investigators that he decided not to attempt the crossing but to stay and watch the other vessels, and one of the owners of Garibaldi Charters, whose son was operating the Norwester and whose daughter was the deckhand on the Taki-Tooo. The Garibaldi Charters co-owner had driven to the parking area near the Coast Guard observation tower, where he had a “good view” of the vessels in the waterway. A little later, about 0700, the Kerri Lin owner arrived at the north jetty to watch the vessels leave the inlet. The Taki-Tooo, the D & D, the MLB, and the Amanda were on the north side of the channel, near the jetty, and the Norwester and Oakland Pilot were “backing strongly” near the jetty tips because of the outgoing channel current. The Garibaldi Charters co-owner said the vessel operators appeared to be “milling around,” waiting for better conditions, 12 A permanent, raised steering cabin or platform on a vessel. 13 “Crossing the Tillamook Bay Bar” describes the dangers specific to the bar area, the north jetty, the middle grounds, and the south jetty areas. A copy of the brochure appears in appendix C.

Factual Information 7 Marine Accident Report and watching the pattern of the waves, which came in sets. He said that the large waves were coming too close together for a boat to avoid going over at least one of them on the way out of the inlet, and that the masters had to depart the jaws of the jetty when the seas were not good to be “in the right position when it does get good.” The masters could not proceed due west out of the channel because of breaking water on the shallow bar. Instead, they had to proceed either southwest or northwest around one of the jetties to reach deep water. On the day of the accident, all the boats took a north-northwest course. The Norwester crossed the bar first, at 0650. The Norwester master told Safety Board investigators that he waited 30 to 45 minutes before seeing a “window” that would allow him through the surf (the area where waves break into foam as they approach the shoreline). According to the seaman on watch at the Coast Guard observation tower, the Norwester rode over one swell on its way across the bar and then “stood straight up” on a second one. The coxswain on the MLB said he saw the stern of the Norwester “just go way up in the air and come back down.” The tower watch maintained visual contact with the Norwester until it cleared the surf. The Norwester master said that after clearing the bar, he contacted the other vessels waiting at the inlet by VHF radiotelephone. The transmission was not taped or monitored by the Coast Guard tower, but the Taki-Tooo deckhand told Safety Board investigators that she heard the Norwester master say, “It wasn’t worth it to go out,” and that the vessels should wait until conditions at the bar “settled down a little bit. . . .” The Norwester’s message was corroborated by a passenger on the D & D who was standing near its master and by the co-owner of Garibaldi Charters, who was monitoring radio traffic with a handheld VHF radio. The charter company co-owner told investigators that he thought the message was intended for the Taki-Tooo master. One of the Taki-Tooo passengers said he also heard the Norwester master say over the radio that he had to avoid hitting a log. The Norwester master told investigators that there were “logs all over the tips and stuff.” In preparation for crossing the bar, the Oakland Pilot master directed his passengers to sit down. Passengers told the Tillamook County sheriff that when the Oakland Pilot “went over a huge swell and dropped 10 to 12 feet off the back end,” the deckhand hit his head against the ceiling, was knocked unconscious, and bit his tongue, causing it to bleed; a passenger hit his head and cracked a window; and another passenger injured his hip. The Taki-Tooo deckhand told Safety Board investigators that after clearing the bar, the Oakland Pilot master called back on the VHF radio and said that he had had to dodge a log and that there were “a lot of logs floating out there.” The watch at the Coast Guard observation tower changed at 0700. In briefing his replacement, the watchstander from the first shift advised that the surf was rough and that he had “just missed some cowboy stuff pulled off by the Norwester and the Oakland Pilot.” The D & D started over the bar next, shortly after 0700. From his vantage point on the north jetty, the Kerri Lin owner observed that the D & D master did not hurry his departure and had no trouble going past the bar. According to a D & D passenger, the vessel went over two or three “good” waves, and the master turned north to maneuver around a log at the end of the jetty. The D & D master said, however, that he did not recall

Factual Information 8 Marine Accident Report seeing any logs. A passenger on the D & D told investigators that as soon as the D & D crossed the bar, “a lot of people” donned lifejackets and left them on for the rest of the trip. He said, “I would never cross the bar again without [a lifejacket].” Meanwhile, the Taki-Tooo master was circling between the north jetty and the jetty tips to assess the bar conditions and, according to the deckhand, waiting for a favorable surf. The deckhand joined the Taki-Tooo master on the flying bridge shortly before they departed the inlet. The deckhand told investigators that she “didn’t notice any” debris in the water. She said that the vessel rode over one swell and that she yelled for everyone to hold on. The waves got larger, she said, and the master said, “I didn’t want to get into this.” The deckhand said that she believed the master put the engines in reverse or astern power so the vessel “didn’t go flying off the other end” of the wave. She said that the boat twisted to the north, and that the swell was coming from the west. The deckhand said that the Taki-Tooo never lost power. The Coast Guard tower watch observed the Taki-Tooo depart the inlet and followed the vessel’s track by looking through his “big-eye” binoculars. He told Safety Board investigators that he had never seen a vessel pass as close to the tip of the north jetty as the Taki-Tooo did. He said that the Taki-Tooo descended into a trough between the waves, and that a 15-foot wave then hit the vessel on the port side and capsized it. The tower watch, the observers on the north jetty, the surviving passengers, and the deckhand all agreed that the Taki-Tooo was parallel to the wave that capsized it. The deckhand described the capsizing as follows: When we were going over the first wave, it kind of got us tilted, when he backed up, I saw the wave coming and I told everybody to hold on, I didn’t look back to see where everybody was, I said, hold on. And I grabbed onto the boat and we went over it and the, okay, I was telling somebody that that was probably about 9- or 10-foot wave. But, right on the other side of it, right on the backside of it, I saw a huge one building and it was really steep and it was coming straight at us. And somehow, I am really not clear on how this happened, whether it was the captain that had turned the boat or whether we were still turning from sliding down the back of the wave, but somehow we got completely sideways to it. And my first impression was that he was trying to turn the boat around to ride with it. But, we got completely sideways to the wave and by the time it was real close, I could tell that we were going to go over. And it was probably about 12 to 15 feet because I was looking up at it. And it just smashed in the side of the boat and went over and, I knew it was going to go over, so it just went straight over. I don’t know [whether] it landed on me or not. I heard it, and somehow I touched the boat, so it may have pushed me down. During his postaccident interview, the Amanda master said that as he watched the Taki-Tooo, it did not appear as if “the vessel was being pushed” by the wave but as if the Taki-Tooo master “just backed off the throttle some, turned, and hit his throttle again to go north, you know, to get off of the bar.” The Kerri Lin master told investigators that he saw the Taki-Tooo go over a 10- to 12-foot wave and that he believed the master reduced speed, which should have allowed the wave to roll under the vessel so it would not crash down on the backside of the wave. The Kerri Lin master said the Taki-Tooo “backed down and . . . kind of went sideways.” He thought the Taki-Tooo master gave more power to the engines as the vessel rolled up and into the curl of a 12- to 15-foot wave that he described as a “monster.”

Factual Information 9 Marine Accident Report From interviews with the survivors, the Safety Board determined that just before the capsizing, six of the passengers were sitting in the cabin, six were sitting on either side of the engine cover in the middle of the deck, and five were sitting or standing at the stern (table 1). The passengers at the stern were thrown into the water during the capsizing, along with all but one of those sitting on the engine cover. That passenger stated that he was washed into the water and then surfaced in the cabin but could not recall how he wound up there. Table 1. Relation of occupants’ location on boat and use of lifejacket to survivability. Location Age/ Gender Precapsize Postcapsize Use of Lifejacket Remarks Fatality Victims 66/M Flying bridge Water No Master of vessel. Body recovered by Coast Guard lifeboat; taken to Station Tillamook Bay. 66/M Cabin Cabin Yes Donned lifejacket. Unable to exit cabin. Body recovered from cabin when vessel washed up on beach. 70/M Open deck Water No Body recovered. 49/F Open deck Water No Body recovered. 53/M Open deck Water No Body recovered. 65/M Open deck Water No Body recovered. 54/M Open deck Water No Body recovered. 61/M Open deck Water No Body recovered. 46/M Open deck Water No Body recovered. 52/M Open deck Water No Body not recovered. 43/M Open deck Water No Body not recovered. Survivors 22/F Flying bridge Water No Deckhand on vessel. Removed boots and outer clothing gear; made it to shore. 18/M Open deck Cabin Yes Held onto lifejacket as exited through window. Made way to shore. Aided out of surf by bystanders. 28/M Open deck Water No Reached life float 5-6 times but unable to hold on. Washed to shore by wave action. 52/M Cabin Cabin Yes While Taki-Tooo was upside down, pulled out lifejackets and passed them out. Removed lifejacket to exit through window; put lifejacket on over his head. Floated to shore. Aided out of water by bystanders 23/M Cabin Cabin Yes Tied lifejacket around arm. Exited through window. Floated to shore. Aided out of surf by bystanders. 34/M Cabin Cabin Yes Assisted in handing out lifejackets. Removed lifejacket to exit through window. Lost hold of lifejacket during exit. Swam to shore. 48/M Cabin Cabin Yes Put lifejacket around neck, exited through window. Floated to shore hanging onto lifejacket. 47/M Cabin Cabin Yes Exited through cabin door; made it to shore.

Factual Information 10 Marine Accident Report All but one of the surviving passengers were in the cabin, which they said came to rest upside down and filled with about 4 feet of water. One passenger pulled lifejackets out of the bins and handed them to the others. One survivor was able to exit through the cabin door. Five men had to remove their lifejackets to exit through the cabin window. Of those, four managed to hold onto their lifejackets as they exited into the water, which enabled them to use their lifejackets to make it to shore. One took off his lifejacket to exit through the window but was unable to hold on to it. He successfully swam to shore. One passenger wearing a lifejacket remained in the cabin and was fatally injured. According to survivors, as they were exiting the cabin, they repeatedly exhorted that passenger, their relative, to leave the boat. They said that he just sat down, however, and emitted a moan. The survivor who had been thrown into the ocean from the open deck told investigators that he never had access to a lifejacket. He said that he had tried to reach the Taki-Tooo’s liferaft [rigid buoyant apparatus] but was repeatedly knocked away from it. The deckhand was thrown off the flying bridge and into the water without a lifejacket. She took off her boots, pants, and jacket and made it to shore. She told investigators that she was a good swimmer. The Garibaldi Charters co-owner told investigators that from his vantage point on the north jetty, he watched the Taki-Tooo pass the end of the jetty, going almost straight north. Then he lost sight of the Taki-Tooo but could see a large wave rise about 4 feet above the outline of the boat. The next thing he saw was the boat upside down. Then he said that he “estimated [he saw] about 5 people in the raft,” which overturned, “and when it came back up, no one was in it.” He radioed the Coast Guard on channel 16 and ran onto the beach, looking for his daughter, who was the Taki-Tooo deckhand. The Coast Guard coxswain said he had moved the MLB toward the bar, from where he watched the Taki-Tooo depart the inlet and pass “really close to the north tip.” He said he then lost view of the Taki-Tooo and waited for the tower watch to tell him what happened to the vessel. Shortly after 0715, the Coast Guard tower notified the MLB that the Taki-Tooo had capsized. The MLB coxswain said he waited about a minute before he felt he could get safe passage across the bar. He described the seas as “really, really choppy and big” and said that the MLB had to travel over a 14-foot-high swell. He said the swells were breaking, and that the entire area around the bar was whitewater. The coxswain told investigators that the Taki-Tooo was very close to the rocks and he felt that any attempt to approach the capsized vessel would endanger the MLB. He estimated that he was within 50 to 75 yards of the jetty tip, as opposed to his typical distance from the jetty of 100 yards. He also told investigators that after clearing the inlet, he remembered that he was not qualified to attempt a rescue in the surf. At 0725, the Thirteenth Coast Guard District’s rescue coordination center in Seattle, Washington, received a distress alert from an EPIRB (emergency position indicating radio beacon) registered to the Taki-Tooo. At 0730, the rescue coordination center received confirmation from Station Tillamook Bay that the vessel had capsized with 19 persons in the water.

Factual Information 11 Marine Accident Report The Kerri Lin master told investigators that by the time he called 911 at 0732, survivors were already coming ashore. Civilians who happened to be in the area provided the initial aid to the survivors. Emergency response personnel arrived soon thereafter and transported seven of the eight survivors by ambulance to Tillamook County General Hospital in Tillamook, Oregon. The Taki-Tooo deckhand was brought to the hospital by private automobile. The Coast Guard recovered the body of the Taki-Tooo’s master a half-hour after the capsizing. (See “Survival Aspects” section for details of the search-and-rescue effort.) Within 2 hours of the accident, the Coast Guard had retrieved two passengers from the surf and the bodies of six other passengers had washed ashore. Two male passengers, whose bodies were never recovered, were declared dead, bringing the fatality total to 11. Injuries The injuries sustained in the Taki-Tooo accident, shown in table 2, are categorized according to the injury criteria of the International Civil Aviation Organization (ICAO). The Safety Board uses the ICAO injury criteria in all its accident reports, regardless of transportation mode. Table 2. Injuries sustained in Taki-Tooo accident. Damages The Taki-Tooo had an estimated market value of $60,000 and a replacement value of $180,000.14 The vessel was declared a total loss after the accident. Additional information about the damage sustained by the Taki-Tooo appears in the “Wreckage” section of this report. Type of Injury Crew Passengers Total Fatal 1 10 11 Serious 0 0 0 Minor 1 7 8 None 0 0 0 Total 2 17 19 Title 49 CFR section 830.2 defines a fatal injury as any injury that results in death within 30 days of an accident. It defines serious injury as that which requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; results in a fracture of any bone (except simple fractures of fingers, toes, or nose); causes severe hemorrhages, nerve, muscle, or tendon damage; involves any internal organ; or involves second- or third- degree burns, or any burn affecting more than 5 percent of the body surface. 14 The values are based on a September 2002 survey performed by a marine surveyor.

Factual Information 12 Marine Accident Report Personnel Information Master The Taki-Tooo master, age 66, had over 26 years’ experience operating charter fishing vessels, according to Coast Guard records. He was issued a license to operate small passenger vessels, good for 5 years, by the Coast Guard in 1984. As qualifying experience in his original application for his 1984 license, he indicated that he had worked 277 full (8-hour) days operating small passenger vessels on the Pacific Ocean in the previous 3 years. His application also indicated that beginning in 1976, he had over 700 days of experience operating small passenger vessels on the Columbia River between the Pacific Ocean and Bonneville Dam and on the Pacific Ocean from Tillamook Head, Oregon, to Leadbetter Point, Washington. When his Coast Guard license was subject to renewal in 1989, as it was every 5 years, Federal regulations stipulated that support be submitted showing that the master had 1 year of experience in the previous 5 years on vessels of the appropriate tonnage or horsepower.15 According to records submitted to the Coast Guard, from March 1984 until his licensure as “Master . . . of Steam or Motor Vessels of Not More Than 50 Gross Tons” in March 1999, all his experience was on the Taki-Tooo, departing from Tillamook Bay and sailing in the Pacific Ocean. The master’s Coast Guard license file indicates that at the time he applied for his current license in February 1999, he had operated the Taki-Tooo some 1,600 days. Three other area vessel operators stated that the Taki-Tooo master had crossed the Tillamook bar more than a thousand times and that he was regarded as a very capable vessel operator. The Taki-Tooo master had lived in the Tillamook area for 15 years. He and his wife owned Davis Fisheries, Inc., of which the Taki-Tooo and the D & D were assets. They were the former owners of Garibaldi Charters, which they sold to the present owners in

1. The terms of the charter company sale stipulated that the Taki-Tooo and the D & D

would be leased to and operated by Garibaldi Charters; however, the owner of the Taki- Tooo continued to operate it part time for Garibaldi Charters because he was highly regarded by his former customers and they would frequently request that he serve as the vessel operator when they booked a fishing voyage. The master and his wife had purchased a second home in Baja California and they divided their time between the Tillamook area in the summer and Mexico in the winter. They had returned from their winter home in Baja California a few weeks before the accident, and the master had operated the Taki-Tooo about three times since his return to become acquainted with new electronics equipment that had been installed on the boat. The master’s wife said that his sleep patterns had been consistent for several days before the accident. She said that he and she went to bed at 2100, as was their custom, and that the master rose at 0430 on the day of the accident, his usual time. She stated that he 15 Title 46 CFR 10.209 (c)(i).

Factual Information 13 Marine Accident Report had coffee, made a lunch to take with him, and listened to the weather report. She further stated that he was pleased that he had been asked to operate the Taki-Tooo that day and was looking forward to the trip. The master had last undergone a physical examination to renew his license, as required by 46 CFR 10.209, on February 17, 1999. The examination record (Coast Guard form 719K, submitted by the master and signed by his evaluating physician) states that the master was taking five prescription medications daily: 40 milligrams of Accupril® [quinapril, used to treat high blood pressure], 25 milligrams of HCTZ [hydrocholorothiazide, used to treat high blood pressure], 2 milligrams of Tenex® [guanfacine, used to treat high blood pressure], 40 milligrams of Lipitor® [atorvastatin, used to treat high cholesterol], and 20 milligrams of amitriptyline, to be taken nightly [an antidepressant, trade name Elavil®]. The record indicates that the master had experienced dizziness in 1996 and that he had been treated for prostate cancer in 1993. The 719K form also indicates that the master’s field of vision, color vision, and hearing were normal.16 The examining physician found the master competent to carry out the duties to be performed on board a U.S. merchant vessel. The master then forwarded the completed 719K form to the Coast Guard regional examination center in Portland, one of 17 such centers that are responsible for overseeing and approving mariner licensing.17 According to the Marine Safety Office in Portland, the Coast Guard regional examination center “had nothing in the file regarding any follow-up action on any of [the master’s] physical examinations.” According to records of his primary care physician, the master had a history of coronary heart disease, high blood pressure, insomnia, prostate cancer, kidney stones, and high cholesterol. The physician’s records indicate that Elavil had been prescribed to treat the master’s insomnia. Deckhand The deckhand, age 22, was the charter owners’ daughter. She had worked as a deckhand for 5 years. She began her career working with the master on the Taki-Tooo, then worked with her brother, the master of the Norwester, for three summers before returning to the Taki-Tooo in June 2003. The accident trip was her first with the Taki-Tooo master in the 2003 season. The deckhand told investigators that she slept 7 1/2 or 8 hours the night before the accident and that she kept regular hours. She said her usual schedule was to go to bed about 2000 or 2100 and rise at 0430, except when she did not have a scheduled charter. 16 The master wore glasses for reading. 17 See (accessed April 15, 2005).

Factual Information 14 Marine Accident Report Vessel Information The Taki-Tooo was manufactured in 1977 in Tacoma, Washington, by Modutech Marine. The principal characteristics of the Taki-Tooo are summarized below: Length: 32.5 feet Beam: 12.33 feet Depth: 5.3 feet Gross tonnage: 14 Crew: 2 (master and 1 deckhand) Passenger capacity: 20 Propulsion: 250-horsepower John Deere model 6076AFM30 turbocharged diesel engine General Construction and Equipment The Taki-Tooo was constructed of fiberglass-reinforced plastic. The decks, built on wood frames, consisted of plywood covered with fiberglass. The vessel’s bronze propeller had four blades, was 26 inches in diameter, and was “right-handed” (rotated clockwise). The vessel’s electronic and communications equipment included a Furuno model 1833C/NT radar/chart plotter (type RDP-139, S/N 4312-1096), a magnetic compass, and a VHF radio. The vessel was also equipped with a second VHF radio, a citizens band radio, a single-sideband radio, a 24-mile-range radar, and an EPIRB. Lifesaving Apparatus The Taki-Tooo was required by the Coast Guard to have lifesaving equipment on board for 22 people. The equipment included the following: Adult lifejackets 22 Child lifejackets 3 Life floats/rigid buoyant apparatus18 1 Ring buoys 1 (light and line attached) The lifejackets were stowed under a table in the cabin. The deckhand told Safety Board investigators that a placard on the wall described how to don the lifejackets. A number of lifejackets floated free after the accident. 18 Flotation equipment with a line attached around the outside. Survivors in the water hold onto the line. The apparatus is not designed to support survivors out of the water.

Factual Information 15 Marine Accident Report Certification and Inspection The Taki-Tooo was inspected and certificated by the Coast Guard as a small passenger vessel under the regulations at 46 CFR parts 175-185. The Coast Guard certificate of inspection (COI)19 issued on March 13, 2001, permitted the Taki-Tooo to operate not more than 100 miles from land in the Pacific Ocean between Point St. George, California, and Angeles Point, Washington. According to the COI, the total number of persons allowed on the Taki-Tooo was 22, including 20 passengers and 2 crewmembers. The boat was required to have both a licensed master and a deckhand. If the boat was away from the dock or if passengers had access to it for more than 12 hours in one 24-hour period, the COI required that an alternate crew be provided. The Marine Safety Office in Portland was the local Coast Guard office in charge of inspecting the Taki-Tooo. The Taki-Tooo was last drydocked for a complete hull examination on November 29, 2001. The only deficiency noted by the Coast Guard inspector was a leak entering the forward compartment from the kingpost (a short mast that carries a cargo boom) on the main deck. The COI stated that the repair had to be completed before the vessel could carry passengers again. The vessel’s next drydock inspection was due in November 2003. The Taki-Tooo underwent an annual inspection in March 2003. The inspector noted eight deficiencies having to do with lines, masthead light, high-water bilge alarm, bilge manifold labeling, fixed fire extinguisher system reinstallation, battery terminal guards, and Rules of the Road book. Coast Guard records contain three reports of marine casualties20 for the Taki-Tooo, in 1993, 1997, and 1999. The reports do not indicate the type of casualty. The Coast Guard inspected the vessel after an onboard fire in March 2003. Wreckage On Sunday, June 15, 2003, the day after the accident, an investigative group comprising a Safety Board investigator, a chief warrant officer from the Coast Guard, and a deputy from the Tillamook County sheriff’s office conducted an on-site examination of the wreckage of the Taki-Tooo, which had been pulled onto the beach 3 hours after the accident (see figure 4). The flying bridge operating console was missing and never recovered. The deck railings on the bow were loose from their mountings. 19 Small passenger vessels carrying more than six passengers for hire may not operate without a valid Coast Guard COI, which is issued by the Coast Guard Officer in Charge, Marine Inspection, for the zone in which the boat operates. The COI, among other conditions, stipulates minimum firefighting, lifesaving, and crew requirements. When determining the number and competencies of the crewmembers, the Officer in Charge, Marine Inspection, considers many factors, including the size of the vessel, its route, the type and horsepower of the vessel’s propulsion machinery, the number of passengers, the type and location of lifesaving equipment, and the hazards peculiar to the route and service. 20 For any vessel (other than a public vessel) operating on the navigable waters of the United States, a marine casualty refers to any accidental grounding or incident resulting in damage by or to the vessel, its apparel, gear, or cargo, or injury or loss of life of any person. Marine casualties include collisions, strandings, groundings, founderings, heavy weather damage, fires, explosions, failure of gear and equipment, and any damage potentially affecting the seaworthiness of the vessel. See 46 CFR 4.03-1.

Factual Information 16 Marine Accident Report In examining the vessel’s propulsion and steering components, investigators found that the rudder and rudder post were solidly mounted and undamaged. The propeller shaft was straight and unremarkable; however, the propeller’s four blades had minor nicks and scratches consistent with normal operation, given the age of the propellers. Investigators noted that the propeller blades were curled at the tips, so they had the propeller removed and sent to the Safety Board’s materials laboratory in Washington, D.C., for detailed examination and documentation of damage. The results are described below, in the “Tests and Research” section. The diesel engine was intact, with no signs of oil leaks or obvious signs of cata- strophic failure. All fuel lines, fittings, and linkages were intact and attached. When manip- ulated at the lower helm station, the throttle and transmission control moved the throttle linkage throughout its range. The lower helm station wheel turned freely in both directions. The Taki-Tooo was then moved to a site in Tillamook, where investigators contin- ued their inspection on June 16. In checking the propulsion and steering mechanisms, they found no evidence of preaccident mechanical malfunction. In addition, the engine and transmission were solidly mounted, the two fuel tanks were secure, the bilge pumps were connected and operable, the high-water bilge alarms were connected, and the electrical fuses in the cabin were intact, though several were filled with water. Investigators had the radar/chart plotter removed and sent to the Safety Board’s recorder laboratory in Washing- ton, D.C. (See “Tests and Research” section for more information.) Figure 4. Taki-Tooo on beach after capsizing.

Factual Information 17 Marine Accident Report Waterway Information General The accident occurred at the entrance to Tillamook Bay, a large (6.2-mile-long, 2.1- mile-wide), shallow (averaging 6.6 feet deep) estuary on the northern Oregon coast. Five major rivers drain runoff from the west slopes of the Coast Range into the bay. At high tide, Tillamook Bay covers about 8,400 acres; at low tide, about half the bottom is exposed as sand and mud flats. The city of Tillamook (population 4,350) and the towns of Garibaldi (population 935) and Bay City (population 1,150) are located on the bay (figure 1). Bay Entrance As noted earlier, the entrance to Tillamook Bay is protected by jetties on the north and south (see figure 2). According to the U.S. Coast Pilot, the north jetty is 1,900 yards long and extends 800 yards offshore, with the last 80 yards submerged.21 A lighted whistle buoy sits in water over 100 feet deep about 1 mile west of the north jetty. The bar, a curved shoal where the water is less than 30 feet deep, lies between the jetty tips and the whistle buoy. Waves break over the bar on the ebbing tide, and the area is considered unpredictable and hazardous. The Oregon State Marine Board cautions boaters trying to cross the bar not to turn around if waves are breaking over it.22 Just outside the north jetty tip is the “north hole,” a section of deep water between the shoal and another shallow area along the sandy beach that runs north of the bay. According to the Station Tillamook Bay log, the Taki-Tooo “rolled in the north hole as it exited the bar.” The Taki-Tooo ended up on the beach north of the north jetty. The waters next to the beach are marked “changeable area”23 on the nautical chart for Tillamook Bay.24 The Tillamook Bay channel lies immediately south of the north jetty. The channel runs 3 miles east to Garibaldi (Miami Cove) and is marked by a directional light, buoys, and daybeacons. The U.S. Army Corps of Engineers maintains the entrance and inner channels to a depth of 18 feet. The entrance channel has no specified width, while the inner channel is 200 feet wide up to Miami Cove.25 There is a turning basin at Garibaldi. 21 National Oceanic and Atmospheric Administration, National Ocean Service, U.S. Coast Pilot, vol. 7 (Pacific Coast: California, Oregon, Washington, and Hawaii), 2003, p. 299. According to field measurements made by the U.S. Army Corps of Engineers in June 2003, the north jetty is only 1,772 yards long and is receding more every year. See “Condition of Tillamook Bar” section for more information. 22 “If you decide to cross, proceed out—but do not attempt to turn around if the bar is breaking.” Oregon State Marine Board website, “Tillamook Bay” (accessed May 28, 2004). 23 Meaning the shoreline and depths change frequently. 24 Tillamook Bay, chart 18558, Coast Survey, United States, Oregon–West Coast, 37th ed. (Washington, DC: U.S. Department of Commerce, National Oceanic and Atmospheric Administration, National Ocean Service, 2002). 25 .

Factual Information 18 Marine Accident Report According to the Oregon State Marine Board, the current runs out of the bay at 4 to 6 knots and is “very strong.”26 The strong current, together with the pinched shape of the jetties, flushes sediment out the narrow entrance and helps maintain the channel at its 18- foot depth. The channel was last dredged in 1976, before the south jetty was built. According to a hydraulic engineer with the Corps of Engineers Portland District, “Since completion of the Tillamook Bay south jetty in 1979, the entrance channel at Tillamook Bay has been ‘self-maintaining’ due to tidal hydraulics.” 27 Although the Tillamook Bay channel does not require dredging, the Corps of Engineers surveys the channel annually. The Corps was scheduled to survey the channel in July 2003 but moved the survey to the third week of June 2003 to assist in the investigation of the Taki-Tooo accident. As in other years, the Corps’s 2003 survey showed that the channel had remained within its authorized depth.28 The Coast Pilot and the nautical chart for Tillamook Bay caution mariners that “the entrance channel is subject to frequent changes.” Tide According to navigation references, the mean tide at Barview (the east end of the entrance channel to Tillamook Bay) is 3.9 feet; the higher high water level is 7.5 feet, the mean high water level is 6.8 feet, the mean low water level is 1.1 feet, and the extreme low water level is minus 3.0 feet. At 0721 on June 14, about 5 minutes after the accident, a low tide of minus 2.1 feet was recorded at Barview. Water Temperature The average water temperature is 57º F for the period between June 1 and June 15 on the Oregon coast in the vicinity of Tillamook Bay.29 Three hours after the accident, the water temperature at the site of the capsizing was 52º F, as measured from one of the two Coast Guard MLBs. For the effect of water temperatures on the human body, see the “Survival Aspects” section of this report. Tillamook Bar Restrictions As noted earlier, Station Tillamook Bay can restrict the bar only to recreational and uninspected passenger vessels; the station does not have the authority to close the bar to inspected passenger vessels. If hazardous conditions warrant closure of the bar, the station works through its chain of command by first notifying the operations center at Group Astoria, which, in turn, notifies the Captain of the Port (COTP) Portland, the Coast Guard authority for the zone that includes Oregon. The COTP, acting under the authority of the Ports and Waterways Safety Act,30 can close the bar to all vessel traffic. 26 Oregon State Marine Board, “Tillamook Bay.” 27 See “Other Information” section for more information on the condition of the Tillamook bar. 28 . 29 National Oceanographic Data Center, Coastal Temperature Guide (accessed June 2, 2004). 30 Title 33 U.S. Code 1221 et seq.

Factual Information 19 Marine Accident Report The Coast Guard officer-in-charge at Station Tillamook Bay told Safety Board investigators that in the 3 years he had been assigned at that location, the bar had never been closed. A Coast Guard marine inspector at the Marine Safety Office in Portland, who had records for the 5 years (1,825 days) before the accident, informed the Safety Board that “at no time could we find that we had requested to restrict [Tillamook bar] to commercial vessels.” He said that the logs indicated that Tillamook bar had been restricted to recreation boats and uninspected small passenger vessels 1,422 times during the previous 5 years; however, depending on the weather, bar restrictions can be enforced and lifted several times a day. Company Operations Garibaldi Charters advertises itself as a family-owned business that offers deep-sea fishing, bottom fishing, diving, whalewatching, eco-tours, scenic excursions, occasional weddings, and scattering of ashes. As noted earlier, Garibaldi Charters leased the Taki- Tooo and the D & D from the previous owner. The company also owned outright the Norwester, the first vessel to depart the inlet on the day of the accident. Garibaldi Charters’ operating season ran from March until October. According to the owner of the charter company, the weather did not permit regular trips from October to March. The D & D master told Safety Board investigators that the company never pressured him to take his boat out, no matter what the weather. The husband of the couple who owned Garibaldi Charters was the usual master of the Taki-Tooo. However, the charter group that had reservations to fish on board the Taki- Tooo the day of the accident had requested the boat’s owner as the master. The charter owner said that the group paid $70 each for the fishing trip. The master received about 30 percent of the gross from ticket sales. If a trip was canceled because of bad weather or sea conditions, the ticket money was refunded and the master received no pay. Meteorological Information According to National Weather Service data, the wind in Garibaldi at the time of the accident was about 10 knots from the southeast, with no precipitation. Surface temperatures were about 56º F, and the sky was cloudy. The National Weather Service issued small craft advisories for hazardous seas on the northern Oregon and southern Washington coasts at 1645 and 2130 on June 13 and at 0330 and 0930 on June 14. The forecast was for northwest swells of between 10 and 12 feet, with a large swell predicted to reach the coast during the day on Saturday. Actual conditions at 0650 on June 14, according to the meteorologist-in-charge at the weather forecast office in Portland, were comparable to the 0330 forecast. Winds were from the south at 5 to 15 knots, and combined seas were 12 to 13 feet.

Factual Information 20 Marine Accident Report The forecast for Tillamook issued at 0430 on June 14 by the weather forecast office in Portland called for mostly cloudy skies with a chance of showers early in the morning. A west wind of 5 to 15 mph was predicted. Medical and Pathological Information Medical Findings The confirmed dead included one female and eight males, ranging in age from 46 to 70. The Tillamook County medical examiner recorded the cause of death in each case as drowning by asphyxiation and hypothermia, based on clinical on-scene observation. Autopsies were not performed on the fatally injured passengers. An autopsy was performed on the master of the Taki-Tooo. As noted earlier, the master had a history of coronary artery disease, high blood pressure, insomnia, prostate cancer, kidney stones, and high cholesterol. The medical examiner’s report noted evidence of previous conditions and indicated that none contributed to his death. The autopsy found no evidence of recent heart attack, a recurrence of his prostate cancer, or evidence of kidney stones. The autopsy report indicated a very small subdural hematoma (bleeding into the brain) and an abrasion to the side of the head. There was no evidence of underlying brain injury, and the hematoma was completely encapsulated. The medical report concluded that the Taki-Tooo master died from drowning by asphyxiation with hypothermia. Tillamook County General Hospital treated all survivors for hypothermia. Of the eight patients, seven were released the day of the accident; one passenger was kept in the hospital overnight. Toxicology Testing The capsizing of the Taki-Tooo was classified as a “serious marine incident” under Federal regulations.31 As a result, drug and alcohol testing of the master was mandatory. The master’s body was sent to the Oregon Health and Science University (OHSU) medical examiner in Portland, Oregon, for autopsy and toxicological analysis. The OHSU laboratory performed a routine urinalysis for five illicit drugs,32 prescriptions, and over- the-counter medications and tested the master’s blood for alcohol. The analyses were negative for the presence of alcohol or illicit drugs. The Safety Board obtained autopsy specimens and sent them for toxicological examination to the Federal Aviation Administration’s Civil Aerospace Medical Institute in Oklahoma City, Oklahoma. Tests for alcohol and illegal drugs were negative. The master’s blood showed amounts of the prescription antidepressant amitriptyline (0.063 31 A serious marine incident is defined at 46 CFR 4.03-2 as one that results in death, injury beyond first aid, damage to property in excess of $100,000, loss of an inspected vessel, or loss of a vessel of 100 gross tons or more. 32 Marijuana, cocaine, opiates, amphetamines, and phencyclidine (PCP).

Factual Information 21 Marine Accident Report milligrams/milliliter) and its metabolite nortriptyline (0.042 milligrams/milliliter). His urinalysis also showed the presence of amitriptyline and nortriptyline. Survival Aspects Emergency Response At 0716, immediately after the accident, the Coast Guard MLB at the north jetty notified Station Tillamook Bay that the Taki-Tooo had capsized. The MLB coxswain said he could not attempt a rescue because the Taki-Tooo was too close to the jetty, in shallow waters and breaking surf. In addition, the coxswain was not qualified to operate a rescue craft in surf conditions (see “Other Information” section for details). As soon as it received news of the capsizing, Station Tillamook Bay sounded the search-and-rescue alarm and at 0718, requested search-and-rescue helicopters from Air Station Astoria, about 30 miles, or 26 minutes, from the accident scene. At 0720, Station Tillamook Bay launched another 47-foot MLB to the accident scene, with a certified surfman as coxswain. At 0721, the Coast Guard station telephoned the Tillamook County Emergency Communications District (911) and requested ambulances for the Coast Guard station and the beach on the north side of the north jetty. The emergency communications operator then paged the volunteer fire and rescue departments of the towns of Garibaldi, Bay City, and Rockaway Beach (figure 1), as well as the emergency medical service (EMS) units for Garibaldi, Manzanita, and Tillamook County. At 0725, the Coast Guard rescue coordination center in Seattle received an EPIRB signal from the Taki-Tooo and 5 minutes later, received confirmation from Station Tillamook Bay that the Taki-Tooo had capsized. By 0726, the Garibaldi fire chief was en route to the accident scene. When the fire chief and one rescue truck from the Garibaldi fire and rescue department arrived on the beach 10 minutes later, the fire chief assumed command. Ambulances arrived from Garibaldi, Manzanita, and Tillamook County between 0738 and 0814. Three patrol cars from the Tillamook County sheriff’s office also arrived on scene during that time. The Rockaway Beach fire department sent its fire chief and a water rescue team. Rockaway fire and rescue brought a personal watercraft to the scene but could not deploy it because of the rough seas. An official representative of the Garibaldi fire and rescue department told Safety Board investigators that each dispatched unit had its own incident commander and participated in the unified command system.33 33 The unified command system is a way of coordinating the response to an emergency. The incident commanders of the various responding agencies work together to make consensus decisions but do not surrender their individual jurisdictional responsibilities.

Factual Information 22 Marine Accident Report Search and Rescue At 0732, the second Coast Guard 47-foot MLB arrived at the accident scene and relieved the first MLB, which stayed outside the surf zone. The crew of the second MLB spotted a man floating face down inside the surf zone, not wearing a lifejacket. The coxswain radioed Station Tillamook Bay that his crew had located a victim and was maneuvering to pick him up. No additional victims were seen in the area. At 0745, the second MLB recovered the unconscious victim (the master). The MLB crew performed CPR on the victim while bringing him to Station Tillamook Bay, from where he was transferred to Garibaldi EMS personnel. At the Coast Guard station, the officer-in-charge came on board the second MLB, which then left on its second trip to the accident site. At 0745, while the MLB was recovering the victim, the Coast Guard HH-60J Jayhawk rescue helicopter that had been launched from Air Station Astoria arrived at the north jetty. The helicopter commander told Safety Board investigators that the Taki-Tooo had already washed ashore and that the “surf was up pretty heavy” (figure 5). He said he also saw empty lifejackets, a liferaft, clothing, logs, and other debris in the water. About 0800, a second helicopter was dispatched from Air Station Astoria. Shortly after 0800, a rescue swimmer lowered from the first helicopter by cable recovered a victim, not wearing a lifejacket, from the surf. The helicopter transferred the victim to EMS personnel on the beach, then returned to the search. The second helicopter arrived about 0820 and began a parallel search of the water from the north jetty to about 1 1/2 miles north. About the same time, the second MLB joined the first MLB at the accident scene, with the officer-in-charge on board. The officer-in-charge, a qualified surfman, told investigators that he intended to jump from the second MLB into the first one so that both MLBs would have a qualified surfman on board. However, he said, the two boats hit each other when they drew alongside, so he jumped into the water and then climbed into the Figure 5. Rescue personnel near Taki-Tooo in surf after capsizing.

Factual Information 23 Marine Accident Report first MLB. He described that as the “safest way” for him to get from one MLB to the other under the circumstances. An hour later, at 0915, the first helicopter recovered another victim from the water outside the surf line, about 200 yards from the tower. The victim was nonresponsive and was not wearing a lifejacket. The helicopter took the victim to the beach and transferred him to EMS personnel. The second helicopter continued to search the water for victims. At 0923, Garibaldi fire and rescue confirmed that there were eight bodies on the beach, including the two recovered from the water. By that time, six survivors had arrived at Tillamook County General Hospital by ambulance and a seventh, the deckhand, had arrived at the hospital by private automobile. At 0927, the Coast Guard cutter Steadfast, based in Astoria, was diverted to help in the search. About 1030, the first helicopter returned to Air Station Astoria and the first MLB returned to Station Tillamook Bay. At 1105, Station Tillamook Bay was advised that only 17 of the 19 people on board the Taki-Tooo had been accounted for. The second helicopter continued to search the water for the two missing victims but left the accident scene about 1600 without finding anyone. The Steadfast arrived on scene at 1700 and assumed on- scene command. The second MLB continued to search until 2100, then returned to Station Tillamook Bay. At 2115, the Steadfast completed its search and was released. At first light on June 15, one of the 47-foot MLBs from Station Tillamook Bay and an HH-60J Jayhawk helicopter from Air Station Astoria resumed the search for the missing victims. Results were negative, and the Coast Guard suspended the search at 0857. According to the Coast Guard, the two 47-foot MLBs from Station Tillamook Bay logged a total of 26 hours in the search-and-rescue effort. One of the HH-60J Jayhawk helicopters from Air Station Astoria searched for 7 hours, the other, for 5.3 hours. An HH-65 Dolphin helicopter from the Coast Guard’s air facility at Newport, Oregon, was in the air briefly. The Coast Guard cutter Steadfast logged nearly 13 hours in the search. Cold Water Immersion According to a senior Coast Guard official, the U.S. Coast Guard Addendum to the National Search and Rescue Supplement is being revised to address survivability in cold air and cold water environments. Until recently, the primary danger from immersion in cold water was considered to be death from hypothermia, a condition in which the body loses heat to the water (which conducts heat away from the body 25 times faster than air of the same temperature) and the core body temperature drops dangerously low. A 2003 study by Transport Canada34 found, however, that hypothermia is only the third of four 34 Transport Canada, Survival in Cold Waters: Staying Alive, report TP13822E (Ottawa, Ontario: 2003). The report, which was requested by the Marine Safety Directorate of Transport Canada, discusses physiology of cold water immersion, research into protecting people from the dangers of sudden cold water immersion, design of immersion suits and their relation to lifejackets, and various groups needing protection. The report incorporates an earlier Transport Canada report on cold shock and swimming failure.

Factual Information 24 Marine Accident Report stages in cold water immersion at which death can occur, and that more than half the deaths related to cold-water immersion occur during the “cold shock” and swimming failure stages. The Coast Guard search-and-rescue addendum will incorporate the Cold Exposure Survival Model developed by Canada’s Defense and Civil Institute for Environmental Medicine. This model predicts “functional time” and survival time based on the cooling of the body’s core as affected by the person’s physical characteristics and clothing and the environmental conditions.35 The Canadian research, which builds on earlier surveys conducted in the United Kingdom and other countries, found that the critical water temperature in incidents of cold water immersion is 59º F (15º C). The Canadian study states, “Entry into water below 15º C should be avoided.” The water temperature at the accident site 3 hours after the Taki- Tooo capsized measured 52º F. The various immersion stages that can cause death, as described in the Canadian study, include the following. Stage 1, initial immersion response or cold shock, occurs during the first 2 to 3 minutes of immersion. Unless victims are mentally prepared and physically protected (with survival suits or lifejackets), they can drown immediately after entering cold water because they cannot control their breathing. The shock of the cold water causes a large gasp followed by hyperventilation (faster breathing) and a greatly increased heart rate and blood pressure. The cardiac effects can cause death, particularly in older or less healthy victims. Stage 2, short-term immersion or swimming failure, occurs during the first 3 to 30 minutes after immersion. According to the Canadian study, “ability to swim in warm water is no indication of how well a human can swim in cold water.” Two theories are advanced to account for death at stage 2. The first is that death is caused by the respiratory and cardiovascular responses begun during stage 1. The second is that cold water causes breathing to stop, the heart rate to slow, or cardiac arrest. In stage 3, long-term immersion or hypothermia, death can occur after 30 minutes of immersion in cold water. Even with mild hypothermia, victims can drown after becoming physically incapacitated or losing consciousness. The Coast Guard developed survival curves to predict death from hypothermia at various water temperatures, and boating safety organizations have published tables showing expected survival time in water of different temperatures. The Canadian study cautions, however, that these curves and tables are difficult to validate. 35 Functional time is the predicted number of hours after initial exposure that a person’s body core temperature decreases to the end of mild hypothermia at 34° C (93.2° F). At functional time, the person is incapacitated by hypothermia and is at the limits of self-help. Survival time is the predicted number of hours after immersion when the person’s core body temperature falls to the end of moderate hypothermia at 28° C (82.4° F). A person with a core temperature of 28° C will lose consciousness. An immersed unconscious person is unable to maintain an airway, which quickly results in drowning.

Factual Information 25 Marine Accident Report Stage 4 is postrescue collapse, in which death occurs during rescue or hours afterward. According to the Transport Canada report, a 1956 study found that 17 percent of shipwrecked survivors rescued from water of 10º C (50º F) or below died within 24 hours.36 Coast Guard Safety Alert On June 29, 2004, the Seventeenth Coast Guard District, based in Juneau, Alaska, issued a safety alert entitled “Cold Water Immersion: It’s More Than Just Hypothermia” to area mariners. The alert stated that a review of the boating fatalities in Alaska for the previous 3 years had indicated that about 75 percent of the people who died probably succumbed to cold shock and swimming failure rather than hypothermia. The alert explained to mariners how their bodies would react when immersed in cold water and what actions to take to increase their chances of survival. The alert stressed: “Wear a lifejacket at all times when boating,” and offered the following rationale for doing so: This [a lifejacket] keeps your head above water if you suddenly fall overboard or capsize, and gives you those precious minutes you need to get back onboard. Even if you have a lifejacket in your hands, you may not be able to put it on. If you cannot self-rescue, it may give you some hypothermia protection and can extend the time you can survive until someone else can rescue you. Tests and Research Propeller Technicians at the Safety Board’s materials laboratory examined the Taki-Tooo’s propeller and found that the tip of each of the four blades curled forward, and that the angle and area of the curl increased in the counterclockwise direction (looking forward). The back of the blades did not show any scoring marks or scraping damage. Laboratory personnel concluded that the curl damage was consistent with the propeller contacting the soft bottom of the ocean floor while under power. One blade showed two dime-sized areas of local deformation in the aft direction. The laboratory found no evidence of impact from hard material in the deformed areas. Chart Plotter The Taki-Tooo’s Furuno model 1833C/NT radar/chart plotter (type RDP-139, S/N 4312-1096) was delivered to the recorder laboratory at the Safety Board on April 30, 2003. The plotter is designed to display navigational data acquired from an integrated onboard radar and an optional Global Positioning System/Wide Area Augmentation System (GPS/WAAS) receiver.37 Recent position and track information is 36 Transport Canada, p. 16. 37 WAAS is a form of GPS that enhances position accuracy by correcting received navigation data (http://users.erols.com/dlwilson/gpswaas.htm ).

Factual Information 26 Marine Accident Report stored in memory for as long as power is applied to the device. A battery is permanently installed in the unit to maintain data integrity while the unit is disconnected from the main power. The exterior of the device showed no evidence of structural damage, but the interior was encrusted with salt. Metallic connections between the onboard battery and the printed circuit card containing the semiconductor memory elements were found completely corroded through. The onboard battery was found to be totally discharged. The unit was sent to the manufacturer, Furuno USA, Inc., to assess the potential for data recovery, but no data were found stored in the memory elements because of the loss of electrical power. Other Information Coast Guard Surf Stations Station Tillamook Bay is a designated surf station, where the Coast Guard operates rescue boats designed to pass through heavy, breaking waves. Surf stations are established at Federally mandated navigable bars or entrances where surf greater than 8 feet occurs 10 percent or more of the time during a calendar year, averaged over at least 5 years,38 and where the water is deep enough to operate surf boats. The Coast Guard has designated 20 surf stations, 5 on the East Coast and 15 on the West Coast (table 3). The wave conditions that occur at the waterways monitored by West Coast surf stations usually differ from the wave conditions at waterways overseen by the East Coast surf stations. As noted earlier, waves are created by wind energy. Because of rotational force effects, weather patterns, and other factors, the prevailing winds on the West Coast are behind the waves, increasing their energy. The prevailing winds on the East Coast, in contrast, blow against the waves, retarding their force. The Pacific Ocean is wider than the Atlantic Ocean, which permits the wind energy to build, creating larger swells. Finally, unlike the East Coast, the West Coast has a steep continental slope and narrow continental shelf that allows the waves to enter shallow water closer to shore. As the waves encounter a rapid change in water depth, their height becomes steeper and they break, spilling, plunging, or surging in the shallows or on the beach. The Coast Guard has identified that the sea state at coastal river bar entrances overseen by several surf stations contributes to conditions that warrant the suspension of traffic by recreational vessels and uninspected commercial boats. This is discussed further in the following section. 38 U.S. Coast Guard Boat Operations and Training (BOAT) Manual, vol. 1, chapter 4, “ Surf Stations” (Commandant Instruction M16114.32A, January 18, 2005).

Factual Information 27 Marine Accident Report Table 3. Designated Coast Guard surf stations. The Coast Guard BOAT manual states that surf stations are required to be staffed by a two-person command cadre (usually, a commanding officer or officer-in-charge and an executive petty officer) and by from five to seven qualified surfmen. Surfmen are MLB coxswains who are specially trained to perform rescues at sea in hazardous conditions (surf and heavy, breaking seas). A surfman is required to be on board a responding MLB when the surf exceeds 8 feet. About 160 surfmen stand duty at the 20 designated surf stations and at the surfman training center (the National Motor Lifeboat School at Cape Disappointment, Washington, near the mouth of the Columbia River39). According to the Coast Guard, since 1999, only about 50 percent of the surfman duty billets have been filled with qualified personnel. In 2003, the Coast Guard established a prospective surfman program to attract and train Surf Station State East Coast Merrimack River Massachusetts Chatham Massachusetts Barnegat Light New Jersey Oregon Inlet North Carolina Hatteras Inlet North Carolina West Coast Grays Harbor Washington Cape Disappointment Washington Quillayute River Washington Tillamook Bay Oregon Yaquina Bay Oregon Depoe Bay Oregon Umpqua River Oregon Siuslaw River Oregon Coos Bay Oregon Chetco River Oregon Humboldt Bay California Noyo River California Bodega Bay California Golden Gate California Morro Bay California 39 For further information, see National Motor Lifeboat School website .

Factual Information 28 Marine Accident Report surfmen.40 A prospective surfman must be previously certified as a coxswain and must meet the qualifications for MLB basic coxswain and heavy-weather coxswain41 before undertaking surfman training. The training can take 2 years or more because most practical tasks require surf conditions (surf in excess of 6 feet).42 According to the Coast Guard’s BOAT manual, Station Tillamook Bay was required to have five qualified surfmen. The Coast Guard Marine Safety Office in Portland informed Safety Board investigators that at the time of the accident, Station Tillamook Bay had only three qualified surfmen, due to the Coast Guard-wide personnel shortage noted above. Surf stations are also required to have at least two surf-capable boats. Station Tillamook Bay had two 47-foot MLBs, the Coast Guard’s newest heavy-surf rescue vessels.43 The lifeboats are designed to operate in extreme conditions, including sustained winds of 50 knots, surf up to 20 feet, and 30-foot seas, and if overturned, can right themselves in 8 seconds. The 47-foot MLBs are equipped with two 450-horsepower engines and have an operating speed of over 25 knots, a range of over 200 nautical miles, and an endurance time of 12 hours. The prototype of the 47-foot MLB was tested at Cape Disappointment. Coast Guard Authority Regarding Unsafe Conditions The Coast Guard has the authority under 33 CFR 177 to determine when unsafe conditions exist on recreational boats or uninspected passenger vessels, or on a body of water, and to require operators of those vessels to take immediate action to protect the safety of those on board.44 The unsafe conditions defined in the rules include operating in a designated “regulated boating area” when wave heights are above 4 feet, when the wave height exceeds that determined by a formula related to the length and freeboard of the boat,45 or when the surface current is 4 knots or greater in the regulated boating area. 40 “Prospective Surfman Program,” Commandant Instruction 16114.35, July 31, 2003. 41 Coxswains who undergo advanced training in operating the 47-foot MLB in heavy weather, defined by the Coast Guard as “sea, swell, and wind conditions combining to exceed 8 feet and/or winds exceeding 30 knots” (U.S. Coast Guard Boat Crew Seamanship Manual, Commandant Instruction M16114.5C, September 13, 2003, appendix A). 42 Practical training is carried out at surf stations after trainees complete coursework at the National Motor Lifeboat School. To be certified as a surfman, an MLB coxswain must satisfy the Coast Guard’s personnel qualification standard. The performance criteria include transiting a bar or inlet inbound and outbound through 8- to 15-foot surf, rescuing a person in the water in 8- to 15-foot surf, maintaining a stationary position in 8- to 15-foot surf, and other tasks (U.S. Coast Guard BOAT Manual, vol. 2, part 6, “Surfman Qualification”). The prospective surfman must also pass comprehensive written examinations. 43 Details about the 47-foot MLB are from the websites of the Thirteenth Coast Guard District and the Seventh Coast Guard District . 44 According to 33 CFR 177.05, the Coast Guard may direct operators to “correct the hazardous condition immediately; proceed to a mooring, dock, or anchorage; or suspend further use of the boat until the especially hazardous condition is corrected.” 45 The formula is given at 33 CFR 177.07(f)(2), as follows: L/10 + F = W, where L = overall length of a boat measured in feet in a straight horizontal line along and parallel with the centerline between the intersection of this line with the vertical planes of the stem and stern profiles excluding deckhouses and equipment; F = the minimum freeboard when measured in feet from the lowest point along the upper strake edge to the surface of the water; W = maximum wave height in feet to the nearest highest whole number.

Factual Information 29 Marine Accident Report The Tillamook Bay bar is 1 of 16 river bar entrances in Oregon and Washington defined as a regulated boating area (33 CFR 177.08[f]). All 10 Coast Guard surf stations (see above) in those states are also regulated boating areas. Regulated areas without a Coast Guard station near their entrances (Coquille River, Nehalem River, Netarts Bay, Rogue River, and Siletz Bay in Oregon; Willapa Bay in Washington) are not normally restricted.46 To protect small-boat operators, the Coast Guard has placed diamond-shaped rough bar advisory signs at the bar entrances of 10 of the regulated boating areas. Two rough bar advisory signs are found at the entrance to the Tillamook Bay channel, one at the Coast Guard station and one on the observation tower (figure 6). The signs are painted white, with an international orange border, and bear the words ROUGH BAR in black capital letters. The signs have two flashing yellow lights that are activated when seas exceed 4 feet in height and are considered hazardous for small boats.47 46 Standard Operating Procedures, Thirteenth Coast Guard District, Seattle, Washington, 2002. Figure 6. Rough bar advisory sign on Coast Guard observation tower at Tillamook Bay. 47 U.S. Coast Pilot, vol. 7, 2003, p. 299.

Factual Information 30 Marine Accident Report Vessel movement at the Tillamook Bar is monitored by a Coast Guard seaman sta- tioned in the observation tower on the north jetty. The tower is manned during daylight from about one-half hour before sunrise and remains manned when the rough bar light is lit. Coast Guard Regulations on Wearing of Lifejackets Current Rules. Federal regulations for the wearing of lifejackets on small passenger vessels are found at 46 CFR 122.508 (subchapter K) and 185.508 (subchapter T). These rules (part of the 1996 amendments to the Small Passenger Vessel Regulations) make the vessel master responsible for determining when “possible hazardous conditions exist” such that passengers should wear lifejackets: (a) The master of a vessel shall require passengers to don life jackets when possible hazardous conditions exist, including, but not limited to: (1) When transiting hazardous bars and inlets; (2) During severe weather; (3) In event of flooding, fire, or other events that may possibly call for evacuation; and (4) When the vessel is being towed, except a non-self-pro- pelled vessel under normal operation conditions. (b) The master or crew shall assist each passenger in obtaining a life jacket and donning it, as necessary. Rulemaking History. The notice of proposed rulemaking (NPRM) for this regulation was first published on January 30, 1989 (Federal Register, vol. 54, no. 18, p. 4412). The notice advised Congress and others that the Coast Guard was completely revising the regulations governing the inspection and certification of small passenger vessels, parts 175 through 187 of 46 CFR. The original regulations had been developed in response to the Small Passenger Vessel Act of 1956, passed by Congress as Public Law 84-519. In its 1989 NPRM, the Coast Guard cited a number of reasons for amending the regulations, including statutory changes, increases in vessel size and capacity, and changes in the scope of operation of small passenger vessels. The Coast Guard noted that “Public Law 84-519 intended that the regulations promulgated thereunder provide a standard of safety for weekend fishermen, sightseers, and possibly small ferries,” but that “the environment in which small passenger vessels operate has changed dramatically.” For example, many no longer operate out of one port, and some engage in international voyages. A further reason given for revising the small passenger vessel regulations was vessel casualties. The NPRM cites 11 marine casualties reported to the Coast Guard between 1973 and 1987, seven of which involved capsizings or sinkings: • Comet, 1973: party fishing boat, foundered and sank off Rhode Island in 48º F water; 12 drowned, 4 missing. • Pearl C., 1976: charter fishing vessel, capsized while being towed across the Columbia River bar off Astoria, Oregon; 1 drowned, 7 missing.

Factual Information 31 Marine Accident Report • Dixie Lee II, 1977: charter fishing vessel, capsized during sudden, severe thunderstorm; 12 died, 1 missing. • Joan La Rie III, 1982: charter fishing vessel, swamped by large wave and sank off New Jersey in 53º F water; 6 drowned, 2 missing. • San Mateo, 1983: charter fishing vessel, capsized while crossing bar at Morro Bay, California, all 32 persons on board thrown into water, all rescued; 3 serious injuries, operator later died of his injuries. • Merry Jane, 1986: charter fishing vessel, broached and heeled sharply to starboard approaching Bodega Bay, California, 19 of 51 aboard fell or were thrown overboard; 9 drowned. • Fish-n-Fool, 1987: charter fishing vessel, capsized off Baja California Norte, Mexico, in 59º F water; 2 died, 8 missing. The NPRM states that investigations of such casualties by the Safety Board and the Coast Guard had led to recommendations that would help prevent casualties or alleviate damages and injuries from future casualties, and that the Coast Guard considered those recommendations in proposing changes to subchapter T. A supplemental notice of proposed rulemaking (SNPRM) was published on January 13, 1994 (Federal Register, vol. 59, no. 9, p. 2210). The rule in the SNPRM contained the following two paragraphs: (b) When evaluating the need to require the donning of lifejackets, the master shall consider the size of the vessel and the location of the passengers on the vessel. (c) Any passenger or crew member shall be permitted to voluntarily don a lifejacket whenever he or she desires. After receiving comments on the NPRM and the SNPRM, the Coast Guard published the interim final rule for the subchapter T regulations on January 10, 1996 (Federal Register, vol. 61, no. 7, p. 1005). The interim final rule omits paragraphs (b) and (c) from section 185.508. The Coast Guard described its rationale for the change as follows:48 The intent of this section was to raise the sensitivity of the master with regard to donning of lifejackets, and raise the priority of donning lifejackets in certain hazardous and deteriorating operating conditions. The comments received on this section were focused on paragraph (c), which permitted passengers and crew to don lifejackets whenever desired. The Coast Guard agrees with comments received that required lifejackets are part of the vessel’s emergency gear, and should not be compromised by allowing passengers to don them in other than master directed circumstances. The final rule for 46 CFR subchapters K and T was published on September 30, 1997.49 The final rule establishing the current regulations became effective on October 30, 1997. 48 Federal Register, vol. 61, no. 7, p. 881. 49 Federal Register, vol. 62, no. 189, p. 51326.

Factual Information 32 Marine Accident Report Previous Board Action—1983. The Safety Board made the following recommendation to the Coast Guard in 1983 regarding the wearing of lifejackets by passengers in hazardous conditions: M-83-80 Amend 46 CFR part 185 to require that children carried on board small passenger vessels wear life preservers while the vessel is departing protected waters and until such time as the operator determines that it is safe to remove them. Safety Recommendation M-83-80 resulted from the Safety Board’s investigation of the 1983 accident in which the small passenger vessel San Mateo capsized at the entrance to Morro Bay, California, with 23 children and 7 adult chaperones on board.50 No one was wearing a lifejacket, but all those aboard were rescued, with only three serious injuries among the passengers. The operator of the vessel, however, later died of his injuries. On February 23, 1984, the Coast Guard advised the Safety Board that it concurred with the intent of the recommendation “to the extent that passengers should wear life preservers when hazardous conditions exist or are expected to be encountered.” The Coast Guard said that the operator of the San Mateo “should have required all passengers to put on life preservers” in accordance with the regulations but that “the decision that passengers aboard small passenger vessels wear life preservers should remain the responsibility of the operator.” The Coast Guard further stated that in the San Mateo accident, “the hazard was not the result of leaving protective waters, but crossing a hazardous bar and standing into rough seas.” The Safety Board replied on July 5, 1984, that it regretted that the Coast Guard did not concur with the recommendation and that “unless Federal regulations are revised to ‘require’ rather than to ‘recommend’ the wearing of life preservers during or in anticipation of emergency situations, passengers of small passenger vessels will not be afforded the full protection intended by the Federal regulations requiring that the equipment be on board.” The Board placed Safety Recommendation M-83-80 in “Open— Unacceptable Action” status and asked the Coast Guard to reconsider its opinion. On November 24, 1995, the Board classified the recommendation “Open— Unacceptable Response” because of the Coast Guard’s lack of timely action. On June 26, 1996, the Coast Guard requested that the Board reclassify the recommendation because it had published final rules that provided requirements for passengers to don lifejackets in possible emergency conditions. On March 12, 1997, citing the new provisions of 46 CFR parts 122.508 and 185.508, the Safety Board classified Safety Recommendation M-83-80 as “Closed—Acceptable Action.” 50 Capsizing of the Charter Passenger Vessel San Mateo, Morro Bay, California, February 16, 1983, Marine Accident Report MAR-83/09 (Washington DC: National Transportation Safety Board, 1983).

Factual Information 33 Marine Accident Report Previous Board Action—1986. The Safety Board made the following recommendation to the Coast Guard in 1986 regarding the wearing of lifejackets by passengers in hazardous conditions: M-86-113 Require that life preservers be worn by passengers of small ocean and coastwise passenger vessels up to 65 feet in length, while on open decks during the time that these vessels are leaving or entering ports which are susceptible to breaking waves similar to Bodega Bay, California. Safety Recommendation M-86-113 resulted from the investigation of the 1986 accident in which the Merry Jane, a 65-foot-long charter passenger vessel, was overtaken by large waves while returning to Bodega Bay, California, after a sportfishing trip.51 As the first large wave passed under the Merry Jane’s port quarter, the vessel suddenly raised and its bow swung to the left, forcing the vessel to become broadside to the waves. The vessel heeled to starboard and nearly capsized. The sudden large heel caused two passengers on the bow, one passenger on the flying bridge, and one crewmember near the stern to be thrown overboard. A few seconds later, the same large wave broke over the vessel’s port side, flooded the afterdeck, and washed 14 of the 48 passengers overboard. After the vessel righted, it was struck again by another large wave, which again heeled the vessel severely and also broke over the vessel. The operator succeeded in turning the vessel to the left to head into the seas. Once headed into the seas, the Merry Jane encountered one more large wave and one more passenger was thrown overboard. Of the 19 persons thrown into the water, 10 persons were rescued and 9 persons died. The Merry Jane sustained only minor damage. On December 31, 1986, the Coast Guard responded that it concurred in part with Safety Recommendation M-86-113. The Coast Guard stated that although “the operator of a passenger vessel is responsible for the operational decisions affecting the safety of the vessel and its passengers,” it would “aid and encourage operators to be more cautious.” The Coast Guard further stated that it intended the local Officers in Charge, Marine Inspection, to “designate hazardous inlets on which operators of small passenger vessels will require to have passengers on open decks don life jackets prior to transiting.” On April 24, 1987, the Safety Board classified Safety Recommendation M-86-113 “Open—Acceptable Response,” pending further Coast Guard action. On November 24, 1995, the Board reclassified the recommendation “Open—Unacceptable Response” because of the Coast Guard’s lack of timely action. On March 12, 1997, after the Coast Guard published its new regulations at 46 CFR 122.508 and 185.508, the Board classified Safety Recommendation M-86-113 “Closed—Acceptable Action.” 51 Near Capsizing of the Charter Passenger Vessel Merry Jane, Bodega Bay, California, February 8, 1986, Marine Accident Report NTSB/MAR-86/11 (Washington, DC: National Transportation Safety Board, 1986).

Factual Information 34 Marine Accident Report Masters’ and Passengers’ View on Wearing Lifejackets. As noted earlier, several masters of the vessels who sailed on the day of the accident indicated that if conditions were so dangerous that they would have to ask passengers to wear lifejackets, they would not, or should not, take their vessels out. The Kerri Lin master stated, “If I have to put lifejackets on people to go out, we don’t go.” The Norwester master told investigators, “You are already in an emergency state if you are putting lifejackets on.” When investigators asked the master whether passengers might be more willing to wear lifejackets if they were lighter and not so cumbersome, possibly self-inflating, he said that it would be up to individual passengers. But he also said that whether passengers are willing to put on a lifejacket “is generally based on the comfortability of the lifejacket.” (See appendix D for information about Coast Guard-approved lifejackets.) The Oakland Pilot master said that requiring passengers to wear lifejackets would frighten them. The D & D operator also told investigators that it frightens many people when the master tells them to put on a lifejacket. But he said that if the Coast Guard had a rule that people had to wear lifejackets when crossing the bar, then they would not question it. “But for us to tell them they have to do it, it just scares the hell out of them.” Actions After Taki-Tooo Accident Lifejacket Safety Alert. On June 17, 2003, the Coast Guard issued a safety alert regarding the wearing of lifejackets. The alert reiterated the regulations at 46 CFR 185 requiring the master of a vessel to require passengers to don lifejackets when possible hazardous conditions exist. The alert noted that wearing a lifejacket in such circumstances is “similar to wearing seatbelts during aircraft take-offs and landings and periods of turbulence.” The message went on to say, “The best time to don a life jacket is before it is needed—before people are in the water.” The safety alert concluded as follows: The Coast Guard has entrusted small passenger vessel masters to use their judgment to determine when to require the passengers to wear life jackets. Should Masters have questions concerning “hazardous conditions” and when life jackets should be donned, they should contact their local Coast Guard Officer in Charge, Marine Inspection for additional guidance. If there is doubt as to whether a hazardous condition exists, passengers and crew should don life jackets. Bar Closing. On September 11, 2004, the COTP Portland, citing adverse weather conditions in the vicinity of Tillamook Bay, issued Order 2004-39 closing the bar to all vessel traffic. The situation report indicates that after returning about 0830 from fishing in the ocean, the D & D operator radioed Station Tillamook Bay of his intent to cross the bar. Station personnel advised the D & D operator that the existing conditions included 18- to 20-foot breakers on the north and south sides of the bar and 8- to 10-foot breakers inside the jetties and recommended that he wait for conditions to change. Station Tillamook Bay then notified Group Astoria of the existing conditions, and Astoria relayed the report to the COTP Portland. At 1215, the order was issued to hold all commercial vessel traffic from crossing the entrance to Tillamook Bay because of hazardous weather conditions. At 1353, after being advised that the bar conditions had abated, the COTP Portland rescinded the order. Two MLBs subsequently escorted the D & D across the bar at 1837, when tide conditions improved.

Factual Information 35 Marine Accident Report Coast Guard Report on Small Passenger Vessel Safety. Fourteen months after the Taki-Tooo capsized, Congress passed the Coast Guard and Maritime Transportation Act of 2004, which included a provision requiring the Coast Guard to report to Congress regarding measures that should be taken to increase the likelihood of survival of passengers on small passenger vessels who may be in the water resulting from the capsizing of, sinking of, or other marine casualty involving the small passenger vessel. The study shall include a review of the adequacy of existing measures (1) to keep the passengers out of the water, including inflatable life rafts and other out-of-the-water survival crafts; (2) to protect individuals from hypothermia and cold shock in water having a temperature of less than 68 degrees Fahrenheit; (3) for safe egress of passengers wearing personal flotation devices; and (4) for the enforcement efforts and degree of compliance regarding the 1996 amendments to the Small Passenger Vessel Regulations (part 185 of title 46, Code of Federal Regulations) requiring the master of a small passenger vessel to require passengers to wear personal flotation devices when possible hazardous conditions exist . . . 52 Congress specifically directed the Coast Guard to describe enforcement of the regulation requiring masters to have passengers don lifejackets in possibly hazardous conditions, and to include in its report “the number of vessels and masters cited for violations of those regulations for fiscal years 1998 through 2003.” Congress also required the Coast Guard to provide recommendations for “improving compliance with, and possible modifications to, those regulations.” On March 31, 2005, the U.S. Department of Homeland Security delivered the Coast Guard’s “Report on Small Passenger Vessel Safety” to the Senate Committee on Commerce, Science and Transportation.53 In discussing the lifejacket regulation, the report states, “At present, there have been no citations issued to vessels or masters for violations of this regulation since it became effective, and the degree of compliance is unknown.” The report describes enforcement or compliance monitoring as “problematical at best”: Enforcement action would require either direct observation by the Coast Guard, testimony or reporting by a passenger (who are [sic] unlikely to complain about not wearing lifejackets) or crew member, or come about as a result of a casualty. Further complicating enforcement, the regulation contains little metric guidance to determine when a bar or inlet is sufficiently “hazardous,” or weather sufficiently “severe,” to trigger the requirement for a given vessel and its capabilities and the experience of its master. In the case of the TAKI TOOO, the master was very familiar with the waters around the Tillamook Bar, and had 17 years of experience operating the vessel—and thus may not have perceived the same degree of risk as a less experienced operator. As noted in the preamble to the 1996 IFR [interim final rule], the intent of the requirement was to raise the sensitivity of the master, based on his/her discretion and judgment, with regard to donning of lifejackets, and to raise the priority of donning lifejackets in certain hazardous and deteriorating operating conditions. 52 Section 624, Coast Guard and Maritime Transportation Act of 2004 (Public Law 108-293). The law was passed on August 9, 2004, to authorize appropriations for the Coast Guard for fiscal year 2005. 53 The Coast Guard transferred from the U.S. Department of Transportation to the Department of Homeland Security in February 2003.

Factual Information 36 Marine Accident Report In addition to the practical difficulties in enforcing the regulation, there have not at present been any specific corresponding civil penalty provisions established in connection with it (although in cases where a master shows poor discretion or judgment that rises to the level of negligence, action could be taken against the master’s license). . . . The case of the TAKI TOOO remains under investigation; however since the master is deceased and the vessel a total loss, it is unlikely that it will result in any citations. The last section of the report discusses, as required by Congress, improving compliance with the regulations. In late 2004, the Coast Guard and the small passenger industry began chartering a Natural Working Group (NWG) to develop “guidance as to what conditions may warrant the mandatory donning of lifejackets on both inspected and uninspected small passenger vessels.” The report states that “partnership with the industry is believed to be preferable to a regulatory solution,” and quotes a statement by the National Marine Charter Association (NMCA) opposing the mandatory use of lifejackets on small passenger vessels: Passengers on charter vessels have the distinct safety advantage of professional guidance from trained, licensed, and experienced operators and crew. Operators of passenger vessels are licensed by the U.S. Coast Guard and have the training and experience to know when circumstances warrant passengers donning PFDs [personal flotation devices, that is, lifejackets]. The safety briefings Captains give to passengers before being underway show where PFDs are kept and how they should be worn. A government intrusion on and regulation of this important business-customer relationship is unwarranted and unneeded, and has not been proven beneficial by any studies or empirical evidence. The report concludes as follows: The Coast Guard is hopeful that the work of the NWG will result in useful guidance for masters of small passenger vessels to supplement their discretion and judgment with regard to donning of lifejackets in hazardous and deteriorating operating conditions, with a view to further improvement of the already excellent safety record of the industry. Condition of Tillamook Bar Nearly all the charter fishing boat owners and operators at Tillamook Bay interviewed by Safety Board investigators said that the condition of the Tillamook bar had deteriorated in recent years.54 The masters described passage over the bar as more dangerous than before because of increased shoaling, which has made the area “too shallow” for safe passage. Several said that the destruction of the ends of the jetties has exposed rocks at the end of the south jetty and that the erosion of the beach next to the north jetty has caused a buildup of sand at the end of the north jetty, making both jetties dangerous. One vessel master told investigators that charter boat operators had lost 20 to 54 Among those interviewed by Safety Board investigators were the masters of the four other boats that left Garibaldi marina the morning the Taki-Tooo capsized and both owners of Garibaldi Charters.

Factual Information 37 Marine Accident Report 30 days a year because of the deteriorated conditions. One of the Garibaldi Charters owners said that the company’s boats could not go out 5 or 6 days a year because of the weather and because “the bar is in bad condition.” The chief of operations for the Portland (Oregon) District of the Army Corps of Engineers told Safety Board investigators that the Tillamook Bay jetties were constructed to offset the accumulation of sand at the bar. She said that, despite local people’s perception that the bar was getting worse, the Corps’s survey charts showed that conditions had not changed much over the years. “The only change that I’ve seen from looking back through the data over the past number of years is that the wave frequency, wave heights and storm frequency had gotten worse,” she said. She explained that maintenance dredging of the channel requires separate funding from maintenance of the jetties and that the Corps has not requested funding for dredging because the jetties are functioning as intended (that is, scouring the channel). The Corps’s public relations manager said that he had received no “negative comments” about the state of the channel. The chief of operations told Safety Board investigators that the Corps had received congressional funding to study the state of the Tillamook Bay jetties and to estimate the cost of work to prevent the north jetty from breaching during a storm. In December 2003, the Corps published a major maintenance report, an extensive study addressing the deterioration of the north and south jetties and exploring repair alternatives and associated costs.55 The study contains a design report and an environmental assessment and includes data from field measurements of the jetties taken the week after the Taki-Tooo accident.56 Deterioration of Jetties and Shoreline. According to the Corps’s study, both jetties at the entrance to Tillamook Bay have been damaged by exposure to “more extreme storm waves” in recent years: • The north jetty is now 384 feet shorter than its authorized length of 5,700 feet. The jetty was completed in 1917 and has been extended or repaired six times since then, the last time in 1991. The study predicts that, on the basis of past recession rates (decreases in length), the north jetty will be 475 feet shorter by 2006. • The south jetty is now 666 feet shorter than its authorized length of 8,025 feet. The jetty was constructed in three stages between 1969 and 1971 and has never been repaired. The south jetty is predicted to be 890 feet shorter by 2006. • The shoreline along the north jetty has eroded. If wave action breaches the jetty, it could destroy the Coast Guard watchtower as well as disrupt the navigation channel. Changes in Bar. The Tillamook bar (called the ebb tidal shoal in the report) has changed as a result of jetty construction and the deterioration of the jetty tips. Before the 55 U.S. Army Corps of Engineers, Tillamook North and South Jetties, Garibaldi, Oregon, Major Maintenance Report (Portland, Oregon: December 2003). The study was funded in 2002. 56 Week of June 23, 2003.

Factual Information 38 Marine Accident Report south jetty was built, the shoal was evenly distributed both north and south. According to the report, a 1984 survey found that the shoal had begun to hook away from the south side of the entrance. By 2002, the hook had extended into the navigation channel. In addition, increased shoaling along the south side of the channel had concentrated the ebb current on the north side of the channel and deepened the north side. Navigation Concerns. The Corps’s study states that deterioration of the jetties “has caused concern for navigability of the channel”: Conditions through the south approach channel and inner channel between the jetty heads are the major concerns to navigability. Wave conditions over the ebb tidal shoal, especially during the ebb tide, have become very treacherous over the past 6 years, possibly caused by receding jetty lengths, mainly the south jetty. The wave conditions over the ebb tidal shoal are very dangerous. There is a channel located just west of the end of the south jetty that boaters use to navigate the entrance. This situation is complicated by the presence of remnant jetty stone that lies adjacent to this natural channel. This channel also forces boaters to put their vessels in a precarious position, broadside to the waves. Non-local boats that must use the entrance as a port of refuge are unaware of the particular dangers of the ebb tidal shoal and the use of the natural channel used by local boaters. According to the Coast Guard, non-locals do not navigate the entrance very well. The study concludes that not to repair the jetties “will eventually lead to an increase in shoaling at the channel entrance. As more of the jetties deteriorate, waves will move further into the navigation channel increasing boating hazards and further de- stabilizing the inner portion of the jetties.” The study does not discuss navigation conditions faced by vessels proceeding outbound on a northwesterly heading, as on the day of the Taki-Tooo capsizing, other than to note that breaking waves over submerged rocks at the end of the north jetty are “problematic.” Proposed Work. The study makes recommendations for partially restoring the jetties and also recommends that “further analysis and project review be conducted to establish the acceptable final length for both jetties that will provide an acceptable level of navigation conditions at the Tillamook Navigation Project.” In July 2003, the Corps received $500,000 to repair the erosion problems at the base of the north jetty. Congress appropriated additional funding in fiscal year 2004 to build a revetment, or embankment, on the north jetty. In September and October 2004, the Corps repaired the north jetty by placing earth and rock at the base and by constructing a 300-foot-long revetment perpendicular to the jetty along the shore. The revetment is intended to prevent further erosion of the sandy beach near the base of the jetty and to protect the Coast Guard watchtower. According to a Corps official, the revetment is a permanent repair and no work to restore the jetties to their original length is anticipated. National Marine Charter Association The NMCA is a nonprofit organization, based in Washington, D.C., that serves the interests of professional marine charter operators nationwide. The association was formed in June 2003 as an offshoot of the National Association of Charterboat Operators. The 470 NMCA members offer for-hire services such as charter fishing, sailing charters, dive charters, eco-tours, water taxis, and yacht charters. Members are kept informed about

Factual Information 39 Marine Accident Report regulatory and legislative matters and other issues by means of a website, special alerts, and a monthly Internet newsletter. The association also collects and disseminates information about marine charter companies and publishes a national directory (available at charternet.com). Recently, the NMCA developed a voluntary program for marine charter vessels called the Accredited Vessel Inspection Program (A-VIP). The program establishes preferred industry operating practices, equipment standards, and safety measures for both uninspected and inspected charter boats. A-VIP is described on the NMCA website as “the marine charter industry’s first accreditation program.” A-VIP certification requires that vessels carry additional equipment such as navigation-fixing devices, damage-control kits, and alternative communication systems. Certified companies are required to have crews trained in emergency procedures and to keep a log of emergency drills. Companies must certify that their crews perform safety tasks before each trip, such as giving safety orientations and counting passengers. Companies must provide proof of liability insurance and crews must be enrolled in drug-testing programs that comply with Federal regulations. Operators must certify that they participate in the Maritime Domain Awareness program (Homeland Security). Operators must have a written plan for accommodating disabled passengers, and must certify that their vessels are in compliance with applicable Coast Guard requirements. The A-VIP application includes detailed guidelines for emergency drills, such as rough weather at sea, and other certification requirements.

40 Marine Accident Report Analysis General The analysis first identifies factors that can be eliminated as causal or contributory to the accident. It then discusses the following safety issues identified in the accident investigation: • Decision to cross the bar • Tillamook Bay operations • Survivability Exclusions The Safety Board examined the Taki-Tooo, its engine, and related components, to determine whether they showed deficiencies that might have been factors in this accident. Investigators found no significant defect, scratch, marking, or other evidence of the vessel’s striking an object or of the boat grounding. Witnesses, including the Taki-Tooo deckhand, described hearing a reduction in engine power, potentially an indication of propulsion failure. In checking the steering and propulsion mechanisms, however, investigators found no evidence of preaccident mechanical malfunction. The engine and transmission were solidly mounted. The engine was intact, with no signs of oil leaks or signs of catastrophic failure. All fuel lines, fittings, and linkages were intact and attached. When manipulated at the lower helm station, the throttle and transmission control moved the throttle linkage throughout its range. Laboratory examination determined that the condition of the propeller blades, which were curled at the tips, was consistent with a propeller under power striking a soft ocean floor. The Safety Board, therefore, concludes that the absence of defects and the evidence of propulsive power indicate that problems with the engine, propeller, and associated boat components such as the throttle and the rudder were not causal factors in this accident. Decision to Cross the Bar The charter boat operators whose trips originate at Garibaldi marina make a series of decisions in transiting the Tillamook Bay bar. They consider whether they should leave port, based on the broadcast weather conditions. Once at the bay entrance, they consider whether conditions present a go/no-go situation, that is, whether the sea state at the bar permits or precludes an attempted transit to the ocean. Finally, they decide, based on the prevailing seas and current conditions, how to maneuver their vessels so that they safely

Analysis 41 Marine Accident Report reach the ocean. In the following discussion, the Safety Board examines personal factors that could have affected the decisions made by the Taki-Tooo master as well as factors affecting the decisions of all the charter boat operators who took vessels out on the day of the accident. Personal Factors Potentially Affecting the Taki-Tooo Master’s Decisions In analyzing the Taki-Tooo master’s actions, the Safety Board considered personal factors that could have influenced his decision-making, including whether his physical condition was affected by the use of alcohol or drugs (illegal and prescribed) or by a sleep deficit. The Board also considered whether financial concerns might have been a factor. Autopsy findings showed that the cause of the master’s death was drowning by asphyxiation with hypothermia and that he did not die as a result of previously noted medical conditions. Toxicological samples from the master showed no evidence in his system of alcohol or of the five classes of illegal drugs tested for under Coast Guard rules. The toxicological analysis did show amounts of amitriptyline and its metabolite, consistent with the master’s having used the prescribed sedative within 24 hours of the accident.57 Available records indicate the master had been taking 20 milligrams of amitriptyline nightly to treat insomnia for at least 4 years, and he probably had been taking the sedative longer. Toxicological studies with amitriptyline have shown that any adverse effect it might have on psychomotor performance usually disappears with regular use of the drug.58 While the master may have experienced some subtle effects of the medication, how such effects would have influenced his actions is unclear. The Safety Board considered whether the master was sleep deprived on the day of the accident, which could have impaired his performance. His wife told Safety Board investigators that for some time before the accident, the master had maintained a regular routine in which he had obtained at least 7 1/2 hours of sleep each night, consistently at the same times. Because the master reportedly received 7 1/2 hours of sleep the night before the accident and a comparable amount of reported sleep each night for at least several nights before the accident, and because he maintained a constant sleep/wake schedule, he would not have sustained either an acute or a chronic sleep deficit or experienced a disruption to his body clock or circadian rhythms. Thus, he was not considered to have been sleep deprived at the time of the accident. According to the owner of Garibaldi Charters, if the charter vessel masters elected not to leave the marina to go fishing or returned to port after examining the bar conditions, they would not receive their portion of the passengers’ fees for the fishing trip. The Safety Board, therefore, considered whether the Taki-Tooo master’s decision to proceed with the 57 R. C. Baselt, Disposition of Toxic Drugs and Chemicals in Man, 5th ed. (Foster City, California: Chemical Toxicology Institute, 2000). 58 R. C. Baselt, Drug Effects on Psychomotor Performance (Foster City, California: Biomedical Publications, 2001).

Analysis 42 Marine Accident Report fishing trip might have been influenced by his concern about the possible loss of income. The Safety Board examined the master’s financial records and dealings, including his charter company sale, lease agreements, real estate dealings, and so forth, and found no evidence that he might have been motivated by financial concerns. Therefore, the Safety Board concludes that the following were not factors in the performance of the Taki-Tooo master: sleep deprivation, alcohol, illegal or prescribed drugs, and financial concerns. Decision of the Charter Operators to Leave Port Since the day before the accident, the National Weather Service had issued small craft advisories in its forecasts, which were broadcast over marine and weather radio channels and posted on Internet sites. At 1645 on June 13, the National Weather Service issued a small craft advisory predicting hazardous seas and 10-foot swells, whereupon the Coast Guard staff at Station Tillamook Bay immediately broadcast a bar restriction via VHF-FM channels 16 and 22A and on citizens band channel 9. The Coast Guard watchstanders also raised a small-craft advisory flag at the station and activated the yellow lights on the rough bar advisory signs. Safety Board investigators later observed the sign and lights from the Tillamook channel and noted no obstructions that might have affected the ability of mariners to observe these lights while transiting the channel and approaching the bar. At 0330 on June 14, the National Weather Service updated its forecast, issuing another small craft advisory that predicted wind waves of 3 feet and northwest swells of 11 feet at 11-second intervals. Station Tillamook Bay then dispatched an MLB at first light to assess conditions at the bar, and after being advised by the coxswain of the turbulent seas at the ends of the jetties and the 8- to 10-foot swells outside the jetties, broadcast a message that the bar restriction remained in effect. Thus, the National Weather Service made several broadcasts advising mariners of weather and ocean sea conditions outside Tillamook Bay bar, and the Coast Guard warned mariners in various ways (flag, lights, bar restriction announcements) of hazardous conditions at the bar itself. The Safety Board, therefore, concludes that before the accident, the National Weather Service and the Coast Guard effectively communicated information about the weather conditions and the rough bar to mariners, including the master of the Taki-Tooo. The wife of the Taki-Tooo master said that he had used his home computer to check the weather forecast the night before the accident and had continued to monitor the marine radio in his home for weather announcements the following morning. She further stated that he usually continued to monitor the weather reports on a marine radio in his truck while en route to the marina. At the marina, the actions of the master indicate that he was aware of the predicted sea state. He and the deckhand discussed abandoning the plan to set out crab pots because of the broadcast rough seas.

Analysis 43 Marine Accident Report The decision of the Taki-Tooo master and the operators of the other four charter vessels to leave port and proceed to the inlet area can be considered judicious. The weather and bar conditions as described in broadcasts presented significant hazards to vessel safety. The National Weather Service reports, however, were marine forecasts for ocean-coastal zones. In the case of the coastal zone that included Tillamook, coastal waters extended 20 nautical miles from shore. Thus, the 11-foot swells predicted for coastal waters could have been greater or less by the time they reached the bar area and shore. On the morning of the accident, all the charter vessel masters who transited the bar before the Taki-Tooo later told investigators that once they were across, the swells they encountered in the ocean were comparatively small. While the National Weather Service marine forecasts might not have accurately reflected conditions at the bar, the Coast Guard restriction for recreational vessels was based on an on-scene assessment conducted by an MLB crew 1 1/2 to 2 hours before any of the five charter vessels left the marina. Because various factors affect the bar conditions, notably the strong ebb tide and incoming seas and swells, the operating environment at the bar can change quickly, dramatically affecting a vessel operator’s ability to make a safe transit. On the day of the accident, the ebbing tide was predicted to end about 0720, thereafter creating a slack water environment, which is the optimal time to cross the bar. Based on their experience operating in the Tillamook Bay area, the masters of the Taki-Tooo and the other charter vessels were no doubt aware that the sea conditions at the bar could easily differ from the conditions described in the coastal marine forecasts. The conditions at the bar are subject to change, as evidenced by the statements of Coast Guard officials who indicated that, over the last 5 years, Station Tillamook Bay had imposed or lifted the bar restriction more than once on a given day. The Taki-Tooo master, with more than 15 years of experience in the area, would have known when the ebb tide was predicted to end and might have believed that conditions could improve after he arrived at the inlet. Therefore, the masters, including the master of the Taki-Tooo, were not imprudent to sail from the marina and proceed to the inlet to assess conditions for themselves. The Safety Board concludes that the decision of the Taki-Tooo master and the other charter vessel masters to leave port and proceed to the bar area to make a first-hand assessment of conditions was appropriate. While the decision to leave the dock to assess conditions at the bar might have been prudent, it also probably subtly influenced the masters’ subsequent decisions to cross the bar rather than return to the dock. By loading passengers on the vessel and taking them almost as far as the bar, the masters’ decision-making ability to return to the dock without crossing the bar was diminished. To return to the dock would have meant that each master would have had to personally face and explain his decision to the passengers who had prepared for the expedition and boarded the vessel and whose anticipation for the fishing voyage no doubt had increased as they neared the bar. For the Taki-Tooo master, in particular, the knowledge that the passenger group chartering his vessel had specifically requested that he serve as their master would most likely have subtly affected his decision not only to leave port but also to subsequently

Analysis 44 Marine Accident Report cross the bar. He would have been motivated not to disappoint those passengers who had traveled some distance to engage in a fishing expedition under his command. If, however, the charter operating companies had established go/no-go policies and operating standards for crossing the bar, the masters would have been relieved from making the decision to cross the bar. For example, the owner of the Kerri Lin, a charter boat 3 feet shorter than the Taki-Tooo but with a larger engine, cancelled his fishing trip on the day of the accident because he had a policy of not operating if the sea swell was 10 feet or greater. If the vessel owner/operators or the masters had such operating parameters, they either could have delegated the explanation for the decision to cancel the fishing trip to the company office manager while the vessel was at the dock, or they could have forewarned passengers when they boarded that, based on the forecast conditions, they might not be able to cross the bar, thus somewhat lowering the anticipation of the passengers. The need for charter operating companies to establish go/no-go policies and operating standards is discussed later in this analysis. When the Taki-Tooo and the other charter vessels arrived at Tillamook Bay bar, the masters maneuvered their boats just inside the jetties and waited for conditions at the bar to permit passage. On this day, however, the sea conditions at Tillamook Bay bar were particularly hazardous. Waves and swells were 10 to 12 feet, on occasion even higher. Witnesses on shore said that the large waves were coming too close together for a boat to avoid going over at least one of them on the way out of the inlet. Moreover, the masters could not position their boats to make the transit to good seas without putting their vessels and their passengers at risk in the large waves. Based on extensive research conducted in decision-making in dynamic environments,59 the evidence suggests that each master would have made the decision to cross based on such factors as his own personal experience and abilities and the capabilities of the vessel he was operating, as well as such situationally specific factors as the size and frequency of the waves and swells. In addition, each master would have had his own personal reason for making a decision. The master of the Norwester, the first vessel to cross, waited 30 to 45 minutes before making the transit attempt. Coast Guardsmen on watch at the station and on the MLB said that the charter boat rode over the first large swell; however, the large swell that immediately followed stood the 41.8-foot-long Norwester “straight up,” almost on its stern. Fortunately, no one on the Norwester was injured while the vessel crossed the bar. Even though the transit appeared to be successful, in the Safety Board’s opinion, the Norwester master should have recognized how quickly the large swells were coming and should not have crossed the bar when he did. After clearing the bar, the Norwester master radioed the other mariners, advising them that “It wasn’t worth it to go out” and that they should wait until conditions at the bar 59 G. Klein, “Applied Decision Making,” in P.A. Hancock (ed.), Human Performance and Ergonomics (San Diego, California: Academic Press, 1999).

Analysis 45 Marine Accident Report “settled down a little bit. . . .” He also advised the other boat operators that he had avoided a log, thus presenting information about additional hazards in the waterway. Despite the broadcast admonition from the Norwester master, the seemingly successful transit of his vessel would have had the effect of making it more difficult for the other masters at the inlet to turn back and return to the marina. Moreover, each successful transit thereafter would have made it increasingly more difficult for those vessel masters still waiting at the bar to cancel their voyages. After the Norwester’s departure, the master of the Oakland Pilot waited only 5 minutes before attempting to cross the bar. In preparation for making the transit, the Oakland Pilot master directed his passengers to sit down. Passengers later stated that the 44-foot-long Oakland Pilot rode over a “huge swell” and dropped 10 to 12 feet off the back of the wave. The crossing attempt reportedly resulted in the deckhand and two passengers sustaining minor injuries. Thus, the Oakland Pilot master’s attempt to mitigate the risk to those on board of crossing the bar under the prevailing conditions was unsuccessful. After clearing the bar, the Oakland Pilot master radioed the other vessel operators that logs were floating in the area. The D & D started over the bar next, shortly after 0700. According to a D & D passenger, the vessel went over two or three “good” waves, and the master turned north to maneuver around a log at the end of the jetty. The Safety Board is aware that fallen trees and logs frequently float in or along the waterways of the Pacific Northwest and present a common hazard to navigation. Still, the decision of the D & D master to attempt to transit a bar area made hazardous by both large waves and floating logs was ill advised. The Taki-Tooo master continued to monitor the bar conditions, noting the movements of other vessels and the success of their masters’ attempts to cross and listening to the radio transmissions from the vessel masters. Given the small community of charter fishing companies operating in the Tillamook Bay area and the level of interaction among the owners and masters, the Taki-Tooo master most likely would have been fully aware of the capabilities of each vessel waiting to cross the bar and the experience level of each master. Certainly, he was familiar with the D & D, a single-engine, 32-foot vessel like the Taki-Tooo but with a slightly less powerful engine. He owned and had operated the D & D and therefore would have been fully aware of the D & D’s capabilities relative to those of his own vessel. Possibly, the decision of the Taki-Tooo master to attempt to cross the bar a few minutes later was influenced by the successful transit of the D & D. The master’s decision could also have been influenced by his extensive operating experience in the Tillamook Bay area. Coast Guard documents support the statements of other area vessel operators that the Taki-Tooo master had crossed the bar more than a thousand times. In the 5 years before the accident, the Coast Guard had restricted the bar over a thousand times. No doubt the Taki-Tooo master had previously crossed the bar in conditions at least as rough as those encountered at the time of the accident. As a result, his confidence in his ability to cross successfully, accrued over many years, may have led him to minimize the hazards he faced.

Analysis 46 Marine Accident Report Thus, the decision of the Taki-Tooo master to cross the bar was probably influenced by a host of factors, including the request of the passengers for his services, his observations of sea conditions comparable to those he had seen before, his previous experience making the bar transit with this vessel, and his observation of the crossings of the other vessels before him. Notwithstanding the information that argued against making the crossing, notably the weather forecasts, the bar restriction, and his own knowledge of the potential hazards of making the effort, the master made the decision to cross the bar. The tragic consequences of his attempt to transit the bar demonstrate the faultiness of his decision-making. The Safety Board concludes that the decision of the charter boat operators, including the master of the Taki-Tooo, to transit Tillamook Bay bar in the hazardous sea conditions that prevailed on the morning of the accident jeopardized the safety of all on board. Safely crossing a bar depends on factors within a master’s control, such as his or her skill and experience and the vessel’s size and power, as well as factors outside his or her control, specifically, the severity of the sea state. The Coast Guard has designated Station Tillamook Bay a surf station, meaning the surf exceeds 8 feet 10 percent or more of the time during a calendar year, averaged over 5 years. Ocean swells, usually very large, converge with waves generated by the prevailing winds in the immediate area. Navigation at the site is further complicated by the complex characteristics of the tidal currents. No master can be assured that the conditions encountered when crossing will be the same conditions as those observed when the decision to cross is made. Witnesses reported that on the day of the accident, the Taki-Tooo traveled closer than normal to the north jetty, recognized in published documents as an “extremely dangerous” area. The deckhand said that she believed the master put the engines in reverse or astern power while they passed over the first large wave so that the vessel “didn’t go flying off the other end” of the wave. After the vessel rode over the first swell, a 9- or 10- foot wave, the charter boat descended into a trough between building waves. The Taki- Tooo deckhand then heard the master say, “I didn’t want to get into this.” She said that she was not sure whether the master had turned the charter boat or whether the boat was still turning from sliding down the back of the wave, but somehow the Taki-Tooo twisted to the north and a “steep,” 15-foot swell came from the west and capsized the charter boat. Because the master died in the accident, the Safety Board was unable to discern what the master meant by his remarks or why the vessel turned parallel to the waves. Therefore, the Safety Board concludes that it cannot be determined whether the Taki- Tooo’s turn to a northerly heading, which placed the vessel broadside to the seas, was due to a deliberate action by the master or to a loss of control by the master.

Analysis 47 Marine Accident Report Tillamook Bay Operations Navigational Conditions at the Bar Safety Board investigators interviewed charter fishing boat owners and operators at Tillamook Bay and nearly all said that the condition of the Tillamook bar had deteriorated in recent years. They claimed that increased shoaling of the “middle grounds” had occurred, which had resulted in greater swell heights across the bar and jetties. An Army Corps of Engineers study confirms that the conditions of the bar have deteriorated over time. The Safety Board sought to determine whether the deterioration was a factor in the accident. Although the Tillamook Bay channel does not require dredging, the Corps of Engineers surveys the channel annually. Analysis of the Corps surveys shows that channel conditions had not changed much over the years. Moreover, the Corps surveyed the channel a week after the accident to assist in the investigation of the Taki-Tooo accident and determined that the channel was within its authorized depth. According to the 2003 Corps of Engineers study, both jetties at the entrance to Tillamook Bay have been damaged by exposure to “more extreme storm waves” in recent years and are now several hundred feet shorter than their authorized length. The shoreline along the north jetty has eroded. The Corps received funding from Congress to partially restore the jetty area, and in September and October 2004, the Corps repaired the north jetty by placing earth and rock at the base and by constructing a 300-foot-long embankment perpendicular to the jetty along the shore. The embankment is intended to prevent further erosion of the sandy beach near the base of the jetty and to protect the Coast Guard watchtower from large waves. According to a Corps official, the embankment is a permanent repair and no work to restore the jetties to their original length is anticipated. The Corps acknowledges in its report that the deterioration “has caused concern for the navigability of the channel.” The Safety Board finds, however, that the condition of the channel and the jetties by themselves were not factors in the accident. As noted above, a postaccident survey showed that the channel was dredged to its allocated depth; thus it posed no impediment to movement of the charter fishing vessels. The jetty tips, although shorter today than when they were constructed, did not represent a danger. The greater issue on the day of the accident is that the vessel operators, all highly experienced masters with extensive knowledge of the area, disregarded the hazardous bar crossing conditions. The Safety Board, therefore, concludes that the condition of the channel and the jetties at the Tillamook Bay bar was not a factor in the accident. Bar Restrictions To accomplish its missions, the Coast Guard has a hierarchical system of stations and offices, each with its own level of authority and responsibility. To maintain safety in navigable waters where hazardous conditions are present, it has established surf stations at bars or inlets where surf greater than 8 feet occurs 10 percent of the time within a year,

Analysis 48 Marine Accident Report averaged over 5 years. In the Pacific Northwest, all 10 surf stations, including Station Tillamook Bay, oversee designated regulated boating areas, coastal areas where the bar conditions are particularly treacherous. As the first level of Coast Guard oversight at the bay, Station Tillamook Bay is authorized to restrict the operators of recreational boats and uninspected small passenger vessels from crossing the bar. The station does not have the authority to restrict commercial traffic, such as charter fishing boats. If conditions at the bar are considered so hazardous that they endanger the passage of commercial vessels, the person in charge at the station, sometimes a senior enlisted person, must go through his command channels to the zone commander, the COTP Portland, who has the authority to order the bar closed to all vessel traffic. On the day of this accident, Station Tillamook Bay restricted the bar to recreational and uninspected small passenger vessels, but did not consider the conditions sufficiently hazardous to recommend to its higher headquarters that the bar be closed to commercial operators. As noted earlier, Station Tillamook Bay had restricted the bar to recreational and uninspected small passenger vessels 1,422 times in the 5 years preceding the accident. In that same period, however, COTP Portland had never closed the bar to commercial vessels. Since the Taki-Tooo accident, the COTP Portland has closed Tillamook Bay bar to commercial traffic once. The Safety Board concludes that a potentially unintended consequence of the Coast Guard’s restricting Tillamook Bay bar only to recreational and uninspected vessels was to afford the passengers on those vessels a higher level of safety than the passengers on charter vessels. The Safety Board recognizes and agrees that the Coast Guard needs to have a system of checks and balances when restricting commercial traffic and that the person at the first level of Coast Guard oversight should not be authorized to shut down a waterway. However, an improved means of safety oversight is needed to minimize the risk to people on board such commercial small passenger vessels as charter boats when they are operated in hazardous sea conditions. Coast Guard regulations presently do not require owners/operators of small passenger vessels to identify the conditions under which their charter boats should or should not attempt bar crossings and to provide their masters with guidance containing such operating criteria. The impact of this omission was reflected in the actions of the charter vessel operators on the morning of the accident. The charter boat operators who were experienced in crossing Tillamook Bay bar reached different decisions about whether and when to attempt to transit the bar. Most attempted to cross; however, one highly experienced master interviewed said that he elected not to go because the sea conditions exceeded a personal safety standard that he had established for his operations. Given the differences among mariners in skill level, knowledge of the bar, and personal willingness to take risks, the absence of guidance to assist masters in making decisions that put passengers at great risk is unacceptable. The Safety Board, therefore, concludes that the absence of a go/no-go policy by the charter boat owners operating out of Tillamook Bay allowed the masters to exercise poor judgment in deciding to cross the bar, given the hazardous sea conditions.

Analysis 49 Marine Accident Report By comparison, Federal Aviation Regulations require operators of commercial air transport, operating under 14 CFR part 121, to develop operating specifications that strictly delineate the conditions under which their aircraft will be allowed to operate. These go/no-go specifications, which are subject to Federal Aviation Administration acceptance, apply to all aircraft in scheduled operations that have the capability to transport 10 or more passengers.60 Unless the aircraft has certain navigation and flight control equipment and the pilot has certain qualifications, passenger- and cargo-carrying commercial air transport aircraft are forbidden from taking off or landing in clearly defined conditions of restricted visibility or adverse wind. In the Safety Board’s opinion, small passenger vessel owners know best the skills of the masters they employ, the size, power, and configuration of the vessels they operate, and the conditions under which masters can safely maneuver their vessels across a hazardous bar. Owners are also familiar with other factors unique to each vessel, such as hull shape, displacement, and propulsion system configuration, that can influence the boat’s ability to safely traverse the bar. In developing vessel-specific operating standards for their masters, the boat owners could be assisted by Coast Guard personnel, who have the knowledge of local conditions, in evaluating whether the go/no-go policies developed and implemented by the small passenger vessel owners are appropriate to attain a sufficient level of safety during rough bar conditions. Therefore, the Safety Board believes that the Coast Guard should require that owners of small passenger vessels operating within Coast Guard-designated surf stations and regulated boating areas on the West Coast develop and implement written go/no-go policies, based on risk-management principles, regarding transiting bars and inlets. Recognizing that the rulemaking effort is a time-consuming process, it would be prudent for small passenger operators to voluntarily develop this safety guidance. Therefore, the Safety Board believes that the National Marine Charter Association should recommend that its member small passenger vessel owners operating within Coast Guard-designated surf stations and regulated boating areas on the West Coast develop and implement written go/no-go policies, based on risk-management principles, regarding transiting bars and inlets. Further, the owners of charter fishing vessels operating out of Tillamook Bay should develop and implement written go/no-go policies, based on risk-management principles, regarding transiting the Tillamook Bay bar. Survivability No one on board the Taki-Tooo donned a lifejacket in preparation for transiting the hazardous bar, as stipulated in Coast Guard regulations at 46 CFR 185.508. The results of this failure to mitigate the risk associated with the crossing attempt are telling. Of the 19 people on board, 12 were not able to retrieve a lifejacket before the charter boat was 60 Title 14 CFR part 121, rules governing air transport operations, and 14 CFR part 91, general operating rules.

Analysis 50 Marine Accident Report swamped by a large wave. Of these, only two survived. In contrast, six of the seven people who were able to retrieve lifejackets survived. Analysis shows that the events of the accident sequence occurred so quickly that those on the deck of the Taki-Tooo had little or no time to take measures to protect themselves. As the vessel departed the inlet and rode over the first swell, the deckhand shouted for the passengers to hold on. The ensuing swells were larger, and within minutes, the Taki-Tooo was in trouble. The passengers on the open deck would have had to try to walk across the deck while the vessel was pitching and rolling to obtain lifejackets from the cabin, where the jackets were stored. They, therefore, could not have easily retrieved a lifejacket. During the capsizing, the master and deckhand on the flying bridge and all but one passenger on the open deck were thrown or washed into the sea. One passenger was washed into the cabin, where he was able to obtain a lifejacket and subsequently escape the overturned vessel. The cabin structure provided protection in two ways to the passengers within it. First, the cabin protected the passengers inside from being washed into the sea. More importantly, after the vessel overturned, the cabin had an air pocket until a window broke and water entered the space. The air supply provided survivors sufficient time to pull lifejackets from the storage bin and to prepare to exit the vessel. One survivor donned his lifejacket and exited via the cabin door. Five survivors elected to exit through the cabin windows; however, they could not get through the windows while wearing the lifejackets as intended, so each individual improvised, either holding onto a jacket or placing it around his arm or neck as he made his way out. One man was unable to hold onto his lifejacket; however, he was able to swim to shore. The other four men, buoyed by their lifejackets, floated to shore. One fatality victim was later found in the cabin wearing a lifejacket. According to survivors, they repeatedly exhorted their relative, who had donned a lifejacket, to leave the cabin. They said that he just sat down, however, and emitted a moan. The Safety Board was unable to determine why this passenger, a 66-year-old man, did not exit the cabin. The chaotic scenario of the capsizing and the severity of the sea state would have made it especially difficult for those cast overboard without lifejackets to survive. The surf was over 10 feet and contained floating debris such as logs and the overturned boat itself. No autopsies were performed on anyone except the master, so the extent of injuries of the fatally injured passengers is indeterminate. However, a healthy person with even a mild head injury (with little or no visible marks on the body) could have become sufficiently disoriented in the prevailing conditions to have died without the assistance of lifejackets. Even without injury, a swimmer would have substantial difficulty remaining afloat in the heavy surf without flotation assistance. It is also likely that the accident victims suffered cold water immersion injuries in the seas, which were 52º F. Studies have shown that in the first 2 to 3 minutes of being immersed in water that is less than 59º F, a person may lose the ability to control breathing. If, as in the case of this capsizing, the accident victims are in choppy water, the wave splash contributes to the loss of breath control. Thus, unless cold water immersion victims are both mentally prepared and physically protected by

Analysis 51 Marine Accident Report lifejackets or survival suits, they can drown immediately or suffer cardiac effects that, in turn, can cause death, particularly in older or less healthy victims. Swimming failure may occur between 3 and 30 minutes after cold water immersion, and death from hypothermia may occur after 30 minutes. In the case of this accident, the vessel itself washed ashore within 30 minutes of capsizing, and no vessel occupants were seen alive in the water by that time. Lifejackets improve the survivability of accident victims in water a number of ways: the design of the flotation device helps keep a victim’s head above water, which is particularly crucial if the person is injured; the thermal qualities of the jacket provide some insulation against the cold; and the buoyancy of the safety gear keeps the person afloat, affording more time to reach safety or be rescued. Considering the multiple hazards in the Taki-Tooo capsizing, the use of lifejackets by all people on the open deck would have benefited them in all these ways. Therefore, the Safety Board concludes that if the master of the Taki-Tooo had required passengers and crew to wear lifejackets, their chances of survival would have been better and the number of fatalities in this accident would probably have been less. In preparation for the fishing expedition, the master of the Taki-Tooo conducted a safety briefing for his passengers, as required by Federal regulations, before the charter boat left the marina. He discussed the donning of lifejackets, pointed out where they were located, and told his passengers that they could don them if they wished. If they chose to do so, he said that he or the deckhand would assist them. None elected to do so. During the transit to the inlet area, the Taki-Tooo passed Station Tillamook Bay, where a small-craft advisory flag was raised and a rough bar advisory sign was illuminated, and the Coast Guard observation tower, where another rough bar advisory sign was illuminated. The master then witnessed the much larger Norwester encounter problems with the sea swells and received radio reports from other operators about the swells and waterway debris. Thus, despite receiving several indications that bar conditions were hazardous, the Taki- Tooo master did not don a lifejacket or direct the deckhand and the passengers to don lifejackets. Coast Guard regulations at 46 CFR 185.508 stipulate that the master should require passengers to don lifejackets when possible [emphasis added] hazardous conditions exist, such as when “transiting hazardous bars and inlets.” However, the regulation permits the master to determine whether conditions are sufficiently hazardous to require passengers to don lifejackets. In effect, the regulation puts masters in the position of acknowledging that they are exposing their passengers to hazardous conditions whenever they require them to don lifejackets, potentially increasing their perceived exposure to liability if something untoward occurs. The regulation followed a series of accidents in which the Safety Board recommended to the Coast Guard that passengers on the open decks of vessels be required to wear lifejackets when transiting areas of rough seas.61 In response, the Coast Guard began the rulemaking process to change the applicable regulation. However, the Coast 61 Safety Recommendation M-86-113.

Analysis 52 Marine Accident Report Guard ultimately issued a rule placing exclusive responsibility on the master for passengers to don lifejackets. The Coast Guard stated that it agreed with comments made during the rulemaking process that passengers should not be permitted to don lifejackets, which are part of the emergency gear, unless so specified by the master. After the Taki-Tooo accident, Safety Board investigators interviewed mariners who operated small passenger vessels across the Tillamook Bay bar, all of whom contended that passengers should not be compelled to don lifejackets when crossing the bar. They said that passengers found lifejackets to be uncomfortable and that requiring passengers to wear lifejackets could frighten them. Of the vessel masters who crossed the bar on the morning of the accident, none required passengers to don lifejackets. Further, none had ever been cited by the Coast Guard for not adhering to the requirements of 46 CFR 185.508 and requiring their passengers to don lifejackets before crossing the bar. Therefore, the Safety Board concludes that the Coast Guard’s failure to enforce regulations at 46 CFR 185.508, which require that lifejackets be worn during possibly hazardous conditions, contributed to the loss of life in the Taki-Tooo accident. After the Taki-Tooo capsized, Congress passed the Coast Guard and Maritime Transportation Act of 2004, which specifically directed the Coast Guard to describe enforcement of the regulation requiring masters to have passengers don lifejackets in possibly hazardous conditions, and to include in its report “the number of vessels and masters cited for violations of those regulations for fiscal years 1998 through 2003.” Congress also required the Coast Guard to provide recommendations for “improving compliance with, and possible modifications to, those regulations.” On March 31, 2005, the U.S. Department of Homeland Security delivered the Coast Guard’s “Report on Small Passenger Vessel Safety,” which indicated that no citations had been issued to vessels or masters for violations of the lifejacket regulation since it became effective, and that enforcement or compliance monitoring was complicated by the fact that the regulation contained little metric guidance for determining when a bar or inlet is sufficiently “hazardous,” or weather sufficiently “severe,” to trigger the requirement for a given vessel after taking into consideration its capabilities and the experience of its master. The report cited the “excellent safety record of the industry” and stated that “partnership with the industry is believed to be preferable to a regulatory solution” to the compliance issue. Charter boat operators should not be permitted to put themselves and their passengers at risk in hazardous conditions, and in the Safety Board’s opinion, the regulatory language clearly contemplated that passengers would have been required to don lifejackets. By all reasonable standards, the Tillamook Bay bar conditions at the time of the accident were hazardous and, therefore, all passengers crossing the bar who were on open decks should have worn lifejackets. Therefore, the Safety Board concludes that the commercial vessel masters who crossed the Tillamook bar on the morning of the accident should have required passengers to wear lifejackets during the transit. Given that the Coast Guard has taken the position that it is too complicated for its personnel to determine whether a bar or inlet is sufficiently hazardous to require those on

Analysis 53 Marine Accident Report board small passenger vessels to wear lifejackets, a revision of existing regulations is warranted. The Safety Board recognizes that a regulatory change affecting all bars and inlets may not be warranted. The sea conditions at West Coast inlets are more severe than the sea conditions at East Coast inlets. The fetch of the incoming swells and the effects of the steep continental slope and the narrow continental shelf make the incoming seas at West Coast bar greater in height and more unpredictable. The Safety Board, therefore, believes that the Coast Guard should revise its regulations to require that small passenger vessels operating in Coast Guard-designated surf stations and regulated boating areas on the West Coast have all passengers and crew wear lifejackets while the vessels transit inlets where rough bar warnings are in effect. Until such time as Federal regulations are revised, the Coast Guard should issue guidance for mariners operating in Coast Guard-designated surf stations and regulated boating areas on the West Coast to require passengers and crew on small passenger vessels to wear lifejackets while transiting inlets where rough bar warnings are in effect. Further, the owners and operators of small passenger vessels operating out of Tillamook Bay should require passengers and crew to wear lifejackets while transiting the Tillamook Bay bar when rough bar warnings are in effect. In addition, the Safety Board believes that the National Marine Charter Association should recommend that its member small passenger vessel owners who operate in Coast Guard-designated surf stations and regulated boating areas on the West Coast require passengers and crew to wear lifejackets while transiting inlets where rough bar warnings are in effect. Emergency Response At the time of the capsizing, a Coast Guard MLB was at the north jetty, monitoring the bar conditions. Coast Guard personnel in the observation tower adjacent to the jetty informed the MLB crew of the accident. However, the MLB on patrol did not assist in the rescue because the safety of the Coast Guard personnel and the vessel would have been jeopardized. Several factors argued against the MLB crew participating in the rescue. The Taki- Tooo was so close to the north jetty that the proximity of the jetty rocks and the rough water would have made rescue exceedingly dangerous. Because Coast Guard requirements compel crewmembers to regard their own safety when considering attempting rescue efforts, and because of the extreme risk involved, the MLB crew’s course of action was proper. Therefore, the Safety Board concludes that even if the Coast Guard MLB had had a qualified surfman on board, the Taki-Tooo capsized in a treacherous area with such heavy surf that any attempt at assistance by the MLB would have endangered its crew. Within 5 to 6 minutes of the capsizing, Station Tillamook Bay had requested that Coast Guard rescue helicopters be dispatched to assist in the recovery efforts, launched a second MLB to the scene, and notified local responders of the accident.

Analysis 54 Marine Accident Report The first individuals to reach the scene were civilians who had been on the beach or nearby. They assisted survivors who had swum or been washed to shore. Within 10 minutes of receiving the first 911 call reporting the accident, emergency response personnel arrived. They attended to the survivors and promptly transported them to the local hospital. All but one passenger was subsequently treated and released. The passenger who was admitted was treated for hypothermia and released the next evening. About 0732, the second MLB, with a certified surfman as coxswain, arrived at the accident site and recovered the first victim (the master). The second MLB returned to Station Tillamook Bay, transferred the victim to rescue personnel, and returned to the accident site with the officer-in-charge on board. As a certified surfman, the officer-in- charge had routinely trained in 8- to 15-foot sea conditions and had “suited up” for this mission; therefore, he was prepared and knew how to transfer to another vessel. He jumped into the water, made his way over to the first MLB, and climbed aboard. Because both MLBs now had qualified surfmen on board, both vessels were able to patrol the heavy surf for accident victims. The first Coast Guard helicopter arrived on scene at 0745 and eventually recovered two bodies. A second helicopter arrived soon after and assisted in the search for victims. By 0923, Garibaldi fire and rescue confirmed that eight bodies had either washed ashore, been pulled from the surf, or been recovered from the ocean. At 0927, the Coast Guard diverted the cutter Steadfast, based in Astoria, to help in the search. At 1105, Station Tillamook Bay was advised that only 17 of the 19 people on board the Taki-Tooo had been accounted for. The Coast Guard continued to search the area for the missing victims until 0857 on June 15, with negative results. The Safety Board concludes that the timeliness of the Coast Guard’s search-and- rescue efforts, the quick notification and rapid response of shoreside emergency responders, and the assistance of nearby civilians resulted in an adequate response to the emergency.

55 Marine Accident Report Conclusions Findings 1. The absence of defects and the evidence of propulsive power indicate that problems with the engine, propeller, and associated boat components such as the throttle and the rudder were not causal factors in this accident. 2. The following were not factors in the performance of the Taki-Tooo master: sleep deprivation, alcohol, illegal or prescribed drugs, and financial concerns. 3. Before the accident, the National Weather Service and the Coast Guard effectively communicated information about the weather conditions and the rough bar to mariners, including the master of the Taki-Tooo. 4. The decision of the Taki-Tooo master and the other charter vessel masters to leave port and proceed to the bar area to make a first-hand assessment of conditions was appropriate. 5. The decision of the charter boat operators, including the master of the Taki-Tooo, to transit Tillamook Bay bar in the hazardous sea conditions that prevailed on the morning of the accident jeopardized the safety of all on board. 6. It cannot be determined whether the Taki-Tooo’s turn to a northerly heading, which placed the vessel broadside to the seas, was due to a deliberate action by the master or to a loss of control by the master. 7. The condition of the channel and the jetties at the Tillamook Bay bar was not a factor in the accident. 8. A potentially unintended consequence of the Coast Guard’s restricting Tillamook Bay bar only to recreational and uninspected passenger vessels was to afford the passengers on those vessels a higher level of safety than the passengers on inspected passenger vessels. 9. The absence of a go/no-go policy by the charter boat owners operating out of Tillamook Bay allowed the masters to exercise poor judgment in deciding to cross the bar, given the hazardous sea conditions.

1. If the master of the Taki-Tooo had required passengers and crew to wear lifejackets,

their chances of survival would have been better and the number of fatalities in this accident would probably have been less.

Conclusions 56 Marine Accident Report

1. The Coast Guard’s failure to enforce regulations at 46 CFR 185.508, which require

that masters direct passengers to wear lifejackets during possibly hazardous conditions, contributed to the loss of life in the Taki-Tooo accident.

1. The commercial vessel masters who crossed the Tillamook bar on the morning of the

accident should have required passengers to wear lifejackets during the transit.

1. Even if the Coast Guard motor lifeboat (MLB) had had a qualified surfman on board,

the Taki-Tooo capsized in a treacherous area with such heavy surf that any attempt at assistance by the MLB would have endangered its crew.

1. The timeliness of the Coast Guard’s search-and-rescue efforts, the quick notification

and rapid response of shoreside emergency responders, and the assistance of nearby civilians resulted in an adequate response to the emergency. Probable Cause The National Transportation Safety Board determines that the probable cause of the capsizing of the Taki-Tooo was the decision of the master to attempt to cross Tillamook Bay bar despite the hazardous sea state that existed at the time. Contributing to the severity of the accident was the failure of the Taki-Tooo master to ensure that he, the deckhand, and the passengers donned lifejackets before crossing the bar. Also contributing to the severity of the accident was the failure of the U.S. Coast Guard to enforce the regulatory requirement at 46 Code of Federal Regulations 185.508, which stipulates that vessel masters shall require passengers to wear lifejackets when transiting a hazardous bar.

57 Marine Accident Report Recommendations As a result of its investigation, the National Transportation Safety Board makes the following recommendations. To the United States Coast Guard: Require that owners of small passenger vessels operating within Coast Guard- designated surf stations and regulated boating areas on the West Coast develop and implement written go/no-go policies, based on risk-management principles, regarding transiting bars and inlets. (M-05-09) Revise your regulations to require that small passenger vessels operating in Coast Guard-designated surf stations and regulated boating areas on the West Coast have all passengers and crew wear lifejackets while the vessels transit inlets where rough bar warnings are in effect. (M-05-10) Until such time as your regulations are revised, issue guidance for mariners operating in Coast Guard-designated surf stations and regulated boating areas on the West Coast to require passengers and crew on small passenger vessels to wear lifejackets while transiting inlets where rough bar warnings are in effect. (M-05-11) To the Owners and Operators of Charter Fishing Vessels Operating Out of Tillamook Bay, Oregon: Develop and implement written go/no-go policies, based on risk-management principles, regarding transiting the Tillamook Bay bar. (M-05-12) Require that passengers and crew wear lifejackets while transiting the Tillamook Bay inlet when rough bar warnings are in effect. (M-05-13) To the National Marine Charter Association: Recommend that your member small passenger vessel owners operating within Coast Guard-designated surf stations and regulated boating areas on the West Coast develop and implement written go/no-go policies, based on risk- management principles, regarding transiting bars and inlets. (M-05-14) Recommend that your member small passenger vessel owners who operate in Coast Guard-designated surf stations and regulated boating areas on the West Coast require passengers and crew to wear lifejackets while transiting inlets where rough bar warnings are in effect. (M-05-15)

Recommendations 58 Marine Accident Report BY THE NATIONAL TRANSPORTATION SAFETY BOARD Adopted: June 28, 2005 MARK V. ROSENKER Acting Chairman RICHARD F. HEALING Member ELLEN ENGLEMAN CONNERS Member DEBORAH A. P. HERSMAN Member

59 Marine Accident Report Appendix A Investigation The U.S. Coast Guard Command Center in Washington, D.C., notified the Safety Board’s communication center of the Taki-Tooo accident about 1600 on June 14, 2003. The Board elected to lead the investigation under the Safety Board–Coast Guard memorandum of understanding and immediately dispatched a team of investigators to the accident site. An investigator from the Board’s Northwest regional aviation office in Seattle, Washington, arrived in Garibaldi, Oregon, about 1700 to control the accident scene until the rest of the team arrived. The team from Board headquarters, consisting of an investigator-in-charge and specialists in vessel operations, human performance, and an aviation survival factors investigator, arrived in Garibaldi about 0830 on June 15. An investigator from the Board’s Alaska regional aviation office in Anchorage was dispatched to serve as group chairman for engineering. The team documented the damage to the Taki-Tooo and interviewed survivors, witnesses, responders, and Coast Guard personnel. The Vice Chairman of the Safety Board accompanied the investigative team to Oregon, and a Board Member joined them at the scene. Also on scene were a specialist from the Board’s Office of Public Affairs and two representatives from the Board’s Office of Transportation Disaster Assistance. The on-scene investigation concluded on June 21, 2003. The Safety Board investigated the accident under the authority of the Independent Safety Board act of 1974, according to Safety Board rules. The designated parties to the investigation were the U.S. Coast Guard and the Oregon State Marine Board. The owner of Garibaldi Charters declined to participate as a party in the investigation.

60 Marine Accident Report Appendix B Accident Chronology June 13, 2003 1645 National Weather Service issues small craft advisory, predicting heavy seas with wind waves of 4 feet and 10-foot swells. 1645 Coast Guard Station Tillamook Bay restricts Tillamook bar to recreational boats and uninspected passenger vessels. June 14, 2003 0330 National Weather Service issues small craft advisory. 0430 Taki-Tooo master wakes up, listens to weather report on home VHF radio. 0445 Seaman mans Coast Guard watchtower on north jetty. 0446 Coast Guard motor lifeboat (MLB) under way for first-light bar report. 0500 MLB on duty at Tillamook bar. 0512 MLB coxswain recommends keeping bar restricted to recreational vessels; reports 6- to 8-foot sloughing and plunging seas at end of jetties [tips], 8- to 10-foot seas outside jetties, winds 14 knots, visibility 0.5 n mi. 0514 Coast Guard posts rough bar warnings at lower base and at watchtower; hoists small craft advisory flag at base; transmits bar restriction on VHF channels 16 and 22A, citizens band channel 09. ~0530 Taki-Tooo master leaves home for Garibaldi harbor, listens to weather report on VHF car radio. ~0530 Taki-Tooo master arrives at Garibaldi Charters office. 0530 Passengers check in and begin boarding Taki-Tooo. 0530 Charter fishing boat Oakland Pilot (44.4 feet) departs Garibaldi marina. 0530 Owner of charter fishing boat Kerri Lin (29.4 feet) cancels day’s charter because of sea conditions. 0545 Taki-Tooo master gives safety briefing (no one takes lifejackets). 0545 Oakland Pilot arrives next to Coast Guard tower. 0600 Charter fishing boats Norwester (41.8 feet long) and D & D (32.4 feet) and uninspected fishing vessel Amanda (23 feet) leave marina for inlet.

Appendix B 61 Marine Accident Report 0600 Taki-Tooo departs marina with 2 crew members and 17 passengers. 0620 Garibaldi Charters owner arrives at north jetty to watch boats cross bar. 0645 Taki-Tooo arrives at north jetty, circles awaiting lull in waves. 0645 Norwester, D & D, and Amanda arrive at tower. 0650 Norwester goes over bar, master radios back “not worth it, wait a little.” 0650 Kerri Lin owner goes to north jetty to watch boats leave inlet. 0655 Oakland Pilot leaves inlet, turns northwest, slams down on swell; deck- hand hits head on ceiling, one passenger breaks window, another passenger injures hip. 0658 Oakland Pilot clears bar. 0700 Shift change at Coast Guard watchtower: seaman being relieved says, “The bar is pretty rough; here is the bar report and you just missed some cowboy stuff pulled off by the Norwester and the Oakland Pilot.” ~0700 D & D crosses bar. ~0705 Taki-Tooo starts across bar. 0715 Taki-Tooo reported by Coast Guard watchtower to have capsized in north hole. 0716 Tower notifies MLB of capsizing. 0716+ MLB on way to accident scene. 0718 Coast Guard Station Tillamook Bay requests helicopter assistance from Air Station Astoria. 0720 MLB tries to help, but Taki-Tooo too close to jetty. 0720 Second MLB launches from Coast Guard Station Tillamook Bay to acci- dent scene. 0721 Coast Guard calls Tillamook County Emergency Communications District (911). 0721 Ebb tide ends. 0725 Coast Guard rescue coordination center in Seattle receives EPIRB signal from Taki-Tooo. 0726 911 operator notifies Garibaldi fire chief of accident. 0730 Rescue coordination center receives confirmation that Taki-Tooo has cap- sized with 19 people in water.

Appendix B 62 Marine Accident Report 0732 Second MLB arrives at accident scene and reports empty liferaft floating free; locals on beach start arriving. 0737 Fire chief and rescue truck from Garibaldi fire and rescue arrive at north jetty; fire chief takes command, reports five survivors on shore. 0740 Second MLB sees one person floating inside surf zone, radios Coast Guard station that going to pick up victim. 0745 Second MLB recovers unconscious victim, begins cardiopulmonary resuscitation. 0745 Coast Guard HH-60J Jayhawk helicopter arrives at north jetty from Asto- ria; aircraft commander reports Taki-Tooo already washed ashore. 0755 Second MLB arrives at Coast Guard station, transfers victim to Garibaldi fire and rescue. 0800 Second Jayhawk helicopter launches from Air Station Astoria. 0802 Rescue swimmer from first Coast Guard helicopter recovers one victim from surf; helicopter lands on beach and transfers victim to fire and rescue unit. 0804 Officer-in-charge boards second MLB at Station Tillamook Bay and leaves for accident site. 0810 Fire and rescue unit reports Taki-Tooo upright on beach with one victim in cabin. 0821 Second MLB arrives back at accident scene, officer-in-charge swims to first MLB. 0840 Second Jayhawk helicopter arrives at accident scene. 0848 Second MLB searches for victims outside surf line. 0908 First Jayhawk helicopter reports another victim in water off north jetty. 0910 Fire and rescue unit notifies Station Tillamook Bay that seven survivors are at Tillamook Hospital. 0915 First Jayhawk helicopter rescues second victim from water 200 yards from tower. 0923 First Jayhawk helicopter lands on beach and transfers victim to fire and rescue unit. 0927 Rescue unit advises Station Tillamook Bay that 18 people are accounted for. 0927 Coast Guard cutter Steadfast is diverted from Astoria to help in search. 0955 Both MLBs patrol surf line.

Appendix B 63 Marine Accident Report 1009 Deputies advise Coast Guard that they will pull Taki-Tooo onto beach to look for survivors. 1015 Second MLB measures water temperature at 52º F. 1022 First Jayhawk helicopter leaves accident site, returns to Air Station Astoria. 1033 First MLB returns to station. 1105 Fire and rescue unit informs Station Tillamook Bay that only 17 people on Taki-Tooo are accounted for. 1107 Station Tillamook Bay notifies second MLB that two people are still missing. 1205-1213 Norwester and Oakland Pilot return safely across bar, with second MLB standing by. 1228 First MLB returns to accident scene and resumes search for two missing passengers. 1238 D & D returns safely across bar. 1254 Second MLB returns to station. 1340 First MLB returns to station. 1341 First MLB under way again, resumes search north of jetty for two missing passengers. 1624 Second Jayhawk helicopter ends search and returns to Air Station Astoria. 1700 Coast Guard cutter Steadfast arrives on scene, assumes command. 1755 Second MLB relieves first MLB, continues searching beach and surf line. 1818 First MLB returns to station. 2100 Second MLB is released from search and returns to base; Coast Guard watchtower is secured. 2115 Coast Guard cutter Steadfast completes search and is released. June 15, 2003 0450 First MLB under way from Station Tillamook Bay to accident scene. 0521 Second MLB under way from Station Tillamook Bay to accident scene, begins to patrol surf line north and south of north jetty. 0550 First MLB returns to base. 0557 Jayhawk helicopter launches from Air Station Astoria.

Appendix B 64 Marine Accident Report 0611 Jayhawk helicopter arrives on scene and begins hover-search of shoreline. 0730 Jayhawk helicopter completes search with negative results and returns to base. 0735 Second MLB completes search with negative results and returns to base. 0857 Thirteenth Coast Guard District calls off search for two missing passengers.

65 Marine Accident Report Appendix C Boating Safety Pamphlet

Appendix C 66 Marine Accident Report HAZARDS Crossing the Bar The bar is the area where the deep waters of the Pacific Ocean meet with the shallower waters near the mouth of a river. Most accidents and deaths that occur on coastal bars are from capsizing. Improper loading and/or overloading are major causes of capsizings. Improperly/overloaded boats have less stability and less freeboard, which can allow seas to break into the vessel, causing the boat to become even less stable. Boats are more likely to capsize when crossing the bar from the ocean because the seas are on the stern and the boater may have less control over the vessel. Boaters must make sure the bar is safe prior to crossing. Check with other boaters or the Coast Guard to find out the condition of the bar. If you are caught on a rough bar running in… Make sure everybody aboard is wearing a personal flotation device. Keep the boat square before the seas. Keep the boat on the back of the swell. Ride the swell and stay clear of the following wave. Avoid sudden weight shifts from passengers or gear moving around in the boat. If possible, have passen- gers lie down as near the centerline of the boat as possible. Do not allow the waves to catch your boat on the side (beam). This condition is called broaching, and can easily result in capsizing. Rough Bar Advisory Signs Be aware of the location and status of rough bar advisory signs. These signs are 6ft by 6ft white, dia- mond shaped daymarks, with the words “ROUGH BAR” in black letters. Two alternating amber lights on the signs are activated when observed seas on the bar exceed 4 feet in height and are considered dangerous. DO NOT CROSS THE BAR WHEN THE LIGHTS ARE FLASHIING! Do not cross until you call Station Tillamook Bay on Ch16 to see if the restriction applies to vessels your size. If the lights are not flashing, there is no guarantee that sea conditions are favorable. Coastal bars may be closed to recreational boats when conditions on the bar create a hazardous condition. Failure to comply with the closure may result in voyage termination, and civil and/or crimi- nal penalties. The regulations are enforced by Coast Guard boarding teams. CROSSING THE TILLAMOOK BAY BAR For Additional Boating Safety Information www.uscgboating.org www.boatoregon.com For Boating Class and Vessel Safety Check Information: www.uscgaux.org/~130/ www.usps.org 1-800-336-BOAT (2628) (class information only) Boating Safety Tips ✔Check Weather, Tide, and Bar Conditions ✔File a Float Plan With Friends/Relatives ✔Don’t Overload Your Boat ✔Wear Your Life Jacket ✔Carry Flares and a VHF-FM Radio ✔Check Weather and Tides Before Departing ✔Have Anchor with Adequate Line ✔Boat Sober EMERGENCIES VHF-FM Radio: Channel 16 If in distress (threatened by grave and imminent danger):

1. Make sure radio is on
2. Select Channel 16
3. Press/Hold the transmit button
4. Speak slowly, and clearly say:

MAYDAY, MAYDAY, MAYDAY

1. Give the following information

• Vessel Name and/or Description • Nature of Emergency • Position and/or Location • Number of People Aboard

1. Release the Transmit Button
2. Wait for 10 seconds – If no response, repeat “Mayday” call

If not in immediate danger, follow the same steps as above, except do not use the word “MAYDAY.” Make Sure Everybody is Wearing a Life Jacket! Telephone: 911 Tell the operator that you have a marine emergency. Be ready to provide the same information required in item number 5 of the mayday call. Coast Guard Stations Tillamook Bay (Garibaldi, OR 503) 322-3531 Diver Down Flag Alpha Flag Tides Tides are the vertical rise and fall of the water and tidal current is the horizontal flow of the water. There are roughly two tides each day in the Pacific Northwest. Tidal movement toward the shore or upstream is the flood current. Movement away from shore or downstream is the ebb current. The period between is known as slack water. Tidal currents may gain tremendous velocity, particularly when the ebb current is augmented by river runoff. It is extremely dangerous to get caught on the bar during a strong ebb current. Even on days that are calm, a fast moving ebb can create bar conditions that are too rough for small craft. Always know the stage of the tide! Avoid crossing the bar during an ebb tide. It is best to cross the bar during slack water or on a flood tide, when the seas are normally calmest. Commercial and Recreational Diving in Tillamook Bay Commercial and recreational diving is popular in Tillamook Bay. Boaters and divers should exercise extra caution to ensure their safety on the water. A rigid replica of the alpha flag must be displayed on boats engaged in diving operations whenever these boats are restricted in their ability to maneuver by the diving operation. The flag should be at least one meter high and be visible all around the horizon. The “diver’s flag,” a red flag with a diagonal white stripe, is a recognizable sign that a diver is operating in the area, but its display is not required by law. Boaters who see either the alpha flag or the divers flag should be aware that a diver is in the area and should avoid that area or operate with extreme caution. If you must approach an area where a diver is operating, turn off motor if possible or slow down to idle speed and proceed cautiously. Likewise, people engaged in diving do not have authority to block the channel or restrict navigation. Please dive responsibly.

Appendix C 67 Marine Accident Report A. Bar area. The entire area between the beach and the 20-foot curve is bar area and breaks on the ebbing tide. The water runs out from four to six knots on the average and is very strong. Boats proceeding out should stop in the channel east of the seaward end of the breakwater and carefully evaluate the bar. Between November and April all vessels should avoid the area around Bell Buoy 1. This is extremely hazardous. The bar area is consistently changing. B. North jetty. Approximately 100 yards of the seaward end of the north jetty is submerged. This, and all areas immediately adjacent to the jetty are extremely dangerous and should be avoided. About the last 150 yards of the outer tip of the North Jetty is curving towards the Tillamook Bay Channel. Do not proceed north or south until you are well clear of the submerged jetties (approximately 200 yards seaward of the jetty tips). C. Middle grounds. Shoaling makes this area unpredictable and hazardous; it should be avoided. D. South jetty. About 100 yards of the outer end of the south jetty is submerged. Extreme caution must be exercised when transiting the area. Junction Gong Buoy “S” has been established until the tip of the south jetty is repaired. Since this buoy sits adjacent to a shoal, surf conditions may be experienced in the immediate area surrounding the buoy and westward of it. Tillamook Bay Channel Tillamook Bay channel lies just south of the north jetty. Boaters are urged to navigate with extreme caution as this channel changes constantly. The Sector Light marks the correct location of the navigable channel only when between the jetties. The sector light should not be used to make an approach to the Tillamook Bay Bar since it runs directly over some hazard- ous areas west of the jetty tips. Most local mariners prefer to transit in and out of Tillamook Bay by following the “south hole” which is the deep water area that runs north and south, just west of the end of the submerged rocks on the south jetty. Rough Bar Warning sign A small boat rough bar warning sign is located just west of the Coast Guard boathouse. A second sign is mounted on the Coast Guard Tower, which is located on the North Jetty. If the yellow lights on these signs are flashing, a restriction has been placed on recreational boats crossing the bar. To see if this restriction affects your vessel, please contact Coast Guard Station Tillamook Bay on VHF-FM channel 16 or call (503) 322-3531. Bar Condition Reports Bar condition and weather reports for Tillamook Bay can be obtained by contacting Coast Guard Station Tillamook Bay on VHF-FM channel 16. KTIL (104.1 FM) reports are only given in the morning (once per day) and only in the summer time. With conditions changing frequently on the bar this morning radio report is only pertinent for the period the report is given. TILLAMOOK BAY BAR DANGER AREAS Soundings in feet In emergency . . . use these grid numbers to report your location. ➥

68 Marine Accident Report Appendix D Coast Guard–Approved Lifejackets Only Type I lifejackets are approved for use on small passenger vessels.1 Type I lifejackets are intended for offshore use, in open or coastal waters, and are designed for extended survival in rough, open water. Type I lifejackets have 22 pounds of buoyancy and will turn most unconscious wearers face up in the water.2 The Coast Guard has approved three varieties of Type I lifejackets for commercial vessels. The first is the inherently buoyant lifejacket, made of material that is capable of floating (kapok [requirements at 46 CFR 160.002], fibrous glass [requirements at 46 CFR 160.005], or plastic foam [requirements at 46 CFR 160.055]). These lifejackets are the most effective type of life preserver in rough water, according to the Coast Guard.3 The lifejackets are reversible, come in sizes to fit children and adults, and are suitable for nonswimmers. Disadvantages are that they are bulky, can be uncomfortable if worn over long periods, and may not fit extremely large or extremely small passengers. The second type of Coast Guard-approved Type I lifejacket is the inflatable lifejacket. The lifejackets are approved only in the adult size. They are worn uninflated and so can be worn continuously and in hot weather. When the lifejacket is submerged, a carbon dioxide cartridge automatically inflates two separate chambers. Inflatable models also have an oral backup system that requires the wearer to blow air into the device through a tube. Disadvantages are that the lifejackets are available only in one universal adult size (for adults over 80 pounds), are not suitable for nonswimmers, and do not provide flotation without being inflated. They also need regular inspection and maintenance, including rearming of the carbon dioxide cartridge. The third variety of approved Type I lifejacket is the hybrid inflatable lifejacket. The Coast Guard calls this type the “best for open, rough or remote water, where rescue may be slow in coming.” The hybrid inflatable lifejacket is approved only in child and youth sizes. It will turn most unconscious wearers face up in the water and is the only inflatable lifejacket approved for weak swimmers, nonswimmers, and children. A hybrid inflatable contains a small amount of built-in flotation material and an inflatable chamber. The carbon dioxide cartridges need to be tested regularly and replaced if expended. 1 U.S. Coast Guard, Small Passenger Vessel Information Package, section C, “Life Saving Equipment Requirements” . 2 Most adults need an extra 7 to 12 pounds of buoyancy to keep their heads above water (accessed April 18, 2005). 3 “Lifesaving and Fire Safety Standards for Commercial Ships and Recreational Boats,” U.S. Coast Guard (accessed April 18, 2005).

FD07278 ｜ 2003_美国_NTSB_PAB0401_Excavation_Damage_to_Natural_Gas_Distribution_Line_Resulting.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2003 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/PAB-04/01 1 E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N

National Transportation Safety Board Washington, D.C. 20594 Pipeline Accident Brief

Accident No.:

DCA-03-MP-004 Type of System:

Natural gas distribution Type of Accident:

Rupture, explosion, and fire Location:

Wilmington, Delaware Date and Time:

July 2, 2003, at 1:44 p.m., eastern daylight time Owner/Operator: Delmarva Power and Light Company doing business as Conectiv Power Delivery Fatalities:

None Injuries:

14 Property Damage and Losses: $300,000 Material Released:

Natural gas Pressure:

6 to 8 inches water column Type of Failure:

Excavation damage Component Affected:

1-1/4 inch steel service line The Accident On July 2, 2003, a contractor hired by the city of Wilmington, Delaware, to replace sidewalk and curbing dug into an unmarked natural gas service line with a backhoe. (See figure 1.) Although the service line did not leak where it was struck, the contact resulted in a break in the line inside the basement of 1816 West 3rd Street, where gas began to accumulate. A manager for the contractor said that he did not smell gas and therefore did not believe there was imminent danger and that he called an employee of the gas company and left a voice mail message. At approximately 1:44 p.m., an explosion destroyed two residences and damaged two others to the extent that they had to be demolished. Other nearby residences sustained some damage, and the residents on the block were displaced from their homes for about a week. Three contractor employees sustained serious injuries. Eleven additional people sustained minor injuries. Preaccident Events Quickform Concrete Company was awarded a contract by the city of Wilmington to replace sidewalk and curbing at various locations specified in the contract. Tech Consultants was responsible for coordinating the sidewalk and curb improvements with

NTSB/PAB-04/01 2 Quickform for the city. The contract noted that street addresses would be used to indicate general work locations but that the exact limits for the work would be marked out on site.

Figure 1. Pulled natural gas service line. After the contract was issued, Tech Consultants received additional address locations for this work. One such location was 1820 West 3rd Street. A Tech Consultants project manager surveyed the work site and determined that sidewalk and curbing replacement was needed in front of the residences at 1816, 1818, and 1820 West 3rd Street. On April 10, 2003, a sketch was prepared by Tech Consultants showing the work to be done in front of the three addresses. On June 23, 2003, Tech Consultants issued a change order to Quickform, which included the 1820 West 3rd Street address location in a list of additional address locations. Tech Consultants did not provide the 1816 and 1818 addresses or sketch to Quickform. According to Tech Consultants, the city asked Tech Consultants not to provide these sketches to contractors because the scope of work could change and there was an expectation that the contractor would attend the work mark-out on site. The contract also required Quickform to have the underground utilities marked out before beginning excavation. On June 23, a Quickform manager called Miss Utility to have underground utilities marked for 1820 West 3rd Street, but the manager inadvertently called in an incorrect address: 820 West 3rd Street.

NTSB/PAB-04/01 3 Conectiv Power Delivery provided gas through its pipeline distribution network to the residences on this block. On June 24, a Conectiv employee placed yellow paint marks on the ground in front of 1818, 1820, and 1822 West 3rd Street to mark the location of its underground service lines to those addresses. The Conectiv employee said that although the Miss Utility information noted planned excavation at 820, he determined that the request for 820 was in error, and he proceeded to mark the correct 1820 address and the additional addresses of 1818 and 1822 to provide a further safety margin. In response to a June 30, 2003, request from the Quickform manager to mark out the project scope, on July 1, a Tech Consultants inspector marked in white paint the sidewalk and curbing in front of 1816, 1818, and 1820 to indicate the scope of the work. The Tech Consultants inspector said that the project scope is normally marked out just days ahead of the work in order to (1) reduce the likelihood that those who live in the area will extend the marking in an attempt to get work done in front of their houses, and (2) limit the amount of open construction ongoing at any given time. Tech Consultants and Quickform said that about half the time, a Quickform representative would accompany the Tech Consultants inspector when locations were being marked; however, on July 1, a Quickform representative did not accompany him. The inspector said that he did not routinely look for signs that the locations of underground utilities had already been marked, and he could not recall noticing which addresses had been marked as he marked the job out in front of 1816, 1818, and 1820 West 3rd Street. On July 2, a Quickform crew arrived at the accident site location. The Quickform foreman said that he understood that the white paint marks defined the scope of work and that as a result he understood that his crew was to replace sidewalk and curbing in front of 1816, 1818, and 1820. He also said that because he didn’t see any yellow paint markings in front of 1816, he believed that there was no underground gas line there and that it was safe to excavate with a backhoe. On July 2, a Quickform backhoe contacted and pulled up an unmarked 1-1/4 inch steel service line serving 1816 West 3rd Street. Contractor employees estimated that the damage to the service line occurred at about 1:30 p.m. The crew was not aware that the action of pulling the service line outside resulted in a break to the line inside the basement at 1816 West 3rd Street. Natural gas then began to accumulate in the residence. The Quickform crew said when they saw the damage, they stopped excavation activities and notified the Quickform manager when he arrived on site a few minutes after the service line was contacted. The line was not leaking outside,1 and the crewmembers and manager said that they did not smell a gas odor coming from the pulled line itself; however, four of the five crewmembers reported that they smelled a faint gas odor at other points along the block before the explosion. The Quickform manager called the Tech Consultants inspector to ask for the phone number of a Conectiv engineer to report the damage; cell phone records show that this call was placed at 1:31 p.m. And according to cell phone records, the

1 Postaccident pressure tests established that the service line was not leaking outside.

NTSB/PAB-04/01 4 manager placed a call at 1:34 p.m. to the Conectiv engineer’s phone, and the manager left a voice mail message. A resident of 1816 West 3rd Street said that she smelled a strong odor in her house at about 1:00 p.m. or shortly thereafter. She and her two children left the house, but she did not tell anyone about the odor. At 1:44 p.m., the explosion occurred. Eight other residents who lived on the block told investigators that they smelled a gas odor before the explosion. Except for Quickform’s voice mail to Conectiv, no calls were placed to Conectiv or the fire department about the damaged line or a leak before the explosion. Emergency Response Beginning at 1:45 p.m., the Wilmington Police Department’s dispatcher received numerous telephone calls reporting an explosion on West 3rd Street. The police department responded to the site to evacuate residents, conduct crowd and traffic control, and provide security. At 1:45 p.m., the Wilmington Fire Department initially dispatched two engine companies, a ladder company, and a battalion chief. At 1:48 p.m., the first responding city ambulance arrived at the accident site. New Castle County Emergency Medical Services (EMS) received the initial dispatch and was en route to the scene at 1:49 p.m. At 1:50 p.m., the first fire department units arrived at the site. At 1:53 p.m., the first EMS responders arrived at the site. At 1:53 p.m., the deputy chief of operations for the fire department arrived at the site and assumed incident command. Postaccident Excavation Procedures In September 2003, Tech Consultants modified the contracts for sidewalk and curb improvements to require the contractor to be present for marking out the project scope, and then to call Miss Utility to have the underground utilities marked out for the project scope. Since the accident, Quickform has developed written safety procedures that instruct employees to verify that underground utilities are marked before beginning excavation and to call emergency numbers if a natural gas line is hit. The Quickform manager advised that the company’s interpretation of a hit line includes a line that is pulled. Occupational Safety and Health Administration The U.S. Department of Labor’s Occupational Safety and Health Administration (OSHA) investigated this accident. Title 29 Code of Federal Regulations (CFR)

NTSB/PAB-04/01 5 1926.651 establishes excavation requirements designed to prevent damage to underground utilities, including a requirement to establish the location of underground installations before opening an excavation. On December 3, 2003, OSHA issued a citation and notification of penalty to Quickform for not contacting Miss Utility before excavating in front of 1816 West 3rd Street. As a result of its investigation of a natural gas pipeline accident in St. Cloud, Minnesota, on December 11, 1998,2 the Safety Board made the following safety recommendation to OSHA: P-00-2 Require excavators to notify the pipeline operator immediately if their work damages a pipeline and to call 911 or other local emergency response number immediately if the damage results in a release of natural gas or other hazardous substance or potentially endangers life, health, or property. In response to this safety recommendation, on June 13, 2003, OSHA issued a Safety and Health Information Bulletin that advises contractors on the hazards of striking underground gas lines during excavation work. The bulletin recommended informing the pipeline operator immediately if the excavator causes damage to a pipeline and to immediately contact emergency authorities if the damage results in a release of natural gas or other hazardous substances. Common Ground Alliance Best Practices The Common Ground Alliance provides a guide to underground utility damage prevention best practices in use throughout the United States. These best practices speak to the value of effective communication among those involved in excavation activities. A best practice notes the value of premarking the excavation area before the one-call3 and before the locator arrives on site as a means of communicating where the excavation is to occur. A best practice advises that upon arrival at the excavation site, excavators should verify that the dig site matches the one-call request. Another best practice, which came about in response to another safety recommendation issued as a result of the Safety Board’s investigation of the St. Cloud, Minnesota, accident, states that excavators should notify the pipeline operator immediately if their work damages a pipeline and to call 911 or other local emergency

2 National Transportation Safety Board, Natural Gas Pipeline Rupture and Subsequent Explosion in St. Cloud, Minnesota, December 11, 1998. Pipeline Accident Report NTSB/PAR-00/01 (Washington, D.C.: NTSB, 2000). 3 The one-call system, the name of which varies from State to State, allows excavators, with a single call, to notify all underground facility owners who are members of the one-call system of planned excavation so the locations of the various facilities can be marked.

NTSB/PAB-04/01 6 response number immediately if the damage results in a release of natural gas or other hazardous substance or potentially endangers life, health, or property.4 Public Education In September 2002, Conectiv included a natural gas informational insert in the utility bills of its natural gas customers. As part of its public education program, Conectiv mailed this type of insert to its natural gas customers approximately once per year. The insert included advice to customers that if the odor was extremely strong to evacuate the premises and call Conectiv. Title 49 CFR 192.616 requires that pipeline operators establish a continuing education program to enable the public to recognize a gas pipeline emergency for the purpose of reporting it to the operator or appropriate public officials. The Safety Board has long been concerned about the issue of pipeline public education programs, including the content, distribution, and effectiveness of pipeline operators’ safety materials for both hazardous liquid and natural gas pipelines. As a result of its investigation of a liquid butane pipeline accident near Lively, Texas, on August 24, 1996,5 the Safety Board recommended that the Research and Special Programs Administration (RSPA): P-98-38 Revise 49 Code of Federal Regulations Part 195 to require that pipeline operators periodically evaluate the effectiveness of their public education programs using scientific techniques. In December 2003, the American Petroleum Institute published its Recommended Practice (RP) 1162 Public Awareness Programs for Pipeline Operators. This standard calls for pipeline operators to periodically evaluate the effectiveness of their public education programs. RSPA has advised the Safety Board that organizations representing essentially the entire gas and hazardous liquid pipeline industry have urged RSPA to incorporate RP 1162 into the pipeline safety regulations and that RSPA is committed to incorporating by reference RP 1162 into the pipeline safety regulation (49 CFR Parts 192 and 195). As a result, the Safety Board, on November 21, 2003, classified Safety Recommendation P-98-38 “ClosedAcceptable Action.”

4 Safety Recommendation P-00-1. 5 National Transportation Safety Board, Pipeline Rupture, Liquid Butane Release and Fire, Lively, Texas, August 24, 1996. Pipeline Accident Report NTSB/PAR-98/02 (Washington, D.C.: NTSB, 1998).

NTSB/PAB-04/01 7 Probable Cause: The National Transportation Safety Board determines that the probable cause of the July 2, 2003, natural gas explosion in Wilmington, Delaware, was the failure of Quickform to verify that all underground facilities were marked within the proposed dig site before beginning excavation. Contributing to the accident was the failure of Tech Consultants and Quickform to effectively communicate about the project scope. Contributing to the severity of the accident was the failure of Quickform employees to immediately notify the utility owner and emergency authorities when they realized they had struck and pulled up a gas service line. Adopted: April 6, 2004

FD07279 ｜ 2003_美国_NTSB_PAR0402_Storage_Tank_Explosion_and_Fire.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2003 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Storage Tank Explosion and Fire in Glenpool, Oklahoma April 7, 2003 Pipeline Accident Report NTSB/PAR-04/02 PB2004-916502 Notation 7666 National Transportation Safety Board Washington, D.C.

this page intentionally left blank

Pipeline Accident Report Storage Tank Explosion and Fire in Glenpool, Oklahoma April 7, 2003 NTSB/PAR-04/02 PB2004-916502 National Transportation Safety Board Notation 7666 490 L’Enfant Plaza, S.W. Adopted October 13, 2004 Washington, D.C. 20594

National Transportation Safety Board. 2004. Storage Tank Explosion and Fire in Glenpool, Oklahoma, April 7, 2003. Pipeline Accident Report NTSB/PAR-04/02. Washington, DC. Abstract: About 8:55 p.m., central daylight time, on April 7, 2003, an 80,000-barrel storage tank at ConocoPhillips Company’s Glenpool South tank farm in Glenpool, Oklahoma, exploded and burned as it was being filled with diesel. Gasoline had been removed from the tank earlier in the day. The resulting fire burned for about 21 hours and damaged two other storage tanks in the area. The cost of the accident was $2,357,483. There were no injuries or fatalities. Nearby residents were evacuated, and schools were closed for 2 days. The safety issues identified in this accident are tank operations, including switch loading, at the ConocoPhillips Company tank farm; the adequacy of emergency planning and emergency response by ConocoPhillips and American Electric Power; and the adequacy of Federal regulations and industry standards for emergency planning. As a result of its investigation of this accident, the Safety Board makes safety recommendations to the Research and Special Programs Administration, ConocoPhillips Company, American Electric Power, the American Society of Mechanical Engineers, and the Institute of Electrical and Electronics Engineers. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2004-916502 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Pipeline Accident Report Contents Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 ConocoPhillips Glenpool Facilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Tank 11 and Appurtenances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Tank Farm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Control Centers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Explorer Glenpool Facilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 American Electric Power Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Postaccident Field Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Tank 11 Wreckage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 ConocoPhillips Crude Oil Pipeline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 AEP Power Lines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 ConocoPhillips Electrical Facilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Safety Board Materials Laboratory Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Diesel Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Design Criteria for Tank Fill Rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Switch Loading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Switch Loading and Tank 11 Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Safety Board Vapor Concentration Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 ConocoPhillips Crude Oil Pipeline Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Operating Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Explorer Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Industry Recommended Tank Filling Rates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 ConocoPhillips Tank Filling Rates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Postaccident Actions at ConocoPhillips Glenpool South Tank Farm . . . . . . . . . . . . . . . . . 25 Federal Safety Regulations – Emergency Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Industry Emergency Response Plan Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 ConocoPhillips Emergency Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Federal Safety Regulations – Ignition Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Tank Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Office of Pipeline Safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 ConocoPhillips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 National Electrical Safety Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Static Electricity and Prevention of Accidental Ignition at Storage Tanks . . . . . . . . . . . . . 30 Static Charge Generation, Accumulation, and Dissipation . . . . . . . . . . . . . . . . . . . . . . 30 Floating Roof Position and Spark Gap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Contents iv Pipeline Accident Report Accident Switch Loading and Flammable Vapors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 American Electric Power . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 ConocoPhillips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Emergency Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Federal Oversight of Pipeline Operators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Appendix A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

v Pipeline Accident Report Executive Summary On April 7, 2003, at about 8:55 p.m., central daylight time, an 80,000-barrel storage tank at ConocoPhillips Company’s Glenpool South tank farm in Glenpool, Oklahoma, exploded and burned as it was being filled with diesel. The tank, designated tank 11, had previously contained gasoline, which had been removed from the tank earlier in the day. The tank contained between 7,397 and 7,600 barrels of diesel at the time of the explosion. The resulting fire burned for about 21 hours and damaged two other storage tanks in the area. The cost of the accident, including emergency response, environmental remediation, evacuation, lost product, property damage, and claims, was $2,357,483. There were no injuries or fatalities. Nearby residents were evacuated, and schools were closed for 2 days. The National Transportation Safety Board determines that the probable cause of the April 7, 2003, storage tank explosion and fire in Glenpool, Oklahoma, was ignition of a flammable fuel-air mixture within the tank by a static electricity discharge due to the improper manner in which ConocoPhillips Company conducted tank operations. Contributing to the extent of the property damage and the magnitude of the impact on the local community was the failure of American Electric Power employees to recognize the risk the tank fire posed to the nearby power lines and take effective emergency action. The safety issues identified during the investigation of this accident are as follows: • Tank operations, including switch loading, at the ConocoPhillips tank farm. • The adequacy of emergency planning and emergency response by ConocoPhillips Company and American Electric Power. • The adequacy of Federal regulations and industry standards for emergency planning. As a result of its investigation of this accident, the National Transportation Safety Board makes safety recommendations to the Research and Special Programs Administration, ConocoPhillips Company, American Electric Power, the American Society of Mechanical Engineers, and the Institute of Electrical and Electronics Engineers.

this page intentionally left blank

1 Pipeline Accident Report Factual Information Accident Synopsis On April 7, 2003, at about 8:55 p.m., central daylight time,1 an 80,000-barrel storage tank at ConocoPhillips Company’s (ConocoPhillips) Glenpool South tank farm in Glenpool, Oklahoma, exploded and burned as it was being filled with diesel. The tank, designated tank 11, had previously contained gasoline, which had been removed from the tank earlier in the day. The tank contained between 7,397 and 7,600 barrels of diesel at the time of the explosion. The resulting fire burned for about 21 hours and damaged two other storage tanks in the area. The cost of the accident, including emergency response, environmental remediation, evacuation, lost product, property damage, and claims, was $2,357,483. There were no injuries or fatalities. Nearby residents were evacuated, and schools were closed for 2 days. Accident Narrative Tank 11 contained about 8,710 barrels2 of gasoline on the afternoon of the accident. The ConocoPhillips operator who was on duty at the time of the accident stated that when she reported for work at Glenpool Terminal at about 3:30 p.m.3 on April 7, 2003, a transfer of gasoline from tank 11 at Glenpool South tank farm, a nearby ConocoPhillips facility, to tankage at Glenpool Terminal, was in progress. Explorer Pipeline Company (Explorer) was scheduled to deliver a batch of diesel into tank 11 about 8:30 p.m., and before that time, the operator would need to complete the transfer of gasoline to Glenpool Terminal and remove the gasoline that remained in the manifold piping and the piping to tank 11. The gasoline from the piping would be transferred to tank 12 at Glenpool South tank farm.4 1 Unless otherwise specified, the times used in this report are central daylight time. 2 A barrel is a liquid measure that, for petroleum, is equal to 42 U.S. gallons. 3 Times in this section are from interviews with ConocoPhillips, Explorer Pipeline Company, and American Electric Power personnel, ConocoPhillips and Explorer Pipeline computer data, the Glenpool fire captain’s summary report, the Glenpool police daily radio log, ConocoPhillips incident tracking notification data, and the Explorer Pipeline Company batch end report. 4 The diesel delivery normally would have been to tank 8, but because of scheduling considerations, the naphtha in tank 8 had not been shipped, making it necessary to empty tank 11 in preparation for the scheduled diesel delivery. In 2002 and 2003, tank 11 was used to store naphtha, toluene, gasoline, and diesel. Naphtha is a petroleum distillate used as a paint solvent, cleaning fluid, and blendstock in gasoline production. Toluene is a petroleum distillate used as an octane booster in fuel and as a solvent in paints and paint thinners, rubber, printing, adhesives, cosmetics, fingernail polish, lacquers, leather tanning, disinfectants, and perfumes.

Factual Information 2 Pipeline Accident Report The piping system at the Glenpool South tank farm allowed products to be delivered to and received from Explorer’s facility, which was northwest of and adjacent to the ConocoPhillips tank farm. (See figure 1.) The piping system also allowed products to be delivered to and received from the ConocoPhillips Glenpool Terminal (also identified by ConocoPhillips as Glenpool Station), which was about 2.7 miles northeast of the Glenpool South tank farm, through a 12-inch-diameter ConocoPhillips pipeline. About 4:00 p.m. at Glenpool Terminal, the ConocoPhillips operator obtained a valve lineup sheet and prepared it jointly with the outgoing shift operator for the upcoming operations. Before leaving the office for the tank farm, the operator verified how much gasoline was in the piping system so that, once the removal operation was complete, she could confirm that all the gasoline had been removed. She went to the Glenpool South tank farm about 4:30 p.m. and began transferring gasoline from the manifold piping to tank 12. When the transfer of gasoline from tank 11 to Glenpool terminal was completed, about 5:33 p.m., she transferred the gasoline in the tank’s piping to tank 12. Figure 1. Schematic of Explorer Pipeline Glenpool tank farm and ConocoPhillips Glen- pool South tank farm showing tank 11, pipelines, and power lines located along dike east of Glenpool South tank farm. 7 11 12 8 9 N ~ 2000 feet Explorer measurement facilities & delivery valves Explorer 28” mainline Explorer 24” line to ConocoPhillips 30” line to tank 11 Explorer Pipeline Glenpool Tank Farm ConocoPhillips Glenpool South Tank Farm 12” crude oil pipeline Power lines

Factual Information 3 Pipeline Accident Report When all transfers were complete, about 6:10 p.m., the operator lined up the valves so tank 11 could receive diesel from Explorer. ConocoPhillips representatives told investigators that even though no gasoline remained in the tank 11 lines or manifold piping at the conclusion of the transfer operation, about 55 barrels of gasoline remained in the tank 11 sump5 between the sump floor and the bottom of the 30-inch-diameter fill/drain pipe (which was about 21 inches above the sump floor). About 6:15 p.m. on April 7, 2003, the ConocoPhillips operator went to the office at the Explorer Glenpool tank farm and spoke with the Explorer operator. The ConocoPhillips operator confirmed with the Explorer operator that the delivery was a 24,500-barrel batch of diesel going into tank 11, which was empty (except for the residual gasoline in the sump). The diesel delivery was from Explorer’s 28-inch-diameter mainline. After the diesel was measured and sampled at the Explorer Glenpool facility, the delivery would continue through Explorer’s 24-inch-diameter line to the ConocoPhillips 30-inch-diameter line and then into tank 11. The ConocoPhillips operator also confirmed that the maximum allowable fill amount was 75,079 barrels. The ConocoPhillips operator then opened two valves in Explorer’s yard to line up the delivery; the delivery to ConocoPhillips commenced when Explorer control room personnel opened the delivery valve. Except for the opening of the delivery valve, lining up the valves, including the two valves in Explorer’s yard, was the responsibility of the ConocoPhillips operator. About 6:30 p.m., after the valve lineup was completed, the ConocoPhillips operator returned to Glenpool Terminal. About 8:33 p.m., Explorer switched the delivery of diesel to the line serving ConocoPhillips at an initial flow rate of 24,000 to 27,500 barrels per hour. The ConocoPhillips operator stated that at about 8:55 p.m., there was a high (product) level alarm in tank 11 and that this was odd because the delivery had just begun and tank 11 had been empty. The Explorer operator at the Glenpool tank farm stated that he observed a fireball but that he was near operating pumps and did not hear an explosion. He described the accident as a flash, followed by smoke and fire, after which the fire totally engulfed tank

1. He said he went to his truck and drove to the Explorer control room, where he called

the Explorer central control dispatcher. He said he then drove in his truck toward the fire to verify its location. It was determined that about 8:55 p.m., after tank 11 had been filling with diesel for about 22 minutes, the tank exploded. The fixed roof separated from the tank shell and was blown northward and folded over on itself, coming to rest on top of the collapsed north wall of the tank. (See figures 2 and 3.) 5 The 15-foot-diameter by 6-foot-deep sump was in the northwest area of the tank floor, which sloped toward the sump. The design of tank 11 is discussed in more detail later in this report.

Factual Information 4 Pipeline Accident Report Figure 2. View of wreckage of tank 11 facing south. Note power lines and earthen dike at left and overpressure piping at right. Figure 3. Wreckage of tank 11.

Factual Information 5 Pipeline Accident Report The Explorer operator then returned to the Explorer control room, and about 8:59 p.m. closed a valve to stop the diesel delivery to ConocoPhillips and switched the delivery to other tankage in the Explorer yard. At this time, the ConocoPhillips facility was isolated from Explorer's piping system. The Explorer operator called and informed the Explorer central control dispatcher that the delivery had been switched. He also called the operator at the ConocoPhillips Glenpool Terminal. About this same time, the ConocoPhillips operator was calling the Explorer operator. The Explorer operator told the ConocoPhillips operator about the ball of fire, which they concluded was a tank on fire at the ConocoPhillips Glenpool South tank farm. The ConocoPhillips operator asked that the delivery be stopped. The two operators agreed that the Explorer operator would call 911 while the ConocoPhillips operator notified her supervisor. After the Explorer operator called 911, he called his supervisor and asked that the supervisor contact Explorer central control and have controllers shut down the 28-inch pipeline that was supplying the diesel to the Explorer facility. Explorer shut down its 28- inch-diameter pipeline at Glenpool tank farm at about 9:35 p.m. and had all tank and header valves closed by about 9:45 p.m. Explorer’s incident command was initially set up at 9:33 p.m. in the Glenpool tank farm control room and was moved to a conference room at 10:40 p.m. A resident who was inside her house, about 1,000 feet east of tank 11, reported hearing a sound like thunder that rattled her house. She said she exited her house less than 30 seconds later, at which time there was a second explosion, this one with a higher pitched sound than the first. She observed that the north side of the tank had collapsed and was on fire and that the wind was blowing the flames south. Power poles owned by American Electric Power (AEP)6 were east of the tank farm over a wall on the dike that surrounded the tank farm. The electric power facilities included three conductor wires and two shield wires7 supported by a single crossbar on dual wooden poles. Just before 6:00 a.m. on April 8, one or more wires on these poles fell to the ground. (See figure 4.) A fire then started in the unburned diesel that was being contained in the dike north of tank 11. About 6:10 a.m. on April 8, 2003, crude oil at 550 pounds per square inch, gauge (psig) was released from aboveground piping between tanks 7 and 8 inside the dike after the piping was engulfed in fire started by the power lines. The piping system provided overpressure protection for ConocoPhillips’ 12-inch-diameter crude oil pipeline. An isolation flange assembly in the piping failed because of the fire, allowing the pressurized crude oil to spray the surrounding area through the loosened flange assembly. By 6:17 a.m., ConocoPhillips had shut down the pipeline pumps and closed the remotely operated valves in the pipeline. 6 AEP, which is based in Columbus, Ohio, operates an electricity transmission and distribution grid and is the Nation’s largest electricity generator. 7 A shield wire is a grounded conductor installed to shield a phase conductor from a direct lightning strike.

Factual Information 6 Pipeline Accident Report The ConocoPhillips Glenpool area supervisor initially estimated that about 7,400 barrels of diesel were in tank 11 at the time of the explosion. This figure was different from the 8,420 barrels read by Explorer’s meter because some product was in the piping system downstream of the meter on its way to tank 11 when the explosion occurred. Safety Board investigators calculated the amount of diesel that was in tank 11 at the time of the explosion. These calculations were based on the amount of gasoline that was in the tank 11 sump when delivery of diesel began, the quantity of diesel metered by Explorer during the delivery, the diesel that was metered after the explosion but that did not enter tank 11, and the quantity of diesel that remained in the previously empty delivery manifold and tank 11 piping at the time of the explosion. Based on these calculations, tank 11 contained between 7,397 and 7,600 barrels of liquid (diesel and a small amount of gasoline) at the time of the explosion. Emergency Response The Glenpool Fire Department received a 911 report of tank explosion and fire at 9:00 p.m. and was on scene by 9:06 p.m., at which time tank 11 had collapsed and was engulfed by flames 75 feet high. Figure 4. View of downed AEP power lines on east dike wall.

Factual Information 7 Pipeline Accident Report The emergency response eventually involved 13 fire departments and firefighting personnel from ConocoPhillips, Sun Refinery, and Williams Fire and Hazard Control. ConocoPhillips had preplanned with Sun Refinery for mutual assistance in firefighting. Initially, the fire departments applied foam from the west side of the dike between tanks 7 and 12 and placed it around the burning tank so that the wind would disperse the foam to contain the ground fire. However, the manner in which the tank collapsed hindered the application of foam to the tank. Firefighters also applied water to tank 12, which contained gasoline, to cool it. Explorer and ConocoPhillips checked the dike drain valves to ensure that they were closed. After the power lines fell and diesel in the north area of the dike caught fire, a fire started inside tank 8 (which contained naphtha) in the area of the internal floating roof seal. This fire eventually extinguished itself, and the heat from the internal fire damaged tank 8. Also, the burning diesel in the north area of the dike caused a flange assembly in the crude oil pipeline overpressure protection system to fail and release crude oil in the area. The ConocoPhillips Glenpool area supervisor stated that because of a concern about the quantity of foam available, he called ConocoPhillips in Ponca City for additional supplies. Another ConocoPhillips employee called the Sinclair Refinery and the Tulsa airport and asked for information about available foam supplies. A staging area was set up to receive foam deliveries. In addition to a family living approximately 1,000 feet east of the tank farm, about 300 families living near the tank farm were evacuated. This was a voluntary evacuation that was lifted on the afternoon of April 9. ConocoPhillips provided housing for the evacuees. Nearby schools were closed for 2 days. Several AEP employees called the AEP transmission system operator between 9:00 p.m. and 9:30 p.m. to notify him of the accident, but he had already seen the fire on the television news. He stated that he knew the AEP power lines were near the fire. About midnight, ConocoPhillips personnel called the AEP dispatcher and requested that an AEP representative inspect the power lines near and to the east of the tank, because the flames were impinging on them. At 12:30 a.m. on April 8, an AEP servicer was dispatched to the site, and by 1:14 a.m., he had inspected the power lines and reported to the transmission system operator. No sag in the lines was observed, and the servicer, who did not communicate with any incident command staff, returned home. He did suggest to the AEP transmission system operator that an AEP representative inspect the wooden power pole near the fire, but there is no record of action being taken. About 3:43 a.m., the incident command noted that the wind had shifted to the east, but the tank 11 fire appeared contained, the cooling operation on tanks 7 and 12 was successful, and the incident appeared to be stable. Within an hour, however, the fire in tank 11 was worse, possibly because the firefighting foam inside the tank was degrading. About 5:00 a.m., after having been contacted again by on-scene personnel at 4:45 a.m., the AEP dispatcher again called the servicer at home. The transmission system operator documented in his log that the fire had restarted and was worse than before and

Factual Information 8 Pipeline Accident Report that AEP should recheck the lines. The servicer returned to the scene at about 5:30 a.m. and observed that the conductor closest to the fire now had a slight sag. This indicated that heat from the fire was affecting the power line. Incident command was notified that the servicer was on site, but the servicer did not check in or otherwise communicate with incident command. About 20 minutes later, one or more wires fell onto the diked area east of the tanks and the diesel that was contained inside that area of the dike ignited. The AEP transmission system operator stated that any decision to deenergize the lines was to be made by him based on information provided by the on-site inspectors and an AEP field representative. He stated that if these lines had been deenergized, power would have been cut to the AEP substation at an Explorer pump station (not at the Glenpool tank farm) and to the pump station. No other outages would have been expected, because the system would have automatically rerouted power. The AEP transmission system operator stated that his emergency response training had not included training for nonelectrical issues. He said his training had involved neither visits to the ConocoPhillips Glenpool South tank farm nor face-to-face meetings with ConocoPhillips personnel. The AEP field representative stated that his training had been primarily on the job and that he had gained experience in actual emergencies. Meteorological Information No lightning was reported or noted in the area at the time of the explosion. The temperature was about 52° F, and the relative humidity was 54 percent. The wind was from the north at 7 mph gusting to 16 mph. ConocoPhillips Glenpool Facilities The ConocoPhillips8 Glenpool South tank farm, constructed between 1978 and 1981, was originally a Conoco facility and consisted of four storage tanks, which were designated 7, 8, 11, and 12, and one smaller tank, designated 9, that was used for mixed products. The tanks were inside a dike consisting of earthen walls and a crushed rock surface. Outside the dike were a control building, valve manifolds, product pumps, a vacuum pump and tank, and an underground sump connected to the vacuum tank. Except for tank 9, the tanks had a “drain dry” design. The floor of tank 11 was sloped to a sump inside the tank, and the 30-inch-diameter common fill/drain piping terminated in the sump. When the tank was drained dry, the only liquid that remained in the tank was approximately 55 barrels in the sump below the bottom of the fill/drain piping. 8 ConocoPhillips was founded in 2002 when Conoco, Inc., and Phillips Petroleum Company merged.

Factual Information 9 Pipeline Accident Report Tank 11 and Appurtenances ConocoPhillips representatives told investigators that no as-built design or construction drawings for tank 11 could be found. According to ConocoPhillips, tanks 11 and 12 were both constructed in 1981 and were similar in design and construction. The following information was obtained from the tank nameplates, the inspection report from the tank 11 external inspection performed in July 2000, the construction specification for tanks 11 and 12, a ConocoPhillips as-built drawing of the tank 11 and tank 12 sump, and photographic evidence and known data from tank 12.9 Tank 11 was a 48-foot-high by 109-foot-diameter welded steel storage tank with a cone-type fixed roof and an internal floating roof (see figure 5). The purpose of a floating roof is to minimize emissions and evaporative losses. It floated on pontoons on top of the product and was equipped with legs that supported the roof when product was drained from the tank and the volume of liquid in the tank decreased to the level at which the roof no longer floated. The ability to “land” the roof, meaning that the roof was sitting on and fully supported by the legs, also prevented it from being damaged by contacting the tank floor. The legs typically are set so the roof is about 3 feet above the tank floor but they can be set at approximately 6 feet to facilitate personnel entering the tank and working under the roof. 9 Investigators were able to internally inspect tank 12, which was out of service for maintenance after the accident. Figure 5. Diagram of storage tank showing floating roof and sump. product Pressure/vacuum vent in floating roof Vent in tank roof and shell Internal floating roof (with straps holding pontoons) Support leg for roof (with sleeves at pontoon) Seal around floating roof 10" diameter pontoon Sump cover Tank dimensions: 109' diameter x 48‘ high (drawing not to scale) Sump 30” diameter fill/drain pipe Flow Drain tube

Factual Information 10 Pipeline Accident Report Continental Pipe Line Company (predecessor of ConocoPhillips) had specified that tank 11 be designed and constructed by Webco Tank, Inc., in accordance with American Petroleum Institute (API) Standard 650 (Welded Steel Tanks for Oil Storage), Appendices D, G, and K. Continental Pipe Line Company had specified that the tank be designed for a range of refined products, including gasoline and diesel, and have a nominal capacity of 80,000 barrels. The design pressure was 4 to 14 psig. The maximum design fill rate was specified to be 32,000 barrels per hour, and the maximum design flow rate for emptying the tank was specified to be 20,000 barrels per hour. Data regarding the design basis for the maximum fill and empty rates were not available. The tank shell was supported on a concrete ring wall foundation. Four ground lugs around the perimeter of the tank were used to ground the tank. There were nine vent openings in the shell near the top of tank and six vents in the fixed roof. The tank floor sloped to a 15-foot-diameter by 6-foot-deep steel sump. The tank did not have a mixer. The datum plate10 was mounted on the south wall of the tank. A 24- and 30-inch-diameter fill/drain pipe connected the manifold piping to the sump. A 30-inch-diameter tee was welded to the end of the 30-inch-diameter pipe inside the sump, which was about 9 feet from the tank wall. A 6-foot by 12-foot rectangular splash plate covered the sump about 6 inches above the tank floor. (The diagrams in figure 6 show the configuration of the sump in tank 11.) The floating roof assembly was fabricated and installed by Altech Industries in

1. Baker Tank Company (which acquired Altech Industries, Inc., in the mid-1980s)

stated that the floating roofs in tanks 11 and 12 were of the same design, materials, and construction. The assembly was aluminum and consisted of a flat roof deck mounted on 10-inch diameter horizontal pontoons. The pontoons were designed to provide sufficient buoyancy to prevent the roof deck from contacting the product in the tank. Spaced throughout the area of the floating roof were aluminum drain tubes. Rows of “C” channels were attached to the sheet metal that formed the deck to provide stiffness. The design documents also showed two “pressure/vacuum vents/manway” openings in the floating roof deck. A butyl nitrile wiper seal around the perimeter of the floating roof was intended to act as a vapor seal to reduce the amount of vapor lost to the environment when the tank contained high-volatile hydrocarbon liquids. The wiper seal in tank 11 was installed in 1995 as a replacement for the original Midwest Urethane Waffle Wiper seal. During the inspection of tank 12, the floating roof was supported on legs that placed it about 6 feet above the floor. Investigators noted that the roof was not centered in the tank while it sat on the legs and that a gap large enough to insert a closed fist existed between the tank wall and the flexible seal attached to the floating roof on one side of the roof. On the opposite side from this gap, the flexible seal was compressed tightly against the interior tank wall. 10 A datum plate is a level metal plate mounted near the floor of a storage tank that is used for measuring the depth of liquid in the tank. The depth is measured using a tape lowered through an opening in the tank’s roof to the datum plate. The volume of liquid in the tank can then be determined by looking up the depth measurement on a strapping table. A strapping table shows for the height (level) of product in a tank the volume (quantity) of product in the tank.

Factual Information 11 Pipeline Accident Report Figure 6. Tank 11 sump and fill/drain piping viewed from the side (top diagram) and from above (bottom diagram). 30" fill/drain pipe 6' x 12' splash plate 15' diameter sump in tank floor Supports for splash plate, pipe, and tee 30" tee Tank shell Tank shell Tank shell Tank floor 30" fill/drain pipe 30" tee 6' x 12' splash plate 15' diameter sump 6' deep Support for splash plate, pipe, and tee

Factual Information 12 Pipeline Accident Report The legs of the floating roof were fitted through aluminum sleeves fastened to the floating roof. The legs could be adjusted to support the roof at different heights above the tank floor when the roof was not floating. Leg length was determined by placing bolts with nuts through predrilled holes in the sleeve and leg above the roof. A bolt and nut could also be placed in the leg below the floating roof to prevent it from descending all the way to the tank floor. Thirty-four legs extended around the interior circumference of the tank, approximately 4 inches inside the tank wall. The interior portion of the roof had about 14 more legs. The strapping table provided to investigators indicated that 7,180 barrels of product would be required to fully float the roof, and that product would first contact the pontoons at a volume of 6,390 barrels. Steel columns that supported the fixed roof extended from the tank floor through the floating roof to the fixed roof. Antirotation cables for the floating roof were installed. The roof had drains approximately 11 inches long. In tank 12, investigators observed that one drain tube was longer than the others and extended below the bottom of the nearby pontoon. (See figure 7.) The floating roof bonding system for tank 11 consisted of stainless steel wires that connected the floating roof to the fixed roof. The purpose of the wires was to keep the floating roof and the tank roof/shell at the same electrical potential for protection against electrostatic discharges.11 At the fixed roof, according to the roof drawings, one pair of wires was connected to each of two eyebolts. Each pair of wires was connected to the eyebolt by a knot through the eye of the bolt for strain relief. In addition, a loop of the wire was mechanically clamped to an aluminum grounding clip, which was bolted to the shank Figure 7. Drain tube extending down from floating roof in tank 12. 11 Bond wires connect two conductors (in this case the floating roof and the fixed roof) so they are at the same electrical potential. Underside of roof deck Pontoon Roof support leg Drain tube

Factual Information 13 Pipeline Accident Report of the eyebolt on the inside of the fixed roof. At the floating roof, each of the four wires was screwed to the frame of the roof in several places. Baker Tank Company provided a data sheet that documented the construction inspection and the as-installed condition of tank 11’s floating roof. This document indicates that the distance from the tank floor (measured adjacent to the manual gauge funnel near the tank wall) to the underside of the roof deck panels was 62 3/8 inches. The data sheet also documented that the installation of the bond wires at both the fixed roof and the floating roof had been checked. The strapping table provided to investigators indicated that at a volume of approximately 7,180 barrels (3 feet 6 inches above the datum plate) the roof was fully floating, and at a volume of approximately 6,390 barrels (3 feet above the datum plate), liquid in the tank first contacted the roof pontoons. Two alarms were set in the supervisory control and data acquisition system (SCADA)12 to alert the controllers when the volume in the tank was nearing the level at which the roof would no longer float. The set points for the alarms were based on the landed height of the floating roof assumed in the ConocoPhillips strapping table. Based on the measurement of the height of the floating roof documented on the construction inspection report and based on measurements investigators made of the tank 11 legs and the floating roof in tank 12, the strapping table was determined to be incorrect. Investigators determined that the distance from the bottom of a pontoon to the datum plate while the tank 11 roof was landed was between 3 feet 8 inches and 3 feet 9 inches. Based on this information, investigators prepared a revised strapping table. From the revised table, it was determined that liquid in tank 11 would first contact the floating roof when the volume was between approximately 7,498 and 7,632 barrels. Tank Farm West of the tank farm and outside of the diked area, two pipelines to/from Explorer’s facility⎯a 24-inch-diameter and a 30-inch-diameter⎯and the ConocoPhillips 12-inch-diameter pipeline to/from Glenpool Terminal were connected to manifolds. The manifolds were an interconnection of pipe and valves that, through the opening and closing of selected valves, allowed product to flow into or out of individual tanks as needed. These valves were either manually or motor operated, and none of them could be remotely operated. ConocoPhillips had no equipment at this facility to control the flow rate to its tank 11 from Explorer. For product movements to Glenpool Terminal in the 12- inch-diameter pipeline, a ConocoPhillips pump was used, or the product was transferred by gravity. For product transfers to Explorer, the 30-inch-diameter line gravity fed product into a pump in Explorer’s yard. 12 Pipeline system controllers use SCADA systems to remotely monitor and control movement of liquids in pipelines and related facilities, such as tank farms. With a SCADA system, controllers can monitor operating parameters—such as tank volumes, product flow rates, pressures, temperatures, valve status, and alarms—and control valves and pumps to adjust the flow in the pipeline system.

Factual Information 14 Pipeline Accident Report The manifold area also included vacuum system equipment. The vacuum process was intended to minimize the mixing of incompatible products, such as gasoline and diesel, when the same piping was used to transport different products. The system consisted of a vacuum pump, vacuum tank, storage sump, sump pump, and interconnecting piping. The system functioned to remove product from three areas: the manifold piping, the piping connecting the manifolds to the individual storage tanks, and the tank sump above the bottom of the fill/drain piping. The vacuumed product was collected in a vacuum tank and drained by gravity into a storage sump before being either pumped to a storage tank suitable for the product or otherwise disposed of. The ConocoPhillips Glenpool South Station log documents that the volume of the 24-inch manifold header was 49 barrels, and the volume of the tank 11 fill/drain piping was 253 barrels. Additional piping unrelated to the storage tanks was inside the diked area east of tank 7. This aboveground pipe and valves included a rupture disk and isolation flange. The rupture disk provided overpressure protection for a ConocoPhillips 12-inch-diameter crude oil pipeline—designated the Wood River crude oil pipeline—that was underground along the east side of the dike. In the event of a pipeline overpressure, the rupture disk would break and relieve the pressure in the pipeline by directing the crude oil into tank 9. The isolation flange assembly included a nonmetallic gasket and was part of the cathodic protection system for the pipeline. The isolation flange assembly electrically insulated the crude oil pipeline from the tank farm facilities. Inside the diked area were several light poles and electrical junction boxes. The junction box between tanks 11 and 12 was an explosion-proof enclosure. Inside this box was wiring for controls and instruments, such as tank level gauges and motor-operated valve controls, which was connected to terminal strips. ConocoPhillips representatives told investigators that there were no security cameras at the Glenpool South tank farm and that the site was secured with a chain link fence and locked gate. The ConocoPhillips operator on duty stated that this gate was closed and locked when she arrived at the Glenpool South tank farm about 4:30 p.m. on April 7, 2003. Control Centers ConocoPhillips had a local control center at Glenpool Terminal and a control panel at Glenpool South tank farm that was connected to the local control center. The control computer polled the station sensors about once a second. The status of each valve and pump was recorded if it had changed from the previous polling. Other data included readings from instruments for temperature, pressure, and product gravity. The tank 11 level gauge data was not received in the local control center at Glenpool Terminal because some of the level gauge data lines had been disconnected in preparation for the installation of a new radar level gauge. However, tank 11 level data was still being transmitted to, monitored at, and recorded at the ConocoPhillips central control center at Ponca City, about 80 miles northwest of the Glenpool South tank farm. This control center had a SCADA system that operated ConocoPhillips pipelines via satellite links and that monitored some of the valves, pumps, and sensors at Glenpool South tank farm. The

Factual Information 15 Pipeline Accident Report ConocoPhillips system was set up so that the operator at Glenpool Terminal controlled the local operations while the controller in Ponca City monitored the station activities and coordinated operations when product flowed into, or out of, the Glenpool stations. The height of product in tank 11 was measured with a level gauge that transmitted the data to the Ponca City control system via a satellite link. The control system computer converted the height data into tank volume using strapping table measurements and other corrections. The tank level was sampled every minute, and the level was recorded if it had changed from the previous reading. The timestamp on the data indicated when the SCADA system received the data. Because of polling and transmission times, delays of up to 1.5 minutes could occur between the time an event occurred and the time it was recorded. Explorer Glenpool Facilities Explorer Pipeline Company’s Glenpool tank farm consisted of 31 tanks, which had a combined capacity of about 3.4 million barrels, and it was adjacent to and northwest of the ConocoPhillips Glenpool South tank farm. Except for a backpressure regulator that maintained a constant pressure at Explorer’s meter, equipment at Explorer’s Glenpool tank farm did not control the flow rate to tankage at the ConocoPhillips Glenpool South tank farm. Data from the Glenpool tank farm flow computer and valves, pumps, and sensors were transmitted via local telephone lines to Explorer’s central control center in Tulsa, Oklahoma. Sensors were polled about every 5 seconds, and the data were recorded in a SCADA system. American Electric Power Equipment Power poles owned by AEP were east of the tank farm on top of the dike wall. The facilities included three conductors rated at 138,000 volts and two shield wires. This power line was originally built in 1930–1931 as a 66,000-volt line and was rebuilt in the same location in 1950 as a 138,000-volt line. After the accident, AEP replaced one set of wooden poles on the dike wall near tanks 7 and 11 with a single steel pole, which raised the wires in this area. Postaccident Field Inspections Tank 11 Wreckage The floating roof and appurtenances had been severely damaged by the explosion, by heat from the fire, and by the collapse of the fixed roof and tank walls. Eleven floating roof legs were recovered from the debris of the burned tank. Pieces of four legs below the sleeves were recovered and reassembled. The recovered sleeves were observed to be

Factual Information 16 Pipeline Accident Report resting on a bolt and nut assembly through the legs, which was between 51 1/2 and 52 inches above the leg foot that rested on the floor of the tank near the tank wall. Based on these measurements, the distance from the datum plate (which was 6 3/4 inches above the tank floor in tank 12) to the bottom of a floating roof pontoon was about 3 feet 8 inches. This was about 8 inches higher than indicated on the original strapping table and, based on a corrected strapping table prepared by investigators, is equivalent to a product volume of between 7,498 and 7,632 barrels. Pontoons that were recovered were discolored; examination of the discoloration indicated that when the roof was floating about 5 inches of the pontoons were submerged. Several roof drain tubes were recovered. The tubes appeared to be made of aluminum and were approximately 11 inches long and 1/2 inch in diameter. The lower 5 inches of the recovered tubes were discolored. On-site examination of tank 11 revealed that two eyebolts were attached to the fixed roof. The eyebolt that was recovered from the folded-over portion of the fixed roof outside the tank on the north side was designated eyebolt No. 1, and the eyebolt that was recovered in the northeast area of the wreckage on the tank floor was designated eyebolt No. 2. A portion of the threaded shank of each eyebolt was found inserted into a hole in the fixed roof. The surfaces of all the eyebolts and wire cables were covered with black soot, consistent with exposure to fire. The disassembled eyebolts and wire cables were sent to the Safety Board Materials Laboratory for examination. Examination of eyebolt No. 2 revealed that a wire cable was tied to the curved head portion. A looped portion of the same wire cable extended beyond the tied knot on the curved head. Solidified metal was found next to the eyebolt. The solidified metal encased a steel bolt and a portion of the looped end of the wire cable. The looped end of the wire cable was wrapped around the bolt. A nut and washer were found attached to the threaded shank portion of the eyebolt. Solidified metal also was found between the nut and the washer. A wire cable was tied to the curved head portion of eyebolt No. 1 similar to eyebolt No. 2. The looped end of the wire cable that extended from the tied knot had been deformed and was flat. The threaded shank portion of eyebolt No. 1 in two areas was covered with solidified metal. The eyebolts were pulled from the wall of the fixed roof by hand without effort. During handling of eyebolt No. 2, the solidified metal fragment separated from the looped end of the wire cable. The looped end of the wire also fractured during this separation event. Two of the four locations where the bond wires were connected at the floating roof were discovered in the wreckage. At these locations, the bond wires were connected to the floating roof structure with screws. ConocoPhillips Crude Oil Pipeline The aboveground piping associated with the ConocoPhillips crude oil pipeline overpressure protection was in the pool of burning diesel. The pipe and valves were burned, but they did not appear to have ruptured. The cathodic protection isolation flange

Factual Information 17 Pipeline Accident Report assembly was on the pipeline side of the first aboveground valve. Crude oil was observed in a drip pan that had been placed below the flange. Black discoloration was observed on the west side of approximately seven of the concrete fence panels adjacent to the crude piping. This fence appeared to delineate the tank farm area from the adjacent property. Some crude oil had sprayed over the fence onto the ground. AEP Power Lines On April 10, 2003, investigators observed the power lines and shield wires on the ground on the east wall of the Glenpool South tank farm dike. The wooden power poles were standing. ConocoPhillips Electrical Facilities At the time of the accident, a radar gauging system for the tanks at Glenpool South tank farm was being installed. For this gauging system, new electrical conduit had been run from the tops of the tanks into the common explosion-proof electrical junction box between tanks 11 and 12. No wiring had been installed in the new conduits, although they were connected to the junction box. The existing conduit/electrical wiring to this box had vapor seals where it entered the electrical box. No vapor seals were observed in the new conduit for the radar gauging system. This conduit was also open to the atmosphere at the top of the tank, in some cases near the tank roof vents. Because the conduit was open from the junction box to the tops of tanks 11 and 12, this conduit was considered a potential path for flammable vapors to enter the junction box. It was hypothesized that flammable vapors from a tank could have been drawn into the open conduit due to strong winds at the time of the explosion and ignited. The flame front could then have traveled back to the vent opening in tank 11, igniting the vapors in the tank. Consequently, before the junction box was opened for examination, a water manometer was attached to the conduit where it entered the electrical box, and the other end of the manometer was open to the atmosphere. The purpose of this measurement was to determine whether a pressure differential (chimney effect) existed between the electrical box and the atmosphere. No pressure differential was noted. When the electrical box was opened and examined, discoloration was found on the bottom of a hole where the new conduit from the new gauge on tank 11 entered the electrical box. However, no evidence of an electric arc was observed in the junction box. The new conduit to tank 11 was excavated to examine the inside of the conduit for soot or other evidence of fire inside the conduit. After the conduit was exposed and opened, it was observed that it was filled with clear water. The installer stated that the conduit was not designed to be watertight.

Factual Information 18 Pipeline Accident Report Tests and Research Safety Board Materials Laboratory Examination Detailed laboratory examination of the two eyebolts and the wires to which they were attached revealed no evidence of arc-related pitting damage, discoloration, or deposits that can result from electrical discharge. The fractured ends of the wires from each cable exhibited elongation deformation and knife edges that are typical of overstress separation. The eyebolts and wire showed no evidence of a preexisting crack or corrosion. The eyebolt threads were covered with deposits of aluminum, indicating that an aluminum grounding clip and aluminum nuts had melted during the fire. The wire found at eyebolt No. 2 was looped around a steel bolt and embedded in solidified metal, which was determined to be melted aluminum. The wire in the general location of the bolt showed evidence of flattening, which was consistent with the wire having been connected to the aluminum grounding clip with a nut and bolt. A coating found on both eyebolts was determined to consist of uniform layers of iron oxide, which is typical of oxidation that occurs rapidly at elevated temperatures. Diesel Analysis The diesel delivered to tank 11 on April 7 originated at a refinery near Pasadena, Texas, and had been stored in a tank there. The refinery arranged for samples to be taken from the tank. An independent lab working for the refinery prepared a “Certificate of Analysis” for these samples, which were referred to as “low sulfur diesel.” A sample of the diesel being delivered to ConocoPhillips tank 11 was taken by Explorer at its Glenpool tank farm approximately 5,000 barrels into the delivery. Explorer’s procedures required that a sample be drawn from the beginning, middle, and end of the batch; however, because the scheduled 24,500-barrel delivery of diesel ended after approximately 8,420 barrels, it was not possible to draw a sample from the middle and the end of the batch. The Safety Board had a portion of Explorer’s sample tested by an independent laboratory. No samples of diesel were collected after the fire because the firefighting efforts had contaminated the diesel with water and other products. The following tests were conducted: • Flash point,13 according to American Society for Testing and Materials (ASTM) D-93, Standard Test Methods for Flash-Point by Pensky-Martens Closed Cup Tester. • Distillation curve, according to ASTM D-86, Standard Test Method for Distillation of Petroleum Products at Atmospheric Pressure. 13 Flash point is the lowest temperature at which a liquid releases enough vapors to the air to form an ignitable mixture. The flash point of gasoline is approximately -50° F.

Factual Information 19 Pipeline Accident Report • Electrical conductivity, according to ASTM D-2624, Standard Test Methods for Electrical Conductivity of Aviation and Distillate Fuels. • Water content, according to ASTM D-1744, Standard Test Method for Determination of Water in Liquid Petroleum Products by Karl Fischer Reagent. The flash point of the diesel was 162° F; the distillation curve showed it to be a “typical” diesel; the electrical conductivity was less than 1 pS/m;14 the water content was 65 parts per million by weight. Design Criteria for Tank Fill Rate ConocoPhillips representatives told investigators that they had no documentation explaining how the maximum fill rate of 32,000 barrels per hour in the fill/drain pipe for tank 11 had been determined. They noted that the company’s current design procedures were based on API Recommended Practice (RP) 2003, Protection Against Ignitions Arising Out of Static, Lightning, and Stray Currents. Switch Loading ConocoPhillips had previously conducted switch loading operations in tank 11 without incident. “Switch loading” refers to filling a tank, which previously contained a high- or intermediate-vapor-pressure product, with a low-vapor-pressure product.15 (“Vapor pressure” is the pressure exerted by a gas in equilibrium with a liquid at a given temperature. High-vapor-pressure products include aviation gasoline, motor gasoline, and naphtha. Intermediate-vapor-pressure products include toluene, xylene, benzene, and jet fuel [JP-4, Jet B]. Low-vapor-pressure products include heating oil, kerosene, diesel, and safety solvents.) At normal ambient temperatures, when a tank is filled with a high-vapor-pressure product, such as gasoline, the vapor space above the surface of the liquid becomes too rich to be flammable. When a tank is being filled with a low-vapor-pressure product, such as diesel, and there are no residual vapors in the tank, the vapor pressure of the diesel is too low to make the vapor-air mixture above the surface of the liquid flammable unless the ambient temperature is at or above the flash point of the product. For the accident switch load, the diesel temperature (66° F) and the ambient temperature (52° F) were well below the flash point of the diesel (162° F). 14 Electrical conductivity is a measure of how well a material accommodates the transport of an electric charge, which is the movement of charged particles through a material in response to an electric field. The unit of measurement is Siemens/meter, or S/m. The prefix “p” is “pico” and equals 1 trillionth, or 10-12. The conductivity of typical diesel is 0.5 to 50 pS/m. 15 Other operations in which a tank is filled with a product different from its previous contents, including filling a tank with a product that has a vapor pressure higher than the vapor pressure of the product previously in the tank, do not pose the hazards associated with switch loading, and are not called switch loading.

Factual Information 20 Pipeline Accident Report For combustion to occur in air with a hydrocarbon fuel, two conditions must be met: an ignition source must be present, and the fuel vapor concentration must be between the lower and upper flammability limits for that particular hydrocarbon vapor. Outside this range, the vapor-air mixture is either too lean or too rich to be ignited. The flammability is dependent on the liquid’s vapor pressure and the environment in which it is handled. At the time of the accident, a switch loading operation was being conducted by loading diesel into a tank that had previously contained gasoline. Because of the hazards involved in this type of operation, both the National Fire Protection Association (NFPA) and the API have specific guidelines for dealing with the switching of product in a tank.16 Both organizations recommend precautions if the vapor space in a tank is at or above the lower flammable limit because of the previously stored product and if the tank is to be filled with a low-vapor-pressure, low-conductivity (static accumulating) product. These precautions include minimizing static generation, preventing charge accumulation, avoiding spark discharge, and controlling the environment inside the tank. Specific recommendations are suggested to minimize generation of static charge; these include avoiding splash filling and upward spraying, limiting the initial fill line and discharge velocities, avoiding loose or floating ungrounded conductive objects (such as gauge floats or sample cans) in the tank, avoiding pumping or flowing hydrocarbons with dispersed water or solids, and limiting the maximum fill rate. For floating roof tanks, these precautions apply until the roof is floating, after which the liquid surface is at the same electrical potential as the floating roof, and the vapor space has been reduced. Factors that contribute to generating a flammable environment include the types of products involved, the amount of time the floating roof is landed with product in the tank, and the time the tank has for ventilation. Switch Loading and Tank 11 Operations Investigators reviewed switch loading records from January 2002 to the time of the accident to determine whether there were any differences in the conditions of these switch loading operations. Three previous switch loading operations were noted during this period. Before each of these switch loading operations, the floating roof landed as the high-vapor-pressure product drained from the tank. Draining operations continued until the tank was empty (except for the approximately 55 barrels of liquid in the sump) and remained empty until the switch load (refilling the tank with low-vapor-pressure product) occurred. In the accident switch load, the floating roof landed as the gasoline drained from the tank on April 4. However, the draining operation was terminated before the tank was empty. On April 5, 1,897 barrels of gasoline were transferred from tank 10 to tank 11 with the intent of refloating the roof. The next day, an additional 1,819 barrels of gasoline were 16 NFPA 30: Flammable and Combustible Liquids Code; NFPA 77: Recommended Practice on Static Electricity; API Recommended Practice 2003: Protection Against Ignitions Arising out of Static, Lightning, and Stray Currents.

Factual Information 21 Pipeline Accident Report added to the tank. (This gasoline was displaced from a pipeline connecting to the Glenpool South tank farm when naphtha was delivered in this pipeline to tank 8.) Based on the corrected strapping table, the tank 11 roof was not floating until this gasoline was added on April 6. The switch load occurred on April 7. The graph in figure 8 illustrates the volume in tank 11 from the morning of April 4, 2004, through the time of the accident on April 7. It is based on data from the tank 11 level gauge. Safety Board Vapor Concentration Study The Safety Board performed a study of vapor concentration to determine whether the environment in tank 11 was flammable at various times during tank operations on April 4 through April 7. Calculations of the fuel vapor concentration within tank 11 were made for four time periods of interest; they are shown in figure 8. At each time period, vapor concentrations were calculated for the spaces above and below the floating roof. The results of these calculations are shown in table 1. Figure 8. Volume of fuels in tank 11 during the 84 hours before the accident. Time 1 Time 2 Time 3 Time 4 Liquid first contacts floating roof at tank volumes between 7498 and 7632 barrels 0 1,000 2,000 3,000 4,000 5,000 6,000 7,000 8,000 9,000 10,000 Volume of liquid in tank (barrels) Accident switch load Explosion (8:55 p.m.) April 4 April 5 April 6 April 7

Factual Information 22 Pipeline Accident Report Table 1. Volume concentration of gasoline vapor above and below the floating roof.

ConocoPhillips operating records show that after removal of gasoline from the tank on April 4, the tank still held 4,994 barrels of gasoline, which was insufficient to float the roof. This amount of gasoline remained in the tank until 8:00 a.m. on April 5 (the period shown as “Time 1” on table 1). Landing the roof allowed gasoline vapors to be produced in the space between the liquid and the floating roof. Calculations show that the vapor space would have become too rich to support combustion because the elapsed time was sufficient to allow the gasoline vapors to reach equilibrium. There would not have been any gasoline vapors introduced to the area between the fixed roof and the floating roof at this time. The 8:00 a.m. delivery on April 5 introduced another 1,897 barrels of gasoline into the tank, bringing the total amount in the tank to 6,891 barrels, which was still insufficient to float the roof. The gasoline entering the tank displaced some of the vapor that had collected below the floating roof. This vapor moved up through the two vents in the floating roof and collected in the space between the fixed roof and the floating roof. The vapor concentration below the floating roof was calculated to be still too rich to support combustion. The vapor concentration above the roof was calculated to be within the flammable range. This amount of gasoline in the tank remained at 6,891 barrels until 3:00 a.m. on April 6 (“Time 2” on table 1), when another 1,819 barrels were added. During this delivery, at about 3:30 a.m., the liquid level reached the pontoons of the floating roof, and the roof began to float. At the end of this delivery, tank 11 held 8,710 barrels of gasoline. At this time, calculations indicate that the space between the fixed roof and the floating roof was still within the flammable range even with the addition of vapors from below. The roof remained floating for another 36 hours (“Time 3”) until the gasoline in the tank was pumped to other tankage. The tank was then drained dry (except for the sump) and remained this way for 3 hours (“Time 4”). While the tank was draining, the roof landed, and some of the vapor that had collected between the fixed roof and the floating roof was transferred back below the floating roof. At this time in the operation, calculations show that a flammable Above the Roof (%) Below the Roof (%) Time 1 0 44–54 Time 2 1.2–1.4 44–54 Time 3 1.5–1.9 44–54* Time 4 1.3–1.6 1.9–2.3

• The roof assembly was floating with the pontoons in contact with the gasoline during this period. The underside of

the internal floating roof deck was approximately 7 inches above the surface of the liquid.

Factual Information 23 Pipeline Accident Report environment existed both below and above the floating roof. Calculations indicate that there was a very small amount of evaporation from the gasoline located in the sump that added to the vapor already present below the floating roof; however, this did not contribute significantly to the vapor concentration below the roof. The addition of diesel to the tank would have displaced some of the gasoline vapor in the tank from below the floating roof to the space between the roofs, further enriching the flammable mixture above the floating roof. ConocoPhillips Crude Oil Pipeline Operations On the east side of the tank farm, a ConocoPhillips 12-inch-diameter crude oil pipeline was underground and aligned in a north-south direction. Near the east wall of the dike and between tanks 7 and 8, the overpressure protection piping for this pipeline was aboveground and inside the dike. The segment of this piping upstream of the rupture disk operated at the same pressure as the pipeline during normal operations. When the accident occurred, at 8:55 p.m. on April 7, the pipeline pressure at the pump discharge at Glenpool Terminal was about 1,348 psig. Between about 3:00 a.m. and 5:00 a.m. on April 8, the pressure was lowered to 550 psig. About an hour later, at 6:10 a.m., the heat from the fire weakened the flange assembly and isolation gasket, and the pipeline failed. Operating Procedures Explorer Procedures Explorer’s operating procedures and shipper information documents stated that deliveries from Explorer’s pipeline system into tankage would be made at full line rate and that the tankage operator was responsible for eliminating conditions⎯such as filling new lines or filling tanks that have the floating roof on supporting legs after construction or repair⎯that may require a reduced flow rate. Industry Recommended Tank Filling Rates According to API RP 2003, for tanks that may contain a flammable mixture in the vapor space, such as can occur during switch loading, protective measures to control the electric charge in a storage tank include the following: Limit the fill line and discharge velocity of the incoming liquid stream to 1 meter/second (3 feet per second) until the fill pipe is submerged either two pipe diameters or 61 centimeters (2 feet), whichever is less. In the case of a floating roof (internal or open top) tank, observe the 1 meter/second (3 feet/second) velocity limitation until the roof becomes buoyant. At the time of the explosion, the tee in the sump at the end of the fill pipe was submerged in the diesel by more than the recommended minimum depth, but the internal roof had not yet floated.

Factual Information 24 Pipeline Accident Report ConocoPhillips Tank Filling Rates “Refined Product Tank Filling Rate Requirements” from the ConocoPhillips Merged Terminal Operating and Procedures Guide described the procedures and requirements for filling tanks. It addressed the prevention of static electricity charges between the refined product and the steel structure of the tank floor and appurtenances and concerns about the stability of floating roofs during tank filling. For floating roof tanks, the ConocoPhillips guide defined an “empty tank” as any tank with the floating roof landed with vapor space between the roof and the surface of the product. The guide noted that, depending on the product, safety precautions may be applicable and environmental reporting requirements may exist. The guide categorized refined products into three vapor-pressure groups (low-, intermediate-, and high-vapor-pressure) and referenced API RP 2003 as the source of this classification scheme. The guide provided examples of products in each group. The guide stated that low-vapor-pressure products, such as diesel (No. 1 or No. 2), had the highest potential for static charge buildup. Also noted was that the introduction of low-sulfur forms of these products had caused greater concern because of the additional potential for ignition when static buildup occurs. The guide stated that delivery of low- vapor-pressure products into an empty tank should not exceed 3 feet per second until the surface of the liquid is above the fill nozzle by a distance of 2 feet or the equivalent of two pipe diameters, whichever is less. In the case of a tank with a floating roof, the 3-feet-per- second velocity limitation was to be observed until the roof became buoyant.17 For intermediate-vapor-pressure products, it was noted that while there was some static electricity buildup in these products, reduced flow rates were not generally required unless the product was being handled in extreme temperature ranges. In this case, the intermediate- vapor-pressure products were to be handled like low-vapor-pressure products. For additional safety, the flow rate of intermediate-vapor-pressure products into empty tanks was to be limited to 3 feet per second whenever pipeline operating conditions permitted. For high-vapor-pressure products, the ConocoPhillips procedures guide noted that while static buildup did occur in these products, the vapor space directly above the surface of the liquid was generally too rich with vapors to be ignited by static charges. For that reason, restricted flow rates were generally not required for these products. Gasoline was identified as a high-vapor-pressure product. The guide also addressed the hazardous condition that may exist with a switch load when a low-vapor-pressure product, such as diesel, is pumped into a tank containing flammable vapors from a previous high- or intermediate-vapor-pressure product. When 17 A 3-feet-per-second delivery velocity in the 30-inch fill line to tank 11 would have been equivalent to a flow rate of about 9,000 barrels per hour. The actual flow rate on April 7 was 27,492 barrels per hour (9.2- feet-per-second velocity in the fill line) at the beginning of the delivery. At this flow rate, the length of time it took to fill the sump with diesel was calculated to be less than 20 seconds. The flow rate at the end of the delivery was 20,409 barrels per hour (6.8-feet-per-second velocity in the fill line); the average delivery rate was 21,050 barrels per hour (7-feet-per-second velocity in the fill line).

Factual Information 25 Pipeline Accident Report high- or intermediate-vapor-pressure product is drained from a tank with a floating roof, air is pulled into the space below the roof, resulting in an air-gas vapor space. Once this condition exists, an explosion may occur if an ignition source, such as a buildup of static electricity, is present. Postaccident Actions at ConocoPhillips Glenpool South Tank Farm After the accident, tanks 7, 8, 9, and 12 were inspected, repaired as needed, and returned to service. Tanks 7, 8, and 12 were retrofitted by ConocoPhillips with two tees on the existing tee inside the sump with the intent of accommodating a higher flow rate from Explorer. Additionally, the splash plates over the sump openings were enlarged to cover the entire outline of the circular sumps. ConocoPhillips indicated that Tank 11 may be replaced depending on future operational requirements. ConocoPhillips revised its operating procedures for the Glenpool South tank farm after the accident. The site-specific procedure, dated August 18, 2003, Local Operating Procedures Guide for Glenpool South Pipeline and the Glenpool South Facility and Breakout Tankage18 for ConocoPhillips, states that when tanks are emptied and vacuumed to remove product from the bottom of the tank, the tank’s roof will be refloated by pumping product from Glenpool Station before Explorer will deliver product into the tank and that Explorer will not deliver product into an empty tank (a tank where the roof is not floating). The procedure also identifies the static electricity hazard caused by movement of product in a pipe. To prevent a hazard, the velocity of product into any new tank, or the first filling of any tank that has been opened and gas-freed, must be maintained at or under 3 feet per second until the roof is floating. A table lists the allowable flow rates for a velocity in the fill pipe of 3 feet per second. A footnote to the table says that tank 12’s two tees give “the delivery system sufficient design to accept [the] Explorer rate into the tank if the roof is not floating.” The procedure does not identify switch loading or describe the hazards associated with switch loading. In addition, ConocoPhillips prepared a procedure that requires tanks to be equipped with low level alarms and defines the minimum operating level for a tank. For tank 11, the minimum operating level would have been just above the level at which the roof legs touch the floor. The procedure identifies the conditions, such as taking a tank out of service for inspection or maintenance, for which the roof may be landed and instructs personnel that, for normal operations, operating a tank below the minimum operating level is not permitted. 18 Federal regulations define a breakout tank as a tank used to relieve surges in a hazardous liquid pipeline system or to receive and store hazardous liquid transported by pipeline for reinjection and continued transportation by pipeline.

Factual Information 26 Pipeline Accident Report Federal Safety Regulations – Emergency Procedures Federal regulations for hazardous liquid pipelines (49 Code of Federal Regulations (CFR) Part 195), which cover breakout tanks such as those at the Glenpool South tank farm, have requirements for emergency procedures, including emergency response planning and emergency response: 195.402 Procedural Manual for Operations, Maintenance, and Emergencies: (a) General. Each operator shall prepare and follow for each pipeline system a manual of written procedures for conducting normal operations and maintenance activities and handling abnormal operations and emergencies. This manual shall be reviewed at intervals not exceeding 15 months, but at least once each calendar year, and appropriate changes made as necessary to insure that the manual is effective. This manual shall be prepared before initial operations of a pipeline commence, and appropriate parts shall be kept at locations where operations and maintenance activities are conducted. … (e) Emergencies. The manual required by paragraph (a) of this section must include procedures for the following to provide safety when an emergency condition occurs; …(e)(2) prompt and effective response to a notice of each type of emergency, including fire or explosion occurring near or directly involving a pipeline facility, accidental release of a hazardous liquid … from a pipeline facility, and operational failure … and taking necessary action, such as emergency shutdown or pressure reduction, to minimize the volume of hazardous liquid … that is released … in event of a failure. (e)(7) Notifying fire, police, and other appropriate public officials of hazardous liquid or carbon dioxide pipeline emergencies and coordinating with them preplanned and actual responses during an emergency, including additional precautions necessary for an emergency involving a pipeline transporting a highly volatile liquid. Federal regulations for natural gas pipelines have similar requirements for emergency planning and response. Industry Emergency Response Plan Guidance For natural gas pipelines, the American National Standards Institute (ANSI) Gas Piping Technology Committee’s Guide for Gas Transmission and Distribution Piping Systems19 includes material intended to assist the user in complying with the Federal regulations. For emergency plans, it states: 19 ANSI GPTC Z380.1, Guide for Gas Transmission and Distribution Piping Systems, Gas Piping Technology Committee. The Gas Piping Technology Committee is an independent consensus committee comprising representatives from the pipeline industry, including manufacturers, operators, and consultants, as well as from pipeline safety regulatory agencies.

Factual Information 27 Pipeline Accident Report Written procedures should state the purpose and objectives of the emergency plan and provide the basis for instructions to appropriate personnel. The objective of the plan should be to ensure that personnel who could be involved in an emergency are prepared to recognize and deal with the situation in an expeditious and safe manner. This may require that parts of the plan be developed and maintained in coordination with local emergency response personnel (e.g., police, fire, and other public officials) and with other entities in or near the pipeline rights-of-way (e.g., other utilities, highway authorities, and railroads) that may need to respond to a pipeline emergency. For natural gas and hazardous liquid pipeline systems, the American Society of Mechanical Engineers (ASME) codes include requirements for emergency planning. However, the codes do not list electric utilities among the parties a pipeline operator should contact when planning its response to an emergency. ConocoPhillips Emergency Procedures The ConocoPhillips Emergency Response Plan, Core Plan, Volume 1, Section 5 (“Response Activities”) and the Oklahoma Emergency Response Plan, “Response Zone Appendix (Glenpool Area),” specify actions to be taken in the event of an emergency. The plans are designed to ensure the safety of the public and company personnel when threatened by the release of hydrocarbons from a pipeline to the environment and to coordinate activities for prompt and safe repair of the pipeline. The plan describes events that require immediate response, including receiving notices of an emergency, such as fire, explosion, or natural disaster involving pipeline facilities; release of hazardous liquids from a pipeline facility; or an operational malfunction causing a hazardous condition. For these situations, emergency shutdown procedures are specified: shut in the pipeline at the nearest block valves and notify the nearest pump station and/or the appropriate control center. The emergency procedures do not specifically include notifying nearby electric utilities, which in this case includes AEP. Federal Safety Regulations – Ignition Protection Title 49 CFR Part 195 prescribes safety standards and reporting requirements for pipeline facilities used in the transportation of hazardous liquids. These standards were amended on April 2, 1999 (Amendment 66). The amendment became effective on May 3, 1999, and incorporated by reference 13 consensus standards for aboveground steel storage tanks. One of the new requirements references API RP 2003 for the prevention of ignition from static electricity: 195.405(a)-- After October 2, 2000, protection provided against ignitions arising out of static electricity, lightning, and stray currents during operation and maintenance activities involving aboveground breakout tanks must be in

Factual Information 28 Pipeline Accident Report accordance with API Recommended Practice 2003, unless the operator notes in the procedural manual (§195.402(c)) why compliance with all or certain provisions of API Recommended Practice 2003 is not necessary for the safety of a particular breakout tank. Before this amendment, there were no specific regulatory requirements for aboveground tanks regarding protection against ignitions. Tank Inspections Office of Pipeline Safety The Research and Special Programs Administration’s Office of Pipeline Safety (OPS) provided inspection reports for the Glenpool South tank farm for the 5-year period before the accident. One inspection of tank 11 had been conducted in this period, on October 24, 2001, and was reported on a four-page form entitled Breakout Tank Evaluation Form (Evaluation Report of Breakout Tank Facilities). The inspection of tank 11 was part of an overall inspection that evaluated five tanks at the Glenpool South tank farm and six tanks at Glenpool Terminal. For each tank, the first part of the evaluation form was completed; a single second part of the form was completed for the 11 tanks. The first part of the evaluation form gathered factual information about the facility, such as tank size, specifications, and contents; cathodic protection data; availability of an Oil Pollution Act Response Plan; standards used for tank design, construction, and repairs; alarms; leak detection; dike description; firefighting equipment; signs; and security. The report included the following for tank 11: (1) there was an overfill alarm, (2) the tank bottom had no history of corrosion, (3) the tank bottom had cathodic protection, (4) the product stored was diesel, (5) the tank was constructed in accordance with API Standard 650 and inspected in accordance with API Standard 653, (6) there was an isolation valve on the tank inlet/outlet to isolate the tank from other facilities, and (7) no repairs, alterations, or reconstruction had taken place. It also noted that the capacity of the tank farm dike was 165,000 barrels, firefighting equipment was adequate, signs were adequate, and there was protection from vandalism and unauthorized entry. No noncompliances were noted. The second part of the evaluation form listed the applicable regulatory requirements from 49 CFR Part 195 and had a space for the inspector to document his evaluation of each item as “S” (satisfactory), “U” (unsatisfactory), “N/A” (not applicable), and “N/C” (not checked). No noncompliances were noted. The inspector’s documentation of his evaluation of ConocoPhillips’ compliance with the requirements for prevention of static ignition (195.405(a)) was “N/A,” indicating that the item was not inspected. ConocoPhillips In July 2000, tank 11 was externally inspected in accordance with API Standard 653 (Tank Inspection, Repair, Alteration and Reconstruction). The inspection included an ultrasonic thickness survey, elevation survey, and visual inspection of the outside of the

Factual Information 29 Pipeline Accident Report tank. Visible signs of rust and paint peeling in scattered areas around the entire tank were observed. The report recommended surface preparation, painting of these areas, and minor earthwork inside the dike to eliminate water accumulation. It also noted that the grounding system appeared to be in good condition. An internal inspection of tank 11 in accordance with API Standard 653 was scheduled for late 2003. In API Standard 653, guidance for evaluation of a floating roof is given by referring the inspector to API Standard 650 (Welded Steel Tanks for Oil Storage) for external and/or internal floating roofs. In section H.4.1.6 (“Internal Floating Roofs”), this standard states: All conductive parts of the internal floating roof shall be electrically interconnected and bonded to the outer tank structure. This may be accomplished by electric bonding shunts in the seal area (a minimum of four, uniformly distributed) or flexible cables from the external tank roof to the internal floating roof (a minimum of two, uniformly distributed). The choice of bonding devices shall be specified by the purchaser, considering strength, corrosion resistance, joint reliability, flexibility and service life. National Electrical Safety Code The Institute of Electrical and Electronics Engineers, Inc., (IEEE) publishes the National Electrical Safety Code. The current edition is dated 2002. According to the IEEE, the code covers: basic provisions for safeguarding of persons from hazards arising from the installation, operation, or maintenance of (1) conductors and equipment in the electric supply stations, and (2) overhead and underground electric supply and communication lines. It also includes work rules for the construction, maintenance, and operation of electric supply and communication lines and equipment. It is applicable to “the systems and equipment operated by utilities, or similar systems and equipment, of an industrial establishment or complex under the control of qualified persons.” Specifically, the code covers utility facilities and functions up to the service point, which is the point of connection between the facilities of the serving utility and the premise wiring. The code does not include any guidelines or requirements for emergencies, such as emergency planning and response documents and training.

30 Pipeline Accident Report Analysis No unusual or abnormal operating conditions were noted during the filling of tank 11 until the explosion occurred. A number of factors were found to have contributed to the explosion and fire and the impact of the fire on the community, and those factors are addressed in this analysis. Exclusions Various ignition sources were considered during the investigation. These included discharge of static electricity, lightning, electrical arcing, and human activity at the scene near tank 11 on the day of the accident. There was no known electrical weather activity on the night of the explosion. There was no evidence of electrical arcing in the junction box between tanks 11 and 12. The conduit from tank 11 to the box was filled with water, which would have prevented flammable vapors from being transmitted to the junction box and would have prevented a flame from being transmitted back to tank 11. In addition, no one was seen at or near the storage facility at the time of the explosion. Therefore, the Safety Board concludes that lightning, electrical arcing, and human activity near the tank did not cause or contribute to the accident. Static Electricity and Prevention of Accidental Ignition at Storage Tanks Investigators considered static electricity within tank 11 as a possible ignition source that led to the explosion. For static electricity to cause ignition, the following must be present: generation and accumulation of a static charge, a spark gap, and, in the spark gap, a flammable mixture and a static discharge of sufficient energy to cause ignition. Static Charge Generation, Accumulation, and Dissipation Static charge buildup in hydrocarbon liquids during transfer operations is a common occurrence. A static charge can be generated by the separation of liquid from a hose or nozzle, the movement of liquid in a pipe, or the mixing, pouring, agitating, misting, or splashing of liquid. The electric charge is carried with the flowing liquid into the downstream container or storage tank. The potential for and magnitude of the static charge increases with low-electrical-conductivity liquids, increased flow velocity, increased turbulence, the presence of water or other suspended particulates, turbulent contact of dissimilar fluids (such as water and a liquid hydrocarbon), and filtration. Static charges accumulate whenever the rate at which the charges are generated exceeds the rate at which the charges dissipate.

Analysis 31 Pipeline Accident Report Materials with low electrical conductivity retain their electric charge longer than materials of higher conductivity. Explorer recovered a sample of the diesel that was transferred during the accident delivery. Laboratory analysis determined that the conductivity of the product was less than 1 pS/m. API RP 2003, Protection Against Ignition Arising Out of Static, Lightning, and Stray Currents, lists the range of conductivity for typical diesel as 0.5 to 50 pS/m and identifies any liquid with a conductivity of less than 50 pS/m as a static accumulator. Explorer’s operating agreement required customers to be able to receive product from Explorer’s pipeline at full line rate. In the delivery piping system from Explorer’s 28-inch pipeline to tank 11, Explorer operated a backpressure regulator to maintain a constant pressure at its custody transfer meter. Explorer and ConocoPhillips did not operate any equipment (except shutoff valves) at Glenpool to monitor or control the flow rate from Explorer. As noted previously, API RP 2003 contains protective measures to control the generation of electric charge in a storage tank, including limiting the velocity of the liquid in the fill line and limiting the discharge velocity of the incoming liquid stream until the fill pipe inside the tank is covered to a specific depth. For tanks with an internal floating roof, it recommends that the velocity of liquid in the fill piping and the discharge velocity of the incoming liquid stream be limited until the internal floating roof has floated. During the initial stages of tank filling, more opportunity exists for the incoming stream to produce agitation or turbulence, hence the need to limit the incoming velocity. The velocity limitation for both measures is identified as 3 feet per second. At the time of the explosion, the tee in the sump at the end of the fill pipe was covered by more than the recommended minimum, but the internal roof had not yet floated. The flow rate of diesel to tank 11 on April 7, 2003, initially ranged from a maximum of 27,492 barrels per hour to a minimum of 20,409 barrels per hour just before the explosion.20 The Safety Board notes that for the entire 24-minute delivery the velocity of diesel in the tank 11 fill pipe was between 2.3 and 3 times the recommended maximum velocity of 3 feet per second. The tee at the end of the fill pipe in the sump reduced the effective discharge velocity of the incoming liquid streams to half that in the pipe; however, the tee did not change the upstream velocity in the fill piping. The Safety Board also notes that for the entire 24-minute delivery the velocity of diesel as it exited the tee was between 1.1 and 1.5 times the recommended maximum velocity of 3 feet per second. Although the tee decreased the exit velocity, it increased the turbulence as it redirected the incoming liquid by 90° inside the tee and then directed it against the sump walls in two places. A 6-foot by 12-foot rectangular splash plate centered on the sump covered the sump opening approximately 6 inches above the floor of the tank. Because the sump was 15 feet in diameter, this plate covered only about 40 percent of the sump and likely functioned to reduce, but not eliminate, splashing and misting of the diesel during the initial delivery. 20 For liquid flow in the same size pipe, the flow velocity is proportional to the flow rate—if the flow rate is tripled, the flow velocity likewise increases by a factor of 3.

Analysis 32 Pipeline Accident Report Thus, the Safety Board concludes that the high velocity of the diesel in the tank fill piping and the turbulence created in the sump area resulted in the generation of increased static charge and, combined with the very-low-electrical-conductivity (static accumulating) liquid, an elevated risk for a static discharge inside the tank. Condition of Floating Roof Bonding System. The floating roof bonding system consisted of stainless steel wires whose ends were screwed to the top of the floating roof structure and attached to eyebolts on the underside of the fixed roof. Two of the four locations where the bond wires were connected to the floating roof were discovered in the wreckage. At these locations, the bond wires were intact and properly connected to the floating roof structure with screws. Examination of the components in the Safety Board’s Materials Laboratory showed that the coating on eyebolt No. 2 consisted of uniform layers of iron oxide typical of oxidation that occurs rapidly at elevated temperatures. Further, evidence of aluminum was found on the eyebolt threads, indicating that attached aluminum material, such as the grounding clip and aluminum nuts, had melted during the fire. The wire found at eyebolt No. 2 was looped around a steel bolt and embedded in solidified, melted aluminum. The wire at this location showed evidence of flattening, which was consistent with the wire having been connected to the aluminum grounding clip with a nut and bolt. Therefore, the available evidence indicates that the bonding wires were properly attached to the floating roof and the tank roof/shell. The Safety Board, therefore, concludes that the floating roof bonding system had most likely been installed as designed, and the available evidence was consistent with the components of the bonding system having been intact before the explosion. Floating Roof Position and Spark Gap When the draining of gasoline from tank 11 was completed at 5:33 p.m. on April 7, 2003, the floating roof landed and was supported by the legs. When the tank was filled with diesel at 8:35 p.m., the floating roof remained supported on the legs until the liquid level reached the pontoons underneath the roof deck. When the pontoons were submerged to approximately one-half of their diameter, the roof became buoyant. Because the floating roof was electrically bonded to the fixed roof and shell, once the diesel was in contact with the floating roof, the conditions necessary for a static discharge to occur between the diesel and the roof no longer existed. Investigators determined the volume of diesel in the tank at the time of the explosion by using the volume that was metered by Explorer and adjusting for the volume delivered after the explosion, the volume that remained in the delivery piping, and the volume already in the sump. The volume in the tank at the time of the explosion was determined to be between 7,397 and 7,600 barrels. Based on the revised strapping table prepared by investigators, these volumes correspond to a height above the datum plate of about 3 feet 7 inches to 3 feet 9 inches.

Analysis 33 Pipeline Accident Report Investigators determined that the surface of the charged diesel was within approximately 2 inches of the pontoons at the time of the explosion. This is the most likely time for a static discharge to occur. Hydrocarbon vapors such as those produced by gasoline require as little as 0.25 millijoules of energy for ignition. The energy in a static discharge can be much higher than this and yet not sufficient to leave a signature on the surface where the discharge occurred. During the inspection of tank 12 at the Glenpool South tank farm, investigators noted that in one case, a drain tube extended slightly below the bottom of the pontoon. If this condition existed in the accident tank, the small-diameter drain tube could have increased the electric field strength when the statically charged diesel surface approached it. Depending on the magnitude of the static charge in the diesel, a static discharge could have occurred between the surface of the diesel and the drain tube, resulting in ignition of the flammable vapors. Accident Switch Loading and Flammable Vapors Operating records show that about 10:00 a.m. on April 4, as tank 11 was being drained, the level of gasoline in the tank dropped below that necessary to float the roof. When the draining operation ended, 4,994 barrels remained in the tank. The next day, April 5, between about 8:00 and 10:00 a.m., an additional 1,897 barrels of gasoline were added to the tank, but the total volume was still insufficient to float the roof. On April 6, about 3:00 a.m., a delivery of another 1,819 barrels of gasoline was begun that would bring the amount of gasoline in the tank to 8,710 barrels. During this delivery, at about 3:30 a.m., the gasoline in the tank reached a level sufficient to again float the roof. Thus, for more than 40 hours⎯from about 10:00 a.m. on April 4 until about 3:30 a.m. on April 6⎯gasoline vapor accumulated in the space between the surface of the gasoline and the floating roof. The gasoline introduced during the deliveries on April 5 and 6 displaced much of this vapor, which moved up through the two vents in the floating roof and, according to calculations, made the space between the fixed roof and the floating roof flammable. When the tank was subsequently drained dry, some of the vapor that had collected between the fixed roof and the floating roof was transferred back below the floating roof, resulting in a flammable environment below the floating roof as well. The Safety Board concludes that the tank 11 operations from April 4 to 7, which included a partial draining that landed the floating roof and partial fillings before draining dry, allowed a large amount of gasoline vapor to be generated and distributed within the tank to create a flammable fuel-air mixture both above and below the floating roof. The Safety Board, therefore, concludes that all the conditions necessary for fuel vapor ignition were present in the storage tank at the time of the accident, and the explosion most likely occurred when a static discharge ignited a flammable fuel-air mixture in the space between the surface of the diesel and the floating roof. The extensive damage to the tank is consistent with the flammable fuel-air mixture above the floating roof contributing to the force of the explosion.

Analysis 34 Pipeline Accident Report ConocoPhillips’ revised procedures do not address the effect of floating roof operations on both creation and prevention of a flammable atmosphere inside a tank. Because it is possible that a floating roof can be landed inadvertently, it is important to include procedures for eliminating or minimizing any flammable vapors that tank operations may have created. Therefore, the Safety Board believes that ConocoPhillips should revise its storage tank operating procedures to include instructions for minimizing the possibility of creating a flammable atmosphere and the occurrence of a static discharge inside a tank after a floating roof has been either intentionally or unintentionally landed, especially for tanks where switch loading is likely to occur. Because the height at which the legs are set and the height of product in a tank determine whether a roof is floating or landed, a pipeline operator’s strapping table for a tank must be accurate to help operators determine the effect of tank operations on movement of the roof. Therefore, the Safety Board believes that the Research and Special Programs Administration should issue an advisory bulletin to liquid pipeline operators to validate the accuracy of their tank strapping tables. No documentation was available for tank 11 regarding the design basis for the maximum flow rate into the tank, for sizing the piping connecting tank 11 to Explorer’s facility, or for sizing the pipe discharge openings in the sump. ConocoPhillips’ current design procedures are based on API RP 2003. These procedures require that flow velocities be restricted in operating situations similar to those identified in API RP 2003. For flow velocity limitation in the case of a tank with a floating roof, the ConocoPhillips procedures stated that delivery of low-vapor-pressure products into an empty tank should not exceed 3 feet per second until the roof is buoyant. Discussions with ConocoPhillips personnel indicated that this statement of velocity limitation was applied to the velocity of the liquid as it exited the tee and not to the velocity of the liquid in the fill piping. After the accident, ConocoPhillips retrofitted the fill piping in tanks 7, 8, and 12 so the fill piping system now terminates in two tees that result in four 30-inch-diameter openings inside the sump. This was done to accommodate higher flow rates from Explorer (up to Explorer’s 28,200 barrels per hour ultimate capacity for diesel) and maintain a 3- feet-per-second maximum exit velocity from the tees. At 28,200 barrels per hour, the velocity in the 30-inch-diameter fill piping is 9.4 feet per second, and the exit velocity is 2.4 feet per second. For tank 11 with a single tee, applying the velocity restriction only to the exit velocity from the tee allowed the velocity in the fill piping to exceed the API recommended maximum by a factor of 2. For the modifications to tanks 7, 8, and 12, the installation of two tees allows the velocity in the fill piping to exceed the API recommended maximum by a factor of 4. Increased flow velocity in the fill piping results in the generation of greater static charges, and when the product is a low-conductivity product (static accumulator), the excess static charge is transferred into the tank with the liquid. Addition of one or more tees at the end of the fill piping does not reduce the velocity of liquid in the fill piping.

Analysis 35 Pipeline Accident Report The Safety Board concludes that ConocoPhillips operated in a manner that allowed tank 11 to be switch loaded at flow velocities significantly higher than those in both its own procedures and industry-recommended practices. The Safety Board believes that ConocoPhillips should evaluate its storage tank operating procedures and make the revisions necessary to ensure that product flow rates in both the tank fill line and the discharge nozzles are restricted to provide a level of protection against excess static electricity that is at least commensurate with industry standards. Emergency Response American Electric Power The explosion occurred at about 8:55 p.m., and AEP was informed of the accident almost immediately. The transmission system operator knew that the AEP power lines were near the fire. An AEP representative visited the scene twice while the tank burned, and he inspected the power lines. But he did not notify the incident commander when he arrived on scene or inform him of his findings. About 5:52 a.m., one or more wires failed and fell onto the diked area, igniting another fire and causing the firefighting effort to be temporarily suspended. An essential part of emergency response is the ability of the incident commander and his staff to be able to continually evaluate response options and determine the most appropriate actions. This requires that they have access to the most current information about not only the tank farm facilities and the products in the tank, but also of nearby facilities. The consideration is not only to minimize damage to these facilities, but also to prevent their involvement in the emergency, as such involvement may add unpredictability to the situation or cause the situation to escalate. Even though AEP knew almost immediately of the fire and the proximity of its power lines to it, the company responded only when asked. The fact that the AEP representative did not make contact with the incident commander limited the incident command’s ability to keep AEP informed as the fire situation changed and limited AEP’s knowledge of the situation. As a result, AEP’s second response to the accident site was too late, and its overall response was ineffective. The Safety Board concludes that the AEP responder did not coordinate his actions with the incident command staff, and AEP did not take effective emergency action. ConocoPhillips On the east side of the tank farm, a ConocoPhillips 12-inch-diameter crude oil pipeline was underground. The overpressure protection piping for this pipeline was aboveground and inside the dike. When the accident occurred, the crude oil pipeline pressure at the pump discharge at Glenpool Terminal was about 1,348 psig. Between about 3:00 a.m. and 5:00 a.m. on April 8, the pressure was lowered to 550 psig. At 6:10 a.m., the heat from the fire weakened the flange assembly, and the pipeline failed. Crude oil sprayed out of the flange into the burning diesel and the nearby concrete fence and onto offsite property. By 6:17 a.m., ConocoPhillips had shut down the pipeline pump and closed the remotely operated valves in the pipeline.

Analysis 36 Pipeline Accident Report As noted previously, Federal safety regulations require that a pipeline operator’s emergency plan include procedures for prompt and effective response to a notice of each type of emergency, including fire or explosion occurring near or directly involving a pipeline facility, accidental release of a hazardous liquid … from a pipeline facility, and operational failure … and taking necessary action, such as emergency shutdown or pressure reduction, to minimize the volume of hazardous liquid … that is released … in event of a failure. The ConocoPhillips emergency response plan stated that “shutting in the line at the nearest block valves” was to be initiated in response to these types of emergencies. In this accident, ConocoPhillips did not shut down its nearby crude oil pipeline until after the segment of pressurized pipeline inside the dike had failed and leaked. Although the operating pressure was being reduced beginning 6 hours after the explosion, the magnitude of the tank 11 fire and the presence of the power lines and other ConocoPhillips tanks adjacent to the fire should have prompted the response specified in the ConocoPhillips emergency response plan. However, timely action by the ConocoPhillips controllers in Ponca City immediately after the pipeline failed minimized the release of oil into the fire. Emergency Procedures Because of the proximity of the AEP power lines and the Glenpool South tank farm, noted previously, it is obvious that damage, a failure, or an emergency at one facility had the potential to jeopardize the safety of the other. However, neither AEP personnel nor ConocoPhillips personnel had contacted one another to familiarize themselves with the affected facilities at the Glenpool South tank farm or to plan for a coordinated response to pipeline and electrical emergencies there. At the Glenpool South tank farm, this recommendation for coordination with other entities would have applied to ConocoPhillips’ coordination with AEP. After the tank exploded, ConocoPhillips initiated contact with AEP and requested that the electric lines be inspected. Although several AEP employees and the AEP transmission system operator were aware of the fire from television news reports, AEP did not respond to the emergency at the tank farm until specifically requested to do so by ConocoPhillips. Had ConocoPhillips and AEP, as part of emergency planning, such as that described in the ANSI Guide for Gas Transmission and Distribution Piping Systems, previously met to discuss and plan emergency response activities for an electric line, tank, or pipeline emergency at the Glenpool South tank farm, it is likely that AEP’s emergency response would have been more effective and that, considering the potential hazard to life and property, actions would have been taken to more thoroughly assess the threat to the electric lines and the consequences of their failure. The Safety Board concludes that because ConocoPhillips and AEP did not preplan their response to emergencies near the

Analysis 37 Pipeline Accident Report Glenpool South tank farm, the emergency response was unsuccessful in managing the electrical hazard caused by the tank explosion and fire. The Safety Board believes that ConocoPhillips should revise its emergency response plan for the Glenpool South tank farm area and similar locations where ConocoPhillips facilities are near electric utilities to include preplanning with nearby electric facilities. The Safety Board believes that AEP should revise its emergency response plan to include areas, such as the ConocoPhillips Glenpool South tank farm, where pipeline transportation facilities are near AEP facilities, and include a requirement that the AEP emergency responders communicate and coordinate with the on-scene agency in charge. As mentioned previously, Federal regulations for both hazardous liquid and gas pipelines require that pipeline operators have procedures for coordinating emergency response with fire, police, and other public officials. However, these regulations do not require pipeline operators to contact or coordinate with operators of other facilities, such as electric utilities, for emergency response. The Safety Board believes that the Research and Special Programs Administration should revise the emergency response planning requirements in the pipeline safety regulations to include coordination with electric and other utilities that may need to respond to a pipeline emergency. ASME codes for gas and liquid pipeline systems include requirements for emergency planning, but they do not include electric utilities among the parties an operator should contact to preplan emergency responses. Therefore, the Safety Board believes that ASME should revise the emergency response planning requirements in its gas and hazardous liquid pipeline codes to include coordination with electric and other utilities that may need to respond to a pipeline emergency. Regarding emergency planning guidelines for electric utilities, many States, including Oklahoma, have adopted the National Electrical Safety Code and require that operators of electric facilities within the scope of the code comply with its provisions. Other States have adopted all or part of the code or use its provisions as the basis for regulations. Nationally recognized codes are an important resource for facility operators. When written by Government and industry professionals with experience in emergency planning, implementation, and personnel training, a code can be a primary reference when an operator prepares a company-specific emergency plan. The National Electrical Safety Code, however, does not address emergency preparedness. Other industry codes applicable to major infrastructure include provisions for emergency planning and training (for example ASME B31.8, ASME B31.4, and NFPA 30).21 The Safety Board concludes that comprehensive, practical industry guidance for the preparation of emergency plans would help operators of electric systems respond effectively to emergencies involving their utilities. The Safety Board, therefore, believes that the IEEE should revise the National Electrical Safety Code to establish requirements for operators to prepare and implement emergency response plans for electric facilities where an emergency may affect pipeline facilities or that may be affected by emergencies at pipeline facilities. 21 ASME B31.8 (Gas Transmission and Distribution Piping Systems), ASME B31.4 (Pipeline Transportation Systems for Liquid Hydrocarbons and Other Liquids), and NFPA 30 (Flammable and Combustible Liquids Code).

Analysis 38 Pipeline Accident Report Federal Oversight of Pipeline Operators In the 5 years before the accident, the OPS conducted one inspection of the Conoco tank farms at Glenpool Terminal and the Glenpool South tank farm. This inspection occurred on October 24, 2001. Five tanks at the Glenpool South tank farm and six tanks at Glenpool Terminal were inspected, as evidenced by completion of a factual part of the inspection record form for each tank and one evaluation section of the inspection record form for all 11 tanks. Based on the Safety Board’s review of other breakout tank inspection records, the OPS uses one set of the evaluation pages for multiple tanks in the same operating area of the same company. One item included as a compliance requirement on the evaluation pages of the Breakout Tank Evaluation Form relates to this accident: 195.405(a) After October 2, 2000, protection provided against ignitions arising out of static electricity, lightning, and stray currents during operation and maintenance activities involving aboveground breakout tanks must be in accordance with API Recommended Practice 2003, unless the operator notes in the procedural manual (§195.402(c)) why compliance with all or certain provisions of API Recommended Practice 2003 is not necessary for the safety of a particular breakout tank. The inspector’s documentation of his evaluation of the ConocoPhillips breakout tanks for compliance with 49 CFR 195.405(a) was “N/A,” which means that the tanks were not evaluated because the safety regulations were not applicable. Since these regulations became effective approximately 12 months before the inspection and the tanks at the Glenpool South tank farm were classified as “breakout tanks” subject to OPS jurisdiction, the determination that the regulations did not apply was obviously incorrect, and as a result, the October 24, 2001, safety evaluation of Conoco’s tankage was incomplete. Federal inspections of a pipeline operator should provide the operator with accurate feedback and the opportunity for immediate, constructive dialogue with the OPS. In addition, the OPS uses data obtained during field inspections to assess the effectiveness of its regulations and identify issues of operator noncompliance. In this case, since the inspector mistakenly determined that the regulatory requirements in the section of the Breakout Tank Evaluation Form related to prevention of ignition from static electricity were not applicable, the opportunity to review and evaluate Conoco’s compliance with 49 CFR 195.405(a) for protections against ignition from static electricity was not taken, and there was no further review within the OPS. Since 2002, the OPS has required that inspection reports be reviewed at the regional offices by a peer review team, a senior engineer, and/or the regional director. Before 2002, not all reports were reviewed. The purpose of the reviews is to ensure that each report has been completed properly, all required items have been addressed, and supporting evidence has been included. The reviews also allow the OPS to monitor the overall performance of the inspectors.

39 Pipeline Accident Report Conclusions Findings 1. Lightning, electrical arcing, and human activity near the tank did not cause or contribute to the accident. 2. The floating roof bonding system had most likely been installed as designed, and the available evidence was consistent with the components of the bonding system having been intact before the explosion. 3. ConocoPhillips Company operated in a manner that allowed tank 11 to be switch loaded at flow velocities significantly higher than those in both its own procedures and industry-recommended practices. 4. The high velocity of the diesel in the tank fill piping and the turbulence created in the sump area resulted in the generation of increased static charge and, combined with the very low electrical conductivity (static accumulating) liquid, an elevated risk for a static discharge inside the tank. 5. Tank 11 operations from April 4 to 7, which included a partial draining that landed the floating roof and partial fillings before draining dry, allowed a large amount of gasoline vapor to be generated and distributed within the tank to create a flammable fuel-air mixture both above and below the floating roof. 6. All the conditions necessary for fuel vapor ignition were present in the storage tank at the time of the accident, and the explosion most likely occurred when a static discharge ignited a flammable fuel-air mixture in the space between the surface of the diesel and the floating roof. The extensive damage to the tank is consistent with the flammable fuel-air mixture above the floating roof contributing to the force of the explosion. 7. The American Electric Power responder did not coordinate his actions with the incident command staff, and American Electric Power did not take effective emergency action. 8. Because ConocoPhillips Company and American Electric Power did not preplan their response to emergencies near the Glenpool South tank farm, the emergency response was unsuccessful in managing the electrical hazard caused by the tank explosion and fire. 9. Comprehensive, practical industry guidance for the preparation of emergency plans would help operators of electric systems respond effectively to emergencies involving their utilities.

Conclusions 40 Pipeline Accident Report Probable Cause The National Transportation Safety Board determines that the probable cause of the April 7, 2003, storage tank explosion and fire in Glenpool, Oklahoma, was ignition of a flammable fuel-air mixture within the tank by a static electricity discharge due to the improper manner in which ConocoPhillips Company conducted tank operations. Contributing to the extent of the property damage and the magnitude of the impact on the local community was the failure of American Electric Power employees to recognize the risk the tank fire posed to the nearby power lines and take effective emergency action.

41 Pipeline Accident Report Recommendations As a result of its investigation of the April 7, 2003, explosion and fire in Glenpool, Oklahoma, the National Transportation Safety Board makes the following safety recommendations: To the Research and Special Programs Administration: Revise the emergency response planning requirements in the pipeline safety regulations to include coordination with electric and other utilities that may need to respond to a pipeline emergency. (P-04-07) Issue an advisory bulletin to liquid pipeline operators to validate the accuracy of their tank strapping tables. (P-04-08) To ConocoPhillips Company: Revise your storage tank operating procedures to include instructions for minimizing the possibility of creating a flammable atmosphere and the occurrence of a static discharge inside a tank after a floating roof has been either intentionally or unintentionally landed, especially for tanks where switch loading is likely to occur. (P-04-09) Evaluate your storage tank operating procedures and make the revisions necessary to ensure that product flow rates in both the tank fill line and the discharge nozzles are restricted to provide a level of protection against excess static electricity that is at least commensurate with industry standards. (P-04-10) Revise your emergency response plan for the Glenpool South tank farm area and similar locations where ConocoPhillips Company facilities are near electric utilities to include preplanning with nearby electric facilities. (P-04-11) To American Electric Power: Revise your emergency response plan to include areas, such as the ConocoPhillips Company Glenpool South tank farm, where pipeline transportation facilities are near American Electric Power facilities, and include a requirement that the American Electric Power emergency responders communicate and coordinate with the on-scene agency in charge. (P-04-12)

Recommendations 42 Pipeline Accident Report To the Institute of Electrical and Electronics Engineers: Revise the National Electrical Safety Code to establish requirements for operators to prepare and implement emergency response plans for electric facilities where an emergency may affect pipeline facilities or that may be affected by emergencies at pipeline facilities. (P-04-13) To the American Society of Mechanical Engineers: Revise the emergency response planning requirements in your gas and hazardous liquid pipeline codes to include coordination with electric and other utilities that may need to respond to a pipeline emergency. (P-04-14) BY THE NATIONAL TRANSPORTATION SAFETY BOARD ELLEN ENGLEMAN CONNERS Chairman CAROL J. CARMODY Member MARK V. ROSENKER Vice Chairman RICHARD F. HEALING Member DEBORAH A.P. HERSMAN Member Adopted: October 13, 2004

43 Pipeline Accident Report Appendix A Investigation The National Transportation Safety Board was notified on April 7, 2003, through the National Response Center, of a storage tank fire in Jenks, Oklahoma. The Safety Board dispatched an investigator from its Washington, D.C., headquarters. No Board Member accompanied the investigator. After the environmental cleanup around the tank was completed, additional investigators from Research and Engineering (Materials Laboratory and explosion/fire) and the pipeline group (SCADA) went to the site. No depositions or hearings were held in conjunction with the investigation. ConocoPhillips, Explorer Pipeline, the Research and Special Programs Administration’s Office of Pipeline Safety, and the Glenpool, Oklahoma, Fire Department were parties to the investigation.

this page intentionally left blank

FD07280 ｜ 2003_美国_NTSB_RAR0501_Derailment_of_Canadian_National_Freight_Train_M33371_and_Sub.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2003 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Derailment of Canadian National Freight Train M33371 and Subsequent Release of Hazardous Materials in Tamaroa, Illinois February 9, 2003 Railroad Accident Report NTSB/RAR-05/01 PB2005-916301 Notation 7686 National Transportation Safety Board Washington, D.C.

this page intentionally left blank

Railroad Accident Report Derailment of Canadian National Freight Train M33371 and Subsequent Release of Hazardous Materials in Tamaroa, Illinois February 9, 2003 NTSB/RAR-05/01 PB2005-916301 National Transportation Safety Board Notation 7686 490 L’Enfant Plaza, S.W. Adopted January 25, 2005 Washington, D.C. 20594

National Transportation Safety Board. 2005. Derailment of Canadian National Freight Train M33371 and Subsequent Release of Hazardous Materials in Tamaroa, Illinois, February 9, 2003. Railroad Accident Report NTSB/RAR-05/01. Washington, DC. Abstract: About 9:04 a.m. central standard time on February 9, 2003, northbound Canadian National freight train M33371 derailed 22 of its 108 cars in Tamaroa, Illinois. Four of the derailed cars released methanol, and the methanol from two of these four cars fueled a fire. Other derailed cars contained phosphoric acid, hydrochloric acid, formaldehyde, and vinyl chloride. Two cars containing hydrochloric acid, one car containing formaldehyde, and one car containing vinyl chloride released product but were not involved in the fire. About 850 residents were evacuated from the area within a 3-mile radius of the derailment, which included the entire village of Tamaroa. No one was injured during the derailment, although one contract employee was injured during cleanup activities. Damages to track, signals, and equipment, and clearing costs associated with the accident totaled about $1.9 million. The safety issues addressed in the report are the effect of bond wire welding on rail integrity and inconsistent instructions regarding the exothermic welding of bond wires. As a result of its investigation of this accident, the Safety Board makes recommendations to the Federal Railroad Administration; ERICO Products, Inc.; and the American Railway Engineering and Maintenance- of-Way Association. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2005-916301 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Railroad Accident Report Contents Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Wreckage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Operations Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Postaccident Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Point of Derailment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Track Geometry Measurements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Walking Track Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Preaccident Track and Signal Condition and Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Preaccident Track/Signal Condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Replacement of Tamaroa Insulated Joint Plug . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Insulated Joint Plug at St. Johns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Welding Signal Bond Wires Onto Insulated Joint Plugs at St. Johns and Tamaroa . 11 Preaccident Track Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Slow Order History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Exothermic Bond Wire Welding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Federal Regulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Railroad Exothermic Welding Policies, Practices, and Experience . . . . . . . . . . . . . . . 13 Industry Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Interaction Between Track Structure and Exothermic Welds . . . . . . . . . . . . . . . . . . . . 18 CN Experience with Exothermic Bond Wire Welding . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Tamaroa Rail and Joint Bars . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Tamaroa Signal Bond Wires and Welds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Demonstration Cadweld Welds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 St. Johns Rail Fracture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Postaccident Developments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Environmental Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Track Condition and Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Rail Failure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Examination of Welding Procedure Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Rail Failure Tracking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Tank Car Survivability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Contents iv Railroad Accident Report Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Appendix A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

v Railroad Accident Report Executive Summary About 9:04 a.m. central standard time on February 9, 2003, northbound Canadian National freight train M33371, traveling about 40 mph, derailed 22 of its 108 cars in Tamaroa, Illinois. Four of the derailed cars released methanol, and the methanol from two of these four cars fueled a fire. Other derailed cars contained phosphoric acid, hydrochloric acid, formaldehyde, and vinyl chloride. Two cars containing hydrochloric acid, one car containing formaldehyde, and one car containing vinyl chloride released product but were not involved in the fire. About 850 residents were evacuated from the area within a 3-mile radius of the derailment, which included the entire village of Tamaroa. No one was injured during the derailment, although one contract employee was injured during cleanup activities. Damages to track, signals, and equipment, and clearing costs associated with the accident totaled about $1.9 million. The National Transportation Safety Board determines that the probable cause of the February 9, 2003, derailment of Canadian National train M33371 in Tamaroa, Illinois, was Canadian National’s placement of bond wire welds on the head of the rail just outside the joint bars, where untempered martensite associated with the welds led to fatigue and subsequent cracking that, because of increased stresses associated with known soft ballast conditions, rapidly progressed to rail failure. The safety issues addressed in the report are as follows: • The effect of bond wire welding on rail integrity, and • Inconsistent instructions regarding the exothermic welding of bond wires. As a result of its investigation of this accident, the Safety Board makes recommendations to the Federal Railroad Administration; ERICO Products, Inc.; and the American Railway Engineering and Maintenance-of-Way Association.

this page intentionally left blank

1 Railroad Accident Report Factual Information Accident Synopsis About 9:04 a.m. central standard time1 on February 9, 2003, northbound Canadian National (CN)2 freight train M33371, traveling about 40 mph, derailed 22 of 108 cars in Tamaroa, Illinois. (See figure 1.) Four of the derailed cars released methanol, and the methanol from two of these four cars fueled a fire. Other derailed cars contained phosphoric acid, hydrochloric acid, formaldehyde, and vinyl chloride. Two cars containing hydrochloric acid, one car containing formaldehyde, and one car containing vinyl chloride released product but were not involved in the fire. About 850 residents were evacuated from the area within a 3-mile radius of the derailment, which included the entire village of Tamaroa. No one was injured during the derailment, although one contract employee was injured during cleanup activities. Damages to track, signals, and equipment, and clearing costs associated with the accident totaled about $1.9 million. 1 Unless otherwise noted, all times are given in central standard time. 2 In July 1999, the Canadian National Railroad purchased the Illinois Central Railroad and became the Canadian National/Illinois Central (CN/IC) Railroad. In November 2003, about 10 months after the Tamaroa accident, the CN/IC was redesignated the Canadian National or CN. For the purposes of this report, the railroad will be referenced throughout by the designation “CN.” Figure 1. Post-derailment wreckage.

Factual Information 2 Railroad Accident Report Accident Narrative Train M33371 was a regularly scheduled northbound freight train that operated between Memphis, Tennessee, and Chicago, Illinois. The train changed crews in Fulton, Kentucky, for that portion of the trip between Fulton and Centralia, Illinois. On the day of the accident, because of the hazardous materials in its consist, the train was designated a “key train.”3 The crew that boarded the train in Fulton consisted of an engineer and a conductor. The conductor would stay with the train until it reached Centralia, Illinois, a timetable distance of 152.4 miles. The engineer would stay on the train only until it met with a designated southbound train at a siding. At that point, the engineers of the two trains would swap trains, with the engineer of the southbound train taking over train M33371 and operating it northbound to Centralia. Train M33371 departed Fulton at 3:33 a.m. on February 9, 2003, with 2 locomotives and 89 cars. On the day of the accident, train M33371 met the designated southbound train at Anna, a siding about 17.7 miles south of Carbondale, Illinois, and about 72.6 miles south of Centralia. The southbound train went into the siding track while train M33371 stayed on the single-track main line. The two engineers conversed, as was the normal routine, before exchanging trains. The engineer who was now operating train M33371 stated that after the crew change, he had a clear signal at Anna and proceeded northward at 6:50 a.m. He said he and the conductor noted no problems with the operation of the train as it continued northward. Train M33371 made a scheduled stop at Carbondale Yard to pick up an additional 19 freight cars. At the yard, the conductor inspected the cars, and after the additional cars were coupled to the rest of the train, an air brake test was performed. No exceptions were noted during the inspection or brake testing. While the train, which now consisted of 76 loads and 32 empties, was still in the Carbondale Yard waiting to depart, southbound CN train 348 passed, followed by northbound Amtrak train 58, the City of New Orleans. After the Amtrak train had passed, the engineer of train M33371 received signal indications from the dispatcher authorizing him to proceed northward, after which the train departed Carbondale. The engineer stated that as train M33371 was passing through Tamaroa, about 26 miles north of Carbondale, he felt a “tug” and noted that the train movement slowed. He said that a moment later, about 9:04, he felt a surge, and the train brakes went into emergency.4 The engineer said he could see dust and debris, and he radioed the train dispatcher. The engineer notified the dispatcher that the train had derailed and that the train was a key train. 3 The Association of American Railroads classifies as a key train any train with 5 tank car loads of a poison inhalation hazard (PIH) (hazard zone A or B) or 20 car loads or intermodal tank loads of a combination of a PIH (hazard zone A or B), flammable gas, Class 1.1 or 1.2 explosives (class A), or environmentally sensitive chemicals. A key train is restricted to a maximum speed of 50 mph. 4 Data from the event recorder on the lead locomotive indicated that the train was traveling about 40 mph when the brake application occurred and that the train came to rest within about 30 seconds.

Factual Information 3 Railroad Accident Report The engineer stated that the conductor had started to get off the lead locomotive when he “saw vapors” on his (west) side and they both observed “dust” on the engineer’s (east) side. The conductor then decided to stay on the locomotive as they looked through the train consist and the hazardous material instruction sheets provided for each hazardous material carried on the train. After about 5 minutes, the crewmen attempted to determine which cars were involved. They noticed a fire and told the dispatcher. About this time, a CN supervisor was heard on the radio, and the crewmen informed the supervisor that they had observed a fire. The conductor dismounted the lead unit and cut the two locomotives from the train. They moved the locomotives about 2 1/2 miles north to a road crossing and awaited further instructions. The CN supervisor arrived at this location and transported the conductor back to the derailment site to meet with emergency personnel and to exchange information concerning the cars and the hazardous materials involved in the accident. Another supervisor arrived and transported the crewmen to a hospital for toxicological testing; he later transported the crewmen to Centralia, where they went off duty at 6:50 p.m. Emergency Response The Perry County Sheriff’s Office reported receiving the first 911 call about 9:04 a.m.; the office then called the Du Quion Emergency Services and Disaster Agency. The Tamaroa Fire Department responded directly to the scene. The State police were on the scene shortly after that, and police and fire department personnel began to evacuate the residents of homes near the tracks to the Tamaroa Community Center. About 140 residents were sheltered at the community center. The Du Quion emergency services coordinator arrived on the scene at 9:30 a.m. He identified the hazardous materials involved in the derailment as hydrochloric acid and methanol, and he ordered the call-up of all disaster agency personnel. By this time, several State, county, and city fire and police departments were involved in the evacuation of all residents from the middle of Tamaroa. By 12:00 noon, vinyl chloride was determined likely to be involved in the derailment, and the evacuation perimeter was expanded to a 3-mile radius from the accident site, an area encompassing about 850 people and the entire village of Tamaroa. Six additional fire departments were assisting the Tamaroa Fire Department in the firefighting effort by 2:30 p.m. Hulcher Professional Services5 hazardous materials personnel were on scene by 4:00 p.m. About 10:00 p.m., lime was brought in, and responders began using it to neutralize the hydrochloric acid. 5 Hulcher Professional Services, Inc., was one of the companies contracted by CN to perform and coordinate emergency and initial response activities at the site.

Factual Information 4 Railroad Accident Report The evacuation area remained the 3-mile radius throughout the next day, Monday, February 10. By 7:00 a.m., dirt was being applied to the methanol tank cars to smother the flames, and neutralization of the hydrochloric acid spill was continuing. The fire was extinguished by about 9:30 a.m. Fixed air monitoring stations were established around the site, and at 3:15 p.m., cargo transfer operations were started. About 3:15 a.m. on Tuesday, February 11, as a damaged tank car containing methanol was being moved, an explosive re-ignition of methanol occurred. A Hulcher employee who was injured in the explosion was taken to the hospital and treated for a knee injury. As progress was made in transferring material from the derailed cars, the evacuation area was reduced to a 1-mile radius of the site at 10:00 a.m. on February 11. The evacuation area was reduced to a 1/2-mile radius on February 12. By 8:50 a.m. on February 12, the material from all but one of the methanol tank cars had been transferred. At 6:00 p.m. on Thursday, February 13, Tamaroa residents, with the exception of those living in houses adjacent to the tracks, were allowed to return home. At 7:00 a.m. on Friday, February 14, the tracks were opened and trains began moving through the area. At 8:00 a.m. on February 15, the order requiring the evacuation of the remaining homes was lifted. Injuries No one was injured during the derailment. A contract employee of Hulcher Professional Services was injured on February 11, as a result of a methanol vapor explosion that occurred during the cleanup of the derailed cars. The employee was taken to Marshal Browning Hospital in Du Quoin for treatment and observation. He was released on February 12 with a brace on his left knee. Damage Track damage started just south of the derailment site, about 89 feet north of a switch and right-hand turnout that connected the CN track to track owned by the Union Pacific Railroad (UP). Damage extended along the CN main track for about 800 feet through a left-hand switch for the CN house track.6 In addition, about 400 feet of UP track was destroyed. This accounted for about $90,000 in track damages and $30,000 in signal equipment damages. 6 The house track was a stub track that was used to set out freight cars that needed mechanical attention or as a place where track maintenance equipment could be parked.

Factual Information 5 Railroad Accident Report All 22 derailed cars were destroyed. Damage to railroad equipment was $925,000. The loss of lading totaled $353,000. The cost of environmental damage and cleanup exceeded $500,000. Total damages were about $1.9 million. Wreckage The 28th through 49th cars of train M33371 derailed and piled up; most were positioned approximately perpendicular to the track in accordion fashion. Seventeen loaded tank cars containing hazardous materials and two containing hazardous material residue derailed. Of the 19 tank cars that derailed 5 were Department of Transportation (DOT) class 105 pressure tank cars that had protective head shields on each end, and 14 were DOT class 111 general service tank cars. The five pressure tank cars were transporting vinyl chloride, a highly flammable and reactive gas that is also a known human carcinogen. One pressure tank car was breached. The breach involved a puncture by a pointed, rigid object that penetrated both the 1/2-inch-thick steel head shield and the 1/2-inch-thick steel tank head. The 6-inch-long puncture was 2 inches wide at its widest point. Of the 14 general service cars that derailed, 2 cars contained phosphoric acid and 2 cars contained hydrochloric acid solution, both of which are corrosive liquids. Three cars contained formaldehyde solution (with methanol), and seven cars contained methanol (two residue), both of which are flammable liquids. Seven of the general service tank cars were breached. Of these, four cars contained methanol, two cars contained hydrochloric acid, and one car contained formaldehyde. Two of the seven cars, a methanol tank car and a formaldehyde tank car, had minor leaks through damaged fittings. The three other tank cars containing methanol lost product through damage to their heads: two had head punctures, and one had a localized area that was severely crushed and torn. One of the two tank cars containing hydrochloric acid solution had a puncture in its side shell. The second tank car containing hydrochloric acid lost product through a compromised section of the tank shell. Operations Information The main track was owned, inspected, maintained, and operated by CN, which had designated it as class 5 track.7 Given this track designation, the single main track had a maximum allowable operating timetable speed of 79 mph for passenger trains, 70 mph for loaded container trains, and 60 mph for other freight trains. (The accident train was restricted to 50 mph because it was designated a key train.) 7 Railroads determine at what class they will operate various segments of their track. As the class designation increases, the track must meet increasingly higher Federal standards for construction, maintenance, and inspection. Federal regulations also establish maximum speeds for each class of track.

Factual Information 6 Railroad Accident Report Typical train counts through Tamaroa included four Amtrak passenger trains, eight manifest freight trains, two unit grain trains, and two local freight trains per day. Train traffic for the 12 months preceding the accident accounted for an annual gross tonnage of 35.2 million gross tons. Postaccident Inspections Equipment The train equipment that had not derailed was inspected, and no preexisting defects or exceptions were noted. The derailed and damaged cars were also inspected, and no obvious preaccident defects or exceptions were noted. Based on car position and marks on equipment, investigators determined that the 28th car was the first car in the train to derail. Point of Derailment The track was completely destroyed in the area of the derailment; however, Safety Board investigators studied and excavated the footprint of the derailment8 and determined that the point of derailment was on the east rail of the main track at an insulated joint plug9 at milepost 279.95. The joint plug appeared on visual inspection to contain rail fatigue defects and was broken into four segments, one of which contained the intact insulated joint. The south end of the segment containing the insulated joint exhibited evidence of receiving rail-end batter;10 the north end exhibited trailing rail-end batter.11 8 The footprint comprised any and all visible evidence, including marks on the ties, marks on the track components and the rail, car and truck component positions, and broken track components. 9 Railroad tracks in centralized traffic control territory have numerous electronic circuits that detect the presence of trains. These circuits use the rails as conductors of a low-voltage electrical current of a designated frequency, often referred to as “code.” To separate the different segments of track circuits, certain lengths of rail must be electrically insulated from adjacent segments. This electronic separation is accomplished by the use of an insulated rail joint, which employs special joint bars and fasteners that electrically isolate the joined rail segments. Typically, when an insulated joint must be replaced, the old joint, along with several feet of rail on each side of the joint, is cut from the track. The cut-out section is then replaced with a manufactured joint plug, which is a relatively short section of rail that contains within its length a pre-assembled insulated rail joint. The joint plug is bolted or welded in place. 10 Receiving rail-end batter is a deformation of the rail head that occurs when an oncoming train wheel strikes the end of rail that has become higher than the adjacent rail. 11 Trailing rail-end batter occurs when a train wheel rolls over the rail head end and drops onto the end of a rail section that has become lower than the adjacent rail.

Factual Information 7 Railroad Accident Report Fatigue cracking appeared to have originated at two exothermic bond wire welds.12 (See figure 2.) Each of the three welds on either side of the insulated joint contained a single track bond wire. One wire was for the electronic track circuit code, the second wire was for an audio frequency circuit, and the third wire was for future use with a grade crossing predictor circuit. The insulated joint plug was manufactured by Allegheny Rail Products, a Division of L. B. Foster Company, in April 2002. Track Geometry Measurements Track geometry measurements were recorded for 30 stations south of the point of derailment. Each station was 15 feet 6 inches apart. All 30 station measurements were taken in an unloaded state with any evidence of rail and tie movement added to the unloaded measurements. Station 1 was closest to the point of derailment, and Station 30 was farthest away. Stations north of the point of derailment could not be measured because the track was destroyed. All geometry measurements were then compared with the Federal requirements for class 5 track. 12 In the case of insulated joints, bond wires are used to connect the rails to the signal circuitry. Bond wires are relatively short, flexible, stranded wires with terminals at each end. One end is attached to the rail near the end of the track circuits, usually at or near the insulated joint bars; the other end connects to track circuit wires that are typically routed underground from the rail(s) to a nearby signal case that houses various components of the signal system. Bond wires are most often attached to the rails by exothermic welding, which is discussed in more detail later in this report. Figure 2. Illustration of the insulated joint plug that failed at Tamaroa showing fracture locations. Three exothermic bond wire welds had been made at the head of the rail on either side of the insulated joint. (Letter designations indicate north or south portions of the plug.) Not to Scale bond wire S4 bond wire S3 bond wire S1 bond wire S2 bond wire N4 bond wire N1 bond wire N3 bond wire N2 insulated joint Initiation Point Initiation Point Approximately 16’ 2”

Factual Information 8 Railroad Accident Report Standard gage measurement is 56 1/2 inches between the rail heads. Gage measurements on non-disturbed Tamaroa track ranged from 56 3/8 inches to 56 5/8 inches. Title 49 Code of Federal Regulations (CFR) 213.53 allows a minimum gage of 56 inches and a maximum gage of 57 1/2 inches. Track surface parameters were measured. The largest cross-level13 deviation measurements revealed a 3/4-inch variation from level at station 2. The 49 CFR 213.63 track surface chart indicates that the maximum allowable deviation for cross level is 1 inch. The maximum variation for track warp14 was 7/8 inch between stations 2 and 4. According to the track surface chart, the maximum allowable deviation for track warp is 1 1/2 inches. The track profile measurement revealed a maximum deviation of 3/4 inch between stations 1 and 2. The track surface chart indicates that the maximum allowable deviation for track profile is 1 1/4 inches. Walking Track Inspection On February 9, 2003, investigators conducted a walking track inspection to the north and south of the derailment area (milepost 279.95) between milepost 278.9 and milepost 281.2. During the walking inspection, spot measurements and observations were made for compliance with class 5 track standards. No exceptions were noted during the inspection. Preaccident Track and Signal Condition and Maintenance Preaccident Track/Signal Condition The CN track foreman and the CN signal maintainer characterized the point of derailment as typically having muddy track conditions; however, all evidence of this muddy track condition was destroyed in the derailment. The signal maintainer stated: My personal opinion is that they had trouble … keeping the Alleghenys up high enough that … the mud in the water [would not be] able to work the joints …. There was a lot of … mud pumping, there. It seemed to be a trouble spot. Anytime the tampers would come down there, [there would be] mud on my signals … where [the tampers] would be pumping mud. The signal maintainer added that mud at the joint seemed to put extra tension on the signal bond wires, especially in freezing weather, when the mud would become hard and “tug on the wire” as trains traversed the joint. He stated that the mud also affected the insulated joint by placing greater tension on it until the insulation started pulling away around the joint bar area. He stated that in the 13 months he was responsible for this territory, he was called one time for an open track wire at that location. He said he had to dig in the mud to find the broken wire that caused the problem. 13 Cross level refers to the relative heights of the two rails. 14 Warp is the measured difference in cross level between any two points less than 62 feet apart.

Factual Information 9 Railroad Accident Report The signal maintainer stated that he inspected insulated joints on his territory at least once a month. He said he checked all bonds in nonwelded joints once every 3 months. He also stated that any time he made a monthly switch inspection, he checked all the bonds at that location. The signal maintainer’s personal logbook records for January 2003 contained a notation of a problem with the track in the area of the subsequent derailment that included poor tie and ballast conditions and subzero temperatures. He stated that the poor surface caused the track to dip down in the area where the derailment would occur, and that mud in that area squirted on the signal mast and junction base. The signal maintainer was asked if he recalled telling anybody about the poor tie and ballast condition and pumping mud. He stated that he had mentioned his concern about this location to the track supervisor on more than one occasion, most recently in late

1. He stated that to his knowledge, no action was taken to correct the problem.

The last train to travel over the derailment site before the accident was Amtrak train 58, the City of New Orleans. The engineer of Amtrak train 58 stated that the train was traveling in a northward direction at about 78 mph when it passed through Tamaroa about 5:00 a.m. on February 9. The engineer stated that his train rode as it always did. He stated that there was a stretch of rough track between milepost 280 and the “graveyard crossing” at milepost 279.1, and that “If you’re drinking a cup of coffee, you got to get a hold of it.” The train 58 engineer stated that in December 2002, while operating an Amtrak train in a southward direction, he told the CN train dispatcher that the track in the derailment area rode rough and asked that a speed restriction be placed on the track. He said the roughest section was between milepost 279.4 and milepost 280. He stated that he believed a speed restriction was put in place but that it had been removed before his next trip. He said that during that next trip, because of his concerns about the ride quality of the train, he operated at a slightly reduced speed. He stated that the train rode significantly better than it had before he reported the rough track condition. Replacement of Tamaroa Insulated Joint Plug A CN welder for the Centralia Subdivision installed the insulated joint plug at the derailment site on January 23, 2003. (See figure 2.) The welder said that one of the two joint bars15 at an insulated joint was cracked. A new Allegheny insulated joint plug was delivered to the site, and the welder cut out the section of rail containing the defective insulated joint and replaced it with the Allegheny plug (which included a new, pre- assembled insulated joint). The new joint plug was not welded into place but was installed with standard 115-pound, 36-inch-long joint bars. The welder stated that he did not field- weld the insulated joint plug into the main track because the temperature was about 10° F 15 Joint bars are steel bars used to fasten together the ends of rails in a track. They are used in pairs and are designed to fit closely in the space between the rail head and rail flange (fishing space). They are held in place by track bolts. Joint bars are also called angle bars, rail joint bars, or splice bars. Joint bars at insulated joints are insulated from the rail to prevent current flow between the joined rail sections.

Factual Information 10 Railroad Accident Report at the time of installation, and such cold conditions affect the weld preparation process. Besides the welder, a welder helper, a track foreman and his laborer, the track inspector, and a signalman all participated in the plug replacement. Insulated Joint Plug at St. Johns About 2 1/2 weeks before the accident at Tamaroa, a CN signal maintainer, while conducting his monthly inspection on January 23, 2003, discovered a broken rail at a signal bond wire weld at St. Johns station (milepost 285.45 on the Centralia Subdivision of the Gulf Division, about 5 1/2 miles from the derailment). The rail failure was in an Allegheny insulated joint plug at the St. Johns switch. (See figure 3.) No information was available to indicate how long the existing welds had been in place or whether there was any additional flexing of the rail due to inadequate underlying ballast support. In the vicinity of the rail fracture, exothermic bond wire welds had been made on the base of the rail just outside the confines of the insulated joint bars. The top of the field side (outside) of the rail base contained three bond wire welds. The fracture appeared to emanate from an area near one of these welds, about 1 inch from the end of the insulated joint bars. Portions of the bond wire weld closest to the joint bars were present on both sides of the fracture.16 Railroad signal systems rely on a low-voltage current introduced into the rails to detect the presence of trains and to set signal aspects to provide train separation. The same current also makes it possible for signal systems to detect an “open” circuit, such as occurs in the case of a broken rail. But at St. Johns, because the bond wire connected to the signal circuit remained attached to the rail even after the fracture occurred, the signal system did not detect the break. The CN signal maintainer who found the broken rail at St. Johns told Figure 3. Illustration of insulated joint plug that failed at St. Johns showing fracture loca- tions. Three bond wire welds had been made to the base of the rail outside the joint bar. 16 After the Tamaroa accident, a 12-inch portion of the St. Johns track was removed from both sides of the separation, with the remains of insulated joint bars attached, and sent to the Safety Board Materials Laboratory for further examination. The results of the examination appear in the “Tests and Research” section of this report. Not to Scale bond wire C bond wire A bond wire B insulated joint to NTSB Lab

Factual Information 11 Railroad Accident Report investigators that the signal system had displayed a clear signal, even though the broken rail had allowed a 5-inch separation in the continuous welded rail (CWR).17 Welding Signal Bond Wires Onto Insulated Joint Plugs at St. Johns and Tamaroa Welding Signal Bond Wires. CN procedures called for signal bond wires at a rail joint to be welded to rails using an exothermic welding process. In a typical exothermic welding process, a chemical reaction is achieved with heavy metal oxides, such as iron or copper oxide, using aluminum as a reducing agent. When ignited, the oxides and aluminum powder react within a few seconds to produce the necessary welding heat. The resultant superheated molten metal is so hot—in excess of 2200o C (about 4000o F) for steel—that the contacting surface layers of the materials to be joined melt and form a permanent bond. To carry out the procedure, the signal maintainer uses a special mold that holds the bond wire against the rail where the two are to be joined. After placing one end of a bond wire into the mold and placing a retaining disk at the bottom of the crucible of the mold to contain the powder mixture, the signal maintainer pours oxide powder into the mold crucible and covers it with a layer of starting powder. He then ignites the mixture using a spark lighter. The molten oxide material burns through the retaining disk and flows downward in the mold, where it contacts the bond wire and the rail, melting them locally and then fusing them upon cooling. Because the exothermic welding system requires no external power source and is highly portable, quick, effective, and relatively inexpensive, it is widely used among railroads. ERICO Products, Inc., (ERICO) of Cleveland, Ohio, and four other companies are known to manufacture exothermic bond wire welding systems for the U.S. rail industry. Each company provides its own mold designs18 and powders. ERICO provides the equipment, supplies, and guidance for the Cadweld® exothermic welding process that CN used at the St. Johns and Tamaroa sites. Bond Wire Welding at St. Johns and Tamaroa. A CN signal inspector used the Cadweld exothermic welding process to weld the signal bond wires onto the insulated joint plugs at both St. Johns and Tamaroa. About 9:30 a.m. on January 23, 2003, the signal inspector’s supervisor called him and said the track crew needed a signal maintainer to bond the signal wires to the insulated joint plug being installed to replace the broken rail of the insulated joint plug at St. Johns. Because a signal maintainer was not available, the signal inspector did the work. He stated that about 2 weeks before installing the new bonds, he had received oral instructions that signal bond wires should be welded to the web of the rail,19 but he did not receive written 17 Continuous welded rail is rail that has been welded together into lengths exceeding 400 feet. 18 A different mold fixture is used depending on whether the bond wires are to be welded to the head, web, or base of the rail. 19 The web is the vertical section of rail between the rail head (top) and the rail base (bottom).

Factual Information 12 Railroad Accident Report instructions to that effect. The signal inspector said he told the supervisor on January 23 that he did not have the mold he would need to weld the bond wires to the web. (He subsequently told accident investigators that many other signal maintainers and inspectors did not have the equipment needed to install bonds in the rail web as directed.) He asked his supervisor for instructions and was told to use what he had at hand. After cleaning the head of the rail with an electric grinder, the signal inspector used a rail bonding mold assembly to bond wires to the rail head. He finished about noon. Also on January 23, track personnel called the signal inspector to bond the new insulated joint plug at Tamaroa. (This was the joint at which the derailment occurred about 2 1/2 weeks later.) The signal inspector used the same grinder to clean the head of the rail, then he put three Cadweld bonds on the rail head on each side of the joint just outside the limits of the joint bars.20 Preaccident Track Inspections CN had last inspected the track that encompassed the point of derailment (milepost 279.95) on February 8, 2003. The track inspection was conducted, via a Hy-Rail vehicle,21 by the relief track inspector as he traversed the track in a northward direction. No track defects were reported in the derailment area or for the entire inspection trip between mileposts 285 and 258. The relief track inspector had also inspected that area on the 2 previous days, February 6 and 7, with no track defects noted. Investigators reviewed CN track inspection records for the period between February 2002 and February 8, 2003. Class 5 track standards under 49 CFR 213.233 require the track to be inspected twice a week; the CN track inspectors stated that they usually inspected the track area three times per week. No records were found of inspections for the week of March 3 through March 9, 2002, and for the week of April 28 through May 4, 2002. In addition, there was no inspection record for one inspection for each of following 3 weeks: February 17 through 23, 2002; February 24 through March 2, 2002; and August 11 through 17, 2002. On May 8, 2002, an Illinois Commerce Commission track inspector inspected the track in the area of the derailment on behalf of the Federal Railroad Administration (FRA). The closest defect to the point of derailment the inspector noted was at the house track switch (at milepost 279.9). At this location, he noted an insufficient fastener condition in a 39-foot-long track segment, and he noted that ties were needed. The fastener condition was repaired on the same day, and the area supervisor stated that some switch ties were replaced in the switch about 2 weeks later and again in November 2002. 20 Railroad officials have told the Safety Board that bond wire welds are typically placed outside the limits of joint bars because of concerns that the welding could damage to the joint insulating material and because bond wires placed away from the bars are less likely to be damaged by track maintenance equipment. (A manufacturer of insulated joints has told the Safety Board that bond wire welding does not damage the joint insulation.) 21 A Hy-Rail vehicle is a highway vehicle, usually a pickup truck, fitted with wheels that allow it to travel along the tracks.

Factual Information 13 Railroad Accident Report A rail defect detector car had been operated over the derailment site on November 15, 2002, to ultrasonically test the rail for internal defects. The closest rail defect detected had been at milepost 282.49, about 2 1/2 miles south of the derailment area. The CN track geometry inspection vehicle was operated from north to south over the area of the derailment on November 19, 2002. Between milepost 279 +3,188 feet and milepost 280 +655 feet, six deviations were found, resulting in the lowering of the track classification from class 5 to class 4. The deviations included one cross-level deviation that measured 1 1/4 inches and five profile deviations (four locations that measured 1 3/8 inches and one that measured 1 5/8 inches). Per 49 CFR 213.63, the maximum allowable cross-level deviation is 1 inch for class 5 track and 1 1/4 inches for class 4 track. The maximum allowable profile deviation is 1 1/4 inches for class 5 and 2 inches for class 4. Slow Order History Prior to the accident, two slow orders had recently been issued in the area of the derailment. The first slow order was related to the deviations noted by the CN track geometry car on November 19, 2002. The slow order restricted freight and intermodal train speed to 60 mph. This slow order was removed as a result of repair work by December 2, 2002, and track speeds were returned to original timetable speeds. The second slow order was issued on February 7, 2003, at the house track switch. The speed restriction was issued for one train at 25 mph because of tamping maintenance in the area of a switch. Exothermic Bond Wire Welding Federal Regulations Title 49 CFR Part 213, “Track Safety Standards,” does not contain guidance on rail bonding. Part 236, “Rules, Standards, and Instructions Governing the Installation, Inspection, Maintenance, and Repair of Signal and Train Control Systems, Devices, and Appliances,” does not specify placement of track circuit connectors on the head, web, or base of the rail. Title 49 CFR 236.51, Track Circuit Requirements, subpart (a)(1), requires that track relay controlling signals shall be in a de-energized position when a rail is broken, except that it shall not be a violation of this requirement if a track circuit is energized when a break occurs between the end of rail and track circuit connector (bond). The regulation does not specify the location or placement of the track circuit bond in relation to the joint bars. Railroad Exothermic Welding Policies, Practices, and Experience Safety Board investigators contacted railroad engineering personnel from a variety of passenger and freight railroads, the FRA, and ERICO and inquired about their policies and experiences regarding exothermic bond wire welding.

Factual Information 14 Railroad Accident Report The Amtrak deputy chief engineer of communication and signals stated that Amtrak drills holes in the rail web and inserts pin bonds to connect track circuit wires.22 Exothermic bond wire welding is used within the area of the joint bars to provide track continuity. Amtrak’s director of engineering tests and standards stated that Amtrak does not allow exothermic bond wire welding to the rail web because of anecdotal evidence that such welding creates martensite23 that could lead to rail failures. Amtrak had no records of rail failures that had been caused by exothermic bond wire welding. The principal engineer for signals for the Long Island Railroad stated that his company uses exothermic bond wire welding for both track circuit wires and bonding wires within the joint bars instead of drilling holes in the rail web and inserting pin bonds to connect track circuit wires. The Long Island Railroad principal engineer for track maintenance stated that rail defects caused by exothermic welds to rail heads would be noted on the ultrasonic/induction internal rail inspections records but not with a separate code. Therefore, without looking at each report, he could not determine the number of rail defects the Long Island Railroad had found at such weld sites. The railroad did not keep records to reflect service failures from exothermic welding, and the engineer was not aware of any rail failures that had been caused by exothermic bond wire welding at the rail web. The Burlington Northern Santa Fe Railroad (BNSF) assistant vice president of signals stated that BNSF uses exothermic bond wire welding for both track circuit wire welding and joint wire welding. Track wires are installed on the rail web, and joint wires are welded on the rail head.24 For new construction projects, track wire comes preinstalled, via pin brazing,25 on the rail web. The BNSF director of rail stated that he did not maintain records of either rail service failures or defects detected by internal inspection that were caused by exothermic bond wire welding. He estimated that the number of rail failures caused by exothermic welding was low. The CSX Transportation (CSX) engineer of field services stated that the CSX does not track rail defects or rail service failures caused by exothermic bond wire welding. He said he did not recall any major occurrences attributed to that type of rail defect or failure. The CSX uses exothermic bond wire welding on the head of the rail for both joint wire bonds and track circuit wire bonds. 22 This process involves drilling holes into the rail web at the neutral axis and pressure-fitting bond wire connections. 23 Martensite is a hard and brittle crystal structure that occurs as a result of very rapid cooling (quenching) of heated steel (at about 1000º C or 1832º F per minute). Subsequent reheating of the steel to about 400º C (752º F) and holding it at this temperature for a time (tempering) produces a strong and tough steel with lower hardness and brittleness. 24 Track wires are those wires that carry current to and from a trackside signal device or component. Joint wires are those that directly connect two sections of rail at a non-insulated joint. The presence of joint bars on either side of a joint preclude the welding of joint wires onto the rail web. 25 Pin brazing is an alternative method of making electrical connections, including bond wire connections, to rails. Research conducted by Stanley Railroad Products, Inc., on the effects of high- temperature pin brazing on steel identified martensite to a depth of 1.5 millimeters (.059 inch) at pin-brazed welds.

Factual Information 15 Railroad Accident Report The UP general director of derailment prevention stated that because of split rail web defects that were detected during internal rail inspections, the UP has examined its practice of exothermic bond wire welding to the rail web. The split web problems occurred primarily on the heavy-haul lines when multiple applications of exothermic bond wire welds were made near the same spot. The UP still uses exothermic bond wire welding for existing track. For new track components, such as insulated joint plugs, frogs, switch points, and stock rails, the company specifies that the component manufacturer install bonds using a low-temperature pin brazing process that does not create martensite. The UP does not track service failures from exothermic bond wire welding, but it notes on inspection reports those rail defects attributed to exothermic bond wire welding found during internal rail inspections. However, because these rail defects are not coded separately, each inspection report must be examined to determine the number of defects caused by exothermic welding. The FRA staff director, Track Division, stated that the agency does not have a cause code26 for derailments caused by rail failures resulting from exothermic bond wire welding and cannot quantify the number of rail defects caused by exothermic bond wire welding. For the FRA, if a derailment occurs as a result of a rail failure caused by an exothermic bond wire weld, it should be reported in a general category of “Other” for types of broken rails. CN reported the rail service failure at Tamaroa to the FRA under the “Other” code of rail failures. Specifically, it was reported as cause code T 299, “Other Rail and Joint Bar Defects.” A spokesperson for ERICO stated that his company does not maintain a database of rail failures attributable to exothermic welded wire bonds. However, ERICO stated that when rail breaks have occurred in the area of the exothermic weld, they were most often attributed to the following: • Application to an area that is not recommended, for example, rail head bonds applied outside the confines of a joint bar, or other rail bonds not applied at the neutral axis27 of the rail web. • Aggressive grinding before bonding that has left visible scratches in the rail. • Failure to properly clean and protect the rail area where the bond will be applied, resulting in an unsatisfactory bond and necessitating repetition of the process. • Re-bonding that overlaps an earlier bond. 26 A cause code is a database number that is assigned to a specific derailment cause. 27 The neutral axis of a beam is an imaginary line in the cross section of a beam at which tensile or compressive stress and strain are essentially zero. For a 115-pound rail section that is 6 5/8 inches high, the neutral axis is 2.98 inches from the bottom of the rail base.

Factual Information 16 Railroad Accident Report Industry Guidance The American Railway Engineering and Maintenance-of-Way Association (AREMA)28 Manual for Railway Engineering gives the following recommended practices at Chapter 4, “Rail,” Part 4, Section 4.1, “Application of Rail Bonds”: The application of pin connected bonds or welded bonds to the outer side of the rail head, within the limits of the joint bars for standard bonding and outside of joint bars for special work where not practicable to apply them within the joint bar limits, is good practice. In addition, the AREMA Communications and Signals Manual, Part 8.1.32, “Recommended Design Criteria for Copper Based Exothermically Welded Type Non- Propulsion Rail-Web Bonds and Track Circuit Connections,” states, in part:

The following shall be considered when installing exothermically welded type rail web bonds:

1. Size, bond type, length and terminal type.
2. For quality and safety, molds, bonds, exothermic welding material and

installation equipment (welder, frame, clamps) shall be from the same manufacturer.

1. Follow bond manufacturer’s installation, removal, and reinstallation

procedures.

1. Bond terminals shall be installed on the neutral axis of the rail. (Ref. AREMA

Manual for Railway Engineering, Chapter 4, “Rail”). The AREMA Communications and Signals Manual, Part 8.6.40, “Recommended Instructions for Application of Head-of-Rail Type Welded Bond,” Section C5, recommends that bonding not be performed when moisture or lubricants are present on the molds, weld metal, or rail surface. The AREMA Railroad Engineering Manual, Section 2.1, addresses the specifications for steel rails. Section 2.1.4.1, “Standard AREMA Chemistry of Rail,” Part (b) “Hardness of Standard Chemistry of Rail Steel,” limits the contents of martensite. Note 4 states that “no untempered martensite shall be present within the rail.” In an April 26, 1999, letter to ERICO, a CN manager who was also chairman of the joint bars subcommittee of Committee 4 of AREMA stated that Section 4.1, Chapter 4, of the AREMA Railroad Engineering Manual (“Application of Rail Bonds”) was too general and that it needed a major revision to make it more specific. The letter asked ERICO for suggested language that could be added to the AREMA manual. 28 AREMA is an industry association that sets recommended standards of practice for railroad construction and maintenance. AREMA’s stated purpose is “The development and advancement of both technical and practical knowledge and recommended practices pertaining to the design, construction, and maintenance of railway infrastructure.”

Factual Information 17 Railroad Accident Report ERICO replied on May 10, 1999, with the following eight suggestions: • Exothermically welded connections to the rail are to be made in accordance with the manufacturer’s recommended procedures. Since the welded connection is part of a system, it is very important to have the bonds, weld metal, molds, and frames supplied by the same manufacturer. • The exothermic weld metal shall be an alloy that is designed to weld to rail steel. • Under no condition shall weld metal containing tin be used to make welded connections to the rail. • The weld metal shall have a minimum tensile strength of 39,000 pounds per square inch. • Bonds are to be exothermically welded to the head of the rail only within the confines or limits of the splice plate or joint bars. • The maximum size bond, to be welded to the head of the rail within the confines of the splice plate [joint bars], shall be 250MCM cable with factory-formed terminals. • Connections or bonds welded to the rail outside the confines of the splice plate or joint bars shall be welded to the web of the rail at the neutral axis. • The maximum size bond to be welded to the web of the rail shall be 500MCM cable with a factory-formed terminal. The CSX engineer of field services, who chairs the rail subcommittee of AREMA’s Committee 4, told the Safety Board that the issue of exothermic bond wire welding had been raised at a meeting of the rail subcommittee, but the procedure had not been perceived as a problem. The suggestions from ERICO were never disseminated by AREMA in either its Railroad Engineering Manual or its Communications and Signals Manual. The AREMA Communications and Signals Manual illustrates, at Part 8.1.30, figure 8130.1, a bond wire positioned on the rail head directly above a joint bar. Although ERICO’s application standard for exothermic welds states that a weld should never be applied over a location that contains an earlier weld, unless the weld is within the confines of a joint bar, the company’s Cadweld instructions did not include reference to the placement of bond welds in relation to joint bars. ERICO’s Cadweld preparation instructions for rail web bonds did not contain the rail-drying requirement found in its Cadweld preparation instructions for rail head bonds, even though both applications require the same pre-weld preparation. ERICO’s Cadweld rail web bond preparation instructions did not contain a requirement that molds be clean and dry, although ERICO provides such a requirement in its preparation instructions for bonds at rail heads.

Factual Information 18 Railroad Accident Report Interaction Between Track Structure and Exothermic Welds After the Tamaroa accident, ERICO evaluated the interaction between the track structure and exothermic bond wire welding. This evaluation included developing a description of engineering facts on exothermic bonds applied to rail and a spreadsheet comparative analysis of track operating loads and stresses based on known track conditions. The company noted that railroad operational conditions have changed over the years and stated that two conditions in particular⎯increased axle loads and the introduction of CWR⎯have raised rail stress levels. The company stated that the introduction of CWR has become the most significant stress component because the increased tensile loading that occurs during cold weather is greater in CWR than in jointed rail. As noted in its May 10, 1999, letter to CN, ERICO states that for design safety, exothermic welded wire bonds outside the confines of joint bars should be applied only to the neutral axis of the rail web. It further states that bonds made in rail between joint bars should be made at the center of the rail head. These are normally the locations of lowest combined stress. ERICO submitted to the Safety Board the results from a finite element analysis.29 The company determined that the highest tensile stresses are in that portion of a rail head just outside the confines of joint bars. The higher stresses are caused by the change in rail stiffness from the additional steel in the joint bar. ERICO contends that this stress condition, combined with uneven tie support and thermal and other stresses, make the portion of a rail head just outside the confines of joint bars a likely site for the initiation of fatigue cracking. CN Experience with Exothermic Bond Wire Welding The CN division engineer stated: We had noticed some [rail] breakage on areas that we have either base-bonded or head-bonded with Cadweld bond … and we have looked at a couple of different methods, and one method that we looked [at] … was welding to the web, as close to the neutral as you can get it, or going to what is a newer procedure, pin brazing. So in November …, I instructed the managers of the signals communication to have his people start going to Cadweld bond on the web and … to purchase pin- brazing outfits …. On November 7, 2002, in response to some previous rail failures, the CN division manager of signals and communication for the Gulf Division issued a maintenance bulletin directing that the practice of applying rail bonds to the head or the base of the rail be stopped immediately. Further instructions required that all bonding be done on the neutral axis of the rail with the use of pin-brazing kits. The division engineer added that bonding onto the rail web was required for specialty track work near switches, signals, and grade crossings. He also stated that he 29 Finite element analysis is the simulation of a physical system (geometry and loading environment) by a mathematical approximation of the real system. Using interrelated building blocks called elements, a real system with infinite unknowns is approximated with a finite number of unknowns.

Factual Information 19 Railroad Accident Report believed that martensite was the cause of previous rail breakage. He said CN had done some testing at the interface between the bond and the parent rail material and had discovered martensite. The division engineer also stated that ATRONA Metallurgical Services, Inc., conducted a metallurgical weld analysis on a previous CN Cadweld rail failure. ATRONA concluded: Welding heated the local welded regions of the surface of the base metal to temperatures above 1400º F and changed the pearlitic/ferritic original base metal’s microstructure to predominantly martensitic. This was possible because the local welded surfaces were not pre-heated prior to welding or were not pre-heated to a high enough temperature. The relatively large mass of the rail effectively quenched the near melted and melted surface and solidified these surfaces very rapidly causing hardness to be dramatically increased. The division engineer stated that internal rail testing on the CN system showed that 327 rail defects (usually cracks) had been caused by exothermic bond wire welding between January 1, 2000, and December 31, 2003. A total of 63,849 internal rail defects were recorded over the same period. CN was able to retrieve the number of exothermic bond wire welding rail defects because CN maintains a specific code for this type of defect in its database. However, service failure records did not specify which, if any, failures had occurred at the site of bond wire welds. For example, CN would not have recorded the St. Johns rail failure as a rail failure caused by exothermic bond wire welding, even though the investigation showed that this was the cause of the failure. In the early 1990s, CN management became concerned about the traces of martensite found in the heat-affected zones at bond points. These concerns led to the testing of exothermic bond wire welds installed on the Alberta District portions of the Edison and Wainwright Subdivisions since March 1992 (Service Test MR-9210). Service Test MR-9210 restricted application of exothermic connections to the neutral axis of the rail to avoid the higher stress areas in the rail head and base. The exothermic bond wire welding on the web of the rail was made during the period between March 1992 and July 1994 (before the purchase of the Illinois Central Railroad by CN). Based on the test results, on October 7, 1994, CN restricted the use of exothermic bond wire welds to applications not involving rail joints. Engineering personnel of the Illinois Central said they were not made aware of the CN test results or restrictions after the 1999 merger of the two railroads. Tests and Research Tamaroa Rail and Joint Bars Seven pieces of rail and six joint bars (two joint bars from each end of the rail plug and two from the insulated joint) were recovered from the accident site and transported to the Safety Board Materials Laboratory in Washington, D.C., for metallurgical

Factual Information 20 Railroad Accident Report examination. Representatives from CN, the FRA, Rocky Mountain Steel (the rail manufacturer), L. B. Foster Company (the insulated joint plug manufacturer), and ERICO (the exothermic bond wire welding system manufacturer) were present during the laboratory examination. The rail specimens were identified as having come from the point of derailment at milepost 279.95. A preliminary examination and matching of fracture faces determined the location of the received pieces in the assembled insulated joint. As the track was laid in a north/south direction, the north and south ends of the rail were identified. Fracture features on the broken rail indicated that the various fractures in the rail pieces initiated from two separate locations in the head of the rail, one location just outside each end of the joint bars at the insulated joint. The cracking from each origin area separated into multiple branches, and some pieces away from the origin areas were not recovered. Detailed examination revealed the presence of fatigue cracking at both of the fracture origin areas. The fatigue cracking initiated from bond wire welds on the field side of the rail head and propagated from the field side toward the gage side of the head. Although the exact extent of the fatigue regions could not be determined, most of the fracture features in the rail head and the web and base portions of the rails were consistent with overstress fracture in these regions. Examination of the broken field side joint bar at the south end of the insulated joint plug showed that the joint bar fractured primarily due to overstress, originating from a small fatigue crack at the bottom of the bar. No evidence of any type of defect was noted at the fatigue origin area. The gage side joint bar at the south end of the insulated joint was intact but slightly bent. Tamaroa Signal Bond Wires and Welds Visual examination showed that the eight bond wire welds in the insulated joint assembly30 contained varying degrees of porosity. Sectioning of the bond wire welds as part of the Materials Laboratory examinations revealed three welds with a single heat- affected zone below all the weld material, three welds with two heat-affected zones below the weld material, one weld with a heat-affected zone below only a portion of the weld material, and one weld that was missing most of the weld material and had a single heat- affected zone that was split by a fracture. The maximum depth of the heat-affected zones varied between 0.032 inch and 0.058 inch. Some of the welds also displayed a loss of weld material, a loss of portions of the heat-affected zone at the weld/rail interface, and cracks propagating within the heat-affected zones. Both of the fatigue origin areas were at welds on the side of the rail head. Portions of the heat-affected zones were missing from these two welds. The shape of the missing portions matched the shape of the cracks observed within other heat-affected zones. The extra etching required to reveal the microstructure of 30 At the same time the welder placed the three welds on either side of the insulated joint, he also welded bond wires at the ends of the plug to provide continuity between the new plug rail and the existing rail. The insulated joint plug thus had a total of eight bond wire welds.

Factual Information 21 Railroad Accident Report the heat-affected zones, the microstructure of the heat-affected zones, and the hardness in the heat-affected zones⎯in the 60 to 66 HRC31 range⎯indicate that the heat-affected zones were hard and brittle and consisted mostly of untempered martensite. In comparison, a high-speed steel, designated “M2” and used to produce metal cutting tools, has a hardness of 63 to 65 HRC, and untempered martensite in a steel with 0.80 percent carbon (such as the rail in this accident) is about 67 HRC.32 Demonstration Cadweld Welds Many iron-based alloys that are brought to a high temperature then quenched (quickly cooled) become hard but brittle. Reheating the same metal to a lower temperature “tempers” it, making it slightly less hard but much less brittle. Cadweld literature describes this two-step process of quenching and reheating and states that Cadweld exothermic welding (which has no reheating step) produces a quenched and tempered thermal cycle that reduces the material’s hardness and increases its toughness. The literature suggests that the tempering is produced by two possible sources, (1) the flow of heat from the very hot weld nugget to the rail or (2) the relatively slow rate of cooling of the martensitic layer. The process literature states that “while the degree of tempering … is not large, it is sufficiently high to reduce the brittleness ….” After the accident, under controlled laboratory conditions, a representative from ERICO applied three Cadweld exothermic bond welds to the head of a rail.33 The rail and mold were preheated as specified, and the resultant welds were of a uniform shape. Sectioning of these welds showed a distinct lack of porosity and that two of the three welds displayed a significant heat-affected zone below the weld material, while one displayed a heat-affected zone below about 50 percent of the weld material. The extra etching required to bring out the structure in the heat-affected zones and their high hardness—in the same 60 to 66 HRC range as the insulated joint welds—were consistent with untempered martensite. The maximum depth of the heat-affected zones was between 0.037 inch and 0.043 inch, which was similar to the size of the heat-affected zones in the Tamaroa bond wire welds. St. Johns Rail Fracture The Safety Board’s Materials Laboratory examined the three St. Johns rail bond wire welds. All were at the top of the rail base, which, like the rail head, is a highly stressed portion of the rail. The rail fracture was found to have been caused by fatigue cracking that initiated in the bond wire weld closest to the end of the joint bar. Sectioning of this weld showed the presence of a heat-affected zone from a previous weld location (a re-bond). The heat input associated with the second weld apparently tempered a portion of the untempered martensite associated with the original weld. The fatigue cracking that led to the rail fracture initiated at the toe of the brittle heat-affected zone associated with the more recent weld and propagated perpendicularly through the tempered heat-affected zone into the rail base. The orientation of this weld was transverse to the rail and to the other 31 Hardness, Rockwell “C” scale. 32 Metals Handbook, Desk Edition, 1985, p. 29-9, Figure 4. 33 A section of the rail from the insulated plug involved in the accident was used for this test.

Factual Information 22 Railroad Accident Report two welds. The microstructure of the heat-affected zones beneath the other welds was consistent with untempered martensite. All the St. Johns welds displayed severe porosity and dissimilar heat-affected zones. The proportions of the St. Johns welds suggest that they were made with a mold that was different from the mold used for the previously examined Tamaroa welds. Postaccident Developments On February 19, 2003, the CN division manager issued a maintenance bulletin giving details about bond wire welding. The maintenance bulletin stated, in part: The suspected cause of the recent derailment on the Centralia Subdivision is a Cadweld bond to the head of the rail at a glued insulated joint location. Therefore effective immediately, Cadweld bonds will only be applied to the web of the rail. The only exceptions are as follows. One is in jointed rail territory where head to head bonds may be used as the joint bars provide a degree of broken rail protection. The other exception is in special track work components such as the heel of a frog. In these circumstances it is recommended that the Division Manager of S&C be consulted. Due to the undesirable microstructure (martensite) left by Cadweld bonding, it is highly recommended that each Division make plans to migrate as soon as possible from Cadweld bonding towards pin brazing. Since the issuance of the February 19, 2003, maintenance bulletin, CN has used only the pin-brazing process. As has been noted in the report, an Allegheny insulated rail joint at St. Johns (milepost 285.5), similar to the one in the Tamaroa derailment area, had been installed on January 23, 2003, and the signal bond wires were exothermically welded on the rail head, contrary to the November 7, 2002, maintenance bulletin that had prohibited the practice. On February 19, 2003, Safety Board investigators informed the CN track supervisor of the similarities between the insulated joint at Tamaroa that appeared to have failed and the one at St. Johns. The CN track supervisor told investigators that he would have the insulated joint changed out, and it was replaced on February 27, 2003. The bond wires were pin brazed onto the web of the replacement rail at or near the neutral axis. Environmental Response The leaking tank cars discharged methanol, vinyl chloride, formaldehyde, and hydrochloric acid. Remediation activities consisted of open excavation, removal of contaminated soil, and groundwater investigation. Six groundwater-monitoring wells were installed to monitor possible transient migration of the spill contaminants though the soil. Several shallow residential wells also were monitored. No contaminants related to the derailment were detected through any of the monitoring efforts.

23 Railroad Accident Report Analysis The Accident CN train M33371 was a regularly scheduled northbound freight train. There was nothing remarkable about the train makeup, which at the time of the derailment was 2 locomotives, 76 loaded cars, and 32 empties. As the train approached Tamaroa on the morning of February 9, 2003, the crew was operating the train at a recorded speed of 40 mph, about 10 mph below the maximum authorized speed of 50 mph. Without warning, shortly after 9:00 a.m., the 28th through 49th cars in the train derailed, and the train emergency brakes automatically applied. When the train crew realized that the train had derailed, they quickly notified the train dispatcher that the derailed train contained hazardous materials, and that some material had been released and started a fire. State and local emergency response organizations arrived at the scene quickly and provided timely and effective response actions. Because of the derailment of 19 hazardous materials cars, about 850 residents were evacuated from the area within a radius of 3 miles around the derailment, which included the entire village of Tamaroa. The Safety Board concludes that the response to the accident by emergency personnel and the train crew was timely and effective, and enhanced the safety of the community. Investigators studied and excavated the footprint of the derailment and determined that the point of derailment was on the east rail of the main track of an Allegheny insulated joint plug at milepost 279.95. Track Condition and Maintenance The point of derailment was characterized by at least two CN track maintenance employees as an area that was “pumping” mud. As long as the track movement that caused the pumping did not exceed the dimensions set forth in 49 CFR 213.63, “Track Surface,” track inspectors would not record a track surface defect for this condition. In addition, postaccident measurements did not reflect a track surface defect at or approaching the point of derailment. But mud pumping would indicate that the track bed, ballast, and ties were not fully supporting the track structure under load. Without this support, the rail would be subject to significant flexing with each passage of a train, and this flexing would greatly increase the stress on the rail. The Safety Board concludes that the known soft ballast condition in the area of the insulated joint increased the amount of rail flexing in that area which, in turn, significantly increased stresses in the rail.

Analysis 24 Railroad Accident Report The Gulf Division engineer determined that some past rail failures on the division had been caused by untempered martensite created by Cadweld exothermic bond wire welding at the rail base and rail head. In response to this finding, the division signals manager, on November 7, 2002, issued instructions that, for work typical of the insulated joint plug installation at Tamaroa, signal bond wires were to be welded only at the neutral axis of the rail web. Signal maintenance employees were told to use Cadweld equipment to weld the wires to the web until new pin-brazing equipment was purchased. In January 2003, insulated joint plugs were replaced at Tamaroa and St. Johns. At that time, not all CN signal maintenance employees had been provided with the correct equipment, either for Cadweld welding to the rail web or for pin brazing. When the bond wire welding was conducted at Tamaroa and St. Johns (for the replacement plug), the signal inspector was instructed to use what he had available. Because he did not have the equipment necessary to place welds at the neutral axis of the rail, he was authorized by his supervisor to exothermically weld the bond wires to the head of the rail at both locations. The Safety Board therefore concludes that the placement of the bond wire welds at Tamaroa, which was authorized by a CN signals supervisor, was not in accordance with the company’s exothermic bond wire welding policy that had been promulgated 2 months before. Rail Failure Laboratory examination of the rail from the area of the derailment revealed the presence of untempered martensite at the weld points for the signal bond wires. These weld points were thus hard and brittle, and their presence on the rail head⎯a high-stress area⎯likely contributed to the development of fatigue cracking at those sites. The Safety Board concludes that fatigue cracks developed in the rail from areas of untempered martensite at points where bond wires had been exothermically welded to the rail head. The fatigue cracking was likely accelerated by abnormal flexing of the rail under load as a result of inadequate underlying track support. The likelihood of such abnormal flexing was indicated by a CN signal maintainer’s statements that, under wet conditions, mud would be pumped from underneath the joint and splashed onto nearby signal equipment. This suggests that during the passage of a train’s wheels, the track would flex downward, then spring back after passage of the wheels, then flex downward again as the next set of wheels loaded the joint. Thus, as a train passed over the joint, any mud and water on the track bed would alternately be drawn into and then discharged from the depressions under the ties. The fatigue cracking on both sides of the insulated joint and the fatigue cracking of the field side joint bar at the south end of the joint plug found during the postaccident inspection suggest significant rail flexing at the joint. The Safety Board concludes that the increased stresses due to the flexing of the rail in the area of the insulated joint caused the propagation of the cracks that had originated in areas of untempered martensite at the rail head, causing the rail to fail only 17 days after installation.

Analysis 25 Railroad Accident Report Examination of Welding Procedure Documents A review of ERICO guidance documents applicable to bond welds revealed some omissions and contradictions that, if the instructions in these documents were used to direct the welding process, could affect the integrity of the weld or the steel at the weld site. For example, effective bond welding requires that the rail be dried before application of the bond wires. However, ERICO’s Cadweld preparation instructions for rail web bonds did not contain the rail-drying requirement found in its Cadweld preparation instructions for rail head bonds, even though both applications require the same pre-weld preparation. AREMA’s Communications and Signals Manual, Part 8.6.40, Section C5, also recommends that bonding not be performed when moisture or lubricants are present on the molds, weld metal, or rail surface. Further, ERICO’s Cadweld rail web bond preparation instructions did not contain a requirement that molds be clean and dry, although ERICO provides such a requirement in its preparation instructions for bonds at rail heads, and such a requirement is appropriate for all applications. To reduce stresses in the weld areas, bond welds at the rail head must be placed above the joint bars. The Cadweld rail head bond instructions, however, illustrate the fixture on a rail head without any reference to the joint bars. In contrast, the AREMA Communications and Signals Manual, at Part 8.1.30, figure 8130.1, properly illustrates a bond wire positioned on a rail head directly above a joint bar. Thus, the Safety Board concludes that ERICO’s exothermic bond wire welding application literature was not entirely consistent with recommended industry practices. ERICO’s Cadweld instructions did not warn against placing a rail head bond outside the confines of a joint bar, despite the fact that ERICO’s own May 10, 1999, list of items to include in AREMA guidance included the statement that “bonds are to be exothermically welded to the head of the rail only within the confines or limits of the splice plate or joint bars.” ERICO’s Cadweld instructions also did not specifically warn against putting a bond weld outside the confines of the joint bar on the rail base, although in its May 10, 1999, guidance to AREMA, ERICO stated that “bonds welded to the rail outside the confines of the splice plate or joint bars shall be welded to the web of the rail at the neutral axis.” (In the case of the broken St. Johns insulated joint plug that was replaced in January 2003, the exothermic bond wire welds were made both outside the confines of the joint bar and on the rail base with equipment supplied by ERICO.) The Safety Board’s document review also revealed that some ERICO guidance literature contained statements that were proven inaccurate by the results of the demonstration welds that ERICO made as part of the accident investigation. Specifically, although the Cadweld process literature stated that the Cadweld process produces a quenched and tempered thermal cycle that tempers the steel and reduces its hardness sufficiently to result in reduced brittleness, Safety Board examination of eight bond wire welds from Tamaroa and three welds from St. Johns found heat-affected zones with structures consistent with untempered martensite. Analysis of a failed CN Cadweld weld

Analysis 26 Railroad Accident Report performed for CN by a metallurgical testing laboratory also revealed an untempered martensitic structure beneath the weld. Finally, the hardness of the heat-affected zones in the demonstration welds that ERICO produced for the Safety Board was found to be near the maximum hardness associated with untempered martensite. The Safety Board therefore concludes that laboratory tests and examination of field welds indicate that little or no tempering of the affected steel occurs during the exothermic welding process. A re- bonded weld on the St. Johns rail did show a reduction in hardness and therefore a tempered martensite structure, suggesting that only a second heating process will truly temper the steels at exothermic welds. At Chapter 4, “Rail,” Part 4, Section 4.1, “Application of Rail Bonds,” the AREMA Railroad Engineering Manual states: The application of pin connected bonds or welded bonds to the outer side of the rail head, within the limits of the joint bars for standard bonding and outside the joint bars for special work where not practicable to apply them within the joint bar limits, is good practice. But, as can be seen in the Tamaroa accident, placing welds on the rail head at locations outside joint bars is never good practice. Untempered martensite at such locations may create fatigue cracking that can propagate especially rapidly if, as at Tamaroa, track conditions allow greater-than-normal rail flexing. On May 10, 1999, ERICO sent AREMA recommendations for proper exothermic bond wire welding for inclusion in the AREMA Railroad Engineering Manual. Two of ERICO’s recommendations addressed placement of the welds. First, ERICO stated that exothermic bond wire welded connections should only be placed on the rail head within the confines or limits of the joint bars. Second, ERICO stated that exothermic bond wire welded connections required outside of the joint bars should be welded to the rail web at the neutral axis. AREMA has not yet revised its manual to include this guidance. Therefore, the Safety Board concludes that the AREMA Railroad Engineering Manual does not adequately address the proper placement of exothermic bond wire welds. Therefore, the Safety Board believes that ERICO should revise the instructions for its Cadweld welding systems to address the proper placement of exothermic bond wire welds, especially in the vicinity of joint bars, and to make users aware that these welds create untempered martensite that could, under certain conditions, lead to fatigue cracking and rail failure. The Safety Board further believes that AREMA should modify its Railroad Engineering Manual and/or its Communications and Signals Manual so both address the proper placement of exothermic bond wire welds and high-temperature pin- brazings and to include information that these welds and brazings create untempered martensite that could, under certain conditions, lead to fatigue cracking and rail failure.

Analysis 27 Railroad Accident Report Rail Failure Tracking Reviewing its internal rail inspections for a 3-year period, CN found that 327 rail defects (0.5 percent of all CN rail defects)34 on its system had been caused by exothermic bond wire welding. However, CN did not track the rail service failures that such welding may have caused. CN reported the rail service failure at Tamaroa (which caused the derailment) to the FRA under a catch-all code of “Other” rail failures. The size and extent of the exothermic bond wire welding rail defect problem throughout the railroad industry cannot be evaluated, because most railroads and the FRA do not record which rail defects or rail service failures may have resulted from exothermic bond wire welding. Some railroads have stopped performing exothermic welding at the rail web because they were detecting internal rail defects caused by the weld. The Safety Board concludes that because most current rail failure tracking methods do not record the cause of rail failures that may have occurred at locations where bond wires have been welded or brazed, no adequate evaluation can be made of the effects of these welds on rail integrity in the U.S. rail system. Therefore, to permit an evaluation of the effects of exothermic bond wire welding on rail integrity across the U.S. rail system, the Safety Board believes that the FRA should require in 49 CFR Part 213, “Track Safety Standards,” that rail cracks originating from bond wire attachments be identified as rail defects and that information be collected on the methods and locations of those attachments. The Safety Board further believes that the FRA should require in 49 CFR Part 225, “Guide for Preparing Accident/Incident Reports,” that derailments caused by rail cracks originating from bond wire attachments be reported with a specific cause code and that information on the methods and locations of those attachments be provided in the accident narrative. Tank Car Survivability In this accident, five tank cars containing vinyl chloride, a highly flammable and reactive gas, derailed. These cars were all pressure tank cars that had head shields and thicker tank walls than general service cars. Only one of the pressure tank cars was breached, the result of a relatively small puncture that likely occurred when the car struck the elevated end of a broken rail. Because of the speed of the derailing car and the small impact area, the tank was subjected to a concentrated force that the tank would not be expected to withstand. Of the 14 general service tank cars that derailed, 7 failed. The failed cars contained materials that are rated less hazardous than the vinyl chloride carried in the pressure cars. Two tank cars leaked flammable liquids (methanol and formaldehyde) through damaged fittings. Four tank cars had punctures or tears in their heads or sidewalls, releasing flammable or corrosive liquids (methanol and hydrochloric acid, respectively). The 34 These were defects that were corrected before they led to failures.

Analysis 28 Railroad Accident Report remaining tank car lost product through a compromised section of the shell. This damage likely occurred as a result of heat from the post-derailment fire that melted a portion of the tank’s interior rubber liner and subjected the steel shell to the corrosive effects of the acid. As a result of accident investigations and Safety Board safety recommendations, the DOT issued regulations requiring shelf couplers and head shields to reduce punctures on tank cars transporting liquefied flammable gases and anhydrous ammonia (a toxic nonflammable liquefied gas). In 1995, also as a result of safety recommendations, the DOT issued tank head puncture-resistance requirements for tank cars transporting any liquefied gas and tank cars constructed of aluminum or nickel and used to transport hazardous materials. Additionally, commencing in July 2006, certain other high-risk hazardous materials, such as those that are poisonous-by-inhalation or designated by the Environmental Protection Agency to pose unusual environmental and health risks, will have to be transported in pressure tank cars that perform better in accidents than general service tank cars that are authorized today.

29 Railroad Accident Report Conclusions Findings 1. The response to the accident by emergency personnel and the train crew was timely and effective, and enhanced the safety of the community. 2. Fatigue cracks developed in the rail from areas of untempered martensite at points where bond wires had been exothermically welded to the rail head. 3. The placement of the bond wire welds at Tamaroa, which was authorized by a Canadian National signals supervisor, was not in accordance with the company’s exothermic bond wire welding policy that had been promulgated 2 months before. 4. The known soft ballast condition in the area of the insulated joint increased the amount of rail flexing in that area which, in turn, significantly increased stresses in the rail. 5. The increased stresses due to the flexing of the rail in the area of the insulated joint caused the propagation of the cracks that had originated in areas of untempered martensite at the rail head, causing the rail to fail only 17 days after installation. 6. ERICO Products, Inc., exothermic bond wire welding application literature was not entirely consistent with recommended industry practices. 7. Laboratory tests and examination of field welds indicate that little or no tempering of the affected steel occurs during the exothermic welding process. 8. The American Railway Engineering and Maintenance-of-Way Association Manual for Railway Engineering does not adequately address the proper placement of bond wire welds. 9. Because most current rail failure tracking methods do not record the cause of rail failures that may have occurred at locations where bond wires have been welded or brazed, no adequate evaluation can be made of the effects of these welds on rail integrity in the U.S. rail system. Probable Cause The National Transportation Safety Board determines that the probable cause of the February 9, 2003, derailment of Canadian National train M33371 in Tamaroa, Illinois, was Canadian National’s placement of bond wire welds on the head of the rail just outside the joint bars, where untempered martensite associated with the welds led to fatigue and subsequent cracking that, because of increased stresses associated with known soft ballast conditions, rapidly progressed to rail failure.

30 Railroad Accident Report Recommendations As a result of its investigation of the February 9, 2003, Canadian National freight train derailment at Tamaroa, Illinois, the National Transportation Safety Board makes the following safety recommendations:

To the Federal Railroad Administration: Require in 49 Code of Federal Regulations Part 213, “Track Safety Standards,” that rail cracks originating from bond wire attachments be identified as rail defects and that information be collected on the methods and locations of those attachments. (R-05-01) Require in 49 Code of Federal Regulations Part 225, “Guide for Preparing Accident/Incident Reports,” that derailments caused by rail cracks originating from bond wire attachments be reported with a specific cause code and that information on the methods and locations of those attachments be provided in the accident narrative. (R-05-02) To ERICO Products, Inc.: Revise the instructions for your Cadweld welding systems to address the proper placement of exothermic bond wire welds, especially in the vicinity of joint bars, and to make users aware that these welds create untempered martensite that could, under certain conditions, lead to fatigue cracking and rail failure. (R-05-03) To the American Railway Engineering and Maintenance-of-Way Association: Modify your Railroad Engineering Manual and/or your Communications and Signals Manual so both address the proper placement of exothermic bond wire welds and high-temperature pin-brazings and to include information that these welds and brazings create untempered martensite that could, under certain conditions, lead to fatigue cracking and rail failure. (R-05-04)

Recommendations 31 Railroad Accident Report BY THE NATIONAL TRANSPORTATION SAFETY BOARD ELLEN ENGLEMAN CONNERS CAROL J. CARMODY Chairman Member MARK V. ROSENKER RICHARD F. HEALING Vice Chairman Member DEBORAH A. P. HERSMAN Member Adopted: January 25, 2005

this page intentionally left blank

33 Railroad Accident Report Appendix A Investigation The Safety Board was notified about 11:00 a.m. eastern standard time on Sunday, February 9, 2003, that a Canadian National/Illinois Central Railroad (as the Canadian National Railroad was then known) freight train had derailed and subsequently released hazardous materials that required the evacuation of residents of Tamaroa, Illinois. The Safety Board launched an accident investigation team to the site. The team included investigators for multiple disciplines: an investigator for operations and mechanical; an investigator for track, signals, and engineering; and an investigator for hazardous materials. Investigators from vehicle performance, hazardous material environmental response, and metallurgical analysis supported the continuing investigation in Washington, D.C. No Board Member was on scene. Parties to the investigation included the Federal Railroad Administration, the Canadian National Railroad, the Brotherhood of Locomotive Engineers, and ERICO Products, Inc. The Safety Board conducted interviews as part of its investigation. The interviews were held during the on-scene segment of the investigation, and more interviews were conducted at Canadian National’s U.S. region headquarters in Homewood, Illinois, and at Safety Board headquarters in Washington, D.C.

this page intentionally left blank

FD07281 ｜ 2003_美国_RAR0301.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2003 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Collision of Two Burlington Northern Santa Fe Freight Trains Near Clarendon, Texas May 28, 2002 Railroad Accident Report NTSB/RAR-03/01 PB2003-916301 Notation 7558 National Transportation Safety Board Washington, D.C.

this page intentionally left blank

Railroad Accident Report Collision of Two Burlington Northern Santa Fe Freight Trains Near Clarendon, Texas May 28, 2002 NTSB/RAR-03/01 PB2003-916301 National Transportation Safety Board Notation 7558 490 L’Enfant Plaza, S.W. Adopted June 3, 2003 Washington, D.C. 20594

National Transportation Safety Board. 2003. Collision of Two Burlington Northern Santa Fe Freight Trains Near Clarendon, Texas May 28, 2002. Railroad Accident Report NTSB/RAR-03/01. Washington, DC. Abstract: At 8:57 a.m., central daylight time, on May 28, 2002, an eastbound Burlington Northern Santa Fe (BNSF) coal train collided head on with a westbound BNSF intermodal train near Clarendon, Texas. Both trains had a crew of two, and all crewmembers jumped from their trains before the impact. The conductor and engineer of the coal train were critically injured. The conductor of the intermodal train received minor injuries; the engineer of the intermodal train was fatally injured. The collision resulted in a subsequent fire that damaged or destroyed several of the locomotives and other railroad equipment. Damages exceeded $8 million. As a result of its investigation of this accident, the Safety Board identified the following safety issues: the use of cell phones by railroad operating crews; the issuance to moving trains of track warrant authority that contains an “after-arrival” stipulation; and the lack of positive train control. As a result of its investigation of this accident, the National Transportation Safety Board makes recommendations to the Federal Railroad Administration and the General Code of Operating Rules Committee. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2003-916301 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Railroad Accident Report Contents Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Preaccident Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 The Collision . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Personnel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Coal Train Engineer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Coal Train Conductor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Intermodal Train Engineer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Intermodal Train Conductor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Train Dispatcher . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Train Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Track and Site Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Method of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Movement of Trains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Track Warrants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Toxicological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Actions of Coal Train Crew . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Cell Phone Use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Use of Cell Phones by Operating Employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Use of After-Arrival Track Warrants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 The Intermodal Train . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 The Coal Train . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Use of Cell Phones by Operating Employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Use of After-Arrival Authority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Positive Train Control Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Appendix A: Investigation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 B: Time Line of Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

v Railroad Accident Report Executive Summary At 8:57 a.m., central daylight time, on May 28, 2002, an eastbound Burlington Northern Santa Fe (BNSF) coal train collided head on with a westbound BNSF intermodal train near Clarendon, Texas. Both trains had a crew of two, and all crewmembers jumped from their trains before the impact. The conductor and engineer of the coal train were critically injured. The conductor of the intermodal train received minor injuries; the engineer of the intermodal train was fatally injured. The collision resulted in a subsequent fire that damaged or destroyed several of the locomotives and other railroad equipment. Damages exceeded $8 million. The National Transportation Safety Board determines that the probable cause of the May 28, 2002, collision at Clarendon, Texas, was (1) the coal train engineer’s use of a cell phone during the time he should have been attending to the requirements of the track warrant his train was operating under and (2) the unexplained failure of the conductor to ensure that the engineer complied with the track warrant restrictions. Contributing to the accident was the absence of a positive train control system that would have automatically stopped the coal train before it exceeded its authorized limits. As a result of its investigation of this accident, the Safety Board identified the following safety issues: • The use of cell phones by railroad operating crews; • The issuance to moving trains of track warrant authority that contains an “after-arrival” stipulation; and • The lack of positive train control. As a result of its investigation of this accident, the National Transportation Safety Board makes recommendations to the Federal Railroad Administration and the General Code of Operating Rules Committee.

1 Railroad Accident Report Factual Information Accident Synopsis At 8:57 a.m., central daylight time, on May 28, 2002, an eastbound Burlington Northern Santa Fe (BNSF) coal train collided head on with a westbound BNSF intermodal train near Clarendon, Texas. (See figure 1.) Both trains had a crew of two, and all crewmembers jumped from their trains before the impact. The conductor and engineer of the coal train received critical injuries. The conductor of the intermodal train received minor injuries; the engineer of the intermodal train was fatally injured. The collision resulted in a subsequent fire that damaged or destroyed several of the locomotives and other railroad equipment. Damages exceeded $8 million. Figure 1. Accident location. TEXAS OKLAHOMA N NEW MEXICO BNSF to Los Angeles Albuquerque Clovis Route of Intermodal Train Fort Worth Dallas BNSF to Points East Oklahoma City Route of Coal Train Clarendon Childress Amarillo BNSF to Powder River Basin Accident Site

Factual Information 2 Railroad Accident Report Accident Narrative Preaccident Events The engineer and conductor of the intermodal train1 went on duty at 6:45 a.m. in Childress, Texas, about 60 miles east of the accident location.2 The engineer and conductor of the coal train went on duty at 6:00 a.m. in Amarillo, Texas, about 55 miles west of the accident location. The coal train, with 116 cars of coal and headed by lead locomotive BNSF 8876,3 departed Amarillo at 7:40 a.m. The train operated eastward, entering track warrant control (TWC)4 territory several miles east of the yard area. Track warrant records indicate that the coal train received a track warrant to enter TWC territory at 7:47 a.m. The crew’s first track warrant was quickly followed by a second track warrant, which was issued5 to the coal train at 7:49 a.m. The second track warrant was an “after-arrival” warrant, which stipulated that the coal train was to wait at Malden Siding for the arrival of a specified train before proceeding beyond that point. As was common BNSF practice when heavy coal trains were to meet other, lighter, trains on this portion of the railroad, the coal train was to remain on the main track while the lighter train was diverted onto the siding. The coal train met the opposing westbound train at Malden Siding, as required. The meet took place from about 8:30 until 8:35, after which, in accordance with its track warrant, the coal train proceeded toward the east end of Ashtola Siding. Meanwhile, the westbound intermodal train (Engine BNSF 4385 West) was granted track warrant authority at 8:26 a.m. This track warrant was also an after-arrival warrant. The train was to proceed to Hedley Siding (see figure 2) where it was to await the arrival of Engine UP 5827 East. Once that train had passed on the adjacent track, the intermodal train’s track warrant authorized it to move on the main track from Hedley Siding to Ashtola Siding. At Ashtola, the intermodal train was to divert onto the siding to allow the coal train to pass on the main track. As instructed by the track warrant, the intermodal train waited for the passage of Engine UP 5827 East, after which the requirement of the track warrant was complete, and the intermodal train began moving westward toward Ashtola. 1 Intermodal trains have rail cars that are designed to handle piggyback trailers or containers. 2 See appendix B for a complete time line of accident events. 3 The General Code of Operating Rules uses the identification of the lead locomotive to formally identify a train for the purpose of issuing authority to occupy main tracks. The train identification also includes the train’s direction. Thus, the official identification of the coal train on track warrants (see note below) was “Engine BNSF 8876 East.” 4 In track warrant territory, train dispatchers control train movements by issuing track warrants, which authorize trains to occupy the section or sections of track covered by the warrant. (See the “Method of Operation” section of this report for more information.) 5 All of the train dispatcher’s communications of track warrants to the coal train were radioed to the conductor who, as required by operating rules, confirmed the information by reading back the warrant to the dispatcher.

Factual Information 3 Railroad Accident Report Figure 2. Operational diagram. West East Malden 304.5 MP Ashtola 288.6 MP Clarendon 275.7 MP Collision Location MP 280.1 Coal Train Intermodal Train Schematic view only-Not to scale Cell Phone Use 07:49 - Coal train authorized by Track Warrant 16 to the east switch at Ashtola. 08:35 - Intermodal Train departed Hedley Siding with Track Warrant 19 authorizing it to operate to Ashtola Siding and to enter the siding at the east switch. 08:43 - Coal Train authorized by Track Warrant 22 to proceed from Ashtola to Hedley, with the stipulation that the authorization was not in effect until after the arrival of the Intermodal Train at Ashtola Siding. 08:47 - Coal Train passed the east switch at Ashtola Siding without stoping. 08:57 - Collision occurred. 1 1 2 2 3 3 4 4 5 5 Time Of Events XXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Factual Information 4 Railroad Accident Report As the coal train neared Ashtola, at 8:43 a.m., the final track warrant, Track Warrant 22, was issued. This was also an after-arrival track warrant that covered the coal train’s movement between Ashtola Siding and Hedley Siding, about 25 miles away. This track warrant specified that the coal train was to hold short of the east end of Ashtola Siding until the arrival in the siding of Engine BNSF 4385 West (the intermodal train). The track warrant would become effective at that point. A review of the audiotapes of the dispatcher’s radio communications confirmed the content of the track warrant, which the conductor read back accurately to the dispatcher, including the stipulation that the track warrant was not in effect until after the arrival of Engine BNSF 4385 West at Ashtola. At the time this warrant was issued, the coal train was approximately 3.2 miles from the point at which it was to stop and wait and was traveling, according to event recorder data, about 48 mph. The Collision The investigation revealed that about the time the final track warrant was radioed to the coal train and read back by the conductor, the coal train engineer placed a call on his cell phone. The engineer was still on this call several minutes later as his train passed the east end of Ashtola Siding. The train should have stopped at this point to await the arrival of the intermodal train, in accordance with the train’s track warrant. Event recorder data indicated that the train was traveling about 48 mph at that time. Most of the BNSF Red River Valley Subdivision, where this accident occurred, is tangent track on modest cuts and fills through undulating territory. In many places, the visibility along tangent stretches of track can be measured in miles. There are curves, however, one of which is a 1°7' left-hand curve6 about 8 miles past the east end of the siding where the coal train should have stopped. After the coal train had traveled for about 9 1/2 minutes after passing the east end of the siding, the train’s conductor saw and alerted the engineer to the oncoming train as the intermodal train rounded the curve ahead. The engineer stated that he exited the rear door of the locomotive, followed by the conductor, and that he jumped from the rear steps. The conductor and engineer of the intermodal train also exited their locomotive and jumped from the walkway. Event recorder information indicates that both trains’ brakes were placed in emergency before the collision. At the time the coal train was placed in emergency, it was moving at 49 mph. The intermodal train was placed in emergency as it was moving at 42 mph with the throttle in the 8th notch (maximum power). An engineering survey commissioned by the BNSF indicates that the coal train went into emergency 1,093 feet before the collision point and that the intermodal train went into emergency 1,064 feet before the collision point. At the point of the collision, the coal train had traveled for almost 10 minutes and about 7.8 miles from the point where it should have waited for the arrival of the intermodal train. (See figures 3 and 4.) 6 This was a right-hand curve when viewed from the coal train.

Factual Information 5 Railroad Accident Report Figure 3. Wreckage of coal train. Figure 4. Wreckage of intermodal train.

Factual Information 6 Railroad Accident Report Emergency Response A witness who lived directly across from the point of the collision stated that she called 911 on her cell phone and that the 911 operator was apparently not aware of the accident. She noted that the time was 8:57. She said that a few minutes after the collision, she saw an “engineer guy”7 walking around and that he said that he was on the train that was going toward Amarillo. The individual appeared to be in shock, and he had been calling for someone else; the witness said she thought that he was probably calling for another crewmember. Records indicate that the first emergency call to Clarendon emergency medical services was placed at 8:57 a.m. and that the first rescue workers reached the scene at 9:03 a.m. Another ambulance was called at 9:03 and was on scene at 9:06. The engineer of the intermodal train was found dead at the scene. All of the injured employees were taken to Northwest Texas Healthcare System, a hospital in Amarillo. Lifestar, a medical helicopter based at Northwest Texas Healthcare System, was used to transport the conductor of the coal train. The engineer of the coal train and the conductor of the intermodal train were transported by ambulance a short time later. The Clarendon Fire Department is staffed by 37 volunteers. The assistant chief of the Clarendon Fire Department indicated that multiple 911 calls and other non-911 calls alerted firefighters to the accident. The first call to the fire department was at 8:59 a.m. The first two fire department units to arrive were on scene at 9:05 and 9:06 a.m. The assistant chief stated that the fire was large and was concentrated in the area of fuel that had spilled from the locomotives. Other fire department units arrived from surrounding communities, and a foam truck arrived from Pampa, Texas, a city about 47 miles away. Rescue workers found the body of the intermodal train engineer adjacent to the track on the north side of the wreckage beneath wreckage debris. The first BNSF supervisor to reach the scene arrived about 10:30 a.m. A highway worker said he was about 1 mile west of the point of the collision and was looking at the coal train as it passed him. He said he heard the train go into emergency, and as he watched, he saw a fireball rise into the sky. He and a coworker rushed to the scene and took part in the rescue efforts. His highway maintenance truck carried shovels that rescue workers used to dig out the coal train conductor, who was partially buried in coal near the fire. The assistant fire chief stated that the BNSF had trained with his department about 2 months before the accident and that he considered the BNSF’s training to be helpful. The BNSF’s safety program instructed firefighters on the basic safety concerns at a railroad accident scene, including the location of personnel aboard trains, railroad nomenclature, and hazards that may be found near a railroad accident. The assistant chief said that his department drills twice a month and that 50 percent of his volunteers are certified, as required by the State. 7 This employee was the conductor of the intermodal train.

Factual Information 7 Railroad Accident Report Injuries The coal train engineer received critical injuries. The conductor of the coal train was struck by the debris of the derailing equipment of his train and partially buried in coal. He received critical injuries and required extensive hospitalization and rehabilitation. Although the intermodal train conductor received minor injuries, the engineer of the intermodal train was fatally injured when he was struck by the derailing equipment. Damage The postcollision fire consumed most of the combustible material in both locomotive cabs. The first six platforms of the intermodal train were also damaged by fire.8 Both locomotives at the head end of the coal train were derailed. The coal train’s lead locomotive was destroyed. In addition to being damaged by fire, the cab section was separated from the frame and crushed into an unrecognizable shape. The second locomotive was also severely damaged. The first 23 cars of the coal train were derailed and destroyed. The distributed power locomotive at the rear of the coal train was not damaged. The two locomotives of the intermodal train were derailed; the lead locomotive was destroyed. The first four intermodal cars, a total of 12 double-stack platforms, were also derailed. The first 3 intermodal cars, each with 3 double-stack platforms, were destroyed, along with the 18 loaded containers that were carried on these cars. The cost of the collision included: Equipment $6,401,192 Lading 427,000 Track 331,189 Environmental cleanup 202,765 Wreck clearing 763,506 Total $8,125,652 Personnel Information Coal Train Engineer The coal train engineer, 51, was hired by the Fort Worth & Denver Railroad on April 10, 1973, in Amarillo as a clerk-operator. In August 1975, he became a staff assistant to the general manager and moved to Fort Worth. He returned to Amarillo to begin training as a locomotive engineer in April 1976 and has an engineer’s seniority date 8 Each railcar can provide one to five platforms. Depending on the size and configuration, each platform can hold one to four containers.

Factual Information 8 Railroad Accident Report of November 8, 1976. He was certified as a locomotive engineer and was listed as having attended a rules examination on October 16, 2001, and a prior rules examination on March 2, 1999. His record includes numerous training and rules classes since 1992. Coal Train Conductor The coal train conductor, 57, began his railroad career on May 26, 1966. His entire railroad career has been with the BNSF or predecessor roads. His last rules class was in 2001, and he had attended a safety meeting on the Wednesday before the accident. Intermodal Train Engineer The intermodal train engineer, 61, was fatally injured as a result of the collision. He had been hired by the railroad as a trainman on June 3, 1959, and had resigned on May 7, 1974. He was reemployed as a trainman on January 31, 1975, and that date is shown as his official hire date. He entered engine service on May 1, 1997. The engineer was listed as having attended a rules examination on December 2, 2001, and a prior rules examination on October 10, 1998. He was certified as a locomotive engineer. His record includes numerous training and rules classes since 1992. Intermodal Train Conductor The conductor of the intermodal train began his railroad career on July 1, 1996. Records show steady employment. The conductor had attended locomotive engineer training in 1998. His last rules class was on April 19, 2001, and he had attended a prior rules class on September 18, 1998. Train Dispatcher The train dispatcher, 57, began his railroad career in June 1970 when he was hired by the Fort Worth & Denver Railroad as a telegrapher. He began working as a clerk- operator in August 1971 and has been a train dispatcher since 1974. The dispatcher had worked as a dispatcher on the Red River Subdivision about 20 of the 28 years that he had worked as a dispatcher. His most recent rules class was on September 15, 2001. His territory includes the TWC territory from Estelline, Texas, to Amarillo as well as some centralized traffic control (CTC) territory north of Amarillo. Train Information The coal train was designated C-RWMOKO0-68A and was a typical coal train that the BNSF originates from the Powder River Basin. The train consisted of 116 cars of bituminous coal that were consigned to a power plant in Oklaunion, Texas. The gross weight of the train was 15,483 tons, giving an average of 133.5 tons per car. All cars were

Factual Information 9 Railroad Accident Report made of aluminum and were designed to be emptied in a rotary dumper. Including the locomotives, the train was 6,380 feet long and had 482 axles. Three locomotives powered the coal train, two on the head end and one on the rear. Rear locomotives, operated by distributed power from the lead locomotive, are used to improve train handling and reduce in-train forces. Records indicate that all locomotives had received their 92-day inspections. The crew noted no problems with the locomotives. Federal regulations require that railroad freight equipment be inspected a minimum of every 1,000 miles. Amarillo is a common inspection point for coal trains that originate in the Powder River Basin and move eastward across Texas. After the coal train arrived and before the accident crew departed, the coal train received the 1,000-mile inspection. During the inspection, a mechanical defect was discovered on one car, which was set out of the train by the accident crew before departure. The intermodal train was made up of double stack container equipment. It had a gross weight of 5,545 tons and was powered by two locomotives. Both locomotives had received their 92-day inspections in April 2002. The train was made up of 34 railcars with 77 platforms and carried 169 containers and 11 truck trailers. Four containers were listed as carrying hazardous materials. The total train length was 7,033 feet. Track and Site Information The collision occurred about 3 miles west of Clarendon, a farming and ranching town about 58 miles east of Amarillo. The single-track Red River Valley Subdivision passes through town in an east-west direction. In 1887, the Fort Worth and Denver City Railroad began constructing track in the area that would become Clarendon. This railroad evolved into the Fort Worth & Denver, then the Chicago Burlington & Quincy. A subsequent merger with the Northern Pacific and the Great Northern produced the Burlington Northern in 1970. In 1995, the Burlington Northern and the Santa Fe merged to form the BNSF Railway. The Red River Valley Subdivision stretches westward from Valley Junction, near Wichita Falls, Texas, to Amarillo, a distance of 217.3 miles. Milepost numbers increase westward. With slight and variable grades, the railroad rises from an elevation of about 1,000 feet near Wichita Falls to more than 3,600 feet in Amarillo. Railroad officials stated that the west end of the Red River Valley Subdivision was the busiest section of single- track non-signaled TWC railroad on the BNSF system. About 30 trains pass over this portion of the subdivision on an average day. The Union Pacific has trackage rights over the subdivision and operates two trains per day each way. No regularly scheduled passenger trains operate on the Red River Valley Subdivision. The collision occurred at milepost 280.1 on tangent track with an ascending grade of 1.05 percent eastward. At the point of the collision, the approximate first half of the eastbound coal train was ascending the 1.05-percent grade; the rear portion was on level

Factual Information 10 Railroad Accident Report track. The head end of the intermodal train had begun to descend the grade as the middle and rear portions were moving uphill on a grade that varied between 1.0 and 0.38 percent. The intermodal train had just rounded a left-hand curve that extended from milepost 279.91 to milepost 280.09. The single track was owned and maintained by the BNSF and had a maximum allowable operating speed of 49 mph for freight trains, a speed that requires the track structure to meet Federal Railroad Administration (FRA) standards for class 4 track. Postaccident inspection of the undamaged track in the area of the collision revealed no track conditions that would prohibit the track from meeting the requirements of class 4 track. There were two trackside warning detectors (TWD) near the accident area.9 The last TWD passed by the eastbound coal train was near Ashtola at milepost 294.0. The last TWD passed by the westbound intermodal train was near Clarendon at milepost 273.2. Event recorder systems in those TWDs recorded nothing unusual about either train. Method of Operation Movement of Trains The Red River Valley Subdivision is controlled from the BNSF operations center in Fort Worth. The eastern half of the subdivision, from Valley Junction to Estelline, is operated by CTC. In CTC territory, the train dispatcher controls wayside signals to authorize or restrict the movement of trains. Trains of the same direction are permitted to follow one another and are spaced automatically by the signal system. The train dispatcher arranges for trains operating in opposite directions to meet at sidings, where one train is routed onto the siding to allow the opposing train to pass. The western half of the subdivision, 99 miles from Estelline to Amarillo, is non- signaled TWC territory.10 The timetable speed for all trains is 60 mph in CTC territory and 49 mph in TWC territory. In TWC territory, track warrants are issued by the train dispatcher to authorize a train to occupy the main track within designated limits. Track warrant limits must be designated by exact points, such as switches, mileposts, and stations. 9 Trackside warning detectors are installed at various trackside locations to detect and report some or all of the following conditions: overheated journals, dragging equipment, excess dimensions, shifted loads, high water, and slides. 10 Some sections of the BNSF have signaled TWC, primarily in areas of double track. In such areas, it is common to have automatic block signals space trains that are moving in the same direction. The train dispatcher has no control over such signals, however, and a track warrant is required for trains to occupy the track.

Factual Information 11 Railroad Accident Report The BNSF uses the General Code of Operating Rules, Fourth Edition.11 The special instructions that were in effect at the time of the accident were BNSF System General Special Instructions No. 7, effective January 20, 2002. The most current timetable for the Red River Valley Subdivision at the time of the accident was the Texas Division Timetable No. 5, effective January 20, 2002. At the time of the accident, the sidings in the TWC portion of the Red River Valley Subdivision were equipped with power switches that were operated by train crews. In the fall of 2002, the BNSF began a conversion program to transfer control of the switches, and the signals guarding them, to the train dispatcher. In effect, this created “CTC islands” at each end of the designated sidings. Track Warrants The train dispatcher issues the authority to occupy tracks and gives other instructions to trains in TWC territory by the use of track warrants. The dispatcher issues track warrants to the conductor of an en-route freight train by radio. This transmission is normally audible to all crewmembers in the locomotive cab and to other trains within radio range. After receiving and recording the track warrant, the conductor must confirm that he has copied it correctly by reading it back to the dispatcher. He typically does this using the locomotive radio’s microphone or, if the unit is so equipped, with a telephone- style handset. The read-back may or may not be heard by the engineer. The track warrant form in use by the BNSF is a preprinted form with 17 lines from which a dispatcher can select particular instructions to authorize and/or restrict train movements. (See figure 5.) When one train is permitted to follow another on the same track, the first train is authorized to proceed12 from one location to another, and a following train is authorized to occupy the same track only after the first train has reported clear of a certain point. When trains traveling in opposite directions are operated on a single track, the dispatcher must arrange for them to meet one another at a siding; one train is permitted to “hold the main track” while the other train is instructed to “leave the main track” (take the siding). 11 While many eastern railroads use the Northeast Operating Rules Advisory Committee (NORAC) rules; western class I railroads, including the BNSF, use the General Code of Operating Rules, as do many regional railroads and smaller railroads. The General Code of Operating Rules Committee meets twice per year, at which time committee members may make additions or otherwise modify the operating rules. 12 A train that is operating on “proceed” authority cannot make a reverse move.

Factual Information 12 Railroad Accident Report Using this track warrant form, a train can be authorized to proceed from one location to another with the issuance of authority, referred to as a “Box 2,” that is contained on line 2 of the track warrant. The crew is instructed to mark an “X” in the box for line 2 and fill in the locations “from” and “to.” Upon a proper read-back of all of the instructions and the track warrant being put into effect by the train dispatcher, the train is authorized to proceed from one location to another. The end point of the train’s authorized segment of track is referred to as the track warrant “limit.” Figure 5. Track warrant form used by the General Code of Operating Rules.

Factual Information 13 Railroad Accident Report When trains of opposing directions are intended to meet at a siding so that one train may pass the other, the train that is to “hold the main track” will not be permitted to pass beyond the siding switch that will be used by the other train to leave the main track and enter the siding. In this case, the opposing train would be given a “Box 2” to operate from one location to another, then would also be given “Box 10” instructions to “clear main track at last named point.” In other words, the opposing train is required to take the siding. In the real-world application of track authority, trains are often given track warrants for many miles of track at a time, and they may be given track warrants long before they arrive at the location(s) where the track warrants are in effect. Because it is desirable to keep trains moving, track warrants are given in advance of the anticipated arrival of a train at the “limit” of a prior track warrant. The result is that trains often simultaneously hold more than one valid track warrant. All track warrants are issued with BNSF’s computerized track warrant system and are entered in the dispatcher’s computer with a standardized screen template. The preprinted form the train crewmember uses to copy the track warrant has lines and items that match the train dispatcher’s computer screen. In some cases, a train crew is given authority to proceed but is instructed that such authority is not in effect until another train arrives and clears the main track. Such a track warrant is known in the industry as an “after-arrival” track warrant because it stipulates that it is not in effect until after the arrival of a specified train. An after-arrival warrant is accomplished with a “Box 7,” whereby the dispatcher instructs a crew to place an “X” in the box for line 7, the line of instruction that stipulates that the track warrant is “not in effect until after the arrival of ____.” The dispatcher then informs the crew of the opposing train’s engine number (including the initials of the owning road) and direction. In some cases, the train for which a train has been instructed to wait will not be the first opposing train that is encountered. After the Clarendon collision, the BNSF issued instructions requiring that a train be stopped at the location where another train is to be met before the train is given a track warrant that contains an “after-arrival.” These instructions13 read: Effective May 31, 2002, at 0700 CDT, track warrant authority containing a Box 7 (not in effect until after the arrival of…) is permitted in non-signaled TWC territory only after the train to receive the track warrant containing the Box 7 is stopped at the meeting point where the opposing train will be met. 13 These instructions were initially issued to heighten awareness of issues related to track warrant operations and were expected to be in effect until all employees were contacted in safety briefings. These instructions were later extended.

Factual Information 14 Railroad Accident Report Meteorological Information There was no fog or other weather-related restrictions to visibility at the time of the collision. A weather observation station in Clarendon indicated that the temperature was 56° F. A witness who reported on conditions at the time of the accident told investigators that it was sunny with just a few clouds in the sky. The engineer of the coal train stated that it was clear and sunny, and he did not indicate that the position of the sun compromised his ability to observe the track ahead. During sight distance testing 48 hours after the accident, the position of the sun was not a factor. Toxicological Information Subpart C of Part 219 of 49 Code of Federal Regulations (CFR) governs postaccident toxicological testing of operating crewmembers and train dispatchers involved in an accident. Both crewmembers of the coal train were tested for drugs and alcohol. The conductor of the intermodal train and the fatally injured engineer of the intermodal train were also tested. Tests of all operating crewmembers and the train dispatcher were negative for the presence of alcohol or drugs. Tests and Research About an hour and a half after the accident, an inspection was begun on the non- derailed cars of the coal train where they had come to rest. Inspection records indicate that all brakes had applied on these cars. The non-derailed cars of the intermodal train were similarly inspected, and all brakes were found to have applied. Two days after the accident, on May 30, 2002, the Safety Board arranged for a sight distance test at the collision site. The test was conducted at the same hour and in about the same weather conditions that existed at the time of the accident. The BNSF supplied the same model locomotives from the same manufacturer to represent the lead locomotive of each accident train. After staging the two test locomotives at the point of collision, each locomotive unit was operated in reverse to establish the distance at which the other locomotive became visible. Because the coal train was operating on tangent track for several miles before the point of collision, the actual location at which the intermodal train became visible was not determined. The intermodal train was operating on curved track when the coal train first became visible, and the point at which the crew would have been able to first observe the coal train14 was 1,202 feet east of the point of collision. 14 These tests indicated that the topography in the accident area would likely allow the crew of the intermodal train to see the cars behind the locomotives of the coal train before they could see the lead unit or the headlight.

Factual Information 15 Railroad Accident Report Investigators examined the computer-generated track warrant copies that were issued from the train dispatcher’s desk in the BNSF’s operation center and noted that the track warrants were correct, complete, and in compliance with the operating rules. Event recorder data indicated that the coal train engineer made no control inputs that would have reduced his train speed below normal operating speed from the time the last track warrant was issued until he placed the train in emergency upon sighting the oncoming intermodal train. Actions of Coal Train Crew The engineer of the coal train told investigators that he did remember leaving Amarillo and the events of the trip up to a point, but he did not remember events as the train was approaching the siding at Ashtola or the events just before the collision. The engineer said he usually let the conductor copy a track warrant and that he usually had a copy of the track warrant in front of him on the control panel. He did not remember the last track warrant, and he did not remember having it in front of him. When interviewed a second time, some 5 months after the collision, he said that from everything that he had been told and heard from others, “we ran the meet.” He said he had no idea why he had passed the point where he should have waited. The conductor said he did not remember anything about his last tour of duty, including the last track warrant and the events that led up to the collision.15 Regarding the issuance of track warrants to trains on the Red River Valley Subdivision, the conductor said he thought it was easy to make a mistake: “It is easy to make a mistake or a miss- mark.…If the ink pen didn’t write or if you didn’t have a carbon copy, who’s to say that you don’t ‘X’ the box and just read it back, something could distract you and you don’t know it.” He talked about the Box 7 being “just one mark.” The conductor also stated: “That one little mark means the difference between life and death.” According to Rule 6.10 of the General Code of Operating Rules, the conductor must remind the engineer that the train is approaching an area restricted by limits of authority, track warrant, or track bulletin, and this reminder must take place at least 2 miles from the restriction. The rule states that if the engineer fails to comply with the restriction, the conductor must stop the train. BNSF special instructions state that the conductor and engineer are jointly responsible, through job briefing, to ascertain and agree on their train’s exact location before reporting past a specific point or clearing their track warrant. 15 Although the conductor willingly participated in postaccident interviews, the injuries he had received seriously impaired his ability to assist investigators in reconstructing the accident.

Factual Information 16 Railroad Accident Report Cell Phone Use All four crewmembers involved in this accident had personal cell phones. According to cell phone records obtained by the Safety Board, the conductor of the coal train used his cell phone for brief calls before the train departed Amarillo. The cell phone belonging to the engineer of the coal train was used for two calls during the morning of the accident. At 8:05 a.m., a 23-minute16 call originated from the engineer’s cell phone. After the completion of this call, and after about 16 minutes of non-use, another call originated from the engineer’s phone at 8:44 a.m. This time corresponds to the end of the last track warrant, which was given to the coal train at 8:43 a.m.17 This call, which lasted about 10 minutes, was to the same number as the previous call. The engineer said, and telephone company records confirm, that the number called was that of a family member. The engineer said that he could not recall the substance of the telephone calls that day. He added that he usually called this family member, who was in failing health, each morning. The coal train passed the east end of Ashtola Siding, the location at which it should have waited for the arrival of the intermodal train, at about 8:47 a.m. The engineer said he did not remember specifically being on the phone at the time his train passed the east end of Ashtola Siding. Use of Cell Phones by Operating Employees Title 49 CFR Part 220 governs railroad communications. Subpart “B” of Part 220, “Railroad and Wireless Communication Procedures,” defines the use of radio and wireless communication and governs the use of these methods of communication. Per Federal regulations, a locomotive engineer is not permitted to copy a track warrant while at the controls of a moving train. Federal regulations do not prohibit a locomotive engineer from using a cell phone while at the controls of a moving train. The General Code of Operating Rules restricts the use of cell phones by operating employees under the general interpretation of Operating Rule 1.10, which prohibits employees from using unauthorized electronic devices while on duty. As a result of an unrelated collision18 on a different BNSF subdivision, the railroad issued instructions to operating employees on June 18, 2002, that specifically restricted cell phone use. The instructions prohibited the use of cell phones and laptop computers while on duty, with certain exceptions. Per these instructions, locomotive engineers “are prohibited from using cell phones/laptop computers while operating the controls of a locomotive.” 16 A security analyst with the telephone company told investigators that the length of the phone call is “rounded up” to the next higher minute for any part of a minute that is used. 17 According to telephone company and BNSF personnel, cell phone and track warrant times are synchronized with coordinated universal time (UTC). 18 This collision was not investigated by the Safety Board.

Factual Information 17 Railroad Accident Report Use of After-Arrival Track Warrants Over a period of time, some railroads, including the Union Pacific (as noted below), have discontinued issuing after-arrival track warrants to moving trains. Rules promulgated by the Northeast Operating Rules Advisory Committee (NORAC), under which some railroads operate, have not allowed the use of after-arrival track warrants for at least 15 years. After this accident, the BNSF changed its operating rules to require that dispatchers not issue after-arrival track warrants until after the affected train is stopped at the location where it is to meet the opposing train. After the Safety Board investigated a head-on collision of two Union Pacific trains at Devine, Texas, in June 1997,19 the Safety Board recommended that the Union Pacific Railroad: R-98-25 Discontinue permanently the use of after-arrival orders in dark (nonsignalized) territory. This recommendation was classified “ClosedAcceptable Action” on July 23, 2001, after the Union Pacific indicated that it would stop using after-arrivals in non- signaled TWC territory. In May 2002, the railroad issued instructions to operating employees that would allow the use of after-arrival track warrants after the train that was issued these instructions had stopped at the point at which it was to wait for the arrival of the opposing train. The Union Pacific’s instructions read: Track Warrant Box 7: A track warrant authority containing a Box 7 (not in effect until after the arrival of…) is permitted in non-signaled TWC territory only after the train to receive the track warrant containing the Box 7 is stopped at the location where the opposing train will be met. The portions of 49 CFR that address train movement mention “mandatory directives” and “train orders” but do not address the information that is contained in these authorities or other similar methods of train control. Also as a result of the Devine collision, the Safety Board made the following safety recommendations to the FRA: R-98-26 Revise 49 Code of Federal Regulations Part 220 to address track warrants and other current railroad operating practices. 19 For more information, see National Transportation Safety Board, Collision and Derailment of Union Pacific Railroad Freight Trains 5981 North and 9186 South in Devine, Texas, June 22, 1997. Railroad Accident Report NTSB/RAR-98/02 (Washington, D.C.: NTSB, 1998).

Factual Information 18 Railroad Accident Report R-98-27 Require railroads to discontinue permanently the use of after-arrival orders in dark (nonsignalized) territory. In a February 4, 1999, letter in response to Safety Recommendation R-98-26, the FRA told the Safety Board that it had issued a final rule, effective January 4, 1999, modifying 49 CFR Part 220 as requested. Accordingly, the Safety Board classified Safety Recommendation R-98-26 “ClosedAcceptable Action” on June 29, 1999. In the same February 1999 letter, the FRA stated that it had issued a safety directive addressing safety practices in direct train control territory. The directive recommended that in those instances in which a train movement instruction includes a train meet, the dispatcher specifically state in the movement authority that “this track warrant includes a requirement to meet another train.” The second recommendation in the directive required that railroads review their operating rules and practices pertaining to operations in non-signaled territory to determine what further enhancements were warranted to improve safety, including the elimination of the use of after-arrival orders. The letter further stated that FRA audits had determined that “the overwhelming majority” of railroads had eliminated the use of these orders in non-signaled direct train control territory. While the letter stated that the FRA would continue to review these safety- critical procedures during future dispatcher audits, the agency stopped short of prohibiting the use of after-arrival orders. Based on this response, the Safety Board classified Safety Recommendation R-98-27 “ClosedUnacceptable Action” on June 29, 1999.

19 Railroad Accident Report Analysis Exclusions The engineer and conductor of the coal train had been on duty less than 3 hours and had traveled about 56 miles before the accident. The engineer and conductor of the intermodal train went on duty about 2 hours 12 minutes before the accident and had traveled about 60 miles before reaching the site of the collision. All of the surviving operating employees were interviewed, and no factors indicating fatigue or illness were identified. All operating employees were tested for the presence of drugs or alcohol after the accident, and all results were negative. The Safety Board therefore concludes that no evidence was found to indicate that crewmember fatigue or the use of alcohol or drugs by crewmembers caused or contributed to the accident. All crewmembers were qualified on this territory. The coal train engineer, with 29 years of service, and the conductor, with 36 years of service, were seasoned employees. The intermodal train conductor had almost 6 years of experience, and the engineer had 42 years of railroad service, including 5 years as an engineer. The weather was clear, with no fog or other restrictions to visibility. The coal train engineer indicated that the position of the sun was not a factor. The time and location of each train’s emergency brake application and the relative speed of the trains indicate that at least one crewmember of each train likely saw the opposing train at about the same time. The railroad’s mechanical department had inspected the coal train before it departed Amarillo. The coal train engineer told investigators that the locomotives were functioning well and that he was comfortable in the cab. The event recorder data from the distributed-power locomotive at the rear of the coal train indicates that it was placed in emergency braking by a radio signal from the head end, as designed. Wayside train defect detectors did not detect a problem with either train and did not sound an alarm. Shortly after the accident, an inspection was begun on the non-derailed cars of both trains where they came to rest. All brakes applied on the equipment that was not derailed. The track in the area of the collision was found to meet the requirements for class 4 track. There were no speed restrictions in the area of the collision, and discussions with crewmembers and other employees revealed no track-related problems. The Safety Board therefore concludes that the following did not cause or contribute to the accident: weather, crew qualifications, and the mechanical condition of the equipment and track. Investigators examined the computer-generated track warrant copies that were issued from the train dispatcher’s desk in the BNSF’s operation center and noted that the track warrants were correct, complete, and in compliance with the operating rules. The audiotapes of the train dispatcher’s communications of the accident track warrant reflected an exact reproduction of the instructions that were contained on the track warrant. The Safety Board concludes that the track warrant instructions were complete and correct; the

Analysis 20 Railroad Accident Report transmission of these instructions and the coal train conductor’s repetition of the instructions back to the train dispatcher were also complete and correct. The Intermodal Train The intermodal train was operating with an “after-arrival” track warrant that gave the intermodal train authority to proceed from Hedley Siding to Ashtola Siding. With the coal train on the main track at Ashtola, the intermodal train would have taken the siding so that the two trains could pass one another. The last track warrant given to the intermodal train was complete and correct. As instructed by the track warrant, the intermodal train waited for Engine UP 5827 East to arrive at Hedley and to pass by on the adjacent track. With the arrival of Engine UP 5827 East, the “after-arrival” requirement of the track warrant was complete, and the intermodal train, Engine BNSF 4385 West, began moving westward toward Ashtola. At the time and location of the collision, the intermodal train was authorized to occupy the main track and was operating below the maximum allowable timetable speed. Given the available sight distance, the crew of the intermodal train initiated an emergency brake application in a timely manner. The Safety Board concludes that the operation of the intermodal train did not cause or contribute to the severity of the collision. The Coal Train Investigators reviewed audiotapes and confirmed that communications between the dispatcher and the coal train crew were similar for both of the last two track warrants given to the train. The conductor accurately repeated the instructions for the last track warrant, including the “Box 7” stipulation that the track warrant was not in effect until after the arrival of BNSF 4385 West (the westbound intermodal train) at the east siding switch at Ashtola. Both the engineer and conductor said they could not remember anything about the track warrant. They could not, therefore, confirm that the engineer had a copy of the track warrant or, if the conductor did give a copy to the engineer, that it reflected the after-arrival instructions. (The track warrant could not be found after the operating cab was destroyed by the impact and fire.) The grade toward Ashtola was descending in the direction in which the coal train was traveling. Normal train handling of a 14,483-ton coal train preparing to stop on a descending grade would include controlling train speed with airbrakes and/or significant dynamic braking. Because the train was moving about 48 mph, the engineer would have needed to begin slowing his train within about 2 minutes of receiving the track warrant in order to bring the train to a smooth, controlled stop before passing the east end of Ashtola Siding. Investigators reviewed event recorder data and found no evidence that the engineer had initiated control inputs that would have stopped, or even slowed, the train before it passed the holding point. Thus, the crew of the coal train essentially ignored the

Analysis 21 Railroad Accident Report after-arrival stipulation of Track Warrant 22 and continued at a relatively steady speed as if the after-arrival stipulation had not been issued. While investigators were given no explanations by the engineer for why he did not act on the after-arrival information, it is not likely that he would have forgotten about the meet with the intermodal train because only a minute or two would have elapsed from the time the warrant was issued until he would have had to begin preparing for it by beginning to slow his train. The only known departure from what must have been a routine conveyance of track warrant information between the conductor and the engineer was the engineer’s placing of a cell phone call. The call was initiated at about the same time the track warrant was received, possibly producing a significant dual-task diversion of the engineer’s attention during the time he would have been expected to read the track warrant. The cell phone call ended several minutes before the collision. During the several minutes after the cell phone call and before the collision, the coal train continued to travel eastward at timetable speed. The engineer’s cell phone use may have diverted enough attention from his track warrant reading that the “Box 7” information was seen but not actually comprehended. Because he could have looked at the track warrant again or checked with the conductor if he had any afterthoughts or uncertainties, it is likely that he proceeded beyond Ashtola with absolutely no knowledge of the oversight. The Safety Board concludes that the engineer’s cell phone use likely distracted him to the extent that he did not take proper note of the after-arrival stipulation imposed by Track Warrant 22 and thus was unaware of the need to prepare to bring his train to a stop. The irregularities of the conductor’s performance after copying Track Warrant 22 may be the result of two factors. First, the task of copying track warrants is a repetitive one, subject to a few variants of the same information every working day. The conductor was well practiced with this routine and was familiar with the territory, and he could undoubtedly perform this task with little mental effort.20 Likely because of the timing of the engineer’s phone call, the conductor probably did not discuss the track warrant with the engineer. Nor is it likely that he would have felt it necessary to do so, because the track warrant involved routine and predictable arrangements that the engineer would be expected to perform. But this expectation would not explain the conductor’s apparent inattention to the operation of the train after receipt of the track warrant. The conductor had himself taken the track warrant information, had copied it down, and had read it back accurately and completely to the dispatcher. There could have been no question in his mind about what was required. He was also familiar with the territory and would have known how close the train was to the required holding point and how quickly it was approaching that point. He would have expected the engineer to begin to slow the train within a minute or two of getting the track warrant information. 20 A fundamental of human error prediction is that accomplished proficiency may increase the risk of employees’ paying less attention to the routine tasks at hand. It has been termed a mechanism of error production. See J.W. Senders and N.P. Moray, Human Error: Cause, Prediction, and Reduction, Hillsdale, New Jersey, Lawrence Erlbaum Associates, 1981, p. 78.

Analysis 22 Railroad Accident Report Further, Operating Rule 6.1 required that the conductor remind the engineer that the train was approaching the end of track warrant authority and even authorized him to stop the train if the engineer failed to take action. Because of the requirements of the operating rule and the fact that the conductor would have known that violating the track warrant instructions could lead to a collision with another train, his failure to communicate with the engineer when it became apparent that the engineer was not preparing to stop suggests that the conductor was not properly attentive to the operation of the train. Also because of the substantial risk involved, he would not likely have been deterred from communicating with the engineer simply because the engineer was on the telephone at the time. Although it cannot be known why the backup systemin this case, the conductorfailed to take action when the primary systemthe engineerdid not perform as expected, this accident highlights once again that human performance alone cannot be relied upon to provide true safety redundancy in a transportation system. Certain information was not available that may have helped investigators determine why neither the engineer nor the conductor acted in accordance with the provisions of the Track Warrant 22. Had recordings of the in-cab conversations between the crewmembers been available for postaccident review, investigators may have been able to assess the crew interactions in the cab during the period for which neither the engineer nor conductor could provide detailed information. But locomotives are not required to be equipped with locomotive cab audio recorders, and these were not. For several years, the Safety Board has been a proponent of installing and using locomotive cab audio recorders to help determine the cause of accidents. Safety Recommendation R-97-9 was issued to the FRA as a result of the Safety Board’s investigation of the collision between a Maryland rail commuter train and an Amtrak passenger train on February 16, 1996, near Silver Spring, Maryland:21 R-97-9 Amend 49 Code of Federal Regulations Part 229 to require the recording of train crewmembers’ voice communications for exclusive use in accident investigations and with appropriate limitations on the public release of such recordings. 21 National Transportation Safety Board, Collision and Derailment of Maryland Rail Commuter MARC Train 286 and National Railroad Passenger Corporation (Amtrak) Train 29 Near Silver Spring, Maryland, February 16, 1996, Railroad Accident Report NTSB/RAR-97/02 (Washington, D.C.: NTSB, 1997).

Analysis 23 Railroad Accident Report The recommendation, which is on the Safety Board’s list of “Most Wanted” transportation safety improvements, was reiterated in the Board’s report of a collision involving three Consolidated Rail Corporation freight trains near Bryan, Ohio, on January 17, 1999.22 Based on the initial responses of the FRA, the Safety Board classified Safety Recommendation R-97-9 “Open—Unacceptable Response.” On April 17, 2003, the Safety Board asked for an update on the status of the implementation of this recommendation. In a May 5, 2003, letter in response to the request for an update, the FRA, citing the absence of “a clear showing that safety benefits will outweigh the costs,” stated that it “has reluctantly come to the conclusion that this recommendation should not be implemented at the present time.” Use of Cell Phones by Operating Employees Locomotive engineers commonly use the locomotive radio to communicate with the dispatcher or other railroad employees. At the same time, cell phones are becoming more prevalent, and all four crewmembers involved in this accident had personal cell phones with them. Cell phone use in controlled research situations has been shown to interfere with the perception process during the performance of operational tasks. The scientific understanding of this impairment is that visual perception is disrupted to the extent that a person does not implicitly attend to the information or physical cues available.23 Such an impairment obviously has implications for operating train crews because use of a cell phone during train operations can call a crewmember’s attention away from the task at hand. Moreover, a crewmember who is on a cell phone may miss information that is broadcast on the locomotive radio. Wayside defect detectors broadcast defect information and axle counts to the crews of passing trains. Similarly, train crews and other employees are required to inspect passing trains and report defects or the improper display of the rear marker. To improve safety, many railroads require that train crews announce their train’s presence on the radio as they approach a meeting point in non-signaled territory and the indication of wayside signals in signaled territory. An employee who is using a cell phone may not hear or perceive such information. 22 National Transportation Safety Board, Collision Involving Three Consolidated Rail Corporation Freight Trains Operating in Fog at Bryan, Ohio, January 17, 1999, Railroad Accident Report NTSB/RAR- 01/01 (Washington, D.C.: NTSB, 2001). 23 Strayer, D.L., Drews, F.A., and Johnston, W.A. Cell Phone-Induced Failures of Visual Attention during Simulated Driving, Journal of Experimental Psychology: Applied. Vol. 9, No. 1, 2003: pp. 23-32. The term “inattentional blindness” was given by earlier researchers to findings where persons were unable to perceive certain controlled presentations in the visual field that they would have seen if they had been attentive to them. Mack, A. and Rock, I., Inattentional Blindness. Cambridge, MA: The MIT Press, 1998. pp. 13-15, 227-250.

Analysis 24 Railroad Accident Report When used by either the engineer or conductor, a cell phone may distract the other crewmember or terminate the normal interaction between the two. Perhaps one employee may wish to ask a question or offer a reminder but chooses to not disturb the employee who is using the phone. An incoming phone call may be a significant distraction to a person who is engaged in a critical task at that particular moment. It is conceivable that both the conductor and the engineer could be on their cell phones at the same time. In this case, neither employee is fully concentrating on the safe operation of the train. In other situations, particularly in passenger operations, an engineer may be alone in the cab. In this case, the sole occupant of the locomotive may be impaired by the demands of a cell phone call. In the Clarendon accident, as noted previously, the engineer placed a cell phone call and continued the conversation during the time he should have been preparing his train to stop, providing convincing evidence that cell phone use by train operating crews can interfere with crewmember attention and communications and can therefore degrade the safety of train operations. Both the General Code of Operating Rules and BNSF operating instructions restrict the use of cell phones by operating employees. The BNSF instructions prohibit locomotive engineers from using cell phones/laptop computers while operating a locomotive. Federal regulations contained in 49 CFR Part 220 do not prohibit an engineer from using a cell phone while at the controls of a moving locomotive. As noted, however, the use of a cell phone by an engineer at the controls of a moving locomotive will likely dilute the engineer’s full awareness and attention, which are required for safe operation. To improve safety, the Safety Board believes that the FRA should promulgate new or amended regulations that will control the use of cellular telephones and similar wireless communication devices by railroad operating employees while on duty so that such use does not affect operational safety. Use of After-Arrival Authority The issuance of after-arrival track warrants is useful in keeping traffic moving because the train that is holding the after-arrival track warrant can depart immediately once the opposing train has cleared. Often, a train crew can reduce the speed of the train and synchronize the time of its arrival at the waiting point so the train does not have to stop, thus saving fuel. There is no need to contact the dispatcher, report the opposing train in the clear, and copy a new track warrant. The authority is valid once the opposing train arrives and clears the main track. However, if the train holding the after-arrival leaves the waiting point too soon or, as in this accident, does not wait at all, the result is likely to be a head-on collision. The eastern half of the Red River Valley Subdivision is signalized with a CTC system. In this territory, signal indications inform crews of routing and required speed changes or the limits of track authority. A train approaching the limits of its track authority will receive, at a minimum, an approach signal instructing the crew to reduce train speed to 30 mph and be prepared to stop at the next signal. If a crew should mistakenly pass a

Analysis 25 Railroad Accident Report stop signal, the train dispatcher will receive an indication of track occupancy by the offending train. In addition, the “fail-safe” signal system will display red (stop) signals to all trains involved. Should a train exceed its authority in dark territory, however, as did the coal train in this accident, nothing is in place to alert others of the incident. As can be expected on the busiest section of BNSF single-track TWC territory, there is typically a high level of radio traffic. The dispatcher is busy, and the crews are constantly waiting for their trains to be contacted by the dispatcher. With hundreds of track warrants written each day, and with track warrant read-backs and crews calling in to cancel the track warrants or report clear of locations, radio traffic can saturate the dispatcher’s frequency. Giving after-arrivals to moving trains is easier for the train dispatchers, but it increases the responsibility of train crews. The territory and the corresponding number of trains that the dispatchers must monitor and control may place a demanding load on the dispatcher. However, the dispatcher’s desk is equipped with computer software that is designed to prevent a dispatcher from delivering an incorrect track warrant. Train crews have no such backup. After the Clarendon collision, the BNSF issued instructions requiring that a train be stopped at the location where another train is to be met before the crew is given a track warrant that contains an after-arrival. This restriction eliminates instances in which a train has a track warrant that instructs the crew to proceed or to keep proceeding, but to remember to stop the train before passing a specific point within the territory. A disoriented or distracted crew may not stop at the designated location. In this accident, had the crew not received their final track warrant, they might have stopped at the limit of their previous warrant; that is, at the east end of Ashtola. The engineer may have heard the radio transmission of at least the beginning of the final track warrant and mistakenly determined that, since he had a track warrant, he did not have to be concerned about stopping in the next several miles. The timing of the engineer’s initiation of the final phone call clearly suggests that he did not believe he had to stop at Ashtola. The Safety Board concludes that the issuance, to moving trains, of track warrants containing after-arrival provisions creates an unacceptable and unnecessary risk of a head- on train collision. The Safety Board believes that the FRA should, in territory not equipped with a positive train control system (discussed below), restrict the issuance of track warrant authority that contains an after-arrival requirement to trains that have stopped at the location at which they will meet the opposing train. In the meantime, the Safety Board believes that the General Code of Operating Rules Committee should add language to the track warrant rules to ensure that in territory not equipped with a positive train control system, track warrant authority that contains an after-arrival requirement is issued only to trains that have stopped at the location at which they will meet the opposing train.

Analysis 26 Railroad Accident Report Positive Train Control Systems Technology does exist to automatically enforce the operating parameters of trains and thus prevent train collisions. Over the past 3 decades, the Safety Board has investigated a long list of train collisions that could have been prevented through the use of a positive train control system24 that incorporated collision avoidance. The Safety Board has addressed this issue through the issuance of a series of safety recommendations. In fact, positive train control has been on the Safety Board’s list of “Most Wanted” transportation safety improvements since 1990. The most recent safety recommendation relating to positive train control was issued as a result of the Board’s previously referenced investigation of the 1999 fatal train collision in Bryan, Ohio: R-01-6 Facilitate actions necessary for development and implementation of positive train control systems that include collision avoidance, and require implementation of positive train control systems on main line tracks, establishing priority requirements for high-risk corridors such as those where commuter and intercity passenger railroads operate. Based on a March 27, 2002, letter in which the FRA outlined steps it had taken toward “achieving the proper atmosphere in the rail industry to allow for the development and implementation of [positive train control],” the Safety Board classified Safety Recommendation R-01-6 “Open—Acceptable Response.” In answer to an April 17, 2003, letter from the Safety Board asking for an update on actions regarding this safety recommendation, the FRA responded, in a May 5, 2003, letter, that it was “moving forward across a broad front to create the conditions under which [positive train control] systems can be more widely deployed on the national rail system.” In the letter, the FRA detailed some of the steps the agency was taking in the following areas: • Providing a radio-navigation infrastructure and ensuring adequate spectrum; • Facilitating positive train control through regulatory change; • Supporting the demonstration and deployment of candidate technologies; and • Analyzing costs and benefits. The FRA stated that the agency was “doing everything within its power to prepare the way for [positive train control] and encourage its rapid deployment.” In the meantime, the majority of railroad operations occur in territory without any automatic means of preventing train collisions. 24 Various names have been given to these types of systems, but one component of all true positive train control systems is a system designed to prevent train collisions.

Analysis 27 Railroad Accident Report The BNSF is developing a system of train separation that would prevent trains from operating beyond the limits of track warrant authority. BNSF’s train collision avoidance system is designed as an “overlay system” that enforces the track warrant limits or signal indications and the operating rules that are in place. The system is designed to inform the engineer of conditions that require him to act. If the engineer does not take the proper actions, the system will automatically stop the train. The BNSF plans to begin a pilot collision avoidance program for trains in the summer of 2003 on about 100 miles of track in western Illinois. The BNSF system will use such information as train position (provided by the global positioning system), switch position (provided by switch sensors), signal indication, locomotive speed and control inputs, and track authority as given by the train dispatcher. This information will be combined with a train and track database to enforce operating parameters. The system will be designed to prevent the overrun of track authority in both signaled and track warrant territory. In addition to the absolute limits of track authority, the system will be able to enforce track speed and permanent and temporary speed restrictions. The Safety Board concludes that had a positive train control system with collision avoidance capabilities been in place and operational on the Red River Valley Subdivision at the time of the accident, the collision probably would not have occurred.

28 Railroad Accident Report Conclusions Findings 1. No evidence was found to indicate that crewmember fatigue or the use of alcohol or drugs by crewmembers caused or contributed to the accident. 2. The following did not cause or contribute to the accident: weather, crew qualifications, and the mechanical condition of the equipment and track. 3. The track warrant instructions were complete and correct; the transmission of these instructions and the coal train conductor’s repetition of the instructions back to the train dispatcher were also complete and correct. 4. The operation of the intermodal train did not cause or contribute to the severity of the collision. 5. The engineer’s cell phone use likely distracted him to the extent that he did not take proper note of the after-arrival stipulation imposed by Track Warrant 22 and thus was unaware of the need to prepare to bring his train to a stop. 6. The issuance, to moving trains, of track warrants containing after-arrival provisions creates an unacceptable and unnecessary risk of a head-on train collision. 7. Had a positive train control system with collision avoidance capabilities been in place and operational on the Red River Valley Subdivision at the time of the accident, the collision probably would not have occurred. Probable Cause The National Transportation Safety Board determines that the probable cause of the May 28, 2002, collision at Clarendon, Texas, was (1) the coal train engineer’s use of a cell phone during the time he should have been attending to the requirements of the track warrant his train was operating under and (2) the unexplained failure of the conductor to ensure that the engineer complied with the track warrant restrictions. Contributing to the accident was the absence of a positive train control system that would have automatically stopped the coal train before it exceeded its authorized limits.

29 Railroad Accident Report Recommendations As a result of its investigation of the May 28, 2002, collision at Clarendon, Texas, the National Transportation Safety Board makes the following safety recommendations: To the Federal Railroad Administration: Promulgate new or amended regulations that will control the use of cellular telephones and similar wireless communication devices by railroad operating employees while on duty so that such use does not affect operational safety. (R- 03-1) In territory not equipped with a positive train control system, restrict the issuance of track warrant authority that contains an after-arrival requirement to trains that have stopped at the location at which they will meet the opposing train. (R-03-2) To the General Code of Operating Rules Committee: Add language to the track warrant rules to ensure that in territory not equipped with a positive train control system, track warrant authority that contains an after- arrival requirement is issued only to trains that have stopped at the location at which they will meet the opposing train. (R-03-3) BY THE NATIONAL TRANSPORTATION SAFETY BOARD Ellen G. Engleman Mark V. Rosenker Chairman Vice Chairman John J. Goglia Member Carol J. Carmody Member Richard F. Healing Member Adopted: June 3, 2003

this page intentionally left blank

31 Railroad Accident Report Appendix A Investigation The National Transportation Safety Board was notified about noon, eastern standard time, on May 28, 2002, that two BNSF freight trains had collided near Clarendon, Texas. The Board launched an investigator in charge from the Atlanta Regional Office and a railroad signal investigator from the Safety Board’s Washington, D.C., headquarters. In addition, a human performance investigator assisted during the subsequent interviews of operating employees. Locomotive event recorder data were processed by the Safety Board’s Office of Research and Engineering. The Safety Board held 2 days of interviews as part of its investigation. The first interviews were held at Amarillo, Texas, on July 1, 2002. Additional interviews were held at the BNSF’s network operations center in Fort Worth, Texas, on July 2, 2002. The Safety Board was assisted in its investigation by the Federal Railroad Administration, the Texas Railroad Commission, the BNSF Railway, the Brotherhood of Locomotive Engineers, and the United Transportation Union.

32 Railroad Accident Report Appendix B Time Line of Events 6:00 a.m. Coal train crew begins tour of duty at the BNSF Amarillo yard office 6:45 a.m. Intermodal train called on duty at Childress, Texas 7:01 a.m. Coal train conductor places 2-minute cell phone call to his home number 7:14 a.m. Coal train conductor places 2-minute cell phone call to an unknown number 7:18 a.m. Intermodal train Track Warrant 12 in effect, Estelline to Hedley 7:40 a.m. After setting out one defective car, coal train crew departs Amarillo 7:47 a.m. Track Warrant 15 is in effect for the coal train from “Restricted lim- its Amarillo” to “East Siding Switch Malden.” 7:49 a.m. Track Warrant 16 is in effect for the coal train from “Malden to East Siding Switch Ashtola” 8:05 a.m. Coal train engineer originates a 23-minute cell phone call 8:26 a.m. Intermodal train Track Warrant 19 in effect, Hedley to Ashtola, instructions to take siding at Ashtola 8:27 a.m. Coal train engineer cell phone call ends 8:28 a.m. Coal train reports clear of milepost 305 8:29 a.m. Coal train is clear of the limits of Track Warrant 15 8:39 a.m. Intermodal train clears track warrant 12, indicates that the limits were clear at 8:30 8:41 a.m. Coal train clears the wayside detector at milepost 294; the head end of the train is about milepost 292.8 8:41 a.m. Coal train reports clear of Track Warrant 15 to dispatcher and that the train is east of milepost 294 8:43 a.m. Coal train receives last track warrant: From “East Siding Switch Ashtola” to “East Siding Switch Hedley after the arrival of BNSF 4385 at Ashtola.” Radio transmission between coal train and dis- patcher ends at about 8:43:55.

Appendix B 33 Railroad Accident Report 8:44 a.m. Engineer originates a 10-minute cell phone call 8:44 a.m. Coal train passes west siding switch Ashtola 8:47 a.m. Coal train passes east siding switch Ashtola 8:48 a.m. Intermodal train clears the detector at milepost 273.2. Head end of the train is at approximately milepost 274.6 8:49 a.m. Intermodal train passes the east end of Clarendon siding at milepost 274.89 8:51 a.m. Intermodal train passes the west end of Clarendon siding at 276.57, about 3.53 miles before the point of collision. 8:53 a.m. Coal train engineer cell phone call ends 8:57 a.m. Collision occurs at milepost 280.1

this page intentionally left blank

FD07282 ｜ 2003_美国_RAR0302.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2003 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Derailment of Amtrak Auto Train P052-18 on the CSXT Railroad Near Crescent City, Florida April 18, 2002 Railroad Accident Report NTSB/RAR-03/02 PB2003-916302 Notation 7487A National Transportation Safety Board Washington, D.C.

this page intentionally left blank

Railroad Accident Report Derailment of Amtrak Auto Train P052-18 on the CSXT Railroad Near Crescent City, Florida April 18, 2002 NTSB/RAR-03/02 PB2003-916302 National Transportation Safety Board Notation 7487A 490 L’Enfant Plaza, S.W. Adopted August 5, 2003 Washington, D.C. 20594

National Transportation Safety Board. 2003. Derailment of Amtrak Auto Train P052-18 on the CSXT Railroad Near Crescent City, Florida, April 18, 2002. Railroad Accident Report NTSB/RAR-03/02. Washington, DC. Abstract: About 5:08 p.m. eastern daylight time on April 18, 2002, northbound National Railroad Passenger Corporation (Amtrak) train P052-18, the Auto Train, derailed 21 of 40 cars on CSX Transportation track near Crescent City, Florida. The train derailed in a left-hand curve while traveling about 56 mph. The train was carrying 413 passengers and 33 Amtrak employees. The derailment resulted in 4 fatalities, 36 serious injuries, and 106 minor injuries. The equipment and track costs associated with the accident totaled about $8.3 million. As a result of its investigation of this accident, the Safety Board identified the following safety issues: continuous welded rail temperature control; continuous welded rail restraint, including ballast and rail anchors; continuous welded rail maintenance procedures and standards; means of end-of-train device activation; Amtrak passenger accountability procedures; and securement of folding armchairs on Amtrak Superliner sleeper cars. As a result of its investigation of this accident, the National Transportation Safety Board makes safety recommendations to CSX Transportation, Inc., Amtrak, the Federal Railroad Administration, and the Transportation Security Administration. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2003-916302 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Railroad Accident Report Contents Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Personnel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Amtrak Train-Operating Crew . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 CSXT Track Maintenance Personnel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Train Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Signal Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Track Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Preaccident CSXT Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Track Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 FRA Track Safety Program and CWR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Rail Anchors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Roadbed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Ballast . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Track Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Postaccident FRA and State Track Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 CWR Temperature Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Operations Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Toxicological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Disaster Preparedness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Area Emergency Response Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Amtrak Personnel Emergency Preparedness Training . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Auto Train Event Recorder Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Survival Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Superliner Passenger Car Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Superliner Sleeper Car Folding Armchairs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Testing and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Track Forces Induced by CSXT Coal Train N16815 . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 CWR-SAFE Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Postaccident Developments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Track Buckle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Track Condition and Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

Contents iv Railroad Accident Report Roadbed, Ballast, and Rail Anchor Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Track Alignment After Surfacing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 CWR Temperature Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Derailment Dynamics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Auto Train Consist . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Two-Way End-Of-Train Device Activation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Passenger Accountability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Railcar Crashworthiness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Superliner Passenger Car Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Superliner Sleeper Car Folding Armchairs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Appendixes A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 B: Passenger On-Board Record Procedures from Amtrak Service Standards Manual for Management Employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 C: Passenger Train Two-Way End-Of-Train Device Regulations . . . . . . . . . . . . . . . . . . . . 68 D: Chronological List of Track Maintenance Operations on Accident Curve Following Shoulder Ballast Cleaning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 E: Summary of Key Event Recorder Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

v Railroad Accident Report Executive Summary About 5:08 p.m. eastern daylight time on April 18, 2002, northbound National Railroad Passenger Corporation (Amtrak) train P052-18, the Auto Train, derailed 21 of 40 cars on CSX Transportation (CSXT) track near Crescent City, Florida. The train derailed in a left-hand curve while traveling about 56 mph. The train was carrying 413 passengers and 33 Amtrak employees. The derailment resulted in 4 fatalities, 36 serious injuries, and 106 minor injuries. The equipment and track costs associated with the accident totaled about $8.3 million. The National Transportation Safety Board determines that the probable cause of the April 18, 2002, derailment of Amtrak Auto Train P052-18 near Crescent City, Florida, was a heat-induced track buckle that developed because of inadequate CSX Transportation track-surfacing operations, including misalignment of the curve, insufficient track restraint, and failure to reestablish an appropriate neutral rail temperature. The safety issues addressed in the report are: • Continuous welded rail temperature control, • Continuous welded rail restraint, including ballast and rail anchors, • Continuous welded rail maintenance procedures and standards, • Means of end-of-train device activation, • Amtrak passenger accountability procedures, and • Securement of folding armchairs on Amtrak Superliner sleeper cars. Other items discussed in the report include: • Suitability of the Auto Train consist and • Crashworthiness of Superliner passenger car windows. As a result of its investigation of this accident, the Safety Board makes safety recommendations to CSXT, Amtrak, the Federal Railroad Administration, and the Transportation Security Administration.

this page intentionally left blank

1 Railroad Accident Report Factual Information Accident Synopsis About 5:08 p.m. eastern daylight time1 on April 18, 2002, northbound National Railroad Passenger Corporation (Amtrak) train P052-18,2 the Auto Train, derailed 21 of 40 cars on CSX Transportation (CSXT) track near Crescent City, Florida. (See figure 1 for a map showing the accident location.) The train derailed in a 3-degree, 11-minute left- hand curve while traveling about 56 mph. The train was carrying 413 passengers and 33 Amtrak employees.3 The derailment resulted in 4 fatalities, 36 serious injuries, and 106 minor injuries. The equipment and track costs associated with the accident totaled about $8.3 million. (See figures 2 through 4 showing the accident aftermath.) 1 Unless otherwise indicated, all times are eastern daylight time. 2 “P052-18” stands for Passenger Train number 52 of the 18th (of April). 3 Of the 33 Amtrak employees on the train, 24 were service personnel, 5 were service managers, and 4 were train-operating crewmembers. Figure 1. Map showing accident location on CSXT Sanford subdivision. (Insert shows CSXT rail line running north from Sanford. Star marks approximate accident site.) 0 20 Miles 40 60 80 Gulf of Mexico ATLANTIC OCEAN FLORIDA GEORGIA ALABAMA Orlando Jacksonville Miami Tampa Crescent City De Land Palatka Sanford 0 20 Miles 40

Factual Information 2 Railroad Accident Report Figure 2. Aerial view of accident site. Figure 3. View of two cars after the accident.

Factual Information 3 Railroad Accident Report Accident Narrative Northbound Amtrak Auto Train P052-18 originated at Sanford, Florida, on April 18, 2002, bound for Lorton, Virginia. The train consisted of a 2-unit diesel-electric locomotive and 16 Amtrak Superliner passenger cars, followed by 24 loaded Amtrak automobile-carrying “autorack” cars. According to the Auto Train crewmembers, the train had been assembled before they boarded. Before departure, carmen4 successfully performed the required Federal Railroad Administration (FRA) initial terminal equipment inspection, a Class I air brake test,5 and a two-way end-of-train (EOT) device test. The Auto Train operating crew held a job briefing before departure. The CSXT train dispatcher granted the Auto Train permission to come out of the loading facility and occupy the main track after southbound Amtrak train 97 had cleared the Sanford Station. The Auto Train departed Sanford at 4:08 p.m., 8 minutes behind schedule. The engineer performed a mandatory running air brake test6 after the train departed the station and noted that the brakes worked as expected. The train-operating crew said that the trip from Sanford until the accident was uneventful and that all equipment functioned normally. Figure 4. Figure 4. Panoramic/composite image view of derailed cars. (Photo source: Putnam County Sheriff’s Department. Panoramic/composite view developed by the Safety Board.) 4 Carmen represent a union (Brotherhood of Railway Carmen) craft of Amtrak mechanical department employees who service and maintain the rolling equipment, principally the cars. 5 See 49 Code of Federal Regulations 238.313. 6 See 49 Code of Federal Regulations 238.319.

Factual Information 4 Railroad Accident Report CSXT dispatcher records showed that the Auto Train had an “out time”7 at Sanford8 of 4:17 p.m. The train passed the Benson Junction, De Land, and Barberville Stations at 4:23, 4:35, and 4:44 p.m., respectively. As the train moved northwards, it passed automated hotbox/dragging equipment detectors at Orange City and Barberville, Florida, which detected no defects. The Auto Train arrived at Seville, Florida, at 4:53 p.m. and waited on the mainline for a CSXT southbound coal train (train N16815) to pass. The Auto Train then departed at 5:00 p.m. Upon leaving Seville, the engineer applied power to accelerate the train to 60 mph, the maximum speed allowed for the curve 3 miles ahead, between mileposts (MPs) 723.0 and 722.2. The train was operating under a clear signal indication9 from the wayside traffic control signal system. Event recorder data showed that the train was traveling at 56 mph as it approached MP 722. The engineer said that he was monitoring the progress of the train’s acceleration, not wanting to exceed the 60-mph speed restriction. He said that the speed indicator was showing 57 mph. As he looked at the track ahead, he noticed an irregularity in the track alignment just before the locomotive passed over it. He saw that both rails were out of alignment. He described the rails as being parallel to one another and out of line to the right (to the east, or outside, of the curve) by about 10 inches. The engineer said that as he raised his hand toward the controls, he was jarred violently as the engine passed over the misalignment. He said that despite being jolted, he quickly managed to bump the air brake handle and initiate a service application of the train air brakes. According to event recorder information, he initiated an emergency brake application a few seconds later. He activated the two-way EOT device about 15 seconds after initiating the emergency brake application.10 The 3rd through 23rd (21 total) cars derailed. According to the event recorder, the lead locomotive unit came to a stop about 700 feet from the point at which the engineer made the emergency brake application. The engineer said that during the derailment, the assistant engineer shouted for him to place the brake handle in emergency. The engineer also heard a radio call from the conductor requesting an emergency brake application. The assistant engineer said that he was reviewing a train bulletin when the engine passed over the track anomaly. He said that he yelled to the engineer and then activated his 7 Out time is not the departure time; it is the time that the train clears the station and interlocking. 8 Sanford is at milepost (MP) 766.3, as measured from a point midway across the CSXT bridge that spans the James River at Richmond, Virginia, which is MP 0. Technically, all the MPs on this track have an “A” as a prefix, in reference to the predecessor railroad Atlantic Coast Line. For simplicity, in this report, the prefix is omitted in all cases. 9 A clear or green wayside signal indicates that the train may travel up to the maximum authorized speed. 10 The two-way EOT device is a telemetry tool attached to the end coupler of the train. The EOT device transmits the brake pipe pressure at the rear of the train to the lead unit (head-end locomotive). The brake pipe pressure can also be seen on a digital readout on the flashing rear-end device itself. A two-way EOT device is also capable of receiving a transmission from the lead unit to open the brake pipe and put the train into emergency.

Factual Information 5 Railroad Accident Report emergency brake valve. After the train came to a stop, the assistant engineer programmed the radio to the emergency channel for the dispatcher. The engineer told the train dispatcher of the derailment and requested emergency assistance. They had the following exchange: Engineer: AA --- Emergency radio, over. We have a wreck, milepost 722, P052. We have cars on their side.11 AA Dispatcher: Okay. P052, we have a wreck at 722 milepost, cars near the right-of-way or on the right-of-way, over? Engineer: We were coming around ----, we had a bad kink in the rail.12 AA Dispatcher: Okay. P052, I understand those are your cars on the side, over. Engineer: We have cars on the side. We will need emergency assistance. AA Dispatcher: Okay, sir. I will get everybody coming. The engineer and assistant engineer assessed the situation and decided that the engineer would remain on the locomotive to relay radio communications. The assistant engineer went to help the passengers and Amtrak personnel in the derailed cars. The dispatcher contacted CSXT police and told them of the derailment and the location. After this conversation, the dispatcher called the Auto Train engineer and they had the following exchange: AA Dispatcher: Okay. I have all the emergency people notified now. Can you give me more information ---- to access it? Over. Engineer: We were coming around a curve at, the Silver Lake Curve; milepost 722.2, there was a bad kink in the rail. The engine made it over, and about the first four cars made it over and then we got cars piled one on top of the other behind it. 11 “AA” is the CSXT letter designation for the dispatcher who controlled the accident area. 12 In the railroad industry, the term “kink” (sometimes called a “sun kink”) refers to a track buckle. A track buckle is an irregularity in track alignment. Track buckles may be caused by a number of conditions; among the causes are rail alignment deviation and the rail’s expansive forces exceeding the ballast/track structure’s capability to restrain them.

Factual Information 6 Railroad Accident Report The conductor was riding in the second car at the time of the derailment. He was thrown about the car as it passed over the misaligned track. After the train came to rest, the conductor exited the coach and radioed the engineer to shut down the head-end power.13 The assistant conductor was riding in the first dining car, which was the seventh car from the locomotive. The dining cars were open for the evening meal, and patrons were being seated at the time of the derailment. The assistant conductor said that he had just gone downstairs into the lower level of the dining car when the derailment occurred. As the car derailed, it rolled onto its side. The assistant conductor helped passengers and crew climb upward out of the “top” of the overturned dining car through what had been a side door. Auto Train on-board service employees told passengers what had happened and that emergency services had been called. Some Amtrak employees provided on-scene first aid to passengers. Amtrak employees continued to assist passengers, and emergency service personnel upon their arrival on-scene, until all the passengers had been evacuated and the site secured. Sometime after dark, the train-operating crew was taken to a local hospital for required FRA alcohol and drug tests.14 Emergency Response At 5:09 p.m., the Putnam County 911 operator (Putnam County Dispatch) received a call from the CSXT police dispatcher requesting immediate emergency medical services for an Amtrak train that had overturned in Crescent City. The dispatcher said that no information could be provided on the number of passengers involved. Putnam County dispatched Rescue Unit #6 from Crescent City Fire Station 3 and Putnam County Sheriff Unit A397 to the derailment at 5:10 p.m. Rescue Unit #6 departed for the accident at 5:12 p.m. A minute later, Engine 3 from Crescent City Fire Station 3 was en route to the accident. About the same time, the Volusia County 911 dispatcher transferred a call from an Auto Train passenger to the Putnam County Dispatch. The passenger said that nine passenger cars were on their sides and that some passengers were trapped. At 5:15 p.m., a Crescent City police officer arrived on-scene at Jaffa Road and State Highway 17. Putnam County Sheriff Unit A397 arrived on-scene at 5:17 p.m. and reported that the accident location was at Old Highway 17 and State Highway 17. About this time, another passenger called the Putnam County Dispatch and reported that the entire train was derailed and overturned. The passenger also said that more than 400 people were on the train and that there were injuries. The first fire department unit, Engine 3 from Crescent City Fire Station 3, arrived on-scene at 5:18 p.m. At 5:19 p.m., the Volusia County 911 dispatcher transferred another 13 Head-end power comes from the electrical generator(s) in the locomotive units that provide all electrical power to the passenger cars for heat, light, and air conditioning. 14 See 49 Code of Federal Regulations Part 219.

Factual Information 7 Railroad Accident Report call from a passenger on the train to the Putnam County Dispatch. This passenger stated that he could hear sirens, and he told the dispatcher that the emergency responders needed to come through a farm. At 5:20 p.m., the chief of the Crescent City Fire Department arrived on-scene (without his radio, which he had left at the station), assumed incident command, and established a command post on Jaffa Road. The fire chief immediately began to assign the arriving emergency responders various duties and to set up triage and staging areas. The fire chief had never before responded to an emergency of this magnitude, and he walked around the accident scene to evaluate the situation. At 5:23 p.m., the first arriving paramedic from Rescue Unit #6 reported to Putnam County Dispatch that 468 people were on the train, several of whom were trapped and others who were “walking wounded.” Shortly thereafter, the deputy chief of Operations for Putnam County Emergency Services initiated the Putnam County Comprehensive Emergency Management Plan by cellular phone while he was en route to the derailment. (The purpose of the plan is to prepare and respond to a variety of disasters and emergencies that affect the public.) In addition, he notified the State Warning Point,15 which alerted Florida State agencies to respond to a mass casualty disaster. From about 5:33 p.m. until his arrival on-scene, the training coordinator for Putnam County Emergency Services attempted to contact the chief of the Crescent City Fire Department but was unsuccessful (because the chief had no radio with him). At 5:40 p.m., the training coordinator arrived on-scene and established a staging area at Clifton Road and Old Highway 17. Having been unable to contact the fire chief, the training coordinator assumed incident command and established a command post at Old Highway 17, south of Clifton Road, at 5:46 p.m. By 7:08 p.m., the training coordinator (incident commander) reported that all passengers had been evacuated except for one entrapped fatality. At 7:19 p.m., the incident commander moved the command post to State Highway 17 and Clifton Road. The incident commander departed the scene at 8:08 a.m. on April 19, which officially ended the emergency response. A total of 441 emergency responders from 31 agencies took part in the response. Ambulances from eight Florida counties and six medical helicopter services responded to the accident and transported injured passengers to eight area hospitals. Before the passengers were transported, emergency responders performed on-scene triage. State and local law enforcement officers helped emergency responders with the passengers and provided security and traffic control at the accident scene until the derailment was cleared from the track on April 21. As a result of the Crescent City derailment, the chairman of the Board of County Commissioners for Putnam County declared a state of emergency for the county between April 18 and 25, 2002, (1-week period) and implemented the Putnam County Comprehensive Emergency Management Plan. The Florida Division of Emergency Management had last certified the plan in June 1999, and the Putnam County Board of Commissioners had last certified it in October 1999. 15 The Florida State Warning Point is a 24-hour communications center that coordinates all State and local resources during an emergency.

Factual Information 8 Railroad Accident Report When Safety Board investigators interviewed the training coordinator for Putnam County Emergency Services (incident commander) after the accident, he said that he had had problems getting accurate information from Amtrak about the number of people on the train. He said that soon after he came on-scene, the conductor told him that 468 people were on board the train and gave him a “greeter list.”16 The incident commander said that the conductor also gave him a passenger list that showed the passengers’ locations by car and room, but the greeter and passenger lists did not match. He said that he and other emergency responders spent time attempting to verify the accuracy of the two lists. On April 19, Amtrak gave him a computer printout list with information that did not fully correlate with either of the other two lists. According to Amtrak, at the time of the accident, the passenger accountability procedures described in its Service Standards Manual for Management Employees were in place on the Auto Train, as well as its other long-distance, overnight, and reserved trains (including all Metroliner and Acela Express trains).17 (See appendix B for referenced procedures.) The passenger accountability procedures outlined in this manual, used in conjunction with the information from the updated passenger manifest, are intended “to ensure that the Conductor’s Ticket Collections Pouch provides an accurate list of everyone on-board who may not be ticketed or appear on the manifest.” Conductors are to fill out form NRPC 3085 for each person who does not have a ticket or does not appear on the manifest. One copy of this form is to be kept in the conductor’s ticket collections pouch and another copy is to be given to Amtrak station personnel at the next open, staffed station along the route. The Amtrak station personnel are to use this form to update the passenger manifest in the electronic reservation system. The incident commander said that he was never provided an accurate count of people on the train. During postaccident interviews, the Auto Train conductor told the deputy chief of Operations for Putnam County Emergency Services that 437 passengers, 3 infants, and 28 crewmembers, for a total of 468 people, had been on the train. By gathering information from Amtrak, Putnam County Emergency Services, and medical records, Safety Board investigators determined, about 5 months after the accident, that 446 people had been on the accident Auto Train. On June 6, 2002, Amtrak officials conducted a debriefing in Palatka, Florida, with representatives of all the emergency responder agencies involved in the accident, in accordance with 49 Code of Federal Regulations (CFR) 239.105. The debriefing had about 80 attendees (including a Safety Board representative) and was intended to determine the effectiveness of the emergency plans that were implemented; to critically review the roles, responsibilities, and performance of the agencies involved; and to 16 A greeter list shows the names of all those who made a reservation to travel on that train on that day. When the passengers arrive to board the train, they check in with an Amtrak employee who “greets” them and checks off their names. It is not uncommon for someone to make a reservation for a particular day and then not to show up. 17 See Amtrak’s Service Standards Reference Manual for Management Employees, Chapter 16 “Train Service Crew Functions and Accountabilities,” Part D “Passenger On-Board Record Procedures,” reissued November 2002.

Factual Information 9 Railroad Accident Report improve emergency planning and response to future accidents and incidents. Although the debriefing minutes prepared by Amtrak do not discuss the issue of passenger accountability, some of the emergency responders involved in the on-scene command structure stated during the debriefing that the emergency responders found it difficult to account for the passengers because of the different lists Amtrak provided. Injuries The derailment resulted in 4 passenger fatalities, 35 serious passenger injuries, and 104 minor passenger injuries. Amtrak on-board employees sustained one serious and one minor injury. One emergency responder received a minor injury. (See table 1.) Table 1. Injuries*

• Title 49 CFR 830.2 defines fatal injury and serious injury as follows: “Fatal injury means any injury which results in death

within 30 days of the accident.” “Serious injury means any injury which: (1) Requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; (2) results in a fracture of any bone (except simple fractures of fingers toes, or nose); (3) causes severe hemorrhages, nerve, muscle, or tendon damage; (4) involves any internal organ; or (5) involves second- or third-degree burns, or any burns affecting more than 5 percent of the body surface.” The minor injury category includes all other persons, not cited in the other injury categories, who were reported treated by area hospitals within 24 hours following the incident. Damage The 3rd through 23rd cars derailed during the accident. The first 16 cars in the train behind the locomotive units were Amtrak Superliner passenger cars; these were followed by 24 autorack cars. After the derailment, the locomotive units and first two passenger cars remained on the rails. The next 14 passenger cars and the 7 succeeding autorack cars derailed. The 7 derailed autorack cars remained generally in-line. The remaining 17 autorack cars stayed on the rails. (See figure 5 and table 2 for the postaccident disposition of the 2 locomotive units and the first 23 cars of the train.) Amtrak Employees Emergency Responders Passengers Total Fatal 0 0 4 4 Serious 1 0 35 36 Minor 1 1 104 106 Total 2 1 143 146

Factual Information 10 Railroad Accident Report Table 2. Information on postaccident disposition of the locomotive units and first 23 cars of the Auto Train. Figure 5. Postaccident disposition of 2 locomotive units and first 23 cars in accident train. (See table 2 for specific information concerning each locomotive unit and car.) Consist Number Car Number Car Type Car Orientation 1 838 Locomotive Not derailed 2 843 Locomotive Not derailed 3 39002 Transition Sleeper Not derailed 4 32502 Sleeper Not derailed 5 32084 Sleeper Over right-of-way, leaning to the right 6 32074 Sleeper Lying on right side, in ditch 7 32503 Sleeper Lying on right side, in ditch 8 33101 Lounge Lying on right side, in ditch 9 38052 Diner Car Lying on right side, in ditch 10 32501 Sleeper Lying on right side, in ditch 11 32100 Sleeper Lying on right side, in ditch 12 32090 Sleeper Lying on left side, perpendicular to right-of- way 13 34129 Coach Leaning 25°+/- to right, 45°+/- to right-of- way 14 34125 Coach Upright, perpendicular to right-of-way M.P. 722 No. 1 M.P. 722.24 No. 2 No. 3 No. 4 NORTH No. 5 No. 6 No. 7 No. 8 No. 9 No. 10 No. 11 No. 12 No. 13 No. 14 No. 15 No. 16 No. 17 No. 18 No. 19 No. 20 No. 21 No. 22 No. 23 No. 24 No. 25 APPROXIMATE START OF DAMAGED TRACK APPROXIMATE END OF DAMAGED TRACK LOCATION OF 36" CULVERT POINT OF DERAILMENT START OF CONCRETE TIE RETAINING WALL END OF CONCRETE TIE RETAINING WALL SCALE ( IN FEET) 0 25 50 100 N

Factual Information 11 Railroad Accident Report The disposition of the derailed cars, particularly the passenger cars, reflected the accordion effect of railcars when they derail, alternately folding together in parallel fashion, perpendicular to the track. (See figure 6.) 15 34126 Coach Lying on left side, 80°+/- to right-of-way 16 34120 Coach Leaning 25°+/- to left, 75°+/- to right-of-way 17 33100 Lounge Leaning 45°+/- to left, 55°+/- to right-of-way 18 38054 Diner Car Leaning 27°+/- to right, 45°+/- to right-of- way 19 9030 Autorack Derailed upright, 15°+/- to right-of-way 20 9031 Autorack Derailed upright, 15°+/- to right-of-way 21 9019 Autorack Derailed upright, leaning to right 22 9035 Autorack Derailed upright, over right-of-way 23 9004 Autorack Derailed upright, over right-of-way 24 9036 Autorack Derailed upright, over right-of-way 25 9001 Autorack Derailed upright, over right-of-way Figure 6. Aerial view of derailment showing accordion effect of derailed cars.

Factual Information 12 Railroad Accident Report Amtrak estimated the cost of damage to the equipment at $8.13 million. About 1,000 feet of the main track was destroyed during the derailment, which required the installation of 25 1/2 track panels. CSXT estimated the cost of track damage at about $150,000. Personnel Information Amtrak Train-Operating Crew The train-operating crew for the Auto Train reported for duty at the Sanford Auto Train terminal at 3:00 p.m., about 2 hours and 8 minutes before the accident. The train crew18 for this train was two engineers,19 a conductor, and an assistant conductor. All train- operating crewmembers except the engineer were regularly assigned to this train. The engineer had been called from the extra list because the regularly assigned engineer was off duty. The 72-hour histories of all the train-operating crewmembers, including the engineer, indicated that their work schedules met Hours of Service Act requirements.20 Each operating crewmember had been promoted by Amtrak and was qualified over the Auto Train route. Both the engineer and the assistant engineer were certified according to Federal regulations.21 CSXT Track Maintenance Personnel Roadmaster. The roadmaster for this territory was one of seven who reported to the assistant regional track engineer in Jacksonville, Florida. The roadmaster’s territory was called “Pecan,” and it ran from Palatka to Sanford, Florida. The roadmaster was the local supervisor responsible for track maintenance through the accident area. He supervised an administrative clerk, a section foreman with associated trackmen, and a track inspector. The roadmaster requested, coordinated, and oversaw the surfacing gang foreman when the surfacing gang was in the roadmaster’s territory. The roadmaster was responsible for ordering and ensuring that all track material and ballast were available for work to be done. 18 In this report, “train crew” generally refers to the operating crew, including two engineers, the conductor, and the assistant conductor. The term does not include the on-board service managers or the on- board service personnel. 19 The Auto Train operates with two locomotive engineers. In this report, the engineer of record is referred to as the “engineer,” while the other engineer is referred to as the “assistant engineer.” 20 See 49 CFR Part 228. 21 See 49 CFR Part 240.

Factual Information 13 Railroad Accident Report The roadmaster was hired as a trackman on May 1, 1962, by a predecessor railroad and promoted to apprentice foreman in 1963. He became a track foreman in 1965, a rail gang supervisor in 1967, and a rail gang foreman 6 months later. In 1970, he was promoted to assistant roadmaster. He was promoted to roadmaster on June 1, 1974. He had been roadmaster for the railroad,22 including the accident area, since July 1977. Section Foreman. The section foreman was hired as a trackman on July 13, 1971. He subsequently became an apprentice foreman and then section foreman. He had been section foreman in the vicinity of the accident since 1977. Surfacing Gang. The surfacing gang was a regional asset and was sent to locations based on roadmaster requests and as directed by the assistant regional track engineer. The surfacing gang foreman was hired as a trackman on May 3, 1971. He had been a surfacing gang foreman since 1978. The foreman was familiar with the accident area. Although there were several surfacing gangs, this surfacing gang usually worked on the Pecan territory, including the vicinity of the accident. The surfacing gang consisted of a Mark III track liner-tamper machine23 operator, a ballast regulator machine operator, and the surfacing gang foreman. Track Inspector. The track inspector was hired as a trackman on December 7,

1. He became an apprentice foreman on March 9, 1971, and a foreman inspector on

March 21, 1972. On November 11, 1974, he was promoted to foreman. He was appointed as assistant roadmaster of Baldwin, Florida, on June 1, 1981, and as roadmaster on the Brooksville Subdivision at Tallahassee, Florida, on October 10, 1983. In October 1995, he transferred to the Pecan territory as a trackman. This employee had been the track inspector on the Pecan territory through the accident area for 6 years (since 1996) prior to the accident. Train Information Amtrak Auto Train P052-18 was about 4,000 feet long and weighed about 3,227 tons.24 The train consisted of a 2-unit diesel-electric locomotive25 followed by 16 Amtrak Superliner passenger cars26 and 24 loaded Amtrak autorack cars. Superliner cars weigh between 150,000 and 160,000 pounds (unoccupied). Autorack cars are unique to the Auto Train and are of three types: bi-level autocarriers, tri-level autocarriers, and tri- 22 The generic term railroad includes the entire system of track, together with stations, land, rolling stock, and other property used in rail transportation. 23 The Fairmont Mark III machine aligned and tamped the track in one operation. 24 This was the consist list weight and did not include the two locomotive units. The weight is approximate within 5 percent of actual weight. Passenger and automobile weights are not critical to train operation and handling because passengers and automobiles account for less than 5 percent of total train weight even if the train is fully loaded. 25 General Electric P40 “Genesis” locomotive units, AMTK 838 and AMTK 843. 26 Superliners: 8 sleeper cars, 2 dining cars, 2 lounge cars, and 4 coaches.

Factual Information 14 Railroad Accident Report level van carriers. Of the 24 autorack cars on Auto Train P052-18, 18 were bi-level autocarriers and 6 were tri-level autocarriers. Loaded bi-level autocarriers weigh about 122,000 pounds and loaded tri-level autocarriers weigh about 164,000 pounds. Superliner cars require electrical power from the locomotive units for air conditioning and lights. Placing the Superliner cars nearest the locomotive units in the Auto Train consist minimizes transmission distance and simplifies connections. Autorack cars do not have conduits and piping because they do not require electricity. Because the autorack cars are typically placed on the end of the train, they do not need to transmit electrical power. After the accident and prior to further movement, the locomotive units and the nonderailed car air brake systems were tested and inspected according to FRA regulations for Class I (49 CFR 238 Subpart D) and general locomotive (49 CFR 232.105) brake system safety requirements. The derailed cars had damage that precluded meaningful air brake tests, so they were not tested. The locomotive units and the first 2 cars were tested as a single block, and the last 17 autorack cars were tested as another block. The tested locomotives and cars functioned as designed. A review of the maintenance and service records for each Amtrak locomotive unit and car revealed no conditions that would affect dynamic movement. The train was equipped with a two-way EOT 23404 (Amtrak) Pulse Sentry II telemetry device.27 (Not all passenger trains are required to have two-way EOT devices. See appendix C for information concerning EOT regulations for passenger trains.) On April 23, 2002, Safety Board investigators tested the accident train EOT equipment at Sanford, Florida. The EOT equipment was mounted on the first postaccident northbound Auto Train, and the test was conducted prior to the train’s departure. The test train’s lead locomotive unit, AMTK 838, had been the lead unit of the accident train. The EOT device was the same one that had been in place on the end of the accident train. After the initial terminal train air brake test was complete, tests were conducted to evaluate the EOT device. The two-way EOT device functioned as designed by immediately initiating an emergency brake application at the rear of the train when the locomotive EOT device was activated. An additional test was conducted after a service brake application was made, in accordance with the accident event sequence as recorded by the event recorder. Again, the EOT emergency activation took place without delay when the locomotive EOT device was activated. The cars on the Auto Train had been equipped with a form of electronically activated pneumatic brakes. Amtrak had been using the electronically activated braking system on the Auto Train on a trial basis, but because the system had some reliability problems, it was disconnected and not being used at the time of the accident. 27 The engineer could make an emergency application of the train air brakes using the two-way EOT device by manually activating the EOT switch in the locomotive cab. At the time of the accident, the technology to enable simultaneous, automatic application of the brakes at the end of the train with the engineer’s emergency application of the brakes was not available. Since the accident, an automatic emergency EOT application feature has reached the final development stage and may soon be ready for testing and FRA approval for use.

Factual Information 15 Railroad Accident Report With electronically activated brakes, the signal to apply or release each car’s brakes travels much more quickly than it does with traditional pneumatically activated brakes. Electronic activation takes place virtually instantaneously, while pneumatic activation takes place at a speed of about 800 feet per second. The lag time that the pneumatic signal takes to move back through the train to apply (or release) the brakes is eliminated with an electronic signal. The electronically activated braking system installed on the Auto Train was redundant in that if the electronic system failed, the train could still be operated in normal full pneumatic mode. In addition, to ensure reliability in an emergency, when the Auto Train was operating in the electronically activated braking mode and the engineer placed the brakes in emergency, the signal would be sent pneumatically, in the traditional manner, through the trainline. Signal Information The derailment occurred on a single main track in traffic control system territory signaled for movement in both directions, between the north end of control point Seville,28 MP 725.6, and the south end of control point Huntington, MP 717.8. The traffic control system consisted of Union Switch and Signal (US&S) color-light wayside signals, US&S Model 23A power-operated switch machines, and coded and electronic track circuits controlled by the AA dispatcher in Jacksonville, Florida. Timetables, train bulletins, and wayside signal indications governed the method of operation. Postaccident investigation included examination of the dispatcher’s data log event recorder in Jacksonville and dragging equipment/hot box detector equipment at Orange City (MP 755.4), Barberville (MP 734.7), and Satsuma (MP 711.9).29 Operational tests were conducted at the south end of Seville (MP 727.5), the north end of Seville (MP 725.6), and north and southbound automatic signal 723. Switch obstruction and point detection tests were performed at the south and north ends of Seville. All signal equipment was found to function as designed. Track Information General The derailment occurred just inside the Putnam County line, near the town of Crescent City on CSXT single main track.30 Based on the visible on-site evidence, train crew testimony, and event recorder data, the point of derailment was MP 722.24. 28 Control points are specific geographic locations used to designate the limits of a train’s authority to occupy track. 29 This location was north of the accident site. 30 This was the CSXT Sanford Subdivision of the Jacksonville Service Lane.

Factual Information 16 Railroad Accident Report The bi-directional railroad track was maintained to FRA Class 4 track31 standards, which permitted a maximum authorized speed of 79 mph for passenger trains and 60 mph for freight trains. There was a permanent speed restriction of 60 mph for passenger trains for the curve where the derailment occurred.32 The train derailed in a 3-degree, 11-minute left-hand curve, northbound in the direction of the accident train movement. The total curve was 1,395 feet long and was located between MP 722.41 and MP 722.15. The circular curve body was 651 feet long, with spirals,33 each 372 feet long, at either end. The outside rail of the curve was designed to be 6 inches higher than the inner rail, which gave the curve a superelevation34 of 6 inches. The track was oriented geographically and by timetable in a north-south direction. The elevation or grade of the track through the accident area, from MP 724.08 to MP 721.80, varied between 0.19 percent descending to 0.73 percent ascending. Preaccident CSXT Inspections FRA regulations required that the accident area track be inspected twice a week.35 Employees designated by CSXT and qualified under FRA regulations conducted daily CSXT track inspections through the accident curve.36 The last preaccident CSXT daily track inspection over this area was conducted by the roadmaster, when he traversed southbound over the derailment area in a Hy-Rail vehicle37 late in the morning of April 18,

1. The roadmaster did not note any anomalies. Between 2:30 and 3:30 p.m. that day,

the roadmaster also traveled northbound over the derailment area, riding in the locomotive cab of Amtrak train 98. He noted no track deviations in the derailment area at that time. The CSXT track inspector for the accident curve was responsible for inspecting about 75 miles of track between Sanford and Palatka, Florida. The inspector had a “playbook” based on work-time standards that outlined the amount of time he was expected to spend on any given inspection task in his territory. The inspector stated that he thought he had enough time to conduct his inspections and that if he needed help he could 31 Railroad track is classified from Class 1, the slowest, to Class 9, the fastest, according to the maximum train speed it is designed to carry. The faster and higher the class of track, the heavier the track structure and the lower the tolerances for deviations from FRA regulation standards. 32 Railroads, like highways, have a general overall speed restriction but also designate lower speed limits for selected areas, such as curves, bridges, etc. 33 Railroad curves transition from straight or “tangent” track into “spirals” of track of gradually increasing curvature, which lead to the actual circular curve of fixed radius. As a train leaves a curve, the transition is reversed from curve to spiral to tangent. 34 Superelevation is the vertical distance that the outer rail is raised above the inner rail on a curve to resist the centrifugal force of moving trains. Superelevation acts like a banked roadway curve to balance the centrifugal forces. 35 See 49 CFR 213.233. 36 See 49 CFR 213.7. 37 This is an inspection made from a pickup truck or similar road vehicle equipped with retractable railroad wheels so that it can travel along the railroad track.

Factual Information 17 Railroad Accident Report request and obtain it. He said he inspected mainline track like that through the accident area from a Hy-Rail vehicle traveling 25 to 30 mph, during which time he also inspected parallel tracks, such as sidings. He inspected mainline track twice a week on nonconsecutive days, and he walked designated curves, including the accident curve, once every 3 months. An FRA track safety specialist reviewed CSXT preaccident track inspection records for the track between Palatka and Sanford for the period from April 2001 through April 18, 2002, as part of the investigation of this accident. Four exceptions were found regarding the track inspection records; the exceptions concerned the records’ failure to indicate that the CSXT inspector had been simultaneously inspecting the track being traversed, the siding, and/or the main track. Track Structure The track through the accident area consisted of anchored steel continuous welded rail (CWR) on treated wooden ties secured with tie plates38 and cut spikes. The inside curve rail was 132-pound39 rail made by Tennessee Steel in 1971 and installed at this location in 1993. The outside curve rail was 136-pound rail made by Bethlehem Steel in 1994 and installed in 1995. The rail lay on double-shoulder tie plates40 that were 7 3/4 inches wide and 14 inches long, secured by five 6-inch cut track spikes per tie plate, and distributed as three rail-holding and two plate-holding spikes. The tie plates rested on treated 7-inch by 9-inch wooden ties that were 8 feet, 6 inches long, with an average spacing of 19 1/2 inches between tie centers. The rail was longitudinally restrained by box anchoring41 every other crosstie. The rail anchors were predominantly Woodings spring- clip-type anchors with random Channel Loc drive-on-type rail anchors. (See figure 7 for a diagram illustrating the relationship between rail, rail anchors, ties, tie plates, and spikes.) FRA Track Safety Program and CWR The FRA regulations covering CWR are at 49 CFR 213.119. Title 49 CFR 213.119, “Continuous Welded Rail, General,” states, in part: Each track owner with track constructed of CWR shall have in effect and comply with written procedures which address the installation, adjustment, maintenance and inspection of CWR, and a training program for the application of those procedures, which shall be submitted to the FRA by March 22, 1999. 38 Tie plates are rectangular pieces of steel placed under the rail to distribute the weight of a train over a greater area of the tie than the base of the rail alone. 39 Railroad rail is designated by the weight of the rail in a 1-yard length; generally, the heavier the rail, the larger the rail. 40 A tie plate shoulder is a small raised portion of metal that forms a ridge next to the base of a rail to help properly position the tie plate and prevent the rail from shifting laterally. 41 Box anchoring places rail anchors on both rails across from each other against each side of a tie.

Factual Information 18 Railroad Accident Report The FRA reviews each plan for compliance with various general principles, which are detailed in the regulations for numerous aspects of CWR use, including installation, adjustment, anchoring, rail temperatures (during installation, repair, and maintenance), monitoring, appropriate speeds, inspection, training for employees working on CWR, and record-keeping, among other issues. The FRA enforces the railroad’s own CWR program, as detailed in the railroad’s written CWR plan and standards (if any). An FRA violation concerning CWR generally reflects the failure of a railroad to comply with its own CWR standards. Rail Anchors Rail anchors are an integral part of the track restraint system for CWR. Rail anchors prevent or restrict the longitudinal movement of the rail, localizing the compressive or expansive forces in the rail and allowing these localized forces to be uniformly distributed throughout the whole track structure. Without the restraint of sufficient, effective, and evenly distributed rail anchors, if ambient temperatures are high, the rail will expand and compressive forces may build up and overcome the lateral Figure 7. Diagram showing the relationship between ties, rails, tie plates, spikes, and rail anchors. The insert is a cross section showing how the rail anchor grips the rail. RAIL SPIKE TIE PLATE TIE RAIL ANCHOR

Factual Information 19 Railroad Accident Report restraint at the weakest point in the track, which may create a track buckle. Conversely, in extreme cold weather, unrestrained rail may contract to break at a weak point. To prevent such problems, rail anchors must be in good condition and properly placed. They must also retain their clamping strength and be tight against the side of the tie. After the accident, Safety Board investigators examined the track that was still intact to the north and south of the point of derailment. Of 1,550 ties inspected, 799 ties were required by CSXT to be box-anchored.42 Of these, 334 ties were missing one or more anchors or had one or more anchors that were not snug against the ties. Of the total 3,196 anchors required through the area inspected,43 622 were judged by postaccident investigators to be missing or not snug against the ties. In postaccident statements, CSXT track maintenance employees indicated that they considered the rail anchor pattern44 in the area of the accident curve prior to the derailment to be “standard.” The track inspector for the curve stated that “We’ve got some worn anchors out there but it—generally it was standard. There [were] a few anchors missing here and there.” He further stated, regarding the rail anchors, “Nothing, in my opinion, that was dangerous or wouldn’t hold, wasn’t doing its job, enough of them. There [were] adequate anchors.” Federal Regulations. The FRA requires that railroads with CWR have “rail anchoring or fastening requirements that will provide sufficient restraint to limit longitudinal rail and crosstie movement to the extent practical….”45 Industry Practices. With respect to recommended practices for rail anchor application and maintenance, the American Railway Engineering and Maintenance-of- Way Association’s (AREMA’s)46 Manual for Railway Engineering, published in 2001, states that rail anchors should be “full bearing against the tie or tie plate.” In his book Railroad Engineering,47 William W. Hay, Mgt. E., M.S., Ph.D., professor emeritus of railway civil engineering for the University of Illinois, Urbana, Illinois, stated that “If the anchor moves away from the tie, it loses its purpose and should be driven back to its proper position or removed and reapplied.” Rail anchor manufacturers instruct users to install rail anchors snug against the tie. 42 There are four anchors per tie (one anchor on each side of a tie for each rail). 43 Total computed as 799 ties times 4 anchors per tie. 44 Rail anchor pattern refers to the pattern used for distribution of the rail anchors along a section of track. In this case, the rail anchor pattern used was to box-anchor every other tie. 45 See 49 CFR 213.119(b). 46 AREMA is an independent industry association that sets recommended standards of practice for railroad construction and maintenance. AREMA’s stated purpose is “The development and advancement of both technical and practical knowledge and recommended practices pertaining to the design, construction and maintenance of railway infrastructure.” 47 W.W. Hay, Railroad Engineering, 2nd ed., p. 588 (New York, NY: John Wiley and Sons, 1982).

Factual Information 20 Railroad Accident Report CSXT Standards. According to CSXT Maintenance Bulletin MWI 1113-01, Performance for Large Scale Track Work,48 if the volume of anchor deviations exceeds 1 percent at any 100 consecutive new ties requiring anchors, this qualifies as an anchor defect. Deviations include missing anchors, anchors not snug against ties, anchors not holding, and anchors not installed correctly. Rework limits require remedial action when the number of missing anchors at new ties reduces the standard anchor pattern by 10 percent or more within any 39-foot length of track. According to the CSXT assistant chief engineer for track maintenance, CSXT’s work performance standards for rail anchors noted above apply only to large system-wide production teams; CSXT local maintenance crews are not required to adhere to these standards. Instead, “normal maintenance practices” for crews on the local level are established empirically through on-the-job training. The local roadmaster and/or track inspector perform quality control on these crews’ operations as part of their normal duties. Roadbed The roadbed is the foundation on which the rails and ties of the track are placed. The roadbed distributes the weight of the train over the earth and provides a firm foundation for the track structure. The curve through the accident area was built on about 10 feet of earthen fill,49 which created an embankment for the track to cross a low area. The top of the embankment formed the railroad roadbed. After the accident, CSXT contracted with AMEC Earth and Environmental, Inc., a geotechnical survey group headquartered in Nashville, Tennessee, to take accident curve and embankment soil-boring samples to determine whether any factors that could have weakened the subgrade were present. The borings included samples taken from down the center of the track. The drilling revealed 3 to 5 feet of ballast below the top of the ties, with dense sand underneath.50 The earth beneath and around the embankment was made up of sand with silt clay and sand over highly plastic clay. The contractor found no zones of extremely loose or soft material in the borings. The curve embankment was bordered at the base by drainage ditches on each side connected by a drainage culvert through the fill. A 36-inch-diameter cast-iron culvert ran perpendicular to and underneath the track about 150 feet north of the point of derailment (MP 722.24). The culvert had about 7 feet of fill cover above it. The culvert was undamaged and its ends were clear of debris. 48 Specialized non-local work gangs that are maintained at the regional or system level usually perform large-scale track work. 49 The fill was measured from the ditch line to the top of the subgrade. 50 These samples were taken after CSXT had widened the roadbed following the accident to accommodate an access road. A 3-D laser survey was also conducted after the accident for roadbed areas just north and south of the accident site. The survey results indicated that the soil-boring findings with respect to embankment depth were representative of preaccident conditions at the accident site. (The engineering firm Phillips & Jordan, Inc., was in charge of the laser survey.)

Factual Information 21 Railroad Accident Report After the accident, the CSXT chief regional engineer for the Jacksonville District stated that the area of the derailment/culvert had a relatively narrow roadbed. He was also asked if he had any idea how the roadbed became narrow. He stated: Well, in a lot of the cases, our roadbeds become narrow because we continue to elevate the track by surfacing our track and raising the track structure. And that narrows up the amount of slope we’ve got for the retaining of ballast. That’s in a lot of cases. CSXT has no requirement to maintain one specific roadbed width; instead, it requires roadbed widths to be adequate to support the ballast section. CSXT standard engineering plan 2601, “CSXT Roadbed Sections for New Construction,” requires a 30- foot roadbed width15 feet to each side from the centerline of the track at the top of the subgradefor single main tracks, sidings, and heavy tonnage tracks. Ballast The term “ballast section” refers to the total cross-sectional area of the ballast, including the ballast between the ties, under the ties, and off the ends of the ties. The ballast that extends out51 beyond the ends of the ties at the same height as the tops of the ties and then slopes down to the sub-ballast or roadbed at a “natural” 2 to 1 ratio is called the “shoulder ballast.” Based on AREMA testing, the shoulder ballast provides about 20 percent of the track’s lateral restraint and the ballast around and underneath the ties accounts for the remaining 80 percent. The track at the point of the derailment and much of the track through the curve was destroyed in the derailment, which precluded exact measurement of some dimensions of the ballast section. Postaccident observations by Safety Board investigators of the intact track to the north and south of the point of derailment showed that, in many places, the ballast did not fill the tie cribs52 between the crossties. Many cribs were half full in the center and less than half full toward the ends. There was little or no ballast off the ends of the ties (shoulder ballast), particularly on the inside of the curve. (See figure 8 indicating the ballast condition of track in the area of the accident.) In postaccident statements, the CSXT chief regional engineer for the Jacksonville District stated that (prior to the installation of a ballast-retaining wall on March 6, 2002) the ballast on the inside of the curve was “lean” and less than the minimum standard but that the outside curve ballast exceeded 12 inches. During postaccident interviews, the CSXT track inspector for the accident curve said that (prior to the installation of a ballast- retaining wall on March 6, 2002) the ballast was not up to standard because it was on a steep embankment. He said, “It wasn’t maintained to standards with the 12 inches of ballast on the high side and 6 inches on the low, two-to-one.” 51 Perpendicular to the longitudinal axis of the track. 52 The tie crib is the space between two ties.

Factual Information 22 Railroad Accident Report Figure 8. Ballast conditions in accident curve.

Factual Information 23 Railroad Accident Report FRA Regulations. The FRA regulation regarding ballast (general), 49 CFR 213.103, states: Unless it is otherwise structurally supported, all track shall be supported by material which will- (a) Transmit and distribute the load of the track and railroad rolling equip- ment to the subgrade; (b) Restrain the track laterally, longitudinally, and vertically under dynamic loads imposed by railroad rolling equipment and thermal stress exerted by the rails; (c) Provide adequate drainage for the track; and (d) Maintain proper track crosslevel, surface, and alinement. Industry Practice. The recommended railroad industry practice for ballast in the AREMA Manual for Railway Engineering, published in 2001, states: 2.1.1.5.2.2, Ballast Section Shoulder Width (BSW) The BSW is proportioned in accordance with Chapter 16, Economics of Railway Engi- neering and Operations, Part 10, Construction and Maintenance Operations and is to pro- vide additional lateral strength to the track. The measure is made from the end of the crosstie to the point of beginning of the Ballast Side Slope (BSS), and is made in the plane of the top of the crosstie. A value for BSW of not less than 12-inches is recommended for standard gage construc- tion of CWR in main track service or as may be defined by individual railway company standards. 2.1.1.5.2.3, Ballast Side Slope The BSS run component of the ballast section is proportioned to provide confining pres- sure to that part of the ballast section expected to transmit the vertical load from the bot- tom of the crosstie to the top of the sub-ballast. The BSS run component is measured in the plane of the top of the crosstie, and the rise component is measured perpendicular to the run component. A BSS value of 2:1 is commonly used. CSXT Standards. The CSXT Engineering Department Field Manual, dated July 21, 2000, page 13, Subpart D – “Track Structure, Parts a, b, c, and d, 103.0.0 Ballast; General,” states: Ballast section will be maintained in accordance with Standard Plan 2602 with particular attention to maintaining proper ballast section and drainage at or around road crossings, turnouts, and rail crossings at grade. CSXT Standard Engineering Plan 2602 requires that the ballast shoulder extend 6 inches straight out from the end (and level with the top) of the ties to the shoulder slope on tangent (straight) track and on the inside of curves, and 12 inches on the outside of curves. The 12-inch (outside curve) width is to continue into the tangent at each end of the curve for 100 feet and then to taper to 6 inches in the succeeding 50 feet.

Factual Information 24 Railroad Accident Report Track Maintenance Shoulder Ballast Cleaning. From September 18 through October 13, 2000, CSXT conducted shoulder ballast cleaning operations on the railroad, including the curve through the accident area. The shoulder ballast cleaning was intended to improve the drainage of the track. Fouled or clogged ballast can trap water and create soft spots under the track. In some soil conditions, like those found in the coral sand of Florida, the fouling material can also form a hardpan of cement-like material. A shoulder ballast cleaning machine removes fouled ballast from the shoulder area of the track, cleans the ballast, and returns the cleaned ballast to the shoulder, allowing water to drain out and away from the track. Within a few months of the fall 2000 CSXT shoulder ballast cleaning, the track through the accident area experienced ballast retention problems that prompted CSXT maintenance activities. (See appendix D for a chronological list of track maintenance operations on the accident curve following the shoulder ballast cleaning.) According to the local CSXT track supervisors and inspector, the ballast was migrating down the inside of the curve embankment. No problems were recorded concerning ballast retention on the outside of the curve. Because of the loss of ballast on the inside, the tie ends to the inside of the curve would drop, causing the outside tie ends to rotate upwards, increasing the superelevation. Surfacing. Surfacing is the process of raising the track and leveling it on the roadbed while simultaneously aligning it into place. The surfacing process is typically accompanied by the addition of new ballast and/or the reapplication of ballast recovered from off the sides of the track, which is then tamped between and around the ties. Between January 2001 and April 18, 2002, CSXT maintenance crews repeatedly surfaced the accident curve to reestablish the correct superelevation and maintain the track geometry. The regional surfacing gang mechanically surfaced the track through the accident curve with a track liner-tamper machine53 (and ballast regulator) on October 9 and 11, 2001; November 19, 2001; February 26, 2002; and March 11, 2002. On at least four occasions between October 2001 and April 18, 2002, local track maintenance crews spot- surfaced54 the track using hand-powered tamping tools. When the surfacing gang foreman was asked after the accident if it was unusual to surface the same area of track repeatedly within 6 months, he said it was “not really standard” and “that would indicate a problem.” 53 The Mark III track liner-tamper machine used in this area aligned and tamped the track in one operation. 54 Spot-surfacing refers to surfacing parts or short sections of track.

Factual Information 25 Railroad Accident Report On October 9, 2001, the regional CSXT surfacing gang began surfacing the accident curve, starting south of the southern end of the curve and moving north (MP 722.5 though MP 722.1).55 This was the only time in the 7 months preceding the accident that the entire curve was surfaced. All subsequent surfacing operations on the curve consisted of surfacing shorter sections of track. The surfacing gang foreman stated that the entire curve was to be surfaced with a 1-inch raise, using available ballast from the track. At the time of the work, the rail temperature was noted as 92° F. After the track liner-tamper machine had measured the curve and the ballast regulator had made an initial pass, the liner-tamper machine surfaced and aligned the south spiral of the curve and the curve itself. Upon beginning the north spiral, the foreman noticed that the track liner-tamper machine was not lining the track properly. He said that the machine was taking the north end of the curve too much to the outside. The foreman made some manual adjustments to line the track back toward the inside of the curve, and the surfacing gang used the liner-tamper machine to line the track in the manual mode. A 25-mph slow order was then placed on the track in that area. After the track liner-tamper machine was repaired, the surfacing gang returned 2 days later, on October 11, to finish and reline the north end of the curve, beginning around where the gang members had initially noticed the problem with the machine. The surfacing gang foreman stated that the machine double-tamped the ties (on a single pass of the machine) and that the gang was able to get 6 inches of ballast on the inside of the curve. This work involved the end of the curve and the north curve spiral for about 450 feet. After the accident, the surfacing gang foreman was asked if he felt confident the curve had been put back in its proper position and alignment by this surfacing work. The foreman replied, “No, sir, I don’t feel that we got the curve back to where it was supposed to be. That’s the reason why I recommended that they leave the 25-mile-an-hour slow order on there.” The foreman further stated that to properly prepare the curve for 60-mph traffic, the entire curve needed to be relined. On November 19, 2001, the surfacing gang machine spot-surfaced portions of track near the north end of the curve (about MP 722.21 to MP 722.1). The foreman said, “I think that we mainly started in the body of the curve and come to the north end.” The gang did not reline the entire curve. The foreman recorded an ambient temperature of 75° F and a rail temperature of 83° F. Following this work, the slow order for this area was removed. All surfacing requires breaking the tie-ballast bond when the track is raised and aligned. As such, surfacing “disturbs” the track. According to CSXT rules at the time of the accident, a “Track Disturbance Report” must be filled out and submitted at the end of the month whenever the track is disturbed (such as when rail repairs, tie installation, or surfacing is conducted) if the rail temperature is below 100° F in a geographic region 55 A CSXT assistant track inspector stated that he unloaded 6 to 8 carloads of ballast in the curve in October 2001, prior to the October 9, 2001, surfacing operation. The section foreman stated that he unloaded an estimated three cars of ballast in the curve sometime during 2001. The exact locations of the ballast applications were not identified in either case. CSXT did not provide the Safety Board with written documentation verifying that these ballast applications had taken place.

Factual Information 26 Railroad Accident Report south of North Carolina and Tennessee.56 The roadmaster uses the reports to identify areas that need additional attention, and the reports may be used for follow-up rail adjustment. No Track Disturbance Reports were filed with CSXT for the October and November surfacing operations. The surfacing gang foreman stated that he completed Track Disturbance Reports for the October and November 2001 work, but he did not submit the reports at the end of each month as required. On February 5, 2002, hand-tamped surfacing was conducted for MP 722.3 through MP 722.1. As a consequence of this work, a slow order was established for MP 722.3 though MP 722.1. This slow order remained in effect through March 13, 2002, because of successive maintenance activities on this section of the track during this period. On February 26, 2002, the regional surfacing gang, under the supervision of the local section foreman,57 performed more machine spot-surfacing on the accident curve from MP 722.3 through MP 722.1. According to the section foreman, they tamped the track twice “because it would not stay up.” The recorded rail temperature was 90° F, and the ambient high and low temperatures that day were 75° and 45° F, respectively. Section 119.786 of the CSXT Engineering Department Field Manual states that “Where a curve over 1° in CWR track will be disturbed at a rail temperature of 50° F or below, the Roadmaster or his designated representative will set reference stakes within the area to be disturbed at [specified locations] before work is performed.” Using the reference points provided by the stakes, the roadmaster is to record the amount of movement between 10 and 15 days after the work has been completed. The term “monumenting”58 is often used to describe such activities. In accordance with section 119.786, the track was not monumented during the February 26 surfacing work. On February 27, the ambient high and low temperatures for the area were 68° and 36° F, respectively. By February 28, the ambient high and low temperatures for the accident area were 55° and 36° F, respectively. During a postaccident interview, the assistant chief engineer for track maintenance stated, “In retrospect, had it been recognized that the temperature could possibly get that low the night the track was surfaced [the night of February 26 and 27], we could possibly have gone out and staked the track.” He further stated, “If you don’t monument the track prior to the work being done, you’ve lost any legitimate reference point. You know, you can’t reference back to something after you’ve changed it.” The CSXT chief regional engineer for the Jacksonville District stated that he had inspected the derailment curve with the roadmaster and the regional engineer on March 1,

1. He said he was briefed on a plan of building a “ballast-retaining wall” in early

March 2002, and he was asked his opinion. He said he thought it was worth attempting. 56 North of these geographical limits, a Track Disturbance Report would be required if the track were disturbed and the rail temperature were below 90° F. 57 The local section foreman substituted for the surfacing gang foreman, who was in training. 58 Monumenting consists of establishing known reference points against which any subsequent movement of the track can be measured.

Factual Information 27 Railroad Accident Report On March 6, 2002, the track inspector had the local track maintenance personnel construct a ballast-retaining wall of used concrete ties along the inside of the curve. Regional engineering managers were aware of this operation. Used concrete crossties were placed on the inside of the curve about 4 feet below the track level (the embankment was about 10 feet high at this location) to form a shallow, ballast-retaining wall. Concrete crossties were stacked 2 ties high (creating a wall about 16 inches high) end-to-end on the inside of the curve down from the toe of the shoulder ballast slope for about 240 feet along the track. The concrete ties were not secured into the embankment. (The point of derailment was near the south end of the ballast-retaining wall.) A number of CSXT maintenance and management personnel familiar with this section of track indicated that the ballast-retaining wall appeared to prevent further ballast migration down the slope. They also indicated that the ballast section on the curve was holding to standard after the wall was constructed. (See figure 9 for a representation of the relative location of the ballast-retaining wall, showing the general relationship between various roadbed and track elements.) On March 8, 2002, three-quarters of a hopper car of ballast, about 70 tons, was spread on the north end of the accident curve. (The section foreman’s personal notes documented this ballast application.) On March 11, 2002, the regional surfacing gang conducted machine spot-surfacing from MP 722.3 to MP 722.2.59 During this operation, the surfacing gang used the ballast Figure 9. Conceptual drawing of cross section of the roadbed in the accident curve showing the estimated location of the ballast-retaining wall, as well as some roadbed, track, and ballast section elements. 59 Because no Track Disturbance Report was filed on this work, this information came from the surfacing gang foreman’s notes. Approx. Scale: 1/4" = 1' 5' 10' 8'6" TIE 6" 12" BALLAST FILL SAND FILL RAIL CSX standard ballast profile for curve (2:1 slope) 6" BALLAST CSX standard inside shoulder ballast width CSX standard outside shoulder ballast width Superelevation Approximate location of ballast-retaining wall

Factual Information 28 Railroad Accident Report that had been deposited on March 8 to help establish the track. The liner-tamper machine started in the body of the curve and moved northward through the spiral of the curve to create a 1-inch lift. Because the surfacing gang foreman “forgot to make out a Track Disturbance Report,” he did not record any rail temperature. (See figure 10 for a visual representation of the relative locations of the surfacing work carried out on the curve between October 9, 2001, and March 11, 2002.) The Florida Department of Transportation railroad track safety inspector walked the accident curve on April 8, 2002, before conducting a Hy-Rail track inspection on April 9, which was his last inspection in the accident area before the derailment. He said that during his walking inspection, he found an area60 where crossties needed to be replaced, and he contacted the CSXT track inspector. The CSXT track inspector placed speed restrictions of 30 mph for passenger trains and 25 mph for freight trains over the affected track. The Palatka track maintenance crew repaired the track by installing five crossties the same day at MP 722.4. After replacing the ties, the maintenance employees spot-surfaced the area, hand-tamped the ballast, and dressed it with a backhoe and by hand. The section foreman recorded the rail temperature as 92° F. During his April 8 and 9 inspections, the Florida Department of Transportation railroad track safety inspector noted no exceptions to the track ballast or rail anchor conditions, and he did not note any rail movement. Figure 10. Relative locations of machine surfacing operations conducted on the acci- dent curve between October 9, 2001, and March 11, 2002. 60 About 300 feet south of the subsequent point of derailment. MP 722.1 MP 722.5 MP 722.24 POD N .1 .5 10/9/01 .1 .3 10/11/01 .1 .2 11/19/01 .1 .3 2/26/02 .2 .3 3/11/02

Factual Information 29 Railroad Accident Report Postaccident FRA and State Track Inspections After the accident, it was not possible to inspect the track at or about the point of derailment (MP 722.24) because the track structure was destroyed. However, an FRA track safety specialist inspected the CSXT track in the accident area to the south of the derailment, from MP 723.0 to MP 722.3, and found 22 exceptions or defects that did not meet FRA Class 4 Track Safety Standards. Four of the exceptions were for more than the allowable number of defective ties per 39 feet of straight track. Three of these four exceptions were located between MP 723.0 and MP 722.8, with the fourth at MP 722.3. Seven other exceptions were for more than the allowable number of defective ties per 39 feet of curved track (greater than 2 degrees) between MP 722.7 and MP 722.6. Based on these exceptions, FRA regulations required the track classification to be reduced to Class 3 for the affected areas. Eleven exceptions were noted for a metal object between the base of the rail and the tie plate, which would cause an undesirable concentrated load. These exceptions were spread over the .7 mile of track inspected, and FRA regulations required the track classification to be reduced to Class 2 for the affected area. A Florida Department of Transportation track safety inspector inspected the track from MP 722.0 to MP 721.5 (north of the point of derailment) after the accident, and he found five track defects that did not meet FRA Class 4 Track Safety Standards. All five of these track defects were for a metal object between the base of the rail and the tie plate (tie plate shoulder). FRA regulations required that the track classification be reduced to Class 2 within the affected area. CWR Temperature Control CWR is subject to mechanically induced outside forces when loaded and to thermally induced internal forces from expansion or contraction. CWR must be longitudinally restrained to prevent rail movement caused by these mechanical and thermal forces. Longitudinal restraint in CWR generally takes the form of additional rail anchors and ballast; elastic clips in lieu of rail-holding spikes; and/or more, larger, or heavier ties. When the longitudinal mechanical and thermal compressive forces in CWR build to a point at which they exceed the track structure’s ability to restrain them, a track buckle will occur. According to AREMA, the magnitude of force that may be developed within CWR, independent of its length, is the product of the difference in temperature between the “neutral rail temperature”61 and the current rail temperature, multiplied by the cross- sectional area of the rail and the factor of 195 pounds per square inch (psi).62 In the daytime, rail temperature is commonly about 30° F above the ambient temperature. 61 This is the same as the anchoring temperature. 62 The internal stress of restrained rail is the product of the coefficient of expansion and the modulus of elasticity of the steel, times the change in temperature.

Factual Information 30 Railroad Accident Report Thermally induced longitudinal rail forces result when restrained CWR seeks to expand or contract beyond its force-free or neutral rail temperature state. The neutral rail temperature is the temperature of the steel rail under conditions free of internal forces due to thermal stress or strain. Because any difference in rail temperature from the initial laying (or adjusting) temperature, when the rail is anchored or restrained, determines the magnitude of the thermally induced internal longitudinal rail forces, the proper selection and control of CWR installation temperature is very important. Consequently, each railroad develops its own well-defined CWR installation—or neutral rail—temperatures for different geographical and climatic locations. These temperatures are intended to minimize the thermally induced internal longitudinal rail forces throughout the range of seasonal temperature change. The CSXT neutral rail temperature for the accident area was 100° F. If the rail temperature is below the designated neutral temperature at the time of CWR installation, the rails are artificially heated to the neutral temperature and then immediately anchored. Conversely, if the rail temperature at the time of CWR installation is above the neutral rail temperature, the rail is cooled, usually by spraying it with a coolant, and then anchored. Without track maintenance, neutral rail temperature will change over time due to movement of the track as the track structure degrades due to the effects of rail traffic and weather. Curved track is more susceptible than straight track to changes in neutral rail temperature. Theoretically, properly constructed and maintained CWR track should not move, and neutral rail temperature should remain unchanged. However, on a practical basis, some movement usually occurs, particularly in curves. The centrifugal forces produced by trains traveling around a curve and the thermal movement of the track (often called “breathing”) with seasonal temperature variation will change the neutral rail temperature. It is common for railroads to realign some curves and adjust the rail every spring because track will not expand exactly back to the position it held before it contracted during the winter, thus altering the rail’s free force or neutral temperature condition. Neutral rail temperature can also change as a result of maintenance activities such as surfacing. As has been described, surfacing involves raising the track and leveling the roadbed on which it rests and then aligning the track back into place. Raising the track from the roadbed breaks the restraining bond of the ties and the ballast, which allows the rail to expand or contract to a new force-free neutral rail temperature.63 If the surfacing involves a length of track that is five or fewer ties long (“spot surfacing”), the neutral rail temperature may not significantly change. However, if the surfacing involves longer lengths of track, the force-free or neutral temperature will likely change significantly, especially if the difference between the current rail temperature and the designated neutral rail temperature is great. Under such circumstances, the CWR should be adjusted. 63 Even though the rail may still be anchored, the rail of the lifted track is free of restraint because only the ties and anchors are attached to the freed rail. Nothing restrains the rail’s longitudinal movement.

Factual Information 31 Railroad Accident Report Rail is adjusted by removing rail anchors, heating or cooling the rail and/or adding or removing small sections of rail, and then reanchoring the rail. The rail in curved track can also be adjusted by lining the curve outwards. Failure to adjust rail that has been disturbed may result in a track buckle later when the weather becomes warm enough that the difference between the new force-free (neutral) rail temperature and the current rail temperature is so great that the track structure cannot be restrained. Railroads attempt to adjust rail that has undergone documented maintenance activities at the earliest opportunity (usually in the spring before the first hot weather occurs). According to the CSXT roadmaster for the Crescent City accident area, local track maintenance forces usually start adjusting rail that has been disturbed during the winter season when the ambient temperature starts to warm to the upper 80s (° F), usually in April. Operations Information The derailment occurred on the CSXT Sanford Subdivision, which was controlled by the CSXT train dispatcher in Jacksonville, Florida. The Auto Train is listed on Amtrak train schedules as train Nos. 52 and 53. Two Auto Train train sets travel between Sanford, Florida, and Lorton, Virginia; one train runs each way daily. The northbound schedule calls for a departure from Sanford at 4:00 p.m. for an arrival in Lorton at 8:30 a.m. the next day. Auto Trains make no scheduled intermediate station stops, except to change operating crewmembers at Florence, South Carolina. Including the Auto Train, Amtrak operates seven scheduled passenger trains on the CSXT Sanford Subdivision each day, Monday through Saturday. Six trains are operated on Sunday. Four of these trains, Nos. 91 and 92 (the Silver Star) and Nos. 97 and 98 (the Silver Meteor), operate between New York City and Miami, Florida. These trains are similar to each other in equipment and consist. Train Nos. 1 and 2 (the Sunset Limited) are operated between Orlando, Florida, and Los Angeles, California. These trains run on alternating days, No. 1 on Tuesdays, Thursdays, and Saturdays; No. 2 on Mondays, Wednesdays, and Fridays. Passenger traffic through the accident area totaled 48 trains per week, while freight traffic totaled 74 trains per week. Freight train traffic volume for the 12 months before the accident was 18.89 million gross tons. CSXT classified this track as heavy tonnage track. The closest passenger station to the accident location is Palatka, Florida, which is about 24.2 miles north of the accident location. De Land, Florida, which is the nearest passenger station to the south, is about 27.8 miles from the accident site.

Factual Information 32 Railroad Accident Report Meteorological Information At 4:53 p.m. on April 18, 2002, the weather conditions at Daytona Beach (about 28 nautical miles from Crescent City) were reported by the National Climatic Data Center as: winds at 9 knots with gusts to 15 knots; visibility 10 miles; few clouds at 3,000 feet; temperature of 80.6° F. By 5:53 p.m., the temperature had fallen to 78.8° F. The day was mostly sunny. On April 20, 2002, at 2:42 p.m., the rail temperature at the accident site area was recorded as 120° F, and the ambient temperature was 88° F. The day was partly sunny. On April 24, 2002, at 5:00 p.m., the rail temperature was measured at 108° F, and the ambient temperature was 83° F. The day was partly sunny. On April 25, 2002, at 1:00 p.m., the rail temperature was 108° F, and the ambient temperature was 86° F. At 2:00 p.m., the rail temperature was 120° F, and the ambient temperature was 86° F. At 5:00 p.m., the rail temperature was 120° F, and the ambient temperature was 87.8° F. The day was partly sunny. Between April 1 and April 18, 2002, maximum daily high temperatures in the Crescent City area ranged from 73° to 89° F. The minimum daily low temperatures ranged from 57° to 71° F. In the days immediately following the accident, the expected high temperatures ranged from 83° to 88° F. Table 3 shows the high and low temperatures in the Crescent City area for each of the days when the curve was mechanically surfacedOctober 9 and 11, and November 19, 2001; and February 26 and March 11, 2002as well as for the 3 days following each surfacing operation.

Factual Information 33 Railroad Accident Report Table 3. High and low temperatures recorded in the Crescent City area for the days when surfacing work took place on the accident curve (in boldface) and the 3 days following each surfacing operation. (Source: Record of River and Climatological Observations, National Climatic Data Center, Asheville, North Carolina.)

• Asterisk indicates that temperatures were recorded at Daytona Beach, Florida, rather than Crescent City, Florida.

Toxicological Information Complete medical records for the Amtrak Auto Train engineer and assistant engineer were obtained from Amtrak and provided to the Safety Board’s Medical Officer for review. No medical condition or use of prescription medication likely to cause performance degradation was found. The four members of the train’s operating crew provided blood and urine samples for toxicological testing pursuant to 49 CFR Part 219, Subpart C. Northwest Drug Testing of Salt Lake City, Utah, conducted the testing. Samples were screened for cannabinoids, cocaine, opiates, amphetamines, methamphetamines, phencyclidine, barbiturates, benzodiazepines, and ethyl alcohol. All results were negative for the presence of alcohol and cited drugs. Day High Temperature (° F) Low Temperature (° F) October 9, 2001 81* 71* October 10 79 61 October 11 87 64 October 12 80 64 October 13 89 70 October 14 84 64 November 19, 2001 75 58 November 20 71 57 November 21 75 57 November 22 77 61 February 26, 2002 75 45 February 27 68 36 February 28 55 36 March 1 66 48 March 11, 2002 74 53 March 12 84 56 March 13 79 54 March 14 78 54

Factual Information 34 Railroad Accident Report Disaster Preparedness Area Emergency Response Training On December 17, 1991, Amtrak train 87, the Silver Meteor, derailed in Palatka, Florida, which, like Crescent City, is in Putnam County. The derailed train struck two homes and blocked the street north of the Palatka Station.64 There were no fatalities. Eleven passengers were seriously injured and 41 sustained minor injuries. Five operating crewmembers and four on-board service employees sustained minor injuries. Because of this prior Amtrak accident in the area, some emergency responders were already somewhat familiar with Amtrak equipment. On September 19, 1997, an Amtrak emergency preparedness manager provided Passenger Train Emergency Response training65 to 63 members of various emergency response agencies in Putnam County. Personnel who received the Amtrak training and responded to the Crescent City derailment included the chief of the Crescent City Fire Department, who was the initial incident commander; the training coordinator for Putnam County Emergency Services, who was the final incident commander; and the Putnam County Sheriff’s Office communications captain. Amtrak subsequently provided similar training to emergency responders from the surrounding counties. Amtrak Personnel Emergency Preparedness Training Amtrak has developed an emergency preparedness training program for its crewmembers as required by 49 CFR Part 239. Amtrak has named this training program “PREPARE” (Passenger Railroad Emergency Preparedness And Response Education). The purpose of this 8-hour course is to prepare operating crewmembers and on-board employees to respond to a train emergency. Amtrak provided Safety Board investigators with the emergency preparedness training records for all the Amtrak employees on the accident train. According to these records, all four operating crewmembers66 had attended the PREPARE training in the 3 months prior to the accident. Of the 24 Amtrak on-board service personnel, 17 had received Amtrak’s PREPARE training between January and March 2002, 5 had received the training in December 2000, and 1 received the training in April 2000. One on-board service person did not receive the PREPARE training prior to the accident. 64 National Transportation Safety Board, Palatka, Florida, December 17, 1991, Railroad Accident Report NTSB/RAR-93/02* (Washington, DC: NTSB, 1993). 65 SAFE 015 course. 66 Engineer, assistant engineer, conductor, and assistant conductor.

Factual Information 35 Railroad Accident Report Auto Train Event Recorder Information Each Auto Train locomotive unit event recorder was downloaded shortly after the accident, and investigators noted the times of the recorded events as indicated by the EOT device and the locomotive event recorders. Event recorder data from both the lead locomotive, AMTK 838, and the trailing unit, AMTK 843, indicated that the train was moving at 56 mph at the time of the initial brake application as the train approached MP 722. During the accident sequence, the event recorder on the lead locomotive unit recorded the trainline pressure at the rear of the train that was transmitted by the EOT telemetry device. The trainline air pressure at the end of the Auto Train was stable at 108 psi67 for several seconds after the first locomotive passed over the track buckle at 5:07:54 p.m. According to the event recorder information, the engineer initiated a service brake application at 5:07:57 p.m. He initiated an emergency brake application at the head end of the train at 5:08:01 p.m. By 5:08:02 p.m., the trainline pressure at the head of the train was 98 psi, the rear-end trainline pressure was 108 psi, and the train speed was 55 mph. At 5:08:04 p.m., the trainline pressure at the head of the train was zero and the rear-end trainline pressure was 108 psi. At 5:08:05 p.m., the pressure at the rear of the train dropped 2 psi to 106 psi and remained at 106 psi for 7 seconds. At 5:08:11 p.m., the EOT went into emergency. The trainline pressure at the rear end dropped to zero at 5:08:12 p.m. At 5:08:15, the engineer activated the EOT device. (See appendix E for more detailed event recorder information.) Survival Factors Superliner Passenger Car Windows Amtrak Superliner passenger railcars are fitted with exterior sidewall windows on both the lower and upper level decks. They are provided in two configurations, a nonremovable and a removable window design. The removable design is identified as an “Emergency Exit window” (pursuant to FRA requirements), from which the window panel can be extracted in an emergency. Both window designs fundamentally consist of a window glazing element fitted into a window frame. The window glazing consists of parallel, dual-pane, 1/4-inch-thick transparent monolithic polycarbonate glazing sheets, held together by an aluminum perimeter frame. There is 1/4 inch of airspace between the two glazing sheets. The window frame is kept in place by a rubber grommet fitted around the window perimeter, which is (on the outside of the railcar) somewhat round in cross section and protrudes about 1/2 inch beyond the plane of the railcar car body sidewall surface. Examination of undamaged Superliner railcars indicated that the edges of the window grommets, at the point of contact with the railcar car body sidewall panel, form a 67 The Auto Train trainline was set for 110 psi.

Factual Information 36 Railroad Accident Report tight fit against the railcar car body sidewall panel without any apparent gaps or voids, and the car body sidewall panels were observed to be square, true, and in plane, and without apparent warpage or other deformation. The exterior right-side sidewall panels of Superliner railcars #32074, #32503, #33101, #38052, #32501, and #32100 exhibited denting, abrasive markings, and battering damage. They also displayed obvious rounded indentions in the roofline between the transverse structural members of the roof. Such damage, which was most prominent in Superliner railcars #32501 and #32100, was consistent with a car body sidewall and roofline that had come into contact with objects along the railroad right-of-way and/or the terrain and/or damaged trackage right-of-way (track ballast, crossties, and/or running rail) during a derailment and subsequent rollover of the railcar. Examination of the damage indicated that the sidewall and roofline elements had become severely warped and displaced from their normal configurations, in a manner consistent with the action that could have contributed to the dislocation of the window grommets and the dislodgment of the window framing structures. Small tufts of vegetation and remnants of splintered trees (severed branches and clusters of leaves) of a character similar to the trees along the perimeter of the track right-of-way were also found embedded in crevices of the mangled window frame elements of several of the damaged Superliner railcars. Remnants of dislodged and splintered trees were found along the track right-of-way near where the Superliner railcars came to rest. Amtrak technical staff represented to Safety Board investigators that the damage sustained by the Superliner exterior sidewall window assemblies and their component elements in this accident was to a degree that was far beyond original intended design criteria. (See figure 11 for postaccident views of railcars with compromised windows.) Four passengers assigned to deluxe bedrooms in Superliner railcar #32100 who were inside the railcar prior to the derailment were found (by emergency responders) outside the railcar after the derailment. All four sustained fatal injuries. Two passengers assigned to deluxe bedrooms in Superliner railcar #32501 who were inside the railcar prior to the derailment were found (by emergency responders) outside the railcar, one fully and one partially, after the derailment. Both persons sustained serious injuries. Superliner Sleeper Car Folding Armchairs The deluxe bedrooms in Amtrak Superliner sleeper cars contain a folding armchair that is not secured to the floor or other attachment point. During the derailment, several armchairs became wedged in the doorways of deluxe bedrooms in cars that were on their sides. Two passengers reported that they were injured when they were struck by armchairs or when they were thrust out of armchairs and against some hard surface.

Factual Information 37 Railroad Accident Report The typical service location of the folding armchair is an open space of the deluxe bedroom, facing a sofa, in an area measuring about 4 feet by 4 feet. The armchair can be repositioned to accommodate the needs of the user or moved elsewhere in the railcar. When not needed, it can be folded and stowed, although it is usually in use during daytime operations and positioned in its normal service area. The armchair is constructed of a welded stainless steel frame structure, tubular stainless steel legs, an upholstered seat- Figure 11. Postaccident Superliner sleeper cars. Top photo shows car 32503 with dam- aged lower level sidewall windows and largely undamaged upper level windows. Bot- tom photo shows car 32100 with compromised sidewall windows on both levels.

Factual Information 38 Railroad Accident Report bottom cushion, an upholstered seatback cushion, and folding upholstered armrests. The chair weighs about 55 pounds. In its open configuration, it measures about 25 inches wide by about 28 inches deep by about 25 1/2 inches high. When folded, it measures about 23 inches wide by about 25 inches deep by about 10 inches high. The folding armchair cannot be readily moved through the sliding main access door of the deluxe bedroom without first folding it. (See figure 12 showing the folding armchair.) Investigators could find no regulatory requirements that specifically address provisions for folding armchairs in passenger railcars. Regulatory requirements addressing the category “interior fittings and surfaces,” which includes passenger railcar seating, are at 49 CFR 238.233. The regulations apply to passenger railcar equipment Figure 12. Exemplar of Superliner sleeper car folding armchair.

Factual Information 39 Railroad Accident Report “ordered on or after September 8, 2000 or placed in service for the first time on or after September 9, 2002.” These regulations state that “Each seat… shall be securely fastened to the car body….” All the passenger railcars involved in this accident went into service before September 8, 2000. Amtrak technical personnel told Safety Board investigators that they have received a proposal from a firm for a device that would provide anchorage for the armchair in its unfolded and folded configurations. Amtrak expects that the device, when installed, will fulfill the safety criteria detailed at 49 CFR 238.233. Testing and Research Track Forces Induced by CSXT Coal Train N16815 CSXT coal train N16815 had passed over the accident curve a few minutes before the Auto Train on the day of the accident. The coal train was traveling southbound, in the opposite direction of the northbound Auto Train, when it passed through the accident location at 39 mph. The coal train was made up of 2 six-axle locomotive units and 95 loaded coal cars with a gross trailing weight of 12,950 tons. (This was about 136 tons per car or 17 tons per wheel.) The cars were equipped with conventional body-mounted brake rigging and ABDW freight brake valves. When interviewed by Safety Board investigators, the coal train-operating crew reported the same general events, control inputs, and speeds that had been recorded in the recovered coal train event recorder data. The coal train crewmembers told investigators that the track in the accident area was not rough and that they experienced no track irregularities when they passed over it. The coal train crew recalled no abnormalities in train-handling or train slack.68 The crewmembers said they made no emergency applications of the coal train air brakes nor did they undertake any other braking activity while passing through the accident curve. Safety Board investigators conducted computer simulations for the CSXT coal train at the New York Air Brake (Knorr) Train Dynamic Services facility in Fort Worth, Texas, from July 15 through 18, 2002. Party representatives from Amtrak, CSXT, the FRA, and the Brotherhood of Locomotive Engineers were present. The CSXT coal train simulations were performed to determine whether the coal train had placed any excessive forces on the track in the area of the derailment prior to the passage of the Auto Train. Data from the coal train’s locomotive event recorder were used, as well as information concerning the track profile and the coal train’s equipment types and weights. The simulations were designed to show in-train forces. Some in-train forces are transferred to the track structure, but these simulations were not designed to show a direct relationship between the track and the in-train forces. 68 Train slack is unrestrained free movement between the cars in a train.

Factual Information 40 Railroad Accident Report The computer simulations indicated that because the coal train passed over the accident area with little change in control inputs and because the train was negotiating small changes in track curvature and grade, it imparted expected amounts of force to the track structure. No significant in-train forces were identified. Within their limitations, the simulations indicated that the coal train’s passage over the accident trackage in the minutes before the derailment had placed no unusual burden on the track structure. (The routine passage of a train that imparts relatively moderate force to the track structure may trigger a track buckle if sufficient weaknesses exist in the track’s structure or if there are problems with the track’s maintenance.) CWR-SAFE Program Track buckling is a phenomenon that occurs suddenly because of track instability. The main determining factors for track buckling are the lateral track resistance, which is largely influenced by the amount of shoulder ballast and the strength of the tie-ballast bond; the longitudinal rail force, which is primarily a function of the neutral rail temperature and rail anchor condition; and the track’s lateral alignment condition. To determine if a track buckle was feasible in the accident curve under the conditions at the time of the derailment, the Safety Board asked the Volpe Center in Cambridge, Massachusetts, to perform a track buckling analysis with a computer software program called “CWR-SAFE,” which had been developed for the FRA. The computer program determines the “allowable temperature increase” for buckling prevention and the buckling safety margin. CWR-SAFE also includes a program for risk-based buckling safety evaluation, with the key output being “probability of buckling versus rail temperature.” The Safety Board provided Volpe with factual track information to formulate the parameters for the buckling analysis. After assuming the parameters to replicate the site conditions, Volpe ran the computer model to reconstruct the neutral rail temperature that would result in a buckle. For track with wooden ties, assuming a relatively “weak” lateral resistance condition in line with the reported ballast conditions, recent surfacing, tie replacements for a 3-degree curve with Class 3 (1.75-inch) lateral alignment defects,69 and an estimated rail temperature (ambient temperature estimate of 85° F + 30° F) of 115° F at time of derailment, the analysis indicated that if the neutral rail temperature were between 60 and 65° F, the track may be prone to buckle. The graph in figure 13 shows the CWR-SAFE program results as a function of curvature for track with Class 3 line defects and a rail temperature of 115° F. The program indicated that the neutral rail temperature requirement for buckling was 62° F. Analysis was also performed for different conditions and parameters. Had the actual rail temperature at the time of the derailment been higher, at 120° F, then the neutral 69 Although the track in the accident area was classified as Class 4, postaccident track inspections required a reduction to Class 2; so, as an approximation, the intermediary Class 3 line defect assumption was used.

Factual Information 41 Railroad Accident Report Figure 13. Graph representing CWR-SAFE track buckling analysis (given a rail temper- ature of 115° F and Class 3 track). Minimum neutral rail temperature requirements for buckling prevention (Rail temperature = 115 o F; Class 3 line defect) 40 45 50 55 60 65 70 75 80 0 1 2 3 4 5 6 Minimum neutral rail temp. (˚F) required for buckling Crescent City derailment (≅ 62˚ F) PARAMETERS: PARAMETERS: Rail: 132 pound Ties: wood Tie spacing: 20 inches Ballast: granite Lateral resistance: 75 ppi (recently surfaced) Tie ballast friction coefficient: 1.2 Torsional resistance: 60 in-kips/rad/in Vertical modulus: 4000 psi Longitudinal resistance: 200 psi Line defect: 1.75 in. (Class 3) Rail temperature: 115° F

Curvature (degrees)

Factual Information 42 Railroad Accident Report rail temperature required for buckling would also have been higher by 5° F, or 67° F. Had the lateral alignment condition been “better” than the assumed Class 3, then the neutral rail temperature required for buckling would have been reduced. (For instance, had the alignment condition been Class 4, a reduction of 5° F would have resulted). Conversely, had the lateral alignment been “worse” (larger than 1.75 inch), the neutral rail temperature required for buckling would have increased. The CWR-SAFE program also showed that Class 4 accident track with a rail temperature of 120° F was similar with respect to buckling propensity to Class 3 track at 115° F. Postaccident Developments As a result of this derailment and a subsequent Amtrak derailment in Kensington, Maryland, the FRA conducted a “focused inspection” in August 2002 of all CSXT track on which Amtrak and commuter rail trains operate. In addition to their normal inspection activities, FRA inspectors were instructed to pay particular attention to CSXT’s procedures required under 49 CFR 213.119 concerning CWR track. According to the FRA’s audit report, of the 4,770 route miles inspected, 511 track miles did not conform to CSXT’s standard ballast section requirements. With respect to the Sanford Subdivision, of the 212 route miles inspected, 14.6 track miles did not conform to ballast section requirements. In addition, six substandard anchor locations were found on the Sanford Subdivision. The FRA issued numerous exceptions with respect to the results of this focused inspection. Also as a result of this accident and the subsequent Kensington derailment, CSXT provided refresher training (over and above annual training) to tamper operators and surfacing team supervisors, re-emphasized the need to submit Track Disturbance Reports, and re-emphasized the need to conduct track tamping procedures. CSXT also now requires that Track Disturbance Reports be submitted weekly rather than monthly. On July 31, 2002, CSXT issued Technical Bulletin 005, entitled Equipment Malfunctions During Surfacing Operations. Among other requirements, the bulletin stated that “if a tamper malfunctions during surfacing operations in a manner that adversely affects the quality of the raising, aligning, or ballast compaction,” the limits of the affected area, including the entire curve, must be checked and reworked if necessary with a fully functioning tamper machine. This technical bulletin remains in effect until replaced by a CSXT Maintenance of Way Instruction. After the Crescent City accident, CSXT widened the track roadbed through the accident area to a width of about 30 feet. The roadbed was extended to accommodate an access road parallel to the track.

43 Railroad Accident Report Analysis This analysis is organized into five main sections. The “Accident” section will discuss the events that took place on the day of the accident, as well as those issues that the Safety Board was able to exclude from involvement in the accident. The second main section will address “Track Condition and Maintenance” and discuss the environment and events in the years and months preceding the accident that led to the derailment. The remaining three sections, “Derailment Dynamics,” “Passenger Accountability,” and “Railcar Crashworthiness,” concern safety issues that developed as a result of the derailment. Accident Synopsis The Auto Train derailed on April 18, 2002, in a left-hand curve near Crescent City, Florida, about 5:08 p.m., about an hour after departing its origin point at Sanford, Florida, heading northward to its destination of Lorton, Virginia. The train made no station stops from 4:08 p.m., when it departed Sanford, until the accident occurred. The train stopped and waited on the mainline at Seville, Florida, till 5:00 p.m. for a CSXT southbound coal train to pass it. About 8 minutes later, while traveling in the curve outside Crescent City, the Auto Train engineer saw a track irregularity, which he referred to as a “kink,” just before the locomotive passed over it. Despite being jolted as the locomotive moved over the track irregularity, the engineer managed to initiate a service application of the train air brakes. A few seconds later, he made an emergency application of the automatic air brakes. The train derailed. The engineer activated the two-way EOT device about 15 seconds after making the emergency air brake application. Exclusions None of the Amtrak on-board personnel reported any significant problems or unusual events involving the equipment during the train’s 1-hour preaccident journey. The engineer said that the train handled as expected, and neither he nor the assistant engineer recalled any signal or train control problems. Postaccident inspections of the Auto Train; subsequent tests of the locomotive controls, braking systems, and EOT device; and review of vehicle maintenance records did not indicate any problems with the Amtrak train equipment. Therefore, the Safety Board concludes that the Auto Train and its related equipment functioned as designed and did not cause the accident. The investigation examined a number of Amtrak train-operating crew human performance factors that might have affected the accident. Review of the event recorder data with respect to train handling showed that before the locomotive passed over the

Analysis 44 Railroad Accident Report track irregularity, the engineer handled the Auto Train in accordance with accepted practices and procedures. Postaccident drug and alcohol testing results for the train- operating crewmembers were negative. The work-rest histories of the train-operating crewmembers indicated that fatigue had no role in the accident. Therefore, the Safety Board concludes that the accident was not caused by improper train handling, drug or alcohol use, or crewmember fatigue. Postaccident testing of the CSXT signal equipment and train control system demonstrated that they worked as designed. No communications problems were reported among the train-operating crewmembers or between the train crew and the dispatcher. Therefore, the Safety Board concludes that neither the signal equipment, the train control system, nor the communications caused or contributed to the severity of the accident. Within 7 minutes of the accident, the first emergency responder arrived on-scene. About 12 minutes after the accident, the chief of the Crescent City Fire Department arrived on-scene and assumed incident command, but he had accidentally left his radio at the fire station. He began organizing the response but left the command post to assess the accident. The training coordinator for Putnam County Emergency Services, en route to the scene, attempted to contact the fire chief but was unable to do so because the chief had no radio with him. After he had arrived on-scene, and after several minutes of being unable to contact the fire chief, the training coordinator, as the highest-ranking emergency responder on-scene, assumed incident command about 5:46 p.m.70 By the time the training coordinator assumed incident command, less than 40 minutes had elapsed since the accident, so this minor organizational problem did not significantly delay or impair the effectiveness of the emergency response. The training coordinator immediately established a command post, a staging area, and a triage area. In all, 441 emergency responders responded to the accident, so there were nearly as many emergency responders as people on the train. All of the more than 400 passengers were evacuated from the train’s 16 passenger cars within 2 hours of the accident. The Safety Board concludes that the overall emergency response to the accident was timely and effectively managed. Track Buckle The Auto Train engineer stated that as the train approached the point of the derailment, he saw that both rails ahead of the train were out of alignment. He said that the rails were parallel to one another and out of alignment to the outside of the curve by about 10 inches. When he subsequently reported the derailment to the dispatcher, he described this misalignment as “a bad kink in the rail.” The term “kink” refers to the track irregularity more properly called a track buckle. 70 The training coordinator was following established incident command guidelines when he assumed incident command. Because the training coordinator was the senior emergency responder on-scene, incident command authority would probably have been transferred to him under regular procedures had the fire chief been at the command post when the training coordinator arrived.

Analysis 45 Railroad Accident Report The investigation examined whether the passage of the southbound CSXT coal train N16815, shortly before the Auto Train, might have triggered the track buckle. When a railroad wheel rolls on the rail, a longitudinal wave is created in front of the wheel as the wheel slightly depresses and “pushes” the rail before it. This imparts compressive dynamic force into the rail. Track buckles may be induced or triggered by the passing of a train when the compressive dynamic forces are added to preexisting thermal forces. Once track begins to buckle out of alignment under a train, the buckle will become progressively more severe as each wheel impacts the rail. A track buckle may occur toward the rear of a passing train, where it may or may not cause a derailment. If the train is moving slowly enough and the cars are heavy enough, the train may negotiate the buckle and continue without the train crew’s noticing it. The coal train that preceded the Auto Train over the accident curve (moving in the opposite direction) was traveling at 39 mph, which was 21 mph below the speed restriction of 60 mph. The coal train was made up of 2 six-axle locomotive units and 95 loaded coal cars, weighing about 136 tons each. Thus, the coal train was likely moving slowly enough and its cars were heavy enough that a track buckle could have developed under the coal train unnoticed by its crew. Although a track buckle might form ahead of a train, such buckles more typically form at the rear of a passing train, due to the progressive force imparted as each car of the train moves over the susceptible area. The Auto Train engineer stated that the buckle was already in the track ahead of the Auto Train when he saw it, not that he saw it forming. Therefore, the Safety Board concludes that the track buckle that caused the derailment of the Auto Train probably originated during the passage of CSXT coal train N16815 over the accident curve. Track Condition and Maintenance The events that led to the development of a track buckle at this location had evolved for more than a year prior to the accident and concerned the track conditions at the accident curve, as well as the track maintenance activities that took place at and near this site. Specifically, the investigation indicated that the roadbed width of the track on the curve embankment, the ballast condition of the track, the rail anchoring in the area, the surfacing operations undertaken by CSXT at this location, and the rail temperature practices used during and after the surfacing operations all contributed to the track instability that allowed the track buckle to form. Individually, perhaps none of these factors would have generated the track buckle; in combination, they created the unstable track environment conducive to the sudden development of a buckle on April 18, 2002. Roadbed, Ballast, and Rail Anchor Conditions The CSXT standard engineering plan for new roadbed requires a 30-foot-wide roadbed. CSXT does not have a specific roadbed width maintenance requirement; instead, it requires roadbeds to be maintained so that they adequately support the ballast section.

Analysis 46 Railroad Accident Report Based on the known tie dimensions and CSXT track standards for existing track, Safety Board investigators calculated that the minimum roadbed width for the track on the accident curve, assuming it met the established CSXT standards, was 15 feet.71 Visual evidence indicated that the roadbed in the accident curve was likely narrower than this minimum.72 The CSXT chief regional engineer for the Jacksonville District stated that the area of the derailment had a relatively narrow roadbed. He also stated that in some cases, CSXT “roadbeds become narrow because we continue to elevate the track by surfacing our track and raising the track structure.” Because the roadbed in the accident curve had narrowed so that it could not adequately retain the normal ballast profile, ballast migrated down the inside slope of the embankment in the months before the accident, necessitating repeated resurfacing operations. Despite the narrow roadbed, it appears that the ballast had not begun to migrate significantly until early in 2001. In fall 2000, about 18 months before the accident, CSXT had conducted shoulder ballast cleaning operations through the accident curve, in an effort to improve track drainage. The shoulder ballast cleaning removed fouled ballast from the shoulder area of the track, cleaned the ballast, and returned the cleaned ballast to the shoulder. However, according to the local CSXT track supervisors and inspector, in the months after the cleaning, ballast began migrating down the inside of the curve embankment. Evidently, by breaking up the hardpan soil supporting the ballast, the cleaning process had freed the ballast and allowed it to move down the inside of the curve embankment. Adequate ballast is crucial to ensuring the track’s lateral support and restraint. Because of the track’s narrow roadbed and the consequent ballast migration, CSXT could not maintain sufficient ballast around the ties and rail at the roadbed track level at the top of the embankment to provide adequate support and restraint. In an attempt to halt ballast migration down the inside slope of the accident curve, CSXT constructed a ballast- retaining wall of used concrete ties on March 6, 2002, about 6 weeks before the accident occurred. The CSXT track inspector for this area acknowledged that before the installation of the ballast-retaining wall, the ballast levels supporting the track at the accident curve were not sufficient to meet CSXT standards. In particular, with respect to the shoulder ballast, he stated, “It wasn’t maintained to [CSXT] standards with the 12 inches of ballast on the high side and 6 inches on the low, two-to-one.” 71 The ballast depth dictates the length of the 2:1 ballast shoulder slope. Because the ties were 7 inches deep and the minimum ballast depth beneath the ties was 8 inches, the ballast profile depth was 15 inches. Thus, a 2:1 ratio means the length of the ballast shoulder slope was 30 inches on each side of the track. According to CSXT standards, the inside curve ballast shoulder width should have been 6 inches and the outside curve ballast shoulder width should have been 12 inches. The length of a tie was 8 feet, 6 inches, or 102 inches. Therefore, the minimum roadbed width necessary to support the CSXT ballast shoulder profile for the accident curve was 30+6+102+12+30 inches = 180 inches, or 15 feet. 72 Because the derailment forces largely destroyed the roadbed and track in the immediate area of the accident, investigators could not measure the roadbed at this location after the accident took place. However, investigators examined the roadbed immediately preceding and beyond the derailment site.

Analysis 47 Railroad Accident Report Safety Board investigators inspected the track adjacent to the derailment site after the April 18, 2002, accident and found that in many places the ballast did not fill the tie cribs between the crossties. Many cribs were only half full in the center and even less full toward the ends. Investigators found little or no ballast off the ends of the ties, let alone a full ballast shoulder up to the tops of the tie ends. Therefore, the Safety Board concludes there was insufficient ballast on the accident curve prior to the accident to meet CSXT’s own standards and to ensure that the CWR was being adequately restrained. In August 2002, the FRA conducted a focused inspection of all CSXT track on which Amtrak trains and commuter rail traffic operate. According to the final FRA report, of the 4,770 CSXT route miles the FRA inspected, 511 track miles did not conform to CSXT’s own ballast section requirements. Rail anchoring restricts the longitudinal movement of the rail, which localizes the compressive or expansive forces in the rail so that these forces are distributed uniformly throughout the track structure. Postaccident inspection of the undamaged track north and south of the derailment site revealed a number of locations where rail anchors were missing or where rail anchors were not snug against ties. Nineteen percent of the rail anchors required through the accident curve were determined to be missing or not snug against ties. A rail anchor that is not snug against the tie allows longitudinal rail movement in one direction to the extent of the distance or gap between the tie and the anchor. Longitudinal rail movement may be due to thermal expansion, which is a function of rail length. The free expansion or contraction in a 3-foot length of rail with a 50° F difference in rail temperature throughout a day would be about .008 inch. (In a 1/4-mile length of rail, this would total about 3 1/2 inches.) Therefore, to adequately restrain the rail, a rail anchor must be snug against a tie, because if the gap between the tie and anchor is (as in the cited example) greater than .008 inch, theoretically, the anchor would never contact the tie or provide any restraint. Thus, a rail anchor that is not snug against a tie is unlikely to provide significant rail restraint. AREMA, rail anchor manufacturers, and industry experts agree that for rail anchors to be effective, they should be against the tie. In the rail anchor standard in its Maintenance Bulletin MWI 1113-01, Performance for Large Scale Track Work, CSXT states that anchors not snug against ties constitute a defect. The Safety Board concludes that missing rail anchors and ineffective rail anchoring contributed to track instability through the accident curve. Although the FRA does not have a minimum requirement for the number of effective anchors for CWR track, CSXT has, as noted above, established its own rail anchoring standards. However, only CSXT’s large system-wide track maintenance production teams are required to adhere to the anchoring standards in Maintenance Bulletin MWI 1113-01. Because CSXT does not require its local maintenance-of-way crews to use such standards, they typically rely on the experience and judgment of local supervisors, which might not be adequate to ensure a safe track condition. Therefore, the Safety Board believes that CSXT should require all track maintenance employees, including large system-wide track maintenance team members and local maintenance-of-

Analysis 48 Railroad Accident Report way crew members, to use a consistent rail anchor standard that includes a requirement that rail anchors be maintained snug against ties. Track Alignment After Surfacing On October 9, 2001, regional CSXT surfacing gang members began to surface the full curve from MP 722.5 to MP 722.1, working from south to north. While working on the northern end of the curve and into the north curve spiral, they realized that the track liner-tamper machine they were using was not lining the track properly. By manually adjusting the machine, they were able to finish surfacing the curve. Two days later, on October 11, after the liner-tamper machine was repaired, the surfacing gang members used it to re-line and tamp the track from the point at which they estimated the machine had first experienced problems and continued north through the rest of the curve and spiral. The gang members did not record the exact location at which the liner-tamper machine went out of alignment, nor did they document the exact location at which the machine was subsequently restarted 2 days later. Therefore, the repaired liner-tamper machine may well have been started at a point in the curve beyond where the machine had actually first deviated, which would have resulted in a discontinuity in the constant smooth transition of the curve and the introduction of a slight deviation or “notch” in the curve that provided a weak point in the track. This area of the track was repeatedly machine-surfaced in the months before the accident. On November 19, 2001, the surfacing gang machine-surfaced portions of track on the northern section of the curve. On February 26, 2002, the curve was machine- surfaced from MP 722.3 to MP 722.1; and on March 11, 2002, the curve was machine- surfaced from MP 722.3 to MP 722.2. At no time during these surfacing processes was the curve measured or checked against a reference point to ensure that the alignment was correct or that a smooth transition was maintained. If an alignment deviation was introduced somewhere near the middle of the curve during the work on October 11, 2001, the subsequent surfacing operations would not have corrected it. The deviation would have remained a weak point in the curve alignment. Given that surfacing work is recorded to the nearest 1/10th of a mile, it is reasonable to suppose that the point of derailment, MP 722.24, fell within the weak anomaly area introduced on October 11, 2001. Therefore, the Safety Board concludes that the problems with the liner-tamper machine on October 9, 2001, and the re-implementation of the repaired machine well into the curve on October 11 introduced a track misalignment and caused a weak point in the curve that was susceptible to later buckling. On July 31, 2002, CSXT issued Track Bulletin 005, notifying its track maintenance workers that if a liner-tamper machine broke down during a surfacing operation in a way that “adversely affected the quality of the raising, aligning or ballast compaction,” they should (among other requirements) check and, if necessary, resurface the entire curve.

Analysis 49 Railroad Accident Report CWR Temperature Control Track buckling occurs when the difference between the current rail temperature and the neutral (force-free) rail temperature creates thermally induced internal longitudinal rail forces strong enough to overcome the track’s lateral restraint. These thermally induced forces will accumulate at the weakest point in the track, which will create a track buckle when the lateral restraint is overcome. To determine what conditions led to the development of the track buckle at the Crescent City curve, it was necessary to establish the current rail temperature when the track buckle developed. Although no one measured the rail temperature at the accident curve around 5:00 p.m. on April 18, 2002, when the track buckle likely developed, meteorological reports indicate that the ambient temperature about that time was in the low 80s (° F), and the day was mostly sunny. When the rail temperature was measured 2 days after the accident, during the late afternoon of April 20 (a partly sunny day), the rail temperature at the accident site area was 120° F at a time when the ambient temperature was in the high 80s (° F). On April 24 (a partly sunny day) at 5:00 p.m., the ambient temperature was 83° F, and the rail temperature was 108° F. Given that the ambient temperature on April 18 was similar to that on April 24, a neutral rail temperature of at least 108° F seems likely. In addition, April 18 was a mostly sunny day while April 24 was only partly sunny. The cumulative effect of hours of nearly continuous sunshine on metal rail by late afternoon on the day of the accident likely increased the rail temperature by a further significant increment. Therefore, it seems probable that the rail temperature about 5:00 p.m. on the day of the accident was well above 108° F. A current rail temperature of between 110° and 120° F is entirely feasible. The CWR-SAFE computer program, which determines the “allowable temperature increase” for buckling prevention and the buckling safety margin, indicated that CWR may buckle when the difference between the neutral rail temperature and the current rail temperature is 50° F or more, depending on the condition of the ballast and track structure.73 For the Crescent City accident curve, the CWR-SAFE program predicted a neutral rail temperature for buckling of between 60° and 65° F. Given a neutral rail temperature of 60° to 65° F and an increase in rail temperature of 50° F, the resulting current rail temperature of around 115° F on the afternoon of the accident could have resulted in a track buckle. Consequently, investigators attempted to determine how a neutral rail temperature in the 60° to 65° F range might have developed for the rail in the accident curve. Numerous maintenance operations were performed in the accident area in the 6 months before the derailment. The repeated surfacing operations have already been noted. These maintenance operations were carried out in the cooler months of the year, when rail temperatures were well below the CSXT neutral rail temperature standard of 100° F. No rail adjustments were performed after these maintenance operations broke the 73 The better the track structure, the greater the difference in temperature the track can withstand. Conversely, the weaker the track structure (particularly if it is deficient in ballast), the less rail temperature change the track can withstand before buckling.

Analysis 50 Railroad Accident Report bond between the ballast and the ties. (Under these conditions, appropriate rail adjustment according to CSXT procedures would have consisted either of removing the rail anchors, heating the rail, and then reanchoring it, or of realigning the curve.) Proper rail temperature control is critical during the period immediately after the track has been disturbed and until the track is reestablished and firmly stabilized in the ballast. On February 26, 2002 (about 7 weeks before the accident), the CSXT regional surfacing gang machine-surfaced the track segment from MP 722.3 through MP 722.1, which encompassed the point of derailment (MP 722.24). The rail temperature was measured at 90° F when the work was completed on February 26. After this surfacing, the ambient temperature in the area decreased for the next 3 days while the track was in the post-surfacing stabilization process. The following were the daily high and low ambient temperatures from February 26 through March 1: The track was exposed to a range of relatively low temperatures during the 3-day period following the February 26 surfacing, while the track was most subject to movement.74 Temperatures during this period were in the 60s (° F) and lower, making the CWR-SAFE criteria of a 60° to 65° F neutral rail temperature not only feasible but probable. Adequate ballast could have helped to restrain, if not prevent, the rail from significantly contracting. Given the lack of ballast, which would have allowed the track to move with relative ease, the rail could have contracted to a low neutral rail temperature, causing the curve to “chord” (shrink) inward, which would have made it prone to buckle when the weather warmed. When about 70 tons of ballast was dumped on the north end of the accident curve on March 8, the rail had already had ample time (10 days) to contract to a new and lower neutral rail temperature without sufficient ballast restraint. Because the track in the curve did not have sufficient ballast, it was inadequately restrained after being disturbed on February 26. CSXT and industry maintenance practices for surfacing CWR track recommend that track not be surfaced until sufficient ballast is distributed to provide the necessary restraint. Insufficient restraint, caused by insufficient ballast, will permit the track to move during stabilization or possibly not to stabilize at all. A later application of ballast, such as CSXT’s addition of 70 tons of ballast to the curve on March 8, will not correct this problem, because movement may have already occurred. Therefore, the Safety Board concludes that the accident curve chorded inward because there was insufficient February 26 75° F 45° F February 27 68° F 36° F February 28 55° F 36° F March 1 66° F 48° F 74 A slow order was in effect for MP 722.3 though MP 722.1 from February 5 through March 13, 2002.

Analysis 51 Railroad Accident Report ballast in the track at the time of the February 26, 2002, surfacing to prevent track movement as the track stabilized. On March 11, the accident curve was resurfaced, this time between MP 722.3 and MP 722.2, a segment containing the point of derailment. The liner-tamper machine started in the body of the curve and moved northward to create a 1-inch lift. The high and low daily temperatures in the days after this surfacing were as follows: These ambient temperatures were somewhat higher than those in effect during the February 26 through March 1 period but were still well below those needed to achieve the desired neutral rail temperature standard of 100° F. Although less likely than the track disturbed during February 26 to fall to the 60° to 65° F neutral rail temperature range necessary for buckling, the track involved in this surfacing would still have developed significant compressive forces that would tend to further stress a buckle-prone weak point in the curve. As has been stated, with the decline in ambient temperature that occurred after the February 26 surfacing operation (coupled with the lack of ballast on the curve from February 26 until March 8), the rail contracted and the track chorded inward. To detect track movement, CSXT requires curves over 1 degree in CWR track to be monumented if the temperature falls below 50° F during surfacing. However, CSXT procedures do not require monumenting if the temperature falls below 50° F during the stabilization period following surfacing work. (Monumenting consists of establishing known reference points against which any subsequent movement of the track can be measured.) The temperature during the February 26 surfacing work was well above 50° F, so the track was not monumented. During the post-surfacing stabilization period, however, temperatures fell below 50° F. When the track was resurfaced on March 11, there was no way to determine whether the track had moved since the February 26 work, because the track had not been monumented on February 26. Therefore, the Safety Board concludes that because the curve was not monumented when it was surfaced on February 26, 2002, the crew resurfacing the track on March 11, 2002, did not know whether the track had moved since February 26, 2002. Had the crew members known the track had moved, they could have adjusted the curve appropriately. Therefore, the Safety Board believes that CSXT should modify its procedures to ensure that when a curve is surfaced, it is also monumented, if local temperatures are predicted to fall below 50° F during the post- surfacing stabilization period. March 11 74° F 53° F March 12 84° F 56° F March 13 79° F 54° F March 14 78° F 54° F

Analysis 52 Railroad Accident Report According to CSXT rules, each time the track is disturbed, a Track Disturbance Report is to be filled out and submitted for later rail temperature reference. At the time of the accident, CSXT required that Track Disturbance Reports be submitted monthly. (Since the accident, CSXT has required that Track Disturbance Reports be submitted weekly.) Roadmasters use the reports to identify areas that need additional attention, particularly when the weather gets warmer. The reports are also used to direct follow-up track adjustment. The CSXT regional surfacing gang foreman, who had performed most of the surfacing operations through the accident curve, admitted that on several occasions he had not submitted the required monthly Track Disturbance Reports after disturbing the track. Consequently, no timely record was available to the roadmaster indicating the necessity of performing appropriate track adjustments following the track disturbances. Also, despite the fact that regional engineering personnel were aware of the surfacing gang foreman’s assignments and locations, no one from CSXT ever checked to ensure that the disturbance reports were submitted after the surfacing was done. According to the roadmaster, local maintenance crews usually start adjusting rail that has been disturbed during the winter season when the ambient temperature rises to approach the upper 80s (° F), which in the Crescent City area typically occurs in April. The temperature on April 18, 2002, reached the low 80s (° F), and temperatures in the mid to high 80s (° F) were experienced in the days after the accident. Thus, when the accident occurred, area temperatures were nearing the range at which track adjustments were normally carried out. Therefore, the Safety Board concludes that had the Track Disturbance Reports been submitted in a timely fashion, the roadmaster might have used them to prioritize the track adjustment work to be carried out on track disturbed during the winter, including the accident curve. In summary, regarding CSXT track maintenance, the Safety Board notes that the Crescent City investigation showed that the CSXT program was inadequate in two general respects. First, CSXT failed to establish some needed track standards. Second, CSXT failed to ensure that its track maintenance workers routinely fulfilled the requirements of its existing track standards. With reference to the former problem, CSXT did not have adequate requirements at the time of the accident for ensuring effective rail anchoring, for monumenting curves when temperatures were expected to fall below 50° F during the track stabilization period following surfacing, or for relining the entire curve if the liner-tamper machine broke down during a surfacing operation. CSXT has since addressed the liner-tamper machine procedure deficiency, and the Safety Board has proposed safety recommendations to provide appropriate requirements for rail anchoring and monumenting. However, the provision of new written requirements in these areas will not solve the underlying quality control problem concerning CSXT track maintenance indicated by this investigation. The Safety Board found that although CSXT had written standards for ensuring the maintenance of an adequate ballast section to restrain the track and for conducting surfacing operations according to established practices and rules (such as drafting and submitting Track Disturbance Reports at specified intervals), CSXT track employees sometimes did not fulfill these requirements. Given these deficiencies, it

Analysis 53 Railroad Accident Report appears that CSXT did not have an effective quality control program that ensured strict adherence to written track standards among its track maintenance employees. Therefore, the Safety Board concludes that CSXT did not provide adequate oversight to ensure that its track maintenance activities were carried out in accordance with its own standards. In addition, when the FRA conducted an August 2002 focused inspection of CSXT track used by Amtrak and commuter rail trains, FRA inspectors found numerous instances of track conditions that did not conform to CSXT requirements. The FRA findings, coupled with the repeated failures by CSXT track personnel to fulfill established CSXT track standards and practices revealed during this accident investigation, suggest that CSXT may have a quality control problem with its track maintenance operations, particularly in the area of track surfacing. Therefore, the Safety Board believes that CSXT should develop a systematic quality control program to ensure that track-surfacing personnel consistently conduct track-surfacing operations in accordance with CSXT standards. Derailment Dynamics Auto Train Consist The first 16 cars in the train were Amtrak Superliner passenger cars; 24 autorack cars followed them. After the derailment, the two locomotive units and the first two passenger cars remained on the rails. However, the remaining 14 passenger cars and 7 of the autorack cars derailed. The 7 derailed autorack cars remained generally in-line. The other 17 autorack cars stayed on the rails. The disposition of the derailed cars, particularly the passenger cars, reflected the accordion effect of railcars when they derail, alternately folding together in parallel fashion, perpendicular to the track. The rapid and violent movements, including the laying over of some of the passenger cars, involved the dissipation of such large forces in such a relatively short distance that they probably caused the majority of the injuries and fatalities. Traditionally, passenger trains are configured with unoccupied nonrevenue cars (such as express and baggage cars) up front and closest to the locomotive, so that these unoccupied cars will absorb the impact and forces of a collision and/or derailment. The Auto Train, however, is a unique type of passenger train, and its consist is set in accordance with the attributes of its special cars. When trains are made up, it is generally desirable to place the heaviest cars in the front, behind the locomotive units, and the rest of the cars in descending order by weight. This type of consist is advantageous because it minimizes the in-train forces during movement, starting, and stopping, and especially during emergency braking. Superliner cars typically weigh between 150,000 and 160,000 pounds (passengers and baggage generally add no more than 5 percent to the car weight). Eighteen of the 24 autorack cars on the train were bi-level autocarriers, weighing about 122,000 pounds each, loaded, and 6 were tri-level autocarriers, weighing about 164,000 pounds each, loaded. Thus, most

Analysis 54 Railroad Accident Report (75 percent) of the autorack cars in this consist were about 30,000 pounds lighter than the Superliner cars, and even the six tri-level autocarriers were only slightly heavier than the Superliner cars. Consequently, from a train density standpoint, the on-average heavier Superliner cars were optimally located near the front of the Auto Train consist.75 Two-Way End-Of-Train Device Activation According to locomotive event recorder information, it was not until about 10 seconds after the engineer put the train in emergency (at 5:08:01 p.m.) and about 7 seconds after the air brakes went into emergency (at 5:08:04 p.m.) that the emergency braking signal actually reached the rear of the train (at 5:08:11 p.m.). There were likely two reasons for this time gap; a pinched trainline air hose between cars and the engineer’s delay in activating the two-way EOT device to initiate an emergency brake application at the rear end. Investigators deduced that a pinched trainline air hose between cars kept the pneumatic signal from reaching the rear of the train when the air brakes went into emergency at the head end. About 7 seconds later, the derailment forces caused a break in the trainline air hose beyond the pinched area, which caused the remainder of the train to go into emergency. The engineer did not activate the EOT device until 5:08:15 p.m., about 15 seconds after he had put the train into emergency. By that time, the EOT device activation was unnecessary, because the full train was already in emergency due to the break in the trainline. Had the engineer immediately activated the two-way EOT device when he put the air brakes in emergency, the rear of the train would have gone into emergency with the head end, which would have minimized car movement. The 7-second delay between the train’s air brakes going into emergency and the emergency signal reaching the end of the train allowed the cars at the rear of the train to continue to move into the forward cars, which were braked and/or stopping. The delay would have been avoided if the two-way EOT device had been automatically activated at the same moment the engineer put the train’s air brakes in emergency. The Safety Board has previously discussed the benefits of automatic activation of EOT devices on trains. In the Bloomington, Maryland, freight train accident report,76 the Safety Board noted that CSXT had installed automatic two-way EOT devices on all its new locomotives. However, this was not the case. CSXT had actually installed automatic-ready two-way EOT devices, which could not, when installed, effect the simultaneous, automatic application of the brakes at the end of the train with the engineer’s emergency application of the brakes. To function properly, the installed devices 75 In addition, the passenger cars on the Auto Train, which require electrical power from the locomotive units, are placed nearest the locomotives to minimize electricity transmission distance and connections. The autorack cars do not have conduits and piping because they do not require electricity, and because they are typically placed on the end of the train, there is no need to transmit electrical power to or through them. 76 National Transportation Safety Board, Derailment of CSX Transportation Coal Train V986-26 at Bloomington, Maryland, January 30, 2000, Railroad Accident Report NTSB/RAR-02/02 (Washington, DC: NTSB, 2002).

Analysis 55 Railroad Accident Report need the additional installation of a computer card encoded with the necessary information technology (software). This technology was not yet available when CSXT installed the devices nor at the time of the Crescent City derailment. Since the Crescent City accident, however, automatic two-way EOT application technology (as provided through the encoded computer cards) has reached the final development stage and should soon be ready for use. The Safety Board concludes that had the two-way EOT device been activated when the Auto Train’s air brakes were put in emergency, the severity of the injuries resulting from the derailment might have been lessened, because the continued forward momentum of the majority of the train’s cars into the stopped passenger cars would have been reduced. At the time of the accident, Amtrak locomotives were not equipped with automatic two-way EOT devices. Consequently, the Safety Board believes that Amtrak should install automatic two-way EOT emergency activation devices on all Amtrak locomotives equipped with manual devices. Passenger Accountability The accident Auto Train was an all-reserved passenger train that was to travel nonstop between Sanford, Florida, and Lorton, Virginia. To account for the Auto Train passengers, Amtrak was using the paper on-board record system described in its Service Standards Manual for Management Employees (refer to appendix B for detailed procedures). Given that the train made no scheduled stops for passengers, if this had been a reliable system, Amtrak should have been able to determine soon after the train departed from Sanford exactly how many passengers were on board the Auto Train by using the passenger manifest and the contents of the conductor’s ticket collections pouch. Even though the accident occurred only about an hour after the train departed from Sanford, this still should have been sufficient time to develop a comprehensive list. Nevertheless, the incident commander told investigators that he had difficulty obtaining accurate information from Amtrak about the number of people on board the train. When he arrived on the scene on April 18, the incident commander was told that 468 people were on the train. Subsequently, he was provided with both a greeter list and a passenger list, but the information on the two lists did not match. The incident commander later complained that emergency responders had to spend time attempting to verify the accuracy of the two lists. The day after the accident, Amtrak gave the incident commander a computer printout list, which contained information that did not match either of the two lists provided on April 18. In fact, Amtrak never provided the incident commander an accurate count of the persons on board the train. Even during postaccident interviews, long after the initial emergency response, Amtrak was still erroneously reporting the total number of people on board the train as 468. Using information gathered and correlated from three sourcesAmtrak, Putnam County Emergency Services, and medical recordsit took Safety Board investigators almost 5 months to determine the number of Auto Train occupants at the time of the

Analysis 56 Railroad Accident Report accident. The total number of people on board the train was 446, a discrepancy of 22 from the figure of 468 people that Amtrak gave in the immediate response phase. In a derailment, the survival of passengers and crewmembers might well depend on emergency responders, who in turn depend on a complete and accurate accounting of all people on the train to ensure that they locate, evacuate, and treat (if necessary) all those on board. If the passenger list does not include every passenger on the train, emergency responders may leave passengers behind. If the passenger list includes people not on the train, emergency responders may be needlessly exposed to prolonged risks as they search for nonexistent passengers. To facilitate an effective emergency response, the incident commander must have an accurate passenger list as soon as possible. This is not the first time the Safety Board has identified passenger accountability as an issue in an Amtrak accident. Following the September 1993 Amtrak accident in Mobile, Alabama,77 in September 1994, the Safety Board recommended that Amtrak: R-94-7 Develop and implement procedures to provide adequate passenger and crew lists to local authorities with minimum delay in emergencies. Amtrak responded to the recommendation with a plan to develop a satellite and long-distance messaging system between long-distance trains and corporate offices. One benefit of this proposed new communications system was to be improved passenger manifests. However, following a 1997 Amtrak accident in Kingman, Arizona,78 Amtrak told the Safety Board that passenger manifests were unrealistic on unreserved trains, due to the number of station stops such trains make. Amtrak indicated, however, that computer systems could provide passenger lists for reserved trains. As a result of this new information, the Safety Board closed Safety Recommendation R-94-7 (Reconsidered) on August 31, 1998, and issued a new recommendation urging Amtrak to: R-98-58 Expedite the development and implementation of a passenger and crew accountability system on reserved trains. 77 National Transportation Safety Board, Derailment of Amtrak Train No. 2 on the CSXT Big Bayou Canot Bridge Near Mobile, Alabama, September 22, 1993, Railroad Accident Report NTSB/RAR-94/01 (Washington, DC: NTSB, 1994). 78 National Transportation Safety Board, Derailment of Amtrak Train 4, Southwest Chief, on the Burlington Northern Santa Fe Railway near Kingman, Arizona, August 9, 1997, Railroad Accident Report NTSB/RAR-98/03 (Washington, DC: NTSB, 1998).

Analysis 57 Railroad Accident Report On September 14, 1999, the president of Amtrak Intercity testified during the Safety Board’s public hearing on the Bourbonnais, Illinois, accident79 that Amtrak had made an investment of $24 million and contracted with Motorola to develop an automated system for accounting for train passengers. He described the system as a simple hand-held device to be used by the conductor, which would scan the tickets and record a passenger name. There was to be a central processing unit on the train for downloading information from the hand-held device. This information was to be transmitted to the Amtrak national reservation system and made available to a number of locations. As such, the passenger data would be readily available to emergency responders. The Amtrak official said the system was scheduled for implementation in 2000. Because Amtrak had indicated that an automated passenger accountability system was in imminent development, the Safety Board classified Safety Recommendation R-98- 58 “Closed--Acceptable Action” on December 5, 2000. However, Amtrak has not implemented such an accountability system. Since Safety Recommendation R-98-58 was closed, Amtrak has failed to provide a timely and accurate passenger count to emergency responders during at least four Amtrak accidents (including this one).80 Earlier this year, an Amtrak official stated in a letter81 to a Safety Board staff member: While Amtrak continues to explore realistic technological alternatives to enhance the efficiency of recording ticketed and non-ticketed passengers, we feel that the passenger accountability system presently in place is a reliable one. Therefore, Amtrak still uses, and appears likely to continue to use, the paper on- board record system outlined in its Service Standards Manual for Management Employees to account for passengers on its long-distance, overnight, and reserved trains. However, as the Crescent City accident indicated, this system is prone to error, delay, and confusion. The system could not provide an accurate list months after the accident, much less during the crucial emergency response period. Therefore, the Safety Board concludes that the paper record passenger accountability system in use for long-distance, overnight, and reserved trains on the Amtrak system cannot be relied upon to provide an accurate and timely passenger manifest in case of emergency. Amtrak uses the same paper record system that performed so poorly on the Auto Train for all its long-distance, overnight, and reserved trains. Amtrak operates the following trains that fall into one or more of these categories: 79 National Transportation Safety Board, Collision of National Railroad Passenger Corporation (Amtrak) Train 59 With a Loaded Truck-Semitrailer Combination at a Highway/Rail Grade Crossing in Bourbonnais, Illinois, March 15, 1999, Railroad Accident Report NTSB/RAR-02/01 (Washington, DC: NTSB, 2002). 80 The other three accidents took place in Syracuse, New York, in February 2001; Nodaway, Iowa, in March 2001; and Kensington, Maryland, in July 2002. 81 Letter dated March 14, 2003, from Amtrak Chief Transportation Officer, Operations Standards and Compliance, to Safety Board investigator concerning the July 29, 2002, Amtrak Train 30 derailment in Kensington, Maryland.

Analysis 58 Railroad Accident Report Since issuing Safety Recommendation R-94-7 nearly 9 years ago, the Safety Board has investigated nine accidents involving Amtrak trains from this list in which passenger accounting has been less than satisfactory during the emergency response. As has been noted, the Safety Board has repeatedly made recommendations to Amtrak concerning this issue, and Safety Board staff members have met with Amtrak representatives both formally and informally to resolve this longstanding problem. To date, Amtrak has not taken effective action to address this safety issue. Consequently, the Safety Board believes that Amtrak should develop and implement an accurate passenger and crew accountability system for all its long-distance, overnight, and reserved trains that will immediately provide an accurate count of the people on board the train in case of emergency. In addition to facilitating effective occupant evacuation and treatment during an emergency, having more complete information about those on board a train could benefit U.S. rail transportation in other ways. An accurate listing of all people on board a train that includes information concerning the identity of each person would be useful for purposes of security as well as safety. To ensure that a passenger and crew identification system meets all safety and security needs, the two Federal agencies primarily responsible for railroad safety and security should collaborate in its creation. Therefore, the Safety Board believes that the Federal Railroad Administration and the Transportation Security Administration should, in cooperation, develop and implement an accurate passenger and crew accountability system for all long-distance, overnight, and reserved passenger trains that will immediately provide an accurate count and identity of the people on board the train in case of emergency at any time during the trip. Railcar Crashworthiness Superliner Passenger Car Windows The investigation examined the construction, intended design criteria, and performance expectations of the Superliner railcar sidewall window when operating in its normal performance environment. The means of retention of those windows, which principally relies on a window grommet to keep the window assembly in place within the Sunset Limited Cardinal Southwest Chief Auto Train California Zephyr City of New Orleans Empire Builder Silver Palm Coast Starlight Silver Star Crescent Silver Meteor Texas Eagle Acela Express Capitol Limited Metroliner Three Rivers Empire Service Lake Shore Limited

Analysis 59 Railroad Accident Report car body sidewall opening, was also evaluated. The investigation identified evidentiary artifacts, consisting of obvious rounded indentions in the roofline edge (between the transverse structural members of the railcar roof), small tufts of vegetation and remnants of splintered trees found within and adhering to crevices in the car body, and battering damage on the railcar sidewall panels, all of which were consistent with the extensive damage that resulted from the substantial, and somewhat prolonged, severely abrasive action of the trees along the perimeter of the trackage right-of-way in this area. Further, the residue track ballast and soil found within the railcars was consistent with the railcars having been overturned and dragged along the trackage right-of-way for some distance. Therefore, the catastrophic breaches of the Superliner exterior sidewall windows in this accident resulted from the severe abrasive action of the trees along the track that came into contact with the exterior sidewalls of the railcars during the derailment, which resulted in the sidewall and roofline elements of the railcar becoming severely warped and displaced from their normal configurations. The abrasive contact of the trees against the sidewall windows also dislocated the window grommets (which keep the window assemblies in place within the car body sidewall openings) and subsequently dislodged the framing structures of the sidewall windows. With no means of retention, the loosened windows were unable to resist the force of the passengers who were thrust against the windows during the vehicle dynamics of the derailment, which resulted in the passengers falling out through the car body sidewall openings as the railcars overturned. Four passengers of Superliner sleeper car #32100 who were ejected through breached windows received fatal crushing injuries, and two passengers of Superliner sleeper car #32501 who were ejected (one fully and one partially) through breached windows were seriously injured. Accordingly, given the design configuration of the Superliner railcar exterior sidewall windows, the operational history of the equipment, the vehicle dynamics of the derailment, the evidentiary artifacts examined, and the severe damage sustained by the windows (as described), the damage sustained by the windows and their component elements in this accident far exceeded the original intended design criteria and expectations. Superliner Sleeper Car Folding Armchairs As currently configured, each deluxe bedroom in an Amtrak Superliner sleeper car contains an unsecured folding armchair. Two Auto Train passengers reported that they were injured during the derailment when they were struck by such armchairs or when they were thrust out of the armchairs, indicating that the unsecured armchairs pose an occupant injury hazard during a derailment. FRA regulations state, at 49 CFR 238.233, that passenger railcar seating fixtures “ordered on or after September 8, 2000, or placed in service for the first time on or after September 9, 2002,” must be securely fastened to the car body. Anchoring occupant seating substantially reduces the risk of occupants being injured by the seating in a derailment. However, because the Amtrak Superliner cars involved in this accident were put in service before September 8, 2000, the FRA requirements concerning seating

Analysis 60 Railroad Accident Report anchoring are not applicable to them. Although Amtrak has indicated that it is pursuing an equipment remedy, some Amtrak trains currently travel with unsecured folding armchairs on Superliner sleeper cars. The Safety Board concludes that in its present unsecured configuration, the folding armchair on Amtrak’s Superliner sleeper cars constitutes an unwarranted hazard. Therefore, the Safety Board believes that Amtrak should, within 1 year, install restraint systems for the unsecured folding armchairs in all its in-service Superliner sleeper cars. The restraint systems should meet the safety criteria established at 49 CFR 238.233.

61 Railroad Accident Report Conclusions Findings 1. The Auto Train and its related equipment functioned as designed and did not cause the accident. 2. The accident was not caused by improper train handling, drug or alcohol use, or crewmember fatigue. 3. Neither the signal equipment, the train control system, nor the communications caused or contributed to the severity of the accident. 4. The overall emergency response to the accident was timely and effectively managed. 5. The track buckle that caused the derailment of the Auto Train probably originated during the passage of CSX Transportation coal train N16815 over the accident curve. 6. There was insufficient ballast on the accident curve prior to the accident to meet CSX Transportation’s own standards and to ensure that the continuous welded rail was being adequately restrained. 7. Missing rail anchors and ineffective rail anchoring contributed to track instability through the accident curve. 8. The problems with the liner-tamper machine on October 9, 2001, and the re- implementation of the repaired machine well into the curve on October 11 introduced a track misalignment and caused a weak point in the curve that was susceptible to later buckling. 9. The accident curve chorded inward because there was insufficient ballast in the track at the time of the February 26, 2002, surfacing to prevent track movement as the track stabilized.

1. Because the curve was not monumented when it was surfaced on February 26, 2002,

the crew resurfacing the track on March 11, 2002, did not know whether the track had moved since February 26, 2002.

1. Had the Track Disturbance Reports been submitted in a timely fashion, the

roadmaster might have used them to prioritize the track adjustment work to be carried out on track disturbed during the winter, including the accident curve.

1. CSX Transportation did not provide adequate oversight to ensure that its track

maintenance activities were carried out in accordance with its own standards.

Conclusions 62 Railroad Accident Report

1. Had the two-way end-of-train device been activated when the Auto Train’s air brakes

were put in emergency, the severity of the injuries resulting from the derailment might have been lessened, because the continued forward momentum of the majority of the train’s cars into the stopped passenger cars would have been reduced.

1. The paper record passenger accountability system in use for long-distance, overnight,

and reserved trains on the Amtrak system cannot be relied upon to provide an accurate and timely passenger manifest in case of emergency.

1. In its present unsecured configuration, the folding armchair on Amtrak’s Superliner

sleeper cars constitutes an unwarranted hazard. Probable Cause The National Transportation Safety Board determines that the probable cause of the April 18, 2002, derailment of Amtrak Auto Train P052-18 near Crescent City, Florida, was a heat-induced track buckle that developed because of inadequate CSX Transportation track-surfacing operations, including misalignment of the curve, insufficient track restraint, and failure to reestablish an appropriate neutral rail temperature.

63 Railroad Accident Report Recommendations As a result of its investigation of the April 18, 2002, Crescent City derailment accident, the National Transportation Safety Board makes the following safety recommendations: To CSX Transportation, Inc.: Require all track maintenance employees, including large system-wide track maintenance team members and local maintenance-of-way crew members, to use a consistent rail anchor standard that includes a requirement that rail anchors be maintained snug against ties. (R-03-06) Modify your procedures to ensure that when a curve is surfaced, it is also monumented, if local temperatures are predicted to fall below 50° F during the post-surfacing stabilization period. (R-03-07) Develop a systematic quality control program to ensure that track- surfacing personnel consistently conduct track-surfacing operations in accordance with CSX Transportation standards. (R-03-08) To the National Railroad Passenger Corporation (Amtrak): Install automatic two-way end-of-train emergency activation devices on all Amtrak locomotives equipped with manual devices. (R-03-09) Develop and implement an accurate passenger and crew accountability system for all Amtrak long-distance, overnight, and reserved trains that will immediately provide an accurate count of the people on board the train in case of emergency. (R-03-10) Within 1 year, install restraint systems for the unsecured folding armchairs in all your in-service Superliner sleeper cars. The restraint systems should meet the safety criteria established at 49 Code of Federal Regulations 238.233. (R-03-11) To the Federal Railroad Administration: In cooperation with the Transportation Security Administration, develop and implement an accurate passenger and crew accountability system for all long-distance, overnight, and reserved passenger trains that will immediately provide an accurate count and identity of the people on board the train in case of emergency at any time during the trip. (R-03-12)

Recommendations 64 Railroad Accident Report To the Transportation Security Administration: In cooperation with the Federal Railroad Administration, develop and implement an accurate passenger and crew accountability system for all long-distance, overnight, and reserved passenger trains that will immediately provide an accurate count and identity of the people on board the train in case of emergency at any time during the trip. (R-03-13) BY THE NATIONAL TRANSPORTATION SAFETY BOARD Ellen G. Engleman Mark V. Rosenker Chairman Vice Chairman John J. Goglia Member Carol J. Carmody Member Richard F. Healing Member Adopted: August 5, 2003

65 Railroad Accident Report Appendix A Investigation The Safety Board was notified at 5:35 p.m. eastern daylight time on April 18, 2002, that an Amtrak Auto Train had derailed near Crescent City, Florida. The Board launched a railroad accident investigation team to the site. The team included a Board Member (accompanied by a public affairs representative and two family affairs representatives) and investigative groups for operations, track, signals, mechanical, human performance, survival factors, and crashworthiness factors. Parties to the investigation included the Federal Railroad Administration; the Florida Department of Transportation; Putnam County, Florida; CSX Transportation; Amtrak; the American Railway Engineering and Maintenance-of-Way Association; the Brotherhood of Locomotive Engineers; the Brotherhood of Maintenance of Way Employes; and the United Transportation Union. The Safety Board held 2 days of sworn interviews as part of its investigation. The first interviews were held at Palatka, Florida, on April 22, 2002, and more were held at Jacksonville, Florida, on July 24, 2002. Parties to the interviews were the Federal Railroad Administration, the Florida Department of Transportation, CSX Transportation, Amtrak, the Brotherhood of Maintenance of Way Employes, and the Brotherhood of Locomotive Engineers. Twelve witnesses were interviewed in Palatka and 11 in Jacksonville.

66 Railroad Accident Report Appendix B Passenger On-Board Record Procedures from Amtrak Service Standards Manual for Management Employees

Appendix B 67 Railroad Accident Report

68 Railroad Accident Report Appendix C Passenger Train Two-Way End-Of-Train Device Regulations As a result of previous Safety Board recommendations,1 the Federal Railroad Administration (FRA) published a final rule2 on January 2, 1997, amending the regulations governing train and locomotive power braking systems to require two-way end-of-train (EOT) devices3 on a variety of freight trains. Passenger trains were exempted from the requirement because of the superior braking ratios of passenger cars and the presence of emergency brake valves (“conductor’s valves”) on each passenger car, which provide safety assurances not present on traditional freight trains. Until recently, Amtrak had been increasing the number of express and mail cars on its long-distance intercity trains. Such cars, including the autorack-type cars on the Auto Train, are not equipped with emergency brake valves because they are unoccupied. “Mixed trains” like the Auto Train, which blend passenger and express service or autorack cars, are also usually much longer than most regular passenger trains. As the number of express cars increased on mixed passenger trains, the FRA became concerned that these trains were becoming more like freight trains than passenger trains, suggesting that the original rationale for exempting passenger trains from two-way EOT requirements may no longer apply. The FRA was also concerned about a mixed train’s ability to stop within normal signal spacing after determining that there is a blockage in the trainline. Consequently, after conducting braking research through the Volpe Center, the FRA and Amtrak formulated two-way EOT device requirement criteria for mixed passenger trains as part of the Railroad Power Brakes and Drawbars regulations, 49 CFR Part 232. As a consequence, the above-referenced regulation became effective on May 1, 1998. The following information summarizes the changes in the new regulation. 1 See Safety Recommendation R-89-82 to the FRA to “Require the use of two-way end-of-train telemetry devices on all cabooseless trains for the safety of railroad operations,” from Collision and Derailment of Montana Rail Link Freight Train With Locomotive Units and Hazardous Material Release, Helena, Montana, February 2, 1989, Railroad Accident Report NTSB/RAR-89/05 (Washington, DC: NTSB, 1989); and Safety Recommendation R-95-44 to the FRA to “Separate the two-way end-of-train requirements from the Power Brake Law notice of proposed rulemaking, and immediately conclude the end-of-train device rulemaking so as to require the use of two-way end-of-train telemetry devices on all cabooseless trains,” from Rear-End Collision of Atchison, Topeka, and Santa Fe Railway Freight Train PBHLA1-10 and Union Pacific Railroad Freight Train CUWLA-10 Near Cajon, California, December 14, 1994, Railroad Accident Report NTSB/RAR-95/04 (Washington, DC: NTSB, 1995). 2 Title 49 CFR 232.23 paragraphs (e) and (g) revised, and adding paragraph (h). 3 A two-way EOT device consists of two radio telemetry devices, one in the controlling locomotive cab, and one mounted on the coupler and connected to the air brake hose (trainline) at the end of the train. The device provides the trainline pressure at the end of the train along with other customized information to the engineer in the controlling cab, and it can activate an emergency air brake application at the end of the train to overcome a possible trainline blockage and stop the train if necessary.

Appendix C 69 Railroad Accident Report I. Passenger Trains Exempted from Two-Way EOT Requirement A. Passenger trains operating at 30 mph or less; B. Passenger trains on which the last car is equipped with an emergency brake valve that is readily accessible to a crewmember who has radio communication with the engineer; and/or C. Passenger trains with 12 or fewer cars4 with a car located no less than halfway back in the consist that has an emergency brake valve readily accessible to a crewmember; and/or D. Passenger trains with 13 to 24 cars with a car no less than two-thirds of the way back in the consist that has an emergency brake valve readily accessible to a crewmember. II. Passenger Trains Required to Have a Two-Way EOT A. Those not exempted as specified above; and/or B. Passenger trains that travel over 30 mph; and/or C. Passenger trains with more than 24 cars.5 III. Operating Constraints on Passenger Trains Exempt from Two-Way EOT Requirements When operating in mountain grade territory (average grade of 2 percent or greater for over 2 continuous miles), a passenger train that is exempted from having a two-way EOT must position a crewmember in radio communication with the engineer in the rearmost car equipped with a readily accessible emergency brake valve 10 minutes before the train descends the heavy grade and the crewmember must not leave until the train has traversed the heavy grade. IV. Actions Concerning the En Route Failure of a Two-Way EOT on a Passenger Train A. If a passenger train is required to have a (operable) two-way EOT device, and the device fails, the train is not permitted to descend a heavy grade (an average grade of 2 percent or more for 2 continuous miles) until an operable device is installed or an alternative method of initiating an emergency brake application from the rear (end) of the train is achieved. 4 A Roadrailer, etc., is considered to be a car. 5 The term “cars” in this context does not include locomotive units, unless the locomotive unit is “dead-in-tow,” in which case the unit is treated like a car.

Appendix C 70 Railroad Accident Report B. Passenger trains that develop en route failure of the two-way EOT device may continue to operate over track that is not in heavy grade territory as long as a crewmember occupies the rearmost car with a readily accessible emergency brake valve and remains in constant radio communication with the locomotive engineer. Also, the engineer must periodically test the braking characteristics of the train by making running brake tests. Each en route failure must also be corrected at the next location where necessary repairs can be conducted or at the next location where a required brake test is to be performed.

71 Railroad Accident Report Appendix D Chronological List of Track Maintenance Operations on Accident Curve Following Shoulder Ballast Cleaning Date Activity MP Location Rail Temp. Slow Order Dates Remarks 09-18-00 to 10-13-00 Shoulder ballast cleaning Thru curve 01-29-01 Surfacing 721.9- 722.3 03-20-01 Surfacing 722.4- 722.9 03-22/23- 01 Surfacing 722.1- 722.3 03-27-01 Surfacing 722.1- 722.3 05-26-01 Rail defect 722.5- 722.6 05-26-01 to 06-04-01 Not test car defect 05-30-01 Rail changed 722.5 128° F 07-03-01 Surfacing 722.2- 722.3 07-03-01 to 07-06-01 Hand- tamped 08-04-01 Surfacing 722.2- 722.3 08-04-01 to 08-08-01 Hand- tamped 08-06-01 Surfacing 722.2 96° F 08-04-01 to 08-08-01 Hand- tamped 10-09-01 Surfaced full curve 722.1- 722.5 92° F 10-05-01 to 11-23-01 Liner-tamper machine problems 10-11-01 Surfaced half curve 722.1- 722.3 See above Liner-tamper machine 11-19-01 Spot- surfaced 722.1- 722.21 83° F See above Liner-tamper machine 12-20-01 Spot- surfaced 722.24 Hand- tamped 01-25-02 Spot in ties and surface 722.3 90° F 01-25-02 to 01-27-02 Hand- tamped 02-05-02 Surfacing 722.1- 722.3 02-05-02 to 03-13-02 Hand- tamped 02-26-02 Spot- surfaced 722.1- 722.3 90° F See above Liner-tamper machine

Appendix D 72 Railroad Accident Report 03-06-02 Concrete tie ballast- retaining wall installed See above 03-08-02 Added 70 tons of ballast 722.1- 722.3 See above 03-11-02 Surfaced 722.2- 722.3 See above Liner-tamper machine 03-25-02 Rail grinding None required 04-08-02 Replaced 5 ties 722.4 92° F Put on and removed same day Hand- tamped 04-09-2 Removed spikes and plates from under rail 722.3 04-18-02 Derailment occurred 722.24

73 Railroad Accident Report Appendix E Summary of Key Event Recorder Data Event Time Feet Speed Throttle Load EOT AB BC PCS Emer EOT Emer. Event

EDT ft mph notch amps psi psi psi

Reqst. 1 17:07:54 1362 56 Notch 8 832 108 110 0 Off Off Off Locomotive passes over POD/kink @ ~1341 feet

17:07:55 1279 56 Notch 8 832 108 110 0 Off Off Off

17:07:56 1195 56 Notch 8 832 108 110 0 Off Off Off

17:07:57 1112 56 Notch 8 832 108 110 0 Off Off Off

2 17:07:58 1028 56 Notch 8 824 108 105 0 Off Off Off Trainline pressure begins to drop

17:07:59 945 56 Notch 8 824 108 102 0 Off Off Off

17:08:00 862 56 Notch 8 832 108 100 1 Off Off Off

3 17:08:01 780 55 Idle 744 108 99 9 Off Off Off Locomotive crew initiates emergency brake

17:08:02 698 55 Idle 0 108 98 3 Off Off Off

17:08:03 617 55 Idle 0 108 45 10 On Off Off

17:08:04 537 54 Idle 0 108 0 35 On Off Off

17:08:05 459 53 Idle 0 106 0 68 On Off Off

17:08:06 382 52 Idle 0 106 0 85 On Off Off

17:08:07 306 51 Idle 8 106 0 88 On Off Off

17:08:08 234 49 Idle 64 106 0 87 On Off Off

17:08:09 170 43 Idle 144 106 0 84 On Off Off

17:08:10 116 36 Idle 144 106 0 46 On Off Off

4 17:08:11 74 28 Idle 48 106 0 16 On Off Off EOT registers emergency

17:08:12 42 22 Idle 24 0 0 1 On Off Off

17:08:13 20 15 Idle 16 0 0 0 On Off Off

17:08:14 7 8 Idle 8 0 0 0 On Off Off

5 17:08:15 4 1 Idle 0 0 0 0 On Off On Engineer throws EOT switch

17:08:16 3 1 Idle 0 0 0 0 On Off On

17:08:17 1 1 Idle 0 0 0 30 On Off On

6 17:08:18 0 0 Idle 0 0 0 69 On Off On Locomotive stops

this page intentionally left blank

FD07283 ｜ 2003_美国_RAR0303.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2003 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Uncontrolled Movement, Collision, and Passenger Fatality on the Angels Flight Railway in Los Angeles, California February 1, 2001 Railroad Accident Report NTSB/RAR-03/03 PB2003-916303 Notation 7575 National Transportation Safety Board Washington, D.C.

this page intentionally left blank

Railroad Accident Report Uncontrolled Movement, Collision, and Passenger Fatality on the Angels Flight Railway in Los Angeles, California February 1, 2001 NTSB/RAR-03/03 PB2003-916303 National Transportation Safety Board Notation 7575 490 L’Enfant Plaza, S.W. Adopted August 5, 2003 Washington, D.C. 20594

National Transportation Safety Board. 2003. Uncontrolled Movement, Collision, and Passenger Fatality on the Angels Flight Railway in Los Angeles, California, February 1, 2001. Railroad Accident Report NTSB/RAR-03/03. Washington, DC. Abstract: About 12:17 p.m. on February 1, 2001, the two cars of the Angels Flight funicular railway collided in downtown Los Angeles, California. The accident resulted in 7 injuries and 1 fatality among the 20 passengers aboard the two cars and injuries to a pedestrian. The Angels Flight Operating Company estimated monetary damage to the cars at $370,000 with an additional $1.2 million to replace the funicular haul system. The safety issues discussed in this report are the adequacy of the safety oversight of the Angels Flight reconstruction project; the adequacy of the design of the reconstructed Angels Flight system; the adequacy and appropriateness of the braking systems designed for Angels Flight; and the adequacy of Angels Flight Operating Company’s maintenance and operating procedures As a result of its investigation, the National Transportation Safety Board issued safety recommendations to the California Public Utilities Commission, the City of Los Angeles Community Redevelopment Agency, and the American National Standards Institute. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2003-916303 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Railroad Accident Report Contents Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Angels Flight Funicular Railway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Postaccident Onsite Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Reconstruction of Angels Flight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Angels Flight Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Drive System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Braking Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Design Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Track Brakes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 End Gates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Emergency Walkway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Haul Cable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Cable Drum Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Deropement Switch Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Gearbox Overheating . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Shafts, Splines, and Bearings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Brake System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Capacity of Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Funicular Railway Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Regulatory Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Current Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 The Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Gear Hub Failure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Brake System Failure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Angels Flight Operations and Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Oversight of Angels Flight Design and Construction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 City of Los Angeles Community Redevelopment Agency Oversight . . . . . . . . . . . . . 38 California Public Utilities Commission Oversight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Contents iv Railroad Accident Report Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Appendix A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

v Railroad Accident Report Executive Summary About 12:17 p.m. on February 1, 2001, the two cars of the Angels Flight funicular railway (Angels Flight) collided in downtown Los Angeles, California. The accident resulted in 7 injuries and 1 fatality among the 20 passengers aboard the two cars and injuries to a pedestrian. The Angels Flight Operating Company estimated monetary damage to the cars at $370,000 with an additional $1.2 million to replace the funicular haul system. The National Transportation Safety Board determines that the probable cause of this accident was the Yantrak Company’s (Lift Engineering’s) improper design and construction of the Angels Flight funicular drive and the failure of the City of Los Angeles Community Redevelopment Agency, its contractors (Pueblo Contracting Services, Yantrak, and Harris and Associates), and the California Public Utilities Commission to ensure that the railway system conformed to initial safety design specifications and known funicular safety standards. The major safety issues identified in this investigation are: • The adequacy of the safety oversight of the Angels Flight reconstruction project; • The adequacy of the design of the reconstructed Angels Flight system; • The adequacy and appropriateness of the braking systems designed for Angels Flight; and • The adequacy of Angels Flight Operating Company’s maintenance and operating procedures. As a result of the investigation, the National Transportation Safety Board makes safety recommendations to the California Public Utilities Commission, the City of Los Angeles Community Redevelopment Agency, and the American National Standards Institute.

this page intentionally left blank

1 Railroad Accident Report Factual Information Accident Synopsis About 12:17 p.m. on February 1, 2001, the two cars of the Angels Flight funicular railway1 (Angels Flight) collided in downtown Los Angeles, California. The accident resulted in 7 injuries and 1 fatality among the 20 passengers aboard the two cars and injuries to a pedestrian. The Angels Flight Operating Company2 estimated monetary damage to the cars at $370,000 with an additional $1.2 million to replace the funicular haul system. Angels Flight Funicular Railway Angels Flight is a funicular railway in downtown Los Angeles that was originally built in 1901 to move passengers one city block between the commercial district at the bottom of Bunker Hill and the residential area at the top of the hill. Angels Flight operated until 1969, when it was dismantled, and the original cars and portions of the infrastructure were stored. Beginning in 1993, the Angels Flight funicular was reconstructed 1/2 block from its original location. It began operations in 1996 using the original two cars. (The two Angels Flight cars were named Olivet and Sinai. The cars were given these names in 1901, and the names were retained for the renovation.) In a basic funicular, the two cars operate in tandem and are connected to each other by a single haul rope (a steel cable). When one car goes up the incline, the other comes down. The two cars counterbalance each other, with the descending car’s weight working to neutralize the weight of the ascending car. Therefore, the power required for operation is nominal, basically only that which is necessary to overcome friction and the relatively equal countervailing forces. The reconstructed Angels Flight funicular used a different haul system (described in the “Angels Flight Design” section of this report), with each car connected to its own cable and the cars interconnected through the cable drums and driving gears. The guideway was a single track at the top and bottom with offset passing sidings midway on the incline. (See figure 1.) The Angels Flight funicular was 298 feet long on an approximately 33-percent grade. Passengers boarded and disembarked from either the lower station or the upper station that was one block uphill. (See figure 2.) Car movement was controlled by an operator inside the upper station house. No Angels Flight personnel 1 A funicular railway, or funicular, is a cable railway on a steep incline with counterbalanced cars simultaneously ascending and descending on parallel sets of rails. 2 The Angels Flight Operating Company managed the revenue operations and physical maintenance of the Angels Flight railway under a contract with the Angels Flight Railway Foundation.

Factual Information 2 Railroad Accident Report were on board either car during movement. The single operator in the upper station house was responsible for visually determining that the track and vehicles were clear for movement, closing the platform gates, pressing the start button,3 monitoring the operation of the funicular cars, observing car stops at both stations, and collecting fares from passengers. 3 The start button initiated automatic operations. This was the mode of operation at the time of the accident. Manual control was available and occasionally used. Figure 1. Angels Flight viewed from upper station. Figure 2. Angels Flight car at the passing siding with upper station in the background.

Factual Information 3 Railroad Accident Report Accident Narrative Just after noon on February 1, 2001, the Angels Flight operator was making change for a customer when he saw the ascending car stop about 30 feet from the top platform. As he focused his attention on the stopped car, he said, it slid downward a few feet, hesitated for an instant, and then began accelerating downward. The operator said that he had seen cars stop on the hill before but had never seen a car reverse direction. He said that as soon as the ascending car started moving downward, he pushed the emergency stop button. He said that the car did not slow or stop after he pushed the button and that the car continued gaining speed until it collided with the other car near the bottom of the hill. (See figure 3.) Persons waiting at the bottom platform who witnessed the collision said that the struck car stopped before the collision. The runaway car derailed during the crash; the struck car did not. The derailment marks and the dispersal of debris after the collision indicated that both cars moved about 20 feet downward from the point of impact. Emergency Response The collision occurred about 12:17 p.m. in a busy section of downtown Los Angeles. Local emergency response agencies reported receiving multiple phone calls almost immediately. A Los Angeles police officer heard the collision and responded to the accident scene within 1 minute. The first fire department vehicle arrived within 4 minutes. Firefighters and paramedics used wooden extension ladders to reach, provide emergency Figure 3. Position of cars after collision.

Factual Information 4 Railroad Accident Report treatment to, and evacuate the passengers. (See figure 4.) The injured passengers were strapped to backboards that were lowered to the ground by firefighters standing along the lengths of the ladders. (See figure 5.) Figure 4. Ladders placed for the emergency evacuation. Walkway on the other side of the tracks can be seen below track level. Figure 5. Passenger evacuation after collision.

Factual Information 5 Railroad Accident Report Injuries At the time of the accident, 8 people were aboard the runaway car and 12 were aboard the car that was struck. One passenger was ejected from the open end of the struck car. Other passengers were injured when they struck vertical grabrails, each other, and various objects inside the cars. One of these injured passengers, an 83-year-old man, died later at a hospital. The Los Angeles County coroner’s office reported the cause of his death as multiple traumatic injuries. Debris from the collision fell onto the surrounding area and injured one pedestrian. Table 1. Injuries.a Damage The lower inboard quarter of the runaway car struck the upper inboard quarter of the stationary car. Approximately 4 feet of each car was crumpled. (See figures 6 and 7.)

Passengers Pedestrians Total Fatal 1 0 1 Serious 5 0 5 Minor 2 1 3 None 12 0 12 Total 20 1 21 a 49 Code of Federal Regulations 830.2 defines fatal injury as “any injury which results in death within 30 days of the accident” and serious injury as “an injury which: (1) requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; (2) results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages, nerve, or tendon damage; (4) involves any internal organ; or (5) involves second or third-degree burns, or any burn affecting more than 5 percent of the body surface.” The minor injury category includes all other persons, not cited in the other injury categories, who were reported treated by area hospitals within 24 hours following the incident.

Factual Information 6 Railroad Accident Report Figure 6. View of some of the exterior damage to cars. Figure 7. View of some of the interior damage to one of the cars.

Factual Information 7 Railroad Accident Report The concrete crossties and rail fasteners under the derailed car were scored and dislocated. Some internal haul system components were broken and destroyed. Monetary damage estimates provided by the Angels Flight Operating Company were as follows: Table 2. Damage. Meteorological Information At the time of the accident, the temperature was 72º F, winds were calm, and the skies were clear. Postaccident Onsite Examination The system’s operating machinery was in the machinery room underneath the operator’s station house. The Angels Flight haul system consisted of a separate cable, drum, axle, and planetary gear for each car, with a sun gear driven by a single 100- horsepower electric motor. (See figure 8.) The driven sun gear meshed with the planetary gear for the Olivet car (the struck car in this accident), which in turn meshed with the planetary gear for the Sinai car (the striking car). Axle shafts (about 3 inches in diameter) connected the planetary gears with their respective cable drums. This gear arrangement meant that the two planetary gears, and thus the two cable drums, were counter-rotational, resulting in counterbalancing loads as one car descended while the other ascended. Emergency brakes (discussed in detail later in this report) that were designed to stop the rotation of the drum were found to be in the released position even though the emergency stop button had been pressed by the operator. Initial inspection also revealed that the 7/8-inch-diameter cable for the Sinai car was intact but that two rows of the wound cable had de-spooled from its drum. Reconstruction of Angels Flight The City of Los Angeles Community Redevelopment Agency (Community Redevelopment Agency) purchased Angels Flight in 1962 because Angels Flight was within the Bunker Hill district urban renewal project area. At that time, Angels Flight was Damage Estimate Equipment $370,000 Wreckage removal 57,000 Infrastructure 73,000 Haul mechanism 1,200,000 Total $1,700,000

Factual Information 8 Railroad Accident Report a designated historic and cultural monument. In response to community interest in and concern about the eventual fate of Angels Flight, the Community Redevelopment Agency pledged to restore the funicular railway as part of the Bunker Hill urban renewal project. In 1991, the Community Redevelopment Agency hired Parsons Brinckerhoff Quade & Douglas Engineering (Parsons) as an advisor on the reconstruction of Angels Flight. In 1992, the Community Redevelopment Agency hired Harris and Associates (Harris) as the construction manager for the renovation of Angels Flight. In 1993, Harris hired Parsons to design specifications for the project. On June 17, 1993, the Community Redevelopment Agency approved the Angels Flight Restoration and Reconstruction Plan. The Community Redevelopment Agency selected Pueblo Contracting Services, Inc., (Pueblo) to be the general contractor for the Angels Flight reconstruction. On November 17, 1994, the Community Redevelopment Agency awarded two construction contracts to Pueblo to rebuild Angels Flight according to the Parsons specifications, and construction began soon afterward. In 1995, Pueblo hired Lift Engineering (Yantrak4) to implement Parsons’s conceptual design by designing and building the funicular drive, control, and braking systems and the haul and drum assembly. (See figure 9.) About 15 months later, a ceremonial opening of Angels Flight took place on February 23 through 25, 1996. Figure 8. Schematic of Angels Flight haul system. 4 Yantrak, a company that built automated trains such as those used at airports, was established in the early 1990s by the owner of Lift Engineering, which until that time had built only ski lifts. During the Angels Flight project, Lift Engineering often sent letters and faxes bearing the Yantrak company name, and parties to the reconstruction commonly referred to Lift Engineering as Yantrak. Gearbox To Olivet Car LEGEND Cable Deropement Device Planetary Gears Sun Gear Motor Axle Shaft Service Brake OlivetCable Drum To Sinai Car Point of Failure Axle Shaft Emergency Brakes SinaiCable Drum Olivet Cable Drum Sinai Cable Drum

Factual Information 9 Railroad Accident Report During the project, the Community Redevelopment Agency had responsibility for contract negotiations, safety oversight, deletions from and modifications of the original safety designs, and safety certification. As owner of the funicular, the Community Redevelopment Agency made final decisions concerning the original engineering design of Angels Flight and subsequent modifications. The project lasted from 1991 through April 1997, when the completed funicular was leased to the nonprofit Angels Flight Railway Foundation, which entered into a 99-year lease with the Community Redevelopment Agency to operate and maintain Angels Flight. The Community Redevelopment Agency maintained ownership but was not involved with the operation or maintenance of Angels Flight. The Angels Flight nonprofit foundation contracted with the for-profit Angels Flight Operating Company to manage the operation and maintenance of the railway. The Angels Flight Operating Company hired the Millar Elevator Service Company (Millar) in 1996 to perform maintenance and inspections. The Millar elevator mechanic assigned to Angels Flight eventually became the maintenance contractor, and he subsequently became vice president of the Angels Flight Operating Company while simultaneously remaining an employee of Millar. Figure 9. Organizations involved in Angels Flight design, construction, and operation. CITY OF LOS ANGELES COMMUNITY REDEVELOPMENT AGENCY Angels Flight Owner 1962 - Present HARRIS & ASSOCIATES Construction Manager 1992 - 1996 PARSONS BRINCKERHOFF Transportation Consultant 1991 - 1996 PUEBLO CONTRACTING SERVICES, INC. General Contractor 1994 - 1996 LIFT ENGINEERING (YANTRAK) Designer and Builder GEAR DRIVE, DRUM, ROPE, AND SPLINE 1995 - 1996 ANGELS FLIGHT RAILWAY FOUNDATION Nonprofit Fundraiser 1995 - Present MILLAR ELEVATOR COMPANY Maintenance and Inspection 1996 - Present ANGELS FLIGHT OPERATING COMPANY Operator 1995 - Present LEGEND Design Construction Operation CALIFORNIA PUBLIC UTILITIES COMMISSION Safety Oversight CITY OF LOS ANGELES COMMUNITY REDEVELOPMENT AGENCY Angels Flight Owner 1962 - Present HARRIS & ASSOCIATES Construction Manager 1992 - 1996 PARSONS BRINCKERHOFF Transportation Consultant 1991 - 1996 PUEBLO CONTRACTING SERVICES, INC. General Contractor 1994 - 1996 LIFT ENGINEERING (YANTRAK) Designer and Builder GEAR DRIVE, DRUM, ROPE, AND SPLINE 1995 - 1996 ANGELS FLIGHT RAILWAY FOUNDATION Nonprofit Fundraiser 1995 - Present MILLAR ELEVATOR COMPANY Maintenance and Inspection 1996 - Present ANGELS FLIGHT OPERATING COMPANY Operator 1995 - Present LEGEND Design Construction Operation LEGEND Design Construction Operation CALIFORNIA PUBLIC UTILITIES COMMISSION Safety Oversight

Factual Information 10 Railroad Accident Report Angels Flight Design Parsons’s specifications for the funicular system included a trackway design with standard steel rails attached to concrete ties, all supported on an elevated framework from 10 to 20 feet above the ground. (See figure 10.) Drive System When originally built in 1901, Angels Flight was a basic funicular, with two cars, connected by a single cable, whose weights counterbalanced each other. The haul system was powered through an arrangement of wheels and gears that the cable passed around at the top of the hill. For the reconstruction of Angels Flight, Parsons did a conceptual design of the haul system. (Subsequently, Yantrak modified the haul system design. A schematic diagram of the Yantrak haul system is shown in figure 8.) Instead of a single cable connecting the two cars, the new haul system consisted of an autonomous cable, drum, axle, and planetary gear for each car, with a common driven, or sun, gear. Thus, each car was attached to its own cable; each cable was wound around and attached to the outside of an independent 6-foot-diameter drum; each drum was connected to its own axle; the axles were connected inboard to separate planetary gears; and the planetary gears were meshed together. One of the planetary gears meshed with a driven sun gear that was powered by a 100-horsepower motor. This design made Angels Flight a double winding drum system that was operated as a double reversible funicular.5 Maximum operating speed was about 352 feet per minute (4 miles per hour). Figure 10. Elevation of Angels Flight track (at left). 5 A double reversible funicular has two cars that reciprocate between stations or terminals on two paths of travel.

Factual Information 11 Railroad Accident Report The 1901 Angels Flight had a second “safety cable” that was used to prevent a runaway if one of the cars became detached from the primary cable, if the primary cable failed, or if anything else happened to cause uncontrolled movement. The reconstructed version of Angels Flight did not have a safety cable. Braking Systems Angels Flight was equipped with two disc-brake-style braking systems: a service brake and emergency brakes. The service brake stopped rotation of the motor shaft powering both cable drums through the gear train. Because the service brake acted on the motor shaft only, it would have no effect on a car that became disconnected from the motor because of failure of a cable or gear train component. Each of the two cable drums was equipped with emergency brake calipers that operated by closing against the drum flanges when the emergency brake was activated. The calipers on both drums closed when the emergency brake was activated; thus, the emergency brake stopped the rotation of both drums simultaneously. The emergency brakes operated to stop the cars if a failure in the gear train caused them to be disconnected from the drive motor; however, the emergency brakes could not stop a car whose drive cable had broken or become detached from the drum. The service and emergency brake systems were both spring-applied brake systems. Hydraulic pressure for the two systems was provided by two identical hydraulic pumps. In the “applied” state for both brake systems, spring pressure held the brake calipers closed. Hydraulic pressure was then used to counteract the spring pressure and release the brakes. The brakes would remain in the released state as long as the hydraulic systems were sufficiently pressurized. To activate the service brake, a solenoid valve had to open, thereby relieving hydraulic pressure in the system. Similarly, to activate the emergency brakes, an identical solenoid valve had to open to relieve the hydraulic pressure. With hydraulic pressure reduced or removed, spring pressure would close the brake calipers against the motor shaft disc or the cable drum flanges, depending on which brake system was activated. The operator’s console had an emergency stop button and a button that operated the service brake. Design Changes Parsons’s specifications called for both cars to be fitted with emergency track brakes, end gates on the cars to contain passengers, and an emergency walkway for the entire length of the tramway to facilitate the evacuation of passengers in the event of an emergency. As discussed below, none of these features were included in the final design and construction.

Factual Information 12 Railroad Accident Report Track Brakes The original design submitted by Parsons and approved by the Community Redevelopment Agency called for both cars to be fitted with emergency track brakes. Track brakes are attached to the underside of the car body with the brake pads configured to apply against the top of the rail, against the sides of the rail, or around the entire railhead. In the event a car exceeds a safe speed because of a loose or broken cable or other catastrophic failure of either the drive or haul system, track brakes provide an independent means of stopping the car by applying a retarding force directly between the car and the track structure. Parsons interoffice communications indicate that final track brake application and configuration was being discussed routinely throughout 1993. Records show that Parsons continued to research recent funicular construction even after the original design was submitted and approved. Nothing in the records from 1993 indicates that the elimination of track brakes was being considered. An August 22, 1995, letter from Yantrak (which was building the drive, control, and braking systems) to Parsons summarized the technical points of a meeting held that morning. Under the section “Track Brake,” the letter stated the following: This track brake is frequently eliminated on modern high-speed (more than 10 m/sec) tramways. Track brake used in the case of overspeed is not very practical. …With such a short track, there is little room to brake, and the probability of running out of track before the tramway stops is high. Rail brake as suggested by the specification is not possible. (Clearances, dynamics, lack of braking surface, lateral displacement of the undercarriage, etc.)…. In response, Parsons (which had developed the design specifications) sent Yantrak the engineering calculations for braking Angels Flight, information from two manufacturers of modern track brakes, and comments concerning the use of a disc brake on a 33-percent grade. On August 30, 1995, Parsons wrote Harris (the construction manager) about its concerns regarding Yantrak’s response: [Yantrak] states ‘This track brake is frequently eliminated on modern high-speed (more than 10 m/sec) tramways.’ This statement appears to be incorrect and irrelevant to inclined railway applications. The average speed specified for the Angel’s Flight is around 6 ft/s or (1.8 m/s). All modern inclined railway systems [Parsons is] aware of are equipped with an emergency track brake for safety reasons. In the letter, Parsons went on to ask for “a list of modern inclined railway systems not equipped with an emergency track brake to support [Yantrak’s] claim [that track brakes are not practical].” In support of Parsons’s inclusion of track brakes in its design, the letter stated the following: The statement made that ‘the probability of running out of track before the tramway stops is high’ because of ‘such a short track’ appears incorrect. A simple calculation shows that the minimum specified track brake rate (1.75 mph/s) at the specified speed (about 4 mph), the stopping distance is approximately 8 to 10 feet. This calculation considers the response time of the brake system.

Factual Information 13 Railroad Accident Report The statement that ‘rail brake as suggested by the specification is not possible’ is incorrect. The suggested concept is actually in use in the USA, Switzerland, Germany, and France, and has been proven to be efficient and reliable. [Yantrak] should support [its] claim with specific evidence. Between August 22, 1995, and September 6, 1995, Harris, Parsons, and Yantrak exchanged correspondence concerning track brakes. The need for a “fail-safe” application, current industry applications of various forms of track brakes, track brake guard rails, a second haul cable, and additional braking calculations were discussed. A September 7, 1995, interoffice Parsons communication stated: …it is my understanding that a decision has been made by [Harris] not to have a track brake to stop the Angel’s Flight vehicles should a rupture of the haul cable occur. It is my professional opinion that the above violation of the technical specification is unacceptable because of the risks of potential injuries/fatalities it may cause to the passengers…. My advice is that [Parsons] should stand firm on the issue or disclaim any responsibility. Alternate solutions will require a complete re-study of the conceptual design. (Example: 2 haul cables.) Parsons sent a letter to Harris on September 8, 1995, objecting to the elimination of track brakes from the Angels Flight vehicles. That letter stated, in part: [Harris has] advised that [Yantrak] … has proposed to delete the track brake required.… The reason stated for this deletion was incompatibility between the conceptual arrangement of the track brake…and the guard rail…. As previously stated, we find no incompatibility between the conceptual arrangement of the track brake and the guard rail. It is our opinion that the deletion of the track brake is an unacceptable departure from the technical specifications. In the event of a rupture of the haul cable the absence of the track brake poses the risk of potential injury or fatality to passengers. Therefore, it is recommended that [Yantrak’s] proposal be rejected. Harris, with the Community Redevelopment Agency giving final approval, decided not to equip the Angels Flight vehicles with track brakes. An October 10, 1995, Parsons document details a review of Yantrak technical drawings. Under the “Trucks” section, the review states in part: “Only a single cable is shown. Since it is understood that the vehicle will not have track brakes, there should be two cables for safety conditions.” Records indicate that on October 11, 1995, a Parsons engineer sent an interoffice communication with annotated photographs of current funicular operations that had either track brakes or two haul cables; these were Peak Tramway in Hong Kong, with two haul cables and no track brakes, and Rigiblick in Switzerland, with one haul cable and track brakes. A meeting was held in Atlanta, Georgia, on November 11, 1995, between Parsons and Harris. Minutes of that meeting state the following:

Factual Information 14 Railroad Accident Report The general safety philosophy of the drive system is discussed at length. [Parsons’s] representatives state that over-design of the drive system is not a satisfactory answer to their concerns about the safety of the system. A failure analysis has not been performed by [Yantrak] to identify the possible catastrophic hazards, and should be required. However, it can be said that there is always a possibility of rupture of the haul cable, or slip of a pinion or bull gear, and both may cause a catastrophic hazard. Present industry practices show that a track brake will satisfy the safety requirements, as well as the redundancy approach of having a second haul ‘safety’ cable. However, due to the project schedule, the track brake approach seems the only possible solution to comply with the safety requirements without impact on the project schedule. A quick review of the undercarriage structure shows that there should be no problems to weld two track brake mounting assemblies to the metallic beams supporting the wooden carbody. The Harris construction manager wrote to Pueblo on November 28, 1995, to express concern about modifying Parsons’s original Angels Flight design: One of [Parsons’s] concerns about your design was the lack of precedent for a system without a safety cable or track brake. [Yantrak] has always indicated that the systems in Pittsburgh operate without either component. [Yantrak] is incorrect. I have photographs of the two Pittsburgh systems and both have safety cables. It would be of benefit if you could produce a documentable example of a system in operation that is similar to the one you are currently designing. On January 22, 1996, about 1 month before Angels Flight began passenger service, Parsons wrote the following to Harris: The submitted documents [see below] show evidence that the proposed design is not in compliance with the required scope of work as related to the safety of the system. As written, they pass on to the Owner, or his representative, the responsibilities/liabilities of a non compliant and non failsafe design. Supporting documentation for the letter detailed the following specific safety weaknesses: • Lack of a back-up safety feature for a haul cable rupture; • Inadequate definition of supervisory responsibilities; • Lack of detailed operating procedures; • Inappropriate operating prohibitions; • Lack of an emergency evacuation plan; • Lack of details, definitions, and values for maintenance procedures and inspections of the undercarriage, haul cable, drive frame, gear case, gearbox mounting flange, rope drum, D-9 hubs, and gearbox; • Out-of-date log sheets and inspection forms; and • Inadequate recommendations to address the deficiencies of the proposed design identified in the hazards analyses.

Factual Information 15 Railroad Accident Report There is no indication that, in response to this letter, substantial revisions or inspection procedure changes were made to Angels Flight before it opened for passenger service. In a February 13, 1996, letter to Pueblo, Yantrak declared that a careful analysis of the conceptual design showed areas that were technically incorrect or inefficient. On the issue of track brakes, the letter stated that “Suggested use of the caliper rail brake was an oversight, since such a brake cannot be employed on the split rail of the train bypass.” The letter also stated that: A higher level of safety was achieved by conservatively sizing the rope and rope supporting elements and in the redundancy of rope attachment, than by monitoring the loss of the rope tension and vehicle overspeed and applying a secondary safety device acting in the case of rope failure. End Gates End gates were proposed for the Angels Flight vehicles by Parsons in its 1993 design. The proposal was based on a formal hazard analysis. The Community Redevelopment Agency approved installation of end gates and included the requirement in the contract that was later awarded to Pueblo. Throughout the Angels Flight reconstruction project, the Los Angeles Conservancy, a historic conservancy group, provided information to the Community Redevelopment Agency concerning the historical accuracy of the restoration.6 The historic conservancy group objected to the Angels Flight vehicles’ being equipped with end gates. According to the group, the cars operated with open entrances and exits without incident from 1901 until 1969. The cars were restored without end gates. In a February 14, 1996, letter to Pueblo, Harris included in its safety concerns about Angels Flight the following about the end gates on the cars: … The formal design (not concept) required gates on the cars. These have not been installed on four of the openings. What issues are involved with the removal of these gates? The cars were operated without end gates at the ceremonial opening February 23 to 25, 1996, and in passenger service thereafter. A March 25, 1996, letter from Harris to Pueblo about contract requirements that needed to be either completed or discussed stated: “Provide gates to cars and automatic stop provisions as required or provide professional opinion supporting evidence that the system can be operated safely without the specified gates and interlocks.” A Community Redevelopment Agency memorandum to Pueblo dated April 5, 1996, requested a change order in the existing contract regarding the end gate. The memorandum stated the following: 6 The primary liaison between the Conservancy and the Community Redevelopment Agency was an individual who later became president of both the Angels Flight Railway Foundation and the Angels Flight Operating Company.

Factual Information 16 Railroad Accident Report The contract specifications … required gates to be added to the two historic funicular cars as part of the rehabilitation of the cars. As work progressed … for the reconstruction of Angels Flight, it became apparent that there was a conflict between the two contracts. … Review of the plans for the reconstruction by the system designer [Parsons] and the system operator [the operating company] along with the regulatory agencies [Public Utilities Commission] led to the question of whether or not the gates are really necessary. In a May 20, 1996, letter to Pueblo, Harris wrote: [Community Redevelopment Agency] desires that [Pueblo] take the necessary steps to immediately install the gates to the cars. Gates at the lower ends are of utmost importance at this time. Please advise [Harris] of the proposed schedule for shop drawings, construction and installation. In a July 29, 1996, letter to the Community Redevelopment Agency concerning this issue, the Angels Flight president (the president of both the nonprofit foundation and the for-profit operating company) wrote: [Rule Company (the company that provided liability insurance for Angels Flight), in its] ‘Insurance Review of Operations’ confirms the opinions expressed when the underwriters first studied [Angels Flight] and underwrote [the] liability insurance with the cars operating open-ended – as the cars operated for 68 years. The letter from the Angels Flight Operating Company also stated that the Rule Company’s letter confirmed that after conducting a review of the first 5 months of operations, “the insurers are not aware of any problems, including any relating to ‘the traditional open end of the cars.’” (Emphasis in original.) On July 30, 1996, Harris sent a written proposal detailing “Safety Gate Shop Drawings” and “Sample of Metal Mesh” to Tetra Design, Inc.,7 for review and approval. In an August 6, 1996, letter to Pueblo, Harris mentioned the end gates and reminded Pueblo that it had not yet complied with the contract requirement that Angels Flight would not operate if a gate were open and would stop if a gate were opened while the tramway was operating. During October 1996, the Community Redevelopment Agency staff exchanged a series of memorandums concerning end gates for Angels Flight. In that correspondence, the Community Redevelopment Agency deputy administrator first opposed the addition of end gates because he believed the risk of a passenger falling from a car with an open end was lower than the risk of a passenger being pinched or hurt by a gate, and “the additional occasional risk from a passenger relying upon a closed end gate that fails is far greater than the risk of having no gates.” However, the Community Redevelopment Agency engineer assigned to the Angels Flight project protested the decision not to have end gates on the Angels Flight cars. Some of that engineer’s objections were as follows: 7 Tetra Design, Inc., was a prospective subcontractor for designing the end gates.

Factual Information 17 Railroad Accident Report • He and others had observed conditions on Angels Flight cars where accidents could have occurred. • The original design team of engineers and transportation experts saw the need for gates to prevent a person from falling out of the Angels Flight cars, which led to gates being specified that were to be interconnected to the control system to stop the drive system if a gate was opened. The project engineer summarized his view as “When weighing the risks of persons getting a pinched finger vs. a possible fatality, … we should protect against the possible fatality.” The deputy administrator then changed his mind on end gates. The Harris construction manager’s written notes indicate that the project engineer: • Told the Harris construction manager that he had been directed by his supervisor to install the gates, • Had prepared a letter to Harris directing that the gates be installed, and • Sent word to the Community Redevelopment Agency director asking whether the decision to install the gates would be appealed to the Community Redevelopment Agency board. Before the end gates could be installed, the Angels Flight president wrote an objection to the Community Redevelopment Agency deputy administrator, stating: … Is it most prudent to add new gates, as some have suggested, or is it more prudent to leave the cars as they always have been—open at the ends? This is an issue that the Angels Flight Operating Company and our insurance advisers have studied carefully. Our conclusion is that it would be less prudent to add new gates. … In every case, the hazards of adding gates equal or outweigh the hazard of leaving the cars as they have been for the first 68 years of operation and for the past 8 months of renewed operation. This is why my advisers and I have concluded that what is most prudent is to not alter the cars by adding the proposed end gates. [Emphasis in original.] In response, the Community Redevelopment Agency administrator wrote to the Angels Flight president announcing the issuance of a contract change order to delete installation of the end gates. The letter noted that it was at the insistence of the Angels Flight foundation and operating company that the agency had contemplated issuing the change order. The administrator also stated that there were safety advantages and disadvantages involved with installing end gates and that the decision not to install the end gates must continue to be studied. Finally, the letter stated that the change order to delete the end gates from the Angels Flight cars would be issued provided that five safety conditions were incorporated in the agreements to be executed between the Community Redevelopment Agency and the Angels Flight Railway Foundation for the conveyance and operation of Angels Flight. As written, those conditions were as follows:

Factual Information 18 Railroad Accident Report First, upon the execution of the conveyance documents, the [foundation] and the [operating company], or any subsequent operator, will be wholly responsible for the maintenance and operation of Angels Flight, including the safety and security of the Angels Flight patrons, as already set forth in the conveyance documents. Second, the [foundation] and the [operating company] will be legally liable for any event or occurrence related to the design, installation and operations of the railway following the conveyance of Angels Flight to the [foundation] and must defend, indemnify and hold harmless the Agency, its Board and staff and the City of Los Angeles. Third, appropriate signage must be installed or verbal warnings enhanced to advise riders of the potential for harm that exists because of the open ends of the cars. … Fourth, a monitoring procedure, including electronic monitoring, such as was discussed in the August meeting and agreed to in your October 29 letter, should be considered by the [foundation] and must be formally incorporated into the Angels Flight operations. … Fifth, and finally, the end opening of the cars must continue to be studied by the [foundation] and [the operating company] for the dual purposes of potential future installation of the end gates and equally important, the introduction of other safety and security measures which may be beneficial. In a November 13, 1996, letter, the Community Redevelopment Agency administrator instructed Harris to prepare a change order that deleted the requirement for end gates on the Angels Flight vehicles. The letter stated that the gate requirement was deleted after a comprehensive and diligent review at the request of the current operator of Angels Flight and the nonprofit foundation. The next day, November 14, Harris issued a request for quotation to Pueblo that stated: “Delete the four gates, hardware, design and interconnect to the operating system as shown at the top and bottom of the funicular cars.…” Emergency Walkway Parsons’s original design called for a walkway along the entire length of the guideway for the evacuation of passengers from stranded vehicles. Preservationists raised concerns about the historical accuracy of the walkway as early as 1993, pointing out that Angels Flight did not have such a walkway between 1901 and 1969. Parsons wrote a memorandum to Harris on December 6, 1993, on the subject of safety versus historical accuracy issues: …the Project Owner [Community Redevelopment Agency] must exercise final approval on various Project features, characteristics, etc. i.e., it cannot delegate certain policy matters to its consultants. Under California Government Code Section 835, a public entity is liable for injury caused by a dangerous condition of its property if the dangerous condition was created by a negligent or wrongful act or omission…and failed to take appropriate measures to protect against the

Factual Information 19 Railroad Accident Report dangerous condition. … a successful effort by others to override the Public Utilities Commission and/or the Fire Department on the need for the emergency staircase … would place the Community Redevelopment Agency in jeopardy. The Community Redevelopment Agency’s deputy director of engineering detailed his position concerning the necessity of an emergency walkway next to the Angels Flight trackway in a memorandum to the Community Redevelopment Agency director of engineering dated March 2, 1995. In that memorandum, he stated that the Community Redevelopment Agency’s acting administrator and senior staff concurred with the need for an emergency walkway and raised concerns that Angels Flight might not be insurable without it. In a March 24, 1995, letter to the Angels Flight Operating Company, an insurance loss control consultant stated his opinion that the track-adjacent walkway “could present an attractive nuisance and facilitate vandalism and malicious mischief.” In a March 28, 1995, letter to the Community Redevelopment Agency’s deputy director of engineering, a supervising engineer from the Public Utilities Commission Rail Transit Safety Section noted that the Public Utilities Commission staff agreed that the safety advantages of the proposed emergency walkway immediately adjacent to the Angels Flight trackway were outweighed by the attractive nuisance safety hazards created. On April 18, 1995, the Community Redevelopment Agency’s director of engineering issued a memorandum to eliminate the emergency stairway. That memorandum stated the following: This Change Order authorizes the contractor to proceed with designs for requested changes which would alter the method of providing emergency egress from the funicular. The Los Angeles City Fire Department (LAFD) and the State Public Utilities Commission have given their approval to delete the trackway emergency stairway they had required, if certain other equipment and facilities are added to Angels Flight. BACKGROUND During the planning for the reconstruction of Angels Flight, the regulating agencies, the LAFD and the Public Utilities Commission, required that some method of emergency egress be provided for the funicular even though historically there was none. After many discussions, LAFD and the Public Utilities Commission recommended that a trackway emergency stairway be included in the plans. Because a trackway emergency walkway was not in keeping with the historic context of Angels Flight, the Los Angeles Conservancy expressed concerns about its inclusion during review of the reconstruction plans. ... a member of the Conservancy and potential operator of Angels Flight, further investigated the need for the trackway emergency stairway and any alternatives thereto. Through various meetings with LAFD and the Public Utilities Commission, [he] has convinced them to agree to an alternative to the trackway emergency stairway which would consist of:

Factual Information 20 Railroad Accident Report • A combination ground-level and elevated stairway separated from the trackway • Auxiliary emergency power supply • Reversible funicular controls • Security system and fence The items noted above were added during the renovation of Angels Flight by the Community Redevelopment Agency. A walkway next to the trackway to facilitate the emergency evacuation of passengers was never constructed. Haul Cable In the aftermath of the decision not to include track brakes or a safety cable on the reconstructed system, Yantrak specified a haul cable that was thicker (7/8, or .875, inch in diameter) and had a higher safety factor than the cable specified in the original Parsons design. Yantrak did not redesign the drums on which the cable wrapped and unwrapped, which were constructed to the original specifications. Cable Drum Design The two Angels Flight cable drums were grooved to accept the cables as they were wound onto the drums to help prevent deropement. The cable drums had outer flanges to help contain the cable. Investigators measured the height of the flanges on both drums. On the Olivet drum, the flanges measured .594 inch on the outer side and .75 inch on the gearbox side. For Sinai, the measurements were .625 inch for the outer side and .75 inch for the gearbox side. Postaccident examination of the drum for Sinai’s cable revealed that during or immediately after the accident, the cable had become partially unspooled from its drum. Deropement Switch Device Both of the Angels Flight cable drums were equipped with switches intended to activate the system brakes to stop the funicular in the case of deropement. (See figure 11.) The switches contained pressure-sensitive edges and were mounted directly above the surface of each haul cable when it was stored on its respective drum. Because the deropement switches did not extend all the way across the drum’s surface, the outboard haul cable coils could derope without triggering the deropement switch, as occurred with the Sinai drum in this accident.

Factual Information 21 Railroad Accident Report Angels Flight had been in passenger service for several months before the deropement switches were added. On August 12, 1996, Harris sent a letter to Pueblo listing “de-roping annunciation and system halting” as requirements that had not been completed. The deropement switches described above were subsequently added. Operations Gearbox Overheating According to the Angels Flight president, high oil temperatures in the gearbox became a concern soon after Angels Flight opened in February 1996. Angels Flight representatives made repeated telephone calls to Yantrak in a continuing attempt to evaluate and correct the problem. Yantrak’s initial response referenced a memorandum from Fairfield Manufacturing,8 which stated: … oil temperatures up to 225 degrees F will not cause gear or seal problems in your Angels Flight drive. …The level of oil in the box will change your operating temperature. I would lower it to the centerline and see how much that helps. As you continue to lower the level, the temperature will fall to a point where you are no longer getting enough lubrication and then it will start to rise. Since your unit is critical, I would not take this test to the point where you get the temperature rise Figure 11. Deropement device. 8 Fairfield Manufacturing supplied most of the gears (but not the hubs, which were supplied by Yantrak) for the Angels Flight gearbox.

Factual Information 22 Railroad Accident Report but do feel you could safely go two inches below centerline and would see significant improvement in oil temperature. During periods of overheating, incidents occurred in which the Angels Flight system automatically shut itself down while in passenger service.9 A California State assistant attorney general told the Safety Board that he had stopped riding Angels Flight long before the accident because he had been stranded on the hill several times when the system shut down while the cars were midway between stations. The assistant attorney general said that Angels Flight operators told him that the shutdowns occurred when the system “got hot” and that the only thing they could do was to wait for it to cool down. He further said that on occasions when the system had stopped, he had observed other passengers exit the cars and walk on the track structure to the bottom of the hill. The Angels Flight vice president stated that he had seen a passenger evacuate a car and walk down the track to the bottom of the hill when the cars were stopped. In a February 27, 1995, letter addressed to the insurer for Angels Flight, the Angels Flight president referenced an insurance loss control consultant’s recommendations that “passenger egress from the cars or from the landings onto or near the tracks should be prevented at all times, ‘emergency’ or otherwise.” The Angels Flight president issued instructions that the cars would be stopped at their terminal berths any time the oil temperature approached 225º F, but this procedure did not completely eliminate the shutdowns. The operating company continued Angels Flight passenger service and did not modify the operating schedule to help prevent delays caused by excessive oil temperatures. According to the Angels Flight vice president, in 1996, the gearbox oil would heat to the point that it vaporized and the vapor filled the machine room. As the oil cooled, it would condense and leave a slick surface on the floor, walls, ceiling, and equipment. During the on-scene investigation, the Angels Flight vice president said he had feared during this period that an electrical spark or other source of ignition could trigger an explosion. He stated that Yantrak was reluctant to install an oil cooler. Initially, an expansion tank that collected the hot oil and returned it to the gearbox sump was added to the lubrication system. The vice president said this measure helped with the overflow situation but did not eliminate the overheating problem. He stated that the high oil temperatures had carbonized the seals around the bearings in the gearbox in 1996, and the seals began to leak. After a debate throughout 1996 that involved Yantrak, Angels Flight, the Community Redevelopment Agency, Pueblo, and Harris, an oil cooler was added to the system in 1997. Additionally, a synthetic oil replaced the conventional oil used previously, and the bearings and seals on the drive side were replaced. The Angels Flight vice president stated that the oil temperatures dropped into “…the 150º [F] to 175º [F] range…” after these changes were made to the system. Eventually, all of the seals and bearings that had been affected by excessive oil temperatures in 1996 were replaced in 1997. 9 An oil temperature sensor and monitoring system automatically shut down the funicular drive when the oil temperature exceeded 225º F.

Factual Information 23 Railroad Accident Report Maintenance According to the Angels Flight Railway Operations and Maintenance Manual, published by Yantrak and accepted by the operating company in 1996, the oil in the gearbox was to be sampled and analyzed every 18,000 cycles or 6 months.10 There was no guidance regarding the reasons for performing the oil analyses, the contaminants or properties that should be measured, or how to evaluate the results of such testing. The manual noted that the gears were to be inspected visually on an annual basis, but there was no guidance on measuring gear wear or the appropriate tolerances between major components within the gearbox. Records of fluids analyses for 1997–1999 were reviewed. Fluids analysis tests were performed on Angels Flight five times in 1997, three times in 1998, and three times in 1999. The tests in 1999 showed that the level of iron in the oil was increasing. A fluids analysis on June 2, 1999, noted that “FE (iron) is starting to increase.” The company that conducted the oil sampling recommended resampling after 250 hours. After the June 1999 oil analysis, bearings were replaced, and the drive system gears were visually inspected. The gear hub splines (described in the next section of the report) were not inspected. No further fluids analysis tests were performed after June 1999, however, contrary to the semiannual requirement in the operations and maintenance manual. A postaccident fluids analysis test on February 28, 2001, showed elevated iron levels in the gearbox oil compared to previous oil analysis results. Tests and Research A series of tests and inspections was conducted at the accident site and at the laboratory of Exponent Failure Analysis Associates (Exponent). The complete funicular system and individual components were examined. The Public Utilities Commission, the Community Redevelopment Agency, Angels Flight Railway Foundation, Pueblo, Caterpillar,11 and Fairfield Engineering12 participated in the postaccident inspections and testing. Testing and inspection protocols were developed by Safety Board staff and Exponent, reviewed by the participants, modified as appropriate, and conducted and documented by Exponent. The outcome of initial testing resulted in additional examination in some areas. Shafts, Splines, and Bearings In the Angels Flight drive system, the planetary gears were connected to the cable drums through axle shafts. Longitudinal grooves (splines) about 4 inches long had been machined into each end of each axle shaft. These splined sections fit into and meshed with 10 Section VII, Gearbox, under Maintenance – Procedures and Intervals. 11 The drums for both of the cars were mounted on Caterpillar D-9 final drive hubs. 12 The D-9 hubs were connected to a gearbox, with many of the parts supplied by Fairfield Manufacturing.

Factual Information 24 Railroad Accident Report splined receiving hubs for the planetary gears and the cable drums. The splines were designed to lock these components in place. The Angels Flight gearbox was disassembled. The gears, shafts, and splines from both the Sinai side and the Olivet side were removed and examined and the results documented. Parties to the investigation were present. Axle Shafts and Splines. The Caterpillar-manufactured axle shafts for both the Sinai and the Olivet sides were found to be in good condition. For the Sinai car, metal shavings were found on the surface of the axle shaft, and the splines of the end of the axle shaft that engaged the planetary gear were slightly worn but otherwise intact. (See figure 12.) The outside diameter of the Sinai shaft, measured at the splines that mated with the receiving hub splines, was 2.912 inches. The outside diameter for the Olivet shaft at the corresponding splines was 2.917 inches. Both axle shafts were subjected to Rockwell C hardness tests.13 The average Rockwell C hardness for the Olivet shaft was 57 and for the Sinai shaft, 60. These hardness levels are near the higher end of the range measured for steel and indicate that the axle shafts were subjected to a hardening heat treatment to maximize their load- bearing capacity. Figure 12. Splined end of Sinai axle shaft that engaged the planetary gear receiving hub. 13 Rockwell hardness tests range from A to V, with the test chosen depending on the hardness of the material tested. The Rockwell C test is used for steel, hard cast iron, and titanium. The Rockwell B test is used for softer metals, such as copper and aluminum alloys, soft steel, and malleable iron.

Factual Information 25 Railroad Accident Report Sinai Receiving Hub and Splines. The Yantrak-supplied receiving hub for the Sinai planetary gear was pressed out of the gear and then sectioned by electron discharge machining. The splines that mated with those of the axle shaft were found to be stripped, thereby preventing the interlocking of the planetary gear with the cable drum. (See figure 13.) Thus, the Sinai car’s cable drum had effectively become disconnected from the drive mechanism, and it became freewheeling. The metal shavings removed from the surface of the Sinai shaft were consistent with the metal of the sheared female splines of the planetary gear receiving hub with which the Sinai axle shaft splines mated. The sectioned piece from this receiving hub was polished using standard metallurgical techniques and then examined under an optical microscope. The microstructure was found to consist of ferrite and pearlite typical of an unhardened steel. The sample of the receiving hub was then subjected to hardness testing at a variety of locations through its cross section, both near and away from the spline teeth. The hardness of the steel was between 78.0 and 80.5 on the Rockwell B scale for softer metals and was consistent throughout the piece. The receiving hub’s average Rockwell B hardness of 79 is typical of a nonheat-treated, soft steel. Thus, the Sinai receiving hub was softer than the axle shaft. Ball Bearings. The ball bearings supporting the receiving hubs on both the Sinai side and the Olivet side of the gearbox were inspected. The bearings on both the Sinai and Olivet sides were coated with a hard black material where they were exposed to the oil reservoir. The bearing races, or grooves for the ball bearings, showed some bluing. Figure 13. Section of planetary gear receiving hub showing stripped splines.

Factual Information 26 Railroad Accident Report Ground metallic residue that was removed during disassembly of the bearings was found to contain both metal shavings originating from the sheared splines and small, spherical pieces of metal that had spalled from the balls. The drum side (outer) ball bearing from the Sinai side of the gearbox was sectioned for study. The outer race was found to be relatively smooth with some pitting. The balls were badly chipped and pitted, as was the surface of the inner race. The condition of the ball bearings was consistent with exposure to high temperatures and inadequate lubrication. The bearings also may have been subjected to high contact stress. Brake System As mentioned previously, the service and emergency braking systems have calipers that are normally clamped shut by a number of springs, and hydraulic pressure is needed to open the brake calipers. Investigators and party members measured the capacity of the emergency brakes on each of the two drums by attaching the cable from the drum through a 20,000-pound load cell to a winch attached to structural members in the machine room. The winch was then used to increase the load on the cable gradually until the drum moved. The maximum force indicated by the load cell was then recorded. Sinai’s emergency brake withstood a cable load of 7,150 pounds before moving. Olivet’s emergency brake capacity was 4,700 pounds. In a second test, the Olivet emergency brake capacity was measured to be 5,300 pounds, for an average of 5,000 pounds. Service brake capacity was also tested. The service brake, like the emergency brake, is normally clamped in the absence of hydraulic pressure. The test was conducted by attaching a 10-foot torque bar to the coupling flange on the service brake and using a hydraulic jack to apply a load to the end of the torque bar. In this test, the disk began to slip when 2,250 foot-pounds of torque were applied to the service brake. This was within the expected range for the service brake. When the emergency brakes were operationally tested, the hydraulic pump functioned as expected to build pressure in the system and cause the brakes to release. This was the normal state during operation of Angels Flight. Further testing, however, revealed that the brakes, once released, could not be reapplied. Investigators determined that the solenoid valve, which was intended to open to relieve pressure (by returning oil to the oil reservoir), had a burned-out coil and therefore did not operate. Because the valve had failed in the closed position, pressure would build in the system to release the brakes, but the always-closed valve would prevent the pressure reduction needed to engage the brakes when needed. Solenoid valves are designed to be “normally open” or “normally closed” when de-energized. In other words, application of electrical current to the solenoid will close a normally open valve and open a normally closed one. The design of the electrical control system for the Angels Flight emergency and service brake systems called for the hydraulic pumps and solenoid valves to be energized whenever the brakes were to be released for operation of the railway. To function properly, this design required a normally open solenoid valve, which would close when energized, thus allowing sufficient hydraulic pressure to build within the system to compress the springs and release the brake calipers.

Factual Information 27 Railroad Accident Report Cutting power to the hydraulic pump and to a normally open solenoid valve would have caused the solenoid valve to open, thus reducing hydraulic pressure and applying the brakes. A normally open valve would also have been fail-safe, that is, it would have kept the brakes applied (because of insufficient hydraulic pressure) in all four failure modesfailure of the electrical system, failure of the solenoid itself, failure of the hydraulic pump, or significant leakage within the hydraulic system. Moreover, in this design, if a normally closed solenoid valve (which opens when energized, thereby preventing hydraulic pressure buildup) were used, neither the service nor the emergency brakes would have released. The latest available schematic diagram of the brake hydraulic system was stamped and dated February 16, 1996, by a civil engineer employed by Yantrak. The diagram for the service brake showed a normally closed solenoid valve. The diagram for the emergency brake system did not indicate whether the solenoid valve was of the normally closed or normally open type, but the parts list supplied by Yantrak specified a normally closed valve. Although the two solenoid valve types perform opposite functions, they look identical except for the part numbers imprinted on them. Inspection of the solenoid valves used in the Angels Flight brake systems determined that the defective valve for the emergency brake system was of the normally closed type, whereas the valve for the service brake system was of the normally open type. Electronic Control System. As noted above, Yantrak’s electric control drawings show a system that either supplies electrical power to both the hydraulic pump and the solenoid valve at the same time or to neither the pump nor the valve. When power is supplied to both the pump and a normally closed solenoid valve, the pump attempts to pressurize the brake system (to open the brake calipers) while at the same time the open solenoid valve is draining off the pressure (to close the calipers). When no power is provided to either the pump or the valve, the valve is closed, and it retains whatever pressure was in the system at the time of the closing, resulting in unpredictable brake behavior. In this design, normally open solenoid valves would have been required to apply and release the brakes in a conventional, fail-safe manner. Electronic-Hydraulic Control Interaction. The control electronics and hydraulics for the emergency brake were reassembled. Pressure sensors were installed, and system voltages were read at key locations using a computer data acquisition system. The hydraulic hoses were attached to the emergency brake calipers to simulate, as closely as possible, the conditions during actual use. Angels Flight personnel provided their recollections of maintenance events to assist in the process. The following was determined from the bench experiments and discussion: • Using the as-built Angels Flight control electronics and the normally closed solenoid valve called for in Yantrak’s design and parts list, the emergency brake hydraulic system developed minimal hydraulic pressure because of the open relief valve. Because the specifications called for the hydraulics to supply a minimum pressure of 1,500 psi to open the brakes, it was concluded that in the as-designed condition, neither the emergency brakes nor the service brake should ever have released.

Factual Information 28 Railroad Accident Report • The fact that the Angels Flight system operated for 5 years showed that the brakes did, in fact, function to some extent. It was theorized that Yantrak may have discovered during initial testing that the brakes would not function and must have replaced the normally closed solenoid valves with normally open ones. After this replacement, both the emergency brakes and the service brake would have functioned. Another possibility is that the system was initially constructed using normally open valves even though the drawings and parts list indicated normally closed valves. • Angels Flight service logs show that one of the solenoid valves later burned out and was replaced. After the solenoid valve failed, Angels Flight ordered normally closed replacement valves. It is not clear from the logs or statements made by Angels Flight maintenance personnel whether the solenoid valve that burned out was an original equipment unit or a replacement unit that was ordered in accordance with Yantrak’s parts list. As previously noted, however, a normally closed solenoid valve would have prevented the emergency brake from releasing. No information was available to investigators that would explain how the funicular could have been operated with a normally closed valve installed in the emergency brake system. However, once the normally closed solenoid valve failed, the railway could be operated, albeit without available emergency brakes. Daily Brake Testing. The Angels Flight vice president stated that he personally performed the daily and monthly maintenance inspections, following the operations and maintenance manual, which included inspecting brake operation. Daily inspections were performed in the morning before passenger service began. The vice president said he would manually reposition the cars from their overnight storage positions14 so that one car (typically Olivet) was at the upper station and the other car was at the lower station. When the cars had been repositioned, he would place the system in automatic operation from the operator’s station house and wait for the cars to begin accelerating. Before the cars attained full speed, he would engage the emergency brake button. The vice president further testified “As I was doing my inspection in the machine room, daily, I would climb up this ladder and the machine was set on a cantilever and you could actually, you know, physically see that the pads were dropped and that’s one of the procedures.” However, the emergency brake pads always looked like they were dropped, because of their distance from the ladder and the small clearances separating the brake pads from the drum flanges. As noted previously, the postaccident inspection found that the emergency brake system had a burned-out coil and therefore did not operate. Capacity of Components Exponent reviewed and analyzed calculations generated by Yantrak for the size and durability of gears, ropes, splines, brakes, bearings, and structural components. The calculations were stamped by a Yantrak civil engineer and dated October 9, 1995. In the 14 The cars were stored beside each other on the passing portion of the track structure.

Factual Information 29 Railroad Accident Report course of its review, Exponent discovered several errors in those calculations that are believed to have affected the selection of brake size and the lifetime of the gears and splines: • In a hand calculation sheet marked “Drive Frame Analysis, Angels Flight Funicular, Community Redevelopment Agency – Los Angeles, CA,” under the subheading “Eqpt Weights & Rope Forces,” rope tensions are calculated assuming a “crush load” of 20,000 pounds in the car and a slope of 19 degrees. In a later page of calculations titled “Haul Rope Analysis,” Yantrak uses a 0.1 g acceleration rate to the calculated maximum rope tension noted above to arrive at a total maximum rope tension of 9,080 pounds. In the Angels Flight acceptance tests on February 15, 1996, the cars were brought to a stop from full speed in 1.0 second under a variety of loading conditions, including crush loads on both vehicles. Since the maximum speed of the cars was 352 feet/minute, or about 5.9 feet/second, this test corresponds to a measured average acceleration of 0.18 g, almost double the acceleration assumed by Yantrak. Thus, Yantrak’s calculation underestimates the maximum rope tension (10,680 pounds) by 1,600 pounds. Furthermore, this figure accounts for the average acceleration only, and not for transient dynamic effects, which occur whenever the brakes are applied. These dynamic effects can be substantial and further increase component stresses. The underestimation of the load affects the calculated life of all gears, shafts, and splines. • According to page 7 of Yantrak’s typed calculation and the catalog from the emergency brake caliper manufacturer, the disc brakes have a maximum available braking force of 12,814 pounds. Assuming Yantrak’s figure for maximum rope tension, 9,080 pounds, and accounting for the difference in effective moment arm for the brakes (29.5 inches from the drum’s center of rotation) and the rope (35 inches from the drum’s center of rotation), Yantrak calculates a maximum required brake force of 10,772 pounds. Using the larger acceleration described above, the maximum required brake force is 12,671 pounds, which is at the upper limit of published maximum brake capacity for these brake calipers. • On page 6 of the typed calculations, under the headings “Input [Axle] Shaft to D-9 Hub” and “Gear Shaft [Hub] Splined onto D-9 [Axle] Shaft,” appear to be calculations of the stresses in these components. However, the calculations do not address the splines themselves, but only the two parts that are splined together (the D-9 axle shaft and the receiving hub on the planetary gear). But because the splines’ teeth reduce the load-bearing surface area and introduce stress concentrations, the splines are significantly weaker than the shafts. Furthermore, the stresses in the shafts are calculated assuming 15,000 inch- pounds of torque. Assuming Yantrak’s own figure of 9,080 pounds of rope tension on a 35-inch-radius drum and accounting for the 20:1 gear reduction on the D-9 hub results in a torque of 15,900 inch-pounds. The corrected rope tension of 10,680 pounds results in a hub torque of 18,700 inch-pounds. These figures exceed the torque used by Yantrak in its calculations. Transient dynamic effects would lead to further increases in the effective torque experienced by the gears, shafts, and splines.

Factual Information 30 Railroad Accident Report Funicular Railway Standards At the time Angels Flight was redesigned and renovated, California had no standards or regulations for the design, construction, and operation of funiculars. Also at that time, the American National Standards Institute (ANSI)15 had no explicit standard covering funiculars, although sections of Standard B77.1, Aerial Tramways, Aerial Lifts, Surface Lifts, and Tows Safety Requirements, contained guidance that could apply to portions of the Angels Flight system. Since approximately 1984, Colorado has had regulations that cover design, construction, and maintenance of funiculars in the Colorado Passenger Tramway Safety Board’s Passenger Tramway Rules and Regulations. The Colorado regulations include ANSI Standard B77.1, revisions to ANSI rules by the Colorado Board, and additional technical rules. The California Public Utilities Commission did not reference any particular set of standards that were to be followed in the reconstruction of Angels Flight. By February 2001, ANSI began internal circulation of a draft Standard B77.2, Funicular Safety Requirements, specifically for funiculars. The B77 Accredited Standards Committee has approved a draft, but it has not been adopted as final by ANSI. The first tentative funicular standards were developed in the early 1980s. The tentative standards were available to the parties during the Angels Flight reconstruction project. Because Standard B77.1 did not cover funicular systems, the tentative standards were suggested for use as a guideline for any authority having jurisdiction in connection with the design, manufacture, construction, and operation of a funicular system. After the accident, a review was made of the ANSI and Colorado standards that were available to, if not specifically referenced by, the Public Utilities Commission and that addressed issues of funicular safety. The guidance existing at the time Angels Flight was redesigned and rebuilt (ANSI tentative standards and the Colorado regulations) agreed that a tramway should have two completely independent brake systems that do not operate at the same time and that each car should be equipped with a braking system capable of stopping and holding the car in the event of a rope failure. The tentative ANSI standards called for each car to have doors that filled the entire entrance opening. Additionally, they stated that each door should have a lock located so that it could only be locked and unlocked automatically or by an authorized person. The tentative standards also stated that funiculars should be equipped with means for evacuation of passengers from stranded vehicles along the entire length of the guideway. The tentative ANSI standards and the Colorado standards stated that cable drums should be designed and built to retain the cable in the event of the failure of a drum, shaft, or mounting. Grooves in the drum were to be designed and built to retain the haul cable in the event of a deropement. A minimum flange extension of 1 1/2 times the cable diameter (measured from the bottom of the cable groove) was considered adequate.16 15 ANSI is a private organization that administers and coordinates the U.S. voluntary standardization and conformity assessment system. 16 The Angels Flight cable was .875 inch in diameter. Therefore, the minimum flange extension would be 1.31 inches. The flanges on the Angels Flight cable drums measured between .594 and .75 inch.

Factual Information 31 Railroad Accident Report Regulatory Oversight In a December 10, 1991, letter to the Community Redevelopment Agency project manager, Parsons called for the creation of a task force to address jurisdictional and safety issues related to the renovation of Angels Flight. Representatives from the California Public Utilities Commission, the City of Los Angeles Department of Building and Safety, the Los Angeles Fire Department, and the Community Redevelopment Agency staffed the task force. The California Public Utilities Commission accepted the responsibility to view Angels Flight as a public utility and to monitor the safety of the design, construction, and operation of Angels Flight. In so doing, it applied selected portions of the provisions from its Rail Transit Safety Section’s procedures manual for State safety oversight of rail fixed guideway systems. In part, California Public Utilities Code 99152 reads as follows: Any public transit guideway planned, acquired, or constructed, on or after January 1, 1979, is subject to regulations of the Public Utilities Commission relating to safety appliances and procedures. … The commission shall develop an oversight program employing safety planning criteria, guidelines, safety standards, and safety procedures to be met by operators in the design, construction, and operation of those guideways. Existing industry standards shall be used where applicable.… On September 16, 1994, the Rail Transit Safety Section of the Public Utilities Commission Safety Division issued Safety Oversight Plan for Design and Construction of Angels Flight Funicular Railway. That plan stated, in part: Successful implementation of the [Public Utilities Commission] staff’s safety oversight plan will … effectively serve as an endorsement of the Community Redevelopment Agency’s decision to begin revenue service on the Angels Flight Funicular Railway Project. The Public Utilities Commission staff suggested that the Community Redevelopment Agency and its consultants perform safety hazards analyses on the Angels Flight project and then indicate the actions required to mitigate hazards to passengers and employees through design solutions and operating procedures. The Public Utilities Commission staff commented on the adequacy and completeness of the hazard analysis and on the efficacy of the design solutions and operating procedures and witnessed the testing of equipment where the effectiveness and completeness of those procedures were demonstrated. Between 1993 and 1996, Parsons and Harris submitted copies of the preliminary hazard analysis report, the preliminary operations and evacuation plan, and the emergency evacuation plan to the Public Utilities Commission. The preliminary hazards analysis report identified hazards that needed to be addressed during the reconstruction process. Among the identified hazards were the lack of end gates on both cars, the lack of track brakes, and the absence of an emergency stairway. Public Utilities Commission staff reviewed the documents and concurred with the report’s findings.

Factual Information 32 Railroad Accident Report The Federal Transit Administration required States to designate an oversight agency to implement requirements of 49 Code of Federal Regulations 659, “State Safety Oversight of Fixed Guideway Systems.” The Governor of California designated the Public Utilities Commission as the State oversight agency. Public Utilities Commission representatives said that although Angels Flight met the definition of a railway for Public Utilities Code 99152, it did not meet the full Federal Transit Administration definition of a rail fixed guideway system. Nevertheless, Public Utilities Commission staff members said they believed it necessary to monitor the operations of Angels Flight, and they applied some of the provisions of the Public Utilities Commission’s Rail Transit Safety Section Procedures Manual for State Safety Oversight of Rail Fixed Guideway Systems. The day before the scheduled ceremonial opening of Angels Flight on February 23, 1996, the Harris construction manager sent a letter to the Community Redevelopment Agency that stated: I have reviewed the submissions by Pueblo and Yantrak relating to the safety and capacity of Yantrak’s design. Based on that review I will recommend to the [Community Redevelopment Agency] that the system designed by Yantrak be accepted by change order as equivalent in safety and operation to the … design proposed in the contract drawings. The Public Utilities Commission supervising engineer sent a letter to the Community Redevelopment Agency acknowledging the Public Utilities Commission’s acceptance of the Community Redevelopment Agency’s letter certifying that “Angels Flight is safe for limited use during the three-day dedication weekend.” The letter stated that Public Utilities Commission safety oversight would “continue after the dedication weekend until all of the outstanding issues” were completed, that is, acceptance of the operations and maintenance manual, completion and acceptance of the hazards analysis, and training of the Angels Flight operating personnel. On February 23, 1996, Angels Flight began service to the public for the ceremonial opening. In March 1997, Public Utilities Commission staff performed an inspection of Angels Flight that was limited to witnessing a magnetic haul cable inspection. Public Utilities Commission staff members stated that they performed informal checks of Angels Flight throughout the succeeding years. On January 9, 2002, the Public Utilities Commission filed an order to initiate rulemaking concerning safety certification. The Public Utilities Commission’s existing requirements (General Order17 164-B) focused on the safety of transportation systems after they are placed in passenger service. On February 27, 2003, the Public Utilities Commission adopted General Order 164-C, Rules and Regulations Governing State Safety Oversight of Rail Fixed Guideway Systems, which supersedes General Order 164-B. The new rule strengthens the safety review process before passenger service is initiated by 17 General Orders set rules for all utilities or classes of utilities, as opposed to decisions rendered in a particular case for a particular utility.

Factual Information 33 Railroad Accident Report establishing Public Utilities Commission review and approval requirements for safety certification program plans, project-specific safety certification plans before construction, and project-specific safety certification verification reports before passenger service. As defined in the rule, a public transit guideway would include all rail transit agencies, rail fixed guideways, and all other light rail, rapid rail, monorail, inclined plane, funicular, trolley, or automated guideways offering transit service to the public, whether or not Federal guidelines or definitions apply. Current Status The Angels Flight railway has not been in operation since the accident on February 1, 2001.

34 Railroad Accident Report Analysis The Accident Postaccident inspection of the Angels Flight drive mechanism revealed that the Sinai car stopped ascending and began its uncontrolled descent when the drive axle for the car’s cable drum became disengaged from its driving planetary gear. When the Angels Flight operator saw the car begin to descend the grade, he pushed the stop button on the operator’s console, which should have simultaneously activated the service and emergency brakes. But the service brakes, which operated on the drive train, had no effect on the freewheeling cable drum that was no longer connected to the drive train mechanism. The emergency brake would have stopped, or at least slowed, the rotation of the cable drum had it applied, but it was found to be inoperative. The cars themselves were not equipped with track brakes that could have operated independently to significantly slow the car or bring it to a stop before the collision. End gates on the cars may have prevented the passenger from being ejected from the end of the Olivet car when it was struck by the Sinai car. Finally, rescue efforts were hampered by the absence of emergency walkways that would have facilitated evacuation of injured passengers. The Safety Board’s investigation of this accident focused on the following safety issues: • The adequacy of the safety oversight of the Angels Flight reconstruction project; • The adequacy of the design of the reconstructed Angels Flight system; • The adequacy and appropriateness of the braking systems designed for Angels Flight; and • The adequacy of Angels Flight Operating Company’s maintenance and operating procedures. Gear Hub Failure The splines on the Sinai planetary gear receiving hub were found to be stripped, which prevented the gear from engaging the axle shaft. This allowed the axle shaft to rotate within the planetary gear hub and rendered the cable drum (connected to the other end of the axle shaft) freewheeling. Testing revealed that the steel used for the receiving gear hub was much softer than the steel used for the axle shaft. The difference between the hardness of the receiving gear hub and that of the axle shaft likely contributed to the failure of the gear by accelerating the damage to the softer gear hub splines. The presence of metal shavings on the Sinai car axle shaft indicated that damage to the planetary gear hub splines had been occurring for some time before the accident.

Analysis 35 Railroad Accident Report The failure of the Sinai planetary gear receiving hub may also have been accelerated by the daily brake tests conducted on the system. The Angels Flight Operating Company vice president tested operation of the brakes by placing the cars in operation and then activating the system service and emergency brakes to bring the cars to a stop. Under normal conditions, the service brakes would have stopped rotation of the motor shaft while the emergency brakes simultaneously stopped rotation of the two cable drums. But postaccident investigation revealed that, for some period of time before the accident, only the service brakes were operable. During the daily brake tests, the service brake activated to stop the driven sun gear, but without emergency brakes, substantial dynamic forces acted on the cable drums and various components of the drive system. Finally, the investigation determined that the dynamic and transient forces acting on the various components of the drive gear system, including the axle and receiving gear hub splines, were greater than those calculated by Yantrak. Because these calculated loads were used to develop the specifications for the drive system components, the service life of those components, including the gear hubs and splines, would likely have been less than predicted even under normal conditions. Under the abnormal stress conditions posed by the daily brake tests conducted with non-functioning emergency brakes, the rate of damage likely increased, as did the likelihood of the kind of catastrophic failure that occurred in this accident. The Safety Board concludes that the planetary gear hub for the Sinai car failed because of one or a combination of the following: (1) the metal used in the manufacture of the gear hub was considerably softer than the metal used for the axle shaft with which it mated, causing deformation damage and eventual failure; (2) the drive train components, including the planetary gear hubs, were not designed for the stresses to which the components were subjected during operation; and (3) the daily brake tests, which were conducted for some period of time without working emergency brakes, placed additional stress on the drive train components and accelerated gear hub damage. Postaccident research and inspection also revealed that the Angels Flight drive system was equipped with deropement switches and cable drum flanges that were inappropriately sized. The .875-inch-diameter cable needed 1.31-inch flange extensions on the drums to meet the minimum height that was considered adequate. However, all of the flange extensions were less than 1 inch high. Further, initially the gearbox lubrication system was problematic, allowing the lubrication oil to overheat and cause system shutdowns. This deficiency went unresolved for more than a year until an oil cooler was installed. The Safety Board therefore believes that before recommencing passenger service on the Angels Flight funicular railway, the Community Redevelopment Agency should conduct a comprehensive review of the design and specifications for the Angels Flight drive system, then make the design or component changes necessary to ensure that the drive system meets accepted industry standards and engineering practices.

Analysis 36 Railroad Accident Report Brake System Failure Once the cable drum for the Sinai car became disconnected from the drive gear system, the car’s haul cable was able to unwind freely as gravity pulled the car down the incline. The emergency braking system was designed to prevent such an occurrence by clamping against the cable drum flanges to stop the drum’s rotation. Had the emergency brakes functioned when activated by the operator, the descent of the car would have been stopped even though the cable drum was no longer connected to the rest of the drive system. The Safety Board therefore concludes that had the Angels Flight emergency braking system been functional on the day of the accident, the brakes would likely have stopped the descent of the runaway car and prevented the collision. The investigation determined that if the Angels Flight service and emergency braking systems had been installed in accordance with the design drawings and parts list, neither of the brakes would have released, and Angels Flight could not have been operated. In this design, normally open solenoid valves would have been required to apply and release the brakes in a conventional, fail-safe manner. At some point, either during initial brake system installation and testing or shortly thereafter, at least the service brake system had to have been equipped with a normally open valve. Postaccident inspection found that the service brake was still equipped with a normally open valve, and it operated properly. But the emergency brake system was equipped with a normally closed valve. Because the valve had failed in the normally closed position, the emergency brake could be released, but it could not be reapplied when needed. Angels Flight records indicated that a solenoid valve had burned out and been replaced with a normally closed valve as indicated on the drawings and parts list. But as noted, this would not have allowed the system to be operated. Although it cannot be known for sure, it is possible that the new valve was inoperative when it was installed or was defective and failed very quickly after its initial activation. Either scenario would explain how the system was able to be operated and would account for the valve configuration found during the postaccident inspection. Although the test procedure for the Angels Flight emergency brakes was conducted daily, the button that activated those brakes simultaneously activated the service brake. Therefore, this method of testing could not confirm that both braking systems were operational. The Safety Board therefore concludes that the brake system as designed was inoperable, as implemented was not fail-safe, and was further inadequate because the emergency brakes could not be activated independent of the service brake and tested separately, which would have revealed that the system’s emergency brakes were inoperative. The Safety Board believes that before recommencing passenger service on the Angels Flight funicular railway, the Community Redevelopment Agency should require that the current Angels Flight emergency braking system (acting on the cable drums) be redesigned to allow it to be tested independent of other braking systems.

Analysis 37 Railroad Accident Report Angels Flight Operations and Maintenance The primary responsibility for day-to-day operations and maintenance of Angels Flight belonged jointly to the Angels Flight Railway Foundation and the Angels Flight Operating Company. Shortly after Angels Flight began passenger service, a problem was noted with overheating of the gearbox oil. The problem was severe enough that on numerous occasions, the system shut down automatically, leaving passengers stranded between stations. At these times, witnesses reported seeing passengers making unauthorized and unsafe evacuations from the cars over the unprotected elevated track structure. As a loss control consultant had noted, such evacuations were so dangerous to passengers that they should have been prevented even during emergencies. But despite the hazard posed to passengers, the operating company did not establish operational practices that would have prevented the system shutdowns or egress onto the tracks. For example, the number of scheduled trips per hour could have been reduced to allow the gearbox to cool between trips while a permanent solution was researched and implemented. Instead, the system was kept operating for more than a year until the overheating problem was ultimately resolved by the installation of an oil cooler. In addition to representing an inconvenience and possible hazard to passengers because of the system shutdowns, the overheating and vaporizing oil was also likely not providing optimal lubrication to the Angels Flight drive system. Within the first few months of operation of Angels Flight, the bearing seals had carbonized due to overheating and had begun to leak. The gearbox bearings and seals had to be replaced in 1997. After the overheating problem had been addressed in 1997 and synthetic oil was used, the Angels Flight Operating Company never changed the oil. It did initially adhere to a regular fluids analysis schedule, sampling the lubricating oil about once every 4 months from 1997 to 1999. After three successive fluid analyses during 1999 showed an increased presence of iron in the oil, the company that conducted the fluid analyses in June 1999 recommended resampling the oil after an additional 250 hours. However, although bearings were replaced and the drive system gears were inspected after the June 1999 analysis, the operating company conducted no additional fluid analyses. As a result, the lubricating oil went untested for 20 months while Angels Flight continued daily operation until the accident occurred. The Safety Board is concerned at the lack of detailed guidance regarding the oil analysis program or maintenance procedures for the funicular drive gearbox. A postaccident fluids analysis test on February 28, 2001, confirmed the presence of elevated iron levels in the gearbox oil. In addition, ground metallic residue, containing both metal shavings from the sheared splines and small metal pieces from the ball bearings, was removed during disassembly of the gearbox after the accident, indicating that damage was occurring before the planetary gear hub splines failed. Therefore, if Angels Flight Operating Company personnel had continued the oil analyses, as required in the operations and maintenance manual, and if the cause of the elevated iron content had been

Analysis 38 Railroad Accident Report investigated further, through a gearbox teardown, for example, they may have discovered the damage in the Sinai car’s planetary gear hub splines. The Safety Board concludes that by allowing Angels Flight to remain in normal passenger service for more than a year with an unresolved problem with overheating of the gearbox, which at times caused cars to stop unexpectedly between stations, the Angels Flight Railway Foundation and the Angels Flight Operating Company adversely affected drive system component integrity and compromised passenger safety. The Safety Board believes that before recommencing passenger service on the Angels Flight funicular railway, the Community Redevelopment Agency should require that the organization(s) responsible for operating and maintaining the Angels Flight funicular develop and follow detailed operating, inspection, and maintenance procedures to ensure the operational integrity of the system and safety of passengers. Oversight of Angels Flight Design and Construction A complex web of organizations was involved in the Angels Flight redevelopment project. Ultimately, this complexity may have contributed to the failure of various oversight agencies to ensure that the Angels Flight system was reconstructed and operated with adequate passenger safeguards. City of Los Angeles Community Redevelopment Agency Oversight As the owner of Angels Flight, the Community Redevelopment Agency was responsible for contract negotiations, safety oversight, design changes, and safety certification. Additionally, beginning in 1991 with its selection of Parsons as a consultant, the Community Redevelopment Agency was responsible for the selection of many of the companies involved in the design and construction of Angels Flight. It hired Harris as the construction manager and selected Pueblo as the general contractor. And even though the Community Redevelopment Agency did not hire Yantrak directly, it was responsible for the selection of the company in its role as overseer of the performance of its contractors and subcontractors and for monitoring how its money was being spent. The Community Redevelopment Agency contracted with Harris as construction manager for the project, and Harris subsequently contracted with Parsons for the design specifications for the reconstructed Angels Flight. Parsons’s specifications called for both cars to be fitted with emergency track brakes and end gates to contain passengers. They also called for an emergency walkway to be constructed for the entire length of the tramway to facilitate the evacuation of passengers in the event of an emergency. None of these features was included in the final system build. Track Brakes. The original Parsons design specifications for the reconstructed Angels Flight included track brakes designed to deploy automatically and stop a runaway car in case of an overspeed condition or the failure of the haul cable or other major

Analysis 39 Railroad Accident Report components that might allow a car to freely translate. Yantrak, the design-build contractor for Angels Flight, took issue with the track brakes in the design specifications. In a September 8, 1995, letter, Parsons informed Harris that it considered the elimination of the track brakes to be unacceptable in that, without either the brakes or a suitable alternate backup safety system, a break in the haul cable could result in injury or fatality to passengers. Based on this risk, Parsons continued to recommend that Harris reject the Yantrak proposal to omit track brakes. Nonetheless, Harris, with the approval of the Community Redevelopment Agency, decided not to equip the Angels Flight vehicles with the track brakes that would likely have prevented the February 1, 2001, collision. In a series of letters and memorandums, Yantrak argued that track brakes would be ineffective in this application and that, in any case, the design of the cars and trackway would not permit their installation. In its February 13, 1996, letter to Pueblo, Yantrak had said that track brakes could not be used on the split rail of the train bypass. The Safety Board notes, however, that the conceptual design specified track brakes only on the outer rail, thereby avoiding the shared (split) rail used by both cars. Increasing the diameter of the haul cable (rope) and other measures proposed by Yantrak did increase the safety factors associated with loss of the cable or car attachment. However, deleting the track brakes (a secondary safety device) ignored other potential failure modes that were unrelated to the haul cables. Redundancy has always been a key factor in the design of transportation systems. For example, even though the original Angels Flight was not equipped with track brakes, it did have a safety cable designed to prevent a runaway car. Further, the guidance on funiculars existing at the time Angels Flight was redesigned and rebuilt (ANSI tentative standards and the Colorado regulations) called for each individual car to be equipped with a braking system. A survey of funiculars worldwide also found that each system utilized cars equipped with braking systems or backup safety cables. The Safety Board therefore concludes that had the Angels Flight cars been equipped with track brakes or a safety cable in accordance with known funicular safety standards and redundant design principles, either of those safety features likely would have stopped the runaway car and prevented the collision even without working emergency brakes. End Gates. The initial design specifications for the reconstructed Angels Flight also called for the installation of end gates to prevent passengers from falling from the cars. The Community Redevelopment Agency approved the installation of end gates and required them in the contract to Pueblo. Later, objections were raised by a conservancy group, which argued that end gates not only would have been inconsistent with the original Angels Flight design but also were unnecessary as shown by the fact that the system had been operated without them and without incident between 1901 and 1969. The Community Redevelopment Agency, while reviewing the issue of whether end gates were necessary to the safety of the system, allowed Angels Flight to begin passenger service without them. In November 1996, some 9 months after Angels Flight began passenger service, the Community Redevelopment Agency consented to requests from Angels Flight officials and issued a change order directing that end gates not be

Analysis 40 Railroad Accident Report installed. Although the Community Redevelopment Agency stated that the issue would need continued study, there is no record of such, and the gates were never installed. Emergency Walkway. The original Angels Flight did not have a walkway adjacent to the trackway that would extend the entire length of the trackway. Such a walkway was included as part of the original reconstruction design specifications, but as with the end gates, a conflict soon developed with the historic preservationist viewpoint. In addition, Public Utilities Commission staff and an insurance loss control consultant supported the view that the walkway would be an attractive nuisance more hazardous than the absence of the walkway. However, the Safety Board notes that an attractive nuisance can be averted in many cases with relatively simple measures, such as installing a fence with locking gates to restrict access. Community Redevelopment Agency officials did require that alternatives to the walkway be included in the final design, including a combination ground-level and elevated stairway separated from the trackway, an auxiliary emergency power supply, reversible funicular controls, and a security system and fence. But none of these alternatives directly addressed the purposes of the emergency walkway, and because of the nature of the accident, these alternatives did nothing to facilitate access to and egress from the funicular vehicles. The Safety Board concludes that the absence of an emergency walkway hampered access by emergency responders to passengers in this accident, made difficult the evacuation of the injured, and increased the risk to both passengers and emergency responders. The agency with overall safety oversight of the reconstruction and subsequent operation of the Angels Flight system was the Public Utilities Commission. Like the Community Redevelopment Agency, although the Public Utilities Commission often came down initially in support of the safety features, in most cases, the Public Utilities Commission ultimately either permitted the removal of safety features from the final Angels Flight design or allowed the system to be operated in passenger service while certain safety issues remained unresolved. Apart from cost issues, it appears that during the Angels Flight reconstruction project decisions about safety features were based in large part on a feature’s adherence to historical accuracy. In the years since the original Angels Flight was built in 1901, there have been great advances in engineering and transportation safety, and, therefore, transportation systems are not designed as they were 100 years ago. Even assuming that accurate accident records exist, the fact that accidents have not occurred with a historic design does not ensure that the design is safe. Given current state-of-the-art technologies, public transportation designs should not be dictated by a desire for historical accuracy at the expense of safety features. The Safety Board believes that before recommencing passenger service on the Angels Flight funicular railway, the Community Redevelopment Agency should direct that the Angels Flight funicular be redesigned in accordance with all applicable funicular safety standards and include provisions for (1) emergency stopping under all foreseeable failure modes, including track brakes or some other independent backup system on the

Analysis 41 Railroad Accident Report cars to prevent a runaway car if a failure occurs in the cable or its associated braking systems; (2) containment of passengers in the event of a collision; and (3) emergency egress and ingress for passengers and emergency responders. California Public Utilities Commission Oversight The Public Utilities Commission had responsibility for the safety of the design, construction, and eventual operation of Angels Flight. The Public Utilities Commission required that the Community Redevelopment Agency and its consultants perform safety hazards analyses on the Angels Flight project and indicate what actions were planned that would mitigate the danger to passengers and employees through design solutions or operating procedures. But the Public Utilities Commission did not require that track brakes, end gates, or an evacuation walkway be installed to address the safety hazards identified by the analyses. These inconsistent decisions suggest that the Public Utilities Commission policies and procedures were insufficient for ensuring the safety of Angels Flight. The Public Utilities Commission granted limited authority for Angels Flight to operate for a 3-day dedication ceremony beginning February 23, 1996. The authorization letter acknowledged that there were “outstanding issues” related to safety at the time. Yet, Angels Flight opened for passenger service on February 26, 1996, without those safety issues being resolved. The Public Utilities Commission did not have an effective process in place to ensure that Angels Flight met all safety requirements before passenger operations were allowed to begin. The Safety Board therefore concludes that the Community Redevelopment Agency and the Public Utilities Commission failed to fulfill their safety oversight responsibilities for the Angels Flight reconstruction by allowing Angels Flight to begin passenger operations with unresolved safety issues. The Safety Board is encouraged by the Public Utilities Commission’s new General Order 164-C involving safety certification. The circumstances surrounding this accident accentuate the need to make ongoing safety assessments from the outset of a project. Under rules existing at the time of the accident, an agency or organization could potentially operate for 3 years before the first safety inspection. California has no standards or regulations for the design, construction, and operation of funiculars. Although funicular standards of another State were available, the Public Utilities Commission did not require that the Angels Flight Railway be reconstructed and operated in accordance with them. Without established regulations, the Public Utilities Commission had no clear standards to use to evaluate the safety of the Angels Flight funicular project. The Safety Board believes the Public Utilities Commission should adopt comprehensive funicular design, construction, and operation regulations that include provisions for (1) emergency stopping under all foreseeable failure modes, (2) containment of passengers in the event of a collision, and (3) emergency egress and ingress for passengers and emergency responders. To ensure that deficiencies discovered during the investigation of the Angels Flight funicular railway accident are specifically addressed, the Safety Board believes that before

Analysis 42 Railroad Accident Report certifying Angels Flight to restart passenger service, the Public Utilities Commission should independently verify that the drive system meets accepted industry standards and engineering practices and that the funicular includes provisions for (1) emergency stopping under all foreseeable failure modes, including track brakes or some other independent backup system on the cars to prevent a runaway car if a failure occurs in the cable or its associated braking systems; (2) containment of passengers in the event of a collision; and (3) emergency egress and ingress for passengers and emergency responders. The Safety Board is encouraged that ANSI is making progress on developing funicular safety standards. Although a draft standard has been approved by the B77 committee, it has not been adopted as final by ANSI. Such a standard would inform and guide organizations such as the Public Utilities Commission in their safety oversight of operations like the Angels Flight railway. Therefore, the Safety Board believes ANSI should establish an accelerated schedule for adoption of the draft ANSI Standard B77.2 for funicular safety requirements.

43 Railroad Accident Report Conclusions Findings 1. The planetary gear hub for the Sinai car failed because of one or a combination of the following: (1) the metal used in the manufacture of the gear hub was considerably softer than the metal used for the axle shaft with which it mated, causing deformation damage and eventual failure; (2) the drive train components, including the planetary gear hubs, were not designed for the stresses to which the components were subjected during operation; and (3) the daily brake tests, which were conducted for some period of time without working emergency brakes, placed additional stress on the drive train components and accelerated gear hub damage. 2. Had the Angels Flight emergency braking system been functional on the day of the accident, the brakes would likely have stopped the descent of the runaway car and prevented the collision. 3. The brake system as designed was inoperable, as implemented was not fail-safe, and was further inadequate because the emergency brakes could not be activated independent of the service brake and tested separately, which would have revealed that the system’s emergency brakes were inoperative. 4. Had the Angels Flight cars been equipped with track brakes or a safety cable in accordance with known funicular safety standards and redundant design principles, either of those safety features likely would have stopped the runaway car and prevented the collision even without working emergency brakes. 5. The absence of an emergency walkway hampered access by emergency responders to passengers in this accident, made difficult the evacuation of the injured, and increased the risk to both passengers and emergency responders. 6. The City of Los Angeles Community Redevelopment Agency and the California Public Utilities Commission failed to fulfill their safety oversight responsibilities for the Angels Flight reconstruction by allowing Angels Flight to begin passenger operations with unresolved safety issues. 7. By allowing Angels Flight to remain in normal passenger service for more than a year with an unresolved problem with overheating of the gearbox, which at times caused cars to stop unexpectedly between stations, the Angels Flight Railway Foundation and the Angels Flight Operating Company adversely affected drive system component integrity and compromised passenger safety.

Conclusions 44 Railroad Accident Report Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the Yantrak Company’s (Lift Engineering’s) improper design and construction of the Angels Flight funicular drive and the failure of the City of Los Angeles Community Redevelopment Agency, its contractors (Pueblo Contracting Services, Yantrak, and Harris and Associates), and the California Public Utilities Commission to ensure that the railway system conformed to initial safety design specifications and known funicular safety standards.

45 Railroad Accident Report Recommendations As a result of its investigation, the National Transportation Safety Board makes the following safety recommendations: To the California Public Utilities Commission: Adopt comprehensive funicular design, construction, and operation regulations that include provisions for (1) emergency stopping under all foreseeable failure modes, (2) containment of passengers in the event of a collision, and (3) emergency egress and ingress for passengers and emergency responders. (R-03-14) Before certifying Angels Flight to restart passenger service, independently verify that the drive system meets accepted industry standards and engineering practices and that the funicular includes provisions for (1) emergency stopping under all foreseeable failure modes, including track brakes or some other independent backup system on the cars to prevent a runaway car if a failure occurs in the cable or its associated braking systems; (2) containment of passengers in the event of a collision; and (3) emergency egress and ingress for passengers and emergency responders. (R-03-15) To the City of Los Angeles Community Redevelopment Agency: Before recommencing passenger service on the Angels Flight funicular railway: Conduct a comprehensive review of the design and specifications for the Angels Flight drive system, then make the design or component changes necessary to ensure that the drive system meets accepted industry standards and engineering practices. (R-03-16) Require that the current Angels Flight emergency braking system (acting on the cable drums) be redesigned to allow it to be tested independent of other braking systems. (R-03-17) Require that the organization(s) responsible for operating and maintaining the Angels Flight funicular develop and follow detailed operating, inspection, and maintenance procedures to ensure the operational integrity of the system and safety of passengers. (R-03-18).

Recommendations 46 Railroad Accident Report Direct that the Angels Flight funicular be redesigned in accordance with all applicable funicular safety standards and include provisions for (1) emergency stopping under all foreseeable failure modes, including track brakes or some other independent backup system on the cars to prevent a runaway car if a failure occurs in the cable or its associated braking systems; (2) containment of passengers in the event of a collision; and (3) emergency egress and ingress for passengers and emergency responders. (R-03-19) To the American National Standards Institute: Establish an accelerated schedule for adoption of the draft American National Standards Institute Standard B77.2 for funicular safety requirements. (R-03-20) BY THE NATIONAL TRANSPORTATION SAFETY BOARD Ellen G. Engleman Mark V. Rosenker Chairman Vice Chairman John J. Goglia Member Carol J. Carmody Member Richard F. Healing Member Adopted: August 5, 2003

47 Railroad Accident Report Appendix A Investigation Both headquarters and Los Angeles staff of the National Transportation Safety Board became aware of the Angels Flight railway collision in Los Angeles, California, within a few minutes of its occurrence at 12:17 p.m. on February 1, 2001, from local and national coverage by the news media. Two railroad accident investigators were sent to the scene from the Gardena, California, office. They arrived on scene about 45 minutes after the accident occurred. No Board Member went with the team. Parties to the investigation included the California Public Utilities Commission, the City of Los Angeles Community Redevelopment Agency, and the Angels Flight Operating Company. The company that designed and built the drive, control, braking, and haul systems, Lift Engineering/Yantrak, is no longer in business, and the principal’s whereabouts are unknown. As part of its investigation, on June 12, 2001, the Safety Board took testimony from the president and vice president of Angels Flight and from the administrator of the City of Los Angeles Community Redevelopment Agency. All parties to the investigation attended the proceeding.

this page intentionally left blank

FD07284 ｜ 2003_美国_RAR0304.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2003 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Collision of Burlington Northern Santa Fe Freight Train With Metrolink Passenger Train Placentia, California April 23, 2002 Railroad Accident Report NTSB/RAR-03/04 PB2003-916304 Notation 7590 National Transportation Safety Board Washington, D.C.

this page intentionally left blank

Railroad Accident Report Collision of Burlington Northern Santa Fe Freight Train With Metrolink Passenger Train Placentia, California April 23, 2002 NTSB/RAR-03/04 PB2003-916304 National Transportation Safety Board Notation 7590 490 L’Enfant Plaza, S.W. Adopted October 7, 2003 Washington, D.C. 20594

National Transportation Safety Board. 2003. Collision of Burlington Northern Santa Fe Freight Train With Metrolink Passenger Train Placentia, California, April 23, 2002. Railroad Accident Report NTSB/RAR-03/04. Washington, DC. Abstract: On Tuesday, April 23, 2002, about 8:10 a.m. Pacific daylight time, eastbound Burlington Northern Santa Fe Railway freight train PLACCLO3-22 collided head on with standing westbound Southern California Regional Rail Authority passenger train 809 on the No. 2 track at Control Point Atwood in Placentia, California. Emergency response agencies reported that 162 persons were transported to local hospitals. There were two fatalities. Damage was estimated at $4.6 million. The safety issues discussed in this report are the attentiveness of the Burlington Northern Santa Fe train crew, the signal awareness form procedures for the Burlington Northern Santa Fe, passenger car survival factors, and the absence of positive train control systems. As a result of its investigation, the National Transportation Safety Board issued safety recommendations to the Federal Railroad Administration, the Burlington Northern Santa Fe Railway Company, and the Association of American Railroads. The Board also reiterated a previously issued safety recommendation to the Federal Railroad Administration. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2003-916304 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Railroad Accident Report Contents Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Site Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Personnel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 BNSF 5340 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Metrolink 809 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Train Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 BNSF 5340 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Metrolink 809 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Wreckage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Metrolink Cab Car 634 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Metrolink Car 113 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Metrolink Car 167 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Metrolink Locomotive 859 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 BNSF Locomotive 5340 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Operations Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Train Dispatching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Train Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Signal Awareness Form . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Calling Signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Medical and Toxicological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Signal System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Sight-Distance Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Locomotive Event Recorder Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Use of Cellular Telephones by BNSF 5340 Crew . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 BNSF Program of Operational Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Postaccident Actions–BNSF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Postaccident Actions–Metrolink . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Mass Casualty Training Drill Exercise Coincident to Accident . . . . . . . . . . . . . . . . . . 26 Regulatory Framework . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 BNSF Train Collision Avoidance System Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Accident Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Crew Alertness to Signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Contents iv Railroad Accident Report Inattention . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Signal Recording . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Enforcement of Operating Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Survival Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Workstation Tables and Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Emergency Access to Car End Areas Through Designated Emergency Windows. . . 32 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Positive Train Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 New Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Recommendation Reiterated in This Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Appendix A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

v Railroad Accident Report Executive Summary On Tuesday, April 23, 2002, about 8:10 a.m. Pacific daylight time, eastbound Burlington Northern Santa Fe Railway freight train PLACCLO3-22 collided head on with standing westbound Southern California Regional Rail Authority passenger train 809 on the No. 2 track at Control Point Atwood in Placentia, California. Emergency response agencies reported that 162 persons were transported to local hospitals. There were two fatalities. Damage was estimated at $4.6 million. The National Transportation Safety Board determines that the probable cause of the April 23, 2002, collision of a Burlington Northern Santa Fe freight train and a Metrolink commuter train in Placentia, California, was the freight train crew’s inattentiveness to the signal system and their failure to observe, recognize, and act on the approach signal at milepost 42.31. Contributing to the accident was the absence of a positive train control system that would have automatically stopped the freight train short of the stop signal and thus prevented the collision. The safety issues identified during this accident investigation are as follows: • Burlington Northern Santa Fe train crew attentiveness; • Burlington Northern Santa Fe signal awareness form procedures; • Passenger car survival factors; • The absence of positive train control systems. As a result of this accident investigation, the National Transportation Safety Board makes safety recommendations to the Federal Railroad Administration, the Burlington Northern Santa Fe Railway Company, and the Association of American Railroads. The Board also reiterates a previously issued safety recommendation to the Federal Railroad Administration.

this page intentionally left blank

1 Railroad Accident Report Factual Information Accident Synopsis On Tuesday, April 23, 2002, about 8:10 a.m. Pacific daylight time, eastbound1 Burlington Northern Santa Fe Railway (BNSF) freight train PLACCLO3-22 collided head on with standing westbound Southern California Regional Rail Authority (Metrolink) passenger train 809 on the No. 2 track at Control Point (CP)2 Atwood in Placentia, California. Emergency response agencies reported that 162 persons were transported to local hospitals. There were two fatalities.3 Damage was estimated at $4.6 million. Accident Narrative The crew (engineer and conductor) of commuter train Metrolink 809 reported for duty at 1:30 a.m. on April 23, 2002, in Riverside, California. (See figure 1.) The crew was scheduled to make several trips operating the same equipment but with varying train numbers during their tour of duty. They left Riverside at 2:55 a.m. on their first trip and arrived at Irvine sometime after 4:00 a.m. On the second trip, they departed Irvine at 4:23 a.m. and arrived at Los Angeles at 5:30 a.m. For their third trip, they departed Los Angeles at 5:45 a.m. and arrived back at Riverside at 7:05 a.m. Meanwhile, the crew (engineer and conductor) of freight train BNSF PLACCLO3- 22 (hereafter referred to by its operational identification, BNSF 5340) had reported on duty at Hobart Yard (near Los Angeles) at 2:30 a.m. on April 23. Between 2:30 and 5:30 a.m., the crew took charge of the assigned locomotives, coupled them to their train, and set out one defective car. By the time this was complete, several priority trains were ready for departure from Hobart Yard, and these trains were permitted to leave ahead of BNSF

1. The conductor said that while he and the engineer waited for the traffic to clear, he

took a 1 1/2 hour nap.4 BNSF 5340 departed Hobart Yard about 7:30 a.m. 1 Both BNSF and Metrolink designate timetable directions as east and west. 2 A control point is a location where absolute signals are present and are under the control of a dispatcher or control operator. Trains may not pass absolute signals displaying stop without authorization. 3 In order to provide standard classifications, the Safety Board applies published aviation injury criteria (49 Code of Federal Regulations 830.2) to all modes of transportation. For statistical uniformity only, an injury to a person that results in death within 30 days of the accident is classified a fatality. In the Placentia accident, a third injured passenger, a 77-year-old woman, died on or about June 7, 2002, which was about 45 days after the accident. Under the foregoing criteria, she is not classified in this report as an accident fatality. The Safety Board's investigation did not identify any evidence that her death was directly attributable to injuries sustained in the accident. Further, this classification does not reflect any determination that she did not, in fact, succumb to injuries received in the accident. 4 General Code of Operating Rules Rule 1.11.1 allows napping by one of the crewmembers when the train is waiting for departure.

Factual Information 2 Railroad Accident Report Between Hobart Yard and CP Atwood, the BNSF railroad is multiple-track territory with either two or three tracks. Trains may be operated in either direction on any of the tracks. The train dispatcher requests routes, and the traffic control system5 moves track switches and displays signal aspects6 to crews who operate their trains on the designated routes. BNSF 5340 changed tracks several times between Hobart Yard and Fullerton Junction as it negotiated the morning train traffic consisting of Metrolink and Amtrak trains. At 7:32 a.m., the Metrolink crew, now operating their train as Metrolink 809, departed Riverside on their fourth trip of the day, heading for San Juan Capistrano. On this trip, the train was configured with the locomotive on the rear and the cab car on the front. The engineer was operating the train from a control compartment in the cab car. Approaching CP Atwood westbound, Metrolink 809 received a diverging clear signal to leave BNSF tracks and enter the Metrolink Olive Subdivision. (See table 1.) Figure 1. Accident location. 5 A traffic control system (typically abbreviated “TCS”) consists of wayside signals, powered switches, and control points. The dispatcher issues commands to the system to route trains on the desired tracks. 6 The signal aspect refers to the physical appearance of the signal, which usually involves the display of colored lights, either singly or in different combinations. Although specific signal aspects vary not only by railroad, but sometimes across territories within a single railroad system, the names given to various signal aspects (clear, approach, stop, etc.) are generally uniform throughout the railroad industry and require similar responses from train crews. Los Angeles San Bernardino San Juan Capistrano Riverside Hobart ROUTE OF BNSF 5340

Factual Information 3 Railroad Accident Report Train BNSF 5340 was moving toward CP Atwood from the west. The engineer recalled that as he approached Basta, which is at MP7 163.0 (about 7 miles from C.P. Atwood), he received a signal that required him to slow his train to 30 mph, which he did. He said that he then noted that the next signal displayed approach but changed to clear before the train reached it. He then resumed normal operating speed. The BNSF crewmembers said they were engaged in a conversation about previous employment; they had both worked at the same oil refinery before beginning their railroad careers. The BNSF 5340 conductor said that he called aloud the signal at MP 42.31the signal before the signal at CP Atwoodas clear (refer to table 1) and that the engineer repeated “clear.” According to the transcript of an interview that BNSF officials conducted with the conductor and engineer of BNSF 5340, the engineer acknowledged that he heard the conductor call out “clear” and that he “confirmed it.” In a Safety Board interview, the engineer said that he did not see the signal. “My conductor called it before we went under it; by the time I looked up, we were past it.” Both crewmembers said they approached CP Atwood thinking they were operating on a clear signal and that they thus were not required to stop or even slow the train. (According to data from signal system data loggers, the signal at MP 42.31 was displaying approach at the time BNSF 5340 passed.) Both BNSF 5309 crewmembers said that just before the train reached CP Atwood, they realized that signal 4EA (MP 40.71) was showing stop.8 The train was traveling about 49 mph at the time. (See figure 2.) They said they noticed Metrolink train 809 on the same track heading toward them, and the engineer placed the train brakes in emergency. The Metrolink 809 engineer said he was slowing the train preparing to go through a switch at 25 mph when he saw the freight train coming toward his train on the same track. He also placed his train in emergency, left the control compartment, and ran back through the lower level of the car warning passengers to brace themselves. Table 1. BNSF Track No. 2 signals as displayed at time of accident. Location Name Aspect Indication Displayed to MP 44.03 Clear Green Proceed BNSF 5340 MP 42.31 Approach Yellow Reduce to 30 MPH prepared to stop at next signal BNSF 5340 CP Atwood (eastbound) Stop Red Stop BNSF 5340 CP Atwood (westbound) Diverging Clear Red over Green Proceed on diverging route at prescribed speed Metrolink 809 7 BNSF milepost numbers increase from 0.0 at San Bernardino to 45.5 at Fullerton Junction. From Fullerton Junction, numbers decrease from 165.5 to 143.4 at Harbor Jct. 8 The approach signal at MP 42.31 was intended to prepare the freight train crew to stop short of the stop signal at CP Atwood.

Factual Information 4 Railroad Accident Report Figure 2. Signal System Layout SAN BERNARDINO MP 40.71 MP 42.31 LOS ANGELES MP 44.03 OLIVE SUBDIVISION TO SAN DIEGO 4EA NTSB Drawing (not to scale) Point of Impact Cab Car Point of Rest Green Signal Yellow Signal Red Signal CP Atwood NOTE: BNSF striking freight train not shown INTENDED STOPPING POINT FOR BNSF 5340 INTENDED ROUTE OF METROLINK 809 MP 40.39

Factual Information 5 Railroad Accident Report As the freight train slowed, the conductor jumped clear of the locomotive at approximately 25 to 30 mph. Soon after, the engineer also jumped clear. The train was traveling about 23 mph when it collided head on with the standing Metrolink train about 1,630 feet past signal 4EA. A security surveillance video camera at a commercial storage facility adjacent to CP Atwood captured a portion of the collision on tape. The tape shows Metrolink 809 coming to a complete stop with the trailing (third) Metrolink passenger car standing in the center of the video camera view. After being stopped for about 12 seconds, Metrolink 809 is propelled backward as BNSF 5340 makes contact. The BNSF 5340 lead locomotive comes to rest in the center of the video image after both trains have stopped. Based on the known length of the Metrolink passenger cars and of BNSF locomotive 5340, the easterly movement of Metrolink 809 during impact was calculated to be about 243 feet. (See figure 3.) Figure 3. Aerial photo of accident scene (courtesy Orange County Sheriff’s Department).

Factual Information 6 Railroad Accident Report Emergency Response Fire and rescue emergency services for the city of Placentia are provided by the Orange County Fire Authority under a “joint powers agreement,” which involves a network of municipality-based fire departments linked by a common county-wide emergency response dispatch system and management organization. The initial request for emergency assistance was a telephone call that was placed to the fire authority 911 communications center at 8:10:56 a.m. This was followed by numerous additional calls. Orange County Fire Authority Division IV/Battalion 2 was the initial responding fire department agency9 and was the principal responding fire/rescue emergency services agency in the accident. Other emergency services resources of Orange County simultaneously responded to the accident. Emergency response support was also provided by a large number of mutual aid response agencies as well as municipal and private ambulance services. Ultimately, at least a dozen emergency response organizations and municipal support agencies were represented at the scene, including five fire department agencies and seven police agencies. A total of about 60 emergency response vehicles, 45 ambulances supplied by seven ambulance companies, and several motor coaches10 responded to the scene. An estimated 120 emergency personnel, about 40 of whom were paramedics, responded to the scene. Also, medical trauma personnel (a physician and eight nurses) responded to the scene. An Orange County Fire Authority chief served as the incident commander11 during the emergency response and coordinated the combined activities of the various responding organizations. The Metrolink cab car,. 634, sustained substantial crush damage and debris in and around the aft stairwell, which rendered the stairwell impassable. (See figure 4.) The stairwell provides access between the upper-level deck, the intermediate level, and the lower-level deck of the railcar (where the main doors are located). There is an intermediate level at each end of the railcar where an end door allows passage to an adjacent coach car. When the cab car came to rest, the aft end door was misaligned relative to the adjacent coach car. (See figure 5.) Emergency responders reported that those passengers on the intermediate level were able to remove the emergency exit windows without external assistance and were readily able to exit through the emergency exit windows and climb to the ground on ladders. 9 Division IV/Battalion 2 is the fire brigade resident to the city of Placentia. 10 The motor coaches provided transportation to local hospitals for those identified during triage to have suffered minor injuries. Other buses were used, upon request, to transport uninjured passengers back to their initiating stations. 11 The incident command system provides for the coordination of personnel, resources, and communication during the response to an emergency.

Factual Information 7 Railroad Accident Report Figure 4. Damaged stairway in Metrolink cab car. Figure 5. Damaged exterior of Metrolink cab car.

Factual Information 8 Railroad Accident Report Emergency responders indicated that while passengers in the aft intermediate level of the coach were slightly delayed in exiting the railcar because of the damaged door, the passengers told responders that they were not injured or entrapped in any way. These passengers were also reported to have instructed the emergency responders to attend to the more seriously injured persons on the train until resources were available to assist them in exiting the car. Emergency responders found two passengers who were showing minimal or no signs of life lying in the aisle of the upper deck of the lead Metrolink railcar. After a medical triage assessment was performed, one of these injured passengers, a 48-year-old male, was immediately transported by ambulance. The passenger expired in route and was pronounced dead upon arrival at the hospital. The other passenger, a 59-year-old male, was later pronounced dead at the scene. Emergency response agency and medical facility records indicated that 264 persons on board the two trains were medically triaged at the scene. A total of 102 persons in the medical triage count were identified as “uninjured.” In addition, one firefighter experienced dehydration at the scene and was transported to a local medical facility, which raised the medical triage count to 265 persons (which included the on-scene fatality). Of the 265 persons in the medical triage count, 162 persons received emergency transportation for medical assessment and/or treatment at local hospitals. This included 157 Metrolink passengers, 2 Metrolink crewmembers, 2 BNSF crewmembers, and the 1 injured firefighter. (See figure 6.) Figure 6. Emergency responders treating accident victims.

Factual Information 9 Railroad Accident Report Site Description The BNSF San Bernardino Subdivision is part of the larger Southern California Division and runs in a timetable east-west direction between San Bernardino at MP 0.0 and Harbor Junction at MP 143.4. The San Bernardino Subdivision consists of multiple main track territory with sidings and crossovers. The maximum timetable12 speed for trains operating through CP Atwood in the vicinity of the accident is 50 mph for freight trains and 60 mph for passenger trains. About 40 to 50 freight trains pass through CP Atwood each weekday, along with more than a dozen passenger trains. The collision occurred on track No. 2 at BNSF milepost 40.39 on tangent track at CP Atwood. The point of collision was east of signal 4EA that governs eastbound movements on track 2 through CP Atwood. CP Atwood also controls movements to and from the Metrolink Olive Subdivision that connects Metrolink stations on the BNSF San Bernardino Subdivision tracks to stations along the Metrolink San Diego and Orange Subdivision tracks. In addition to the Olive Subdivision connector, there are two main tracks at CP Atwood, and trains can run in either direction on any track. The general track construction at CP Atwood is a mixture of 119-, 131-, and 136- pound continuously welded rail fastened through tie plates to standard timber crossties supported by granite ballast. Injuries A review of hospital records for those Metrolink passengers transported from the scene indicated that the passengers stated to the medical staff that their injuries were sustained principally as a result of being thrown forward and striking some hard or unyielding surface or object such as a workstation table or seatback structure. (See table 2.) 12 BNSF, Southern California Division Timetable No. 6, effective January 20, 2002.

Factual Information 10 Railroad Accident Report Table 2. Injuries Notations in several passengers’ medical records indicated that they had informed the medical staff that one of the Metrolink train crewmembers in the cab car attempted to warn passengers of the impending collision just before the impact. The notations also indicated that several of those passengers were able to place themselves in positions or locations that they felt might have helped to reduce their injuries. A review of the pathology reports on the two fatalities indicated that both persons received severe blunt impact trauma injuries to the chest and upper abdomen. These two fatally injured persons were found near seats 58 and 61 and 66 and 70, respectively, on the upper level of the lead railcar. They were apparently sitting next to each other on the right side of the aisle (relative to the direction of travel) in seats numbered 60 and 61, with both persons facing the direction of travel. (See figures 7 and 8.) These seats are about in the middle of the railcar and are a paired seating set arranged in an opposing (face-to-face) layout with another paired seating set (seat numbers 56 and 57), with a workstation table between them. The workstation table was found to have been pushed forward relative to its normal service location and was partially resting against the seatback of the opposite seat pair set. Although the table pedestal had not fully separated from its attachment to the floor, its attachment joint with the floor was bent and partially separated.13 No one was identified as having been occupying seats 56 or 57 at the time of the collision. Injury Typea Employees Passengers Others Total Fatal 0 2 0 2 Serious 0 22 0 22 Minor 4 114 1b 119 None 0 122c 0 122 Total 4 260 1 265 a 49 Code of Federal Regulations (CFR) 830.2 defines fatal injury as “any injury which results in death within 30 days of the accident” and serious injury as “an injury which: (1) requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; (2) results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages, nerve, or tendon damage; (4) involves any internal organ; or (5) involves second- or third-degree burns, or any burn affecting more than 5 percent of the body surface.” b Responding firefighter treated for dehydration. c Includes 102 persons who were medically triaged at the scene and identified as “uninjured” and released from the scene, plus 20 persons who were transported in the “minor” injury category to a local medical facility for which no medical records could be located (these persons apparently did not receive medical assessment or treatment and are thus not listed as injured). 13 Emergency medical services personnel later needed to detach the table from the floor and wall in order to access the emergency exit window at that location.

Factual Information 11 Railroad Accident Report Figure 7. Seating layout of the upper-deck level of the Metrolink cab car. (Fatally injured passengers were seated in seats 60 and 61 at workstation table.) DIRECTION OF TRAVEL Table Table Table Table 60 61 64 65 68 69 72 73 62 63 66 67 70 71 74 75 58 59 54 55 50 51 46 47 42 43 38 39 34 35 36 37 40 41 44 45 48 49 52 53 56 57 32 33

Factual Information 12 Railroad Accident Report Damage Metrolink cars 634 and 113 derailed and sustained substantial crush damage. Metrolink estimated monetary damage at $4.6 million. BNSF locomotive unit 5340 sustained damage to the front end. BNSF estimated monetary damage to be $25,000. Switch No. 3 on BNSF track No. 2 was damaged as a result of being run through (subjected to train movement that conflicted with the route for which the switch was lined) by the freight train. BNSF engineering personnel estimated the total track, structures, and signal equipment damages at $6,400.00. This figure included costs for the installation of a new switch point and stock rail. Category Damages BNSF Equipment $25,000 Metrolink Equipment 4,600,000 Track-Structures-Signals 6,400 Total $4,631,400 Figure 8. Photograph depicting a simulation of the positions of the two fatally injured passengers relative to an exemplar workstation table. (The passengers were facing the direction of travel.)

Factual Information 13 Railroad Accident Report Personnel Information BNSF 5340 The engineer of BNSF 5340 was hired as a switchman in 1997. He was promoted to locomotive engineer on July 30, 1999. He had operated over the accident territory (Hobart to Barstow) for 1 1/2 years as a conductor and about 1 year as an engineer. He was due for engineer recertification training on July 30, 2002. His disciplinary record indicated that he received a formal reprimand for failing to stop short of cars on a yard track while working as a switchman in 1997. Otherwise, his record was clear. The BNSF 5340 engineer was assigned to an extra board.14 The day before the accident (Monday, April 22) he completed a 12-hour shift that began on Sunday at 4:00 p.m. and ended the next morning at 4:00 a.m. He said he then drove for an hour to his home, where he fell asleep about 5:30 a.m. and slept for about 10 hours. After waking, he remained at home, did some chores, and ate dinner. Afterwards, he said he took a nap for 2 1/2 hours until he was awakened by a phone call from the railroad at 11:30 p.m., during which he was told to report for duty at 2:30 a.m. He said he departed his house at 1:30 a.m. on April 23 and drove to the terminal. He told investigators that he felt “pretty good” when he departed Hobart Yard on the accident trip. The BNSF 5340 conductor was hired as a switchman in 1998. He was promoted to conductor 3 months after being hired. His disciplinary record indicates he received a 30- day suspension in 2000 for failing to properly secure railcars, resulting in a collision with a motor vehicle. Otherwise, his record was clear. The conductor was also assigned to an extra board. On the day before the accident (Monday, April 22), the conductor, after completing an assignment that had taken him to an away-from-home terminal, arrived at his hotel about 12:30 a.m. and slept until 7:45 a.m., when he was called by the BNSF to go on duty at 9:15 a.m. on April 22. He worked until 4:10 p.m. He said he spent time with his wife that evening, ate dinner, and slept from 9:00 p.m. until 11:30 p.m., when he was called to go on duty at Hobart Yard at 2:30 a.m. He said that after this call, he slept for another hour, then awoke and traveled to the terminal. He arrived at the terminal at 2:25 a.m. and went on duty at 2:30. The conductor said that although he felt tired when he reported for work, he felt “wide awake” when BNSF 5340 departed Hobart Yard. Metrolink 809 The Metrolink 809 engineer was hired on August 24, 1992. He began operating Metrolink trains in September 1999. He received a favorable evaluation during his last locomotive engineer evaluation on January 18, 2002. 14 An extra-board employee does not have an assigned job but is called as necessary either to substitute for a regular employee who is unavailable for duty or to serve as a crewmember on an unscheduled assignment.

Factual Information 14 Railroad Accident Report The Metrolink 809 conductor began working in the railroad industry with the Atchison Topeka and Santa Fe Railroad in 1973 as a switchman/brakeman, and worked there until he was hired by Amtrak in March 1989. He began working on Metrolink15 trains in September 1999. Train Information BNSF 5340 BNSF 5340 consisted of three locomotives and 27 loaded multi-platform intermodal freight cars (67 platforms total). The train weight was 5,755 tons. Records indicate that a mechanical inspection and an initial terminal air brake test were performed before the train departed Hobart Yard on the day of the accident. No exceptions were noted during this inspection and testing. Metrolink 809 Metrolink 809 consisted of one locomotive and three passenger cars. At the time of the accident, the locomotive was at the rear of the train being controlled from the cab car at the front. This configuration, referred to as “push–pull” operation, eliminates the need to turn or switch equipment at the end of each run and allows quicker turnaround time at terminals. Records indicate the Metrolink 809 was mechanically inspected and received an initial terminal air brake test before its departure from Riverside. No exceptions were noted during the inspection and testing. The passenger cars on Metrolink 809 were bi-level coach cars manufactured by Bombardier Transportation, a division of Bombardier Corporation. The Metrolink railcar coach fleet comprises three groups16 of Bombardier bi-level coach railcars identified by delivery series, number, and delivery dates, with the delivery of the individual groups occurring several years apart. With regard to the design of interior features, the three groups of bi-level coach railcars are similar, with minor variants occurring between the delivery series. The design incorporates two full decks (an upper and lower) in the center of the railcar, with an intermediate-level deck situated over the truck assemblies at each end of the car. All three decks provide passenger seating. The bi-level coaches are all configured to the same basic passenger seating arrangement. The only significant difference between the coach/cab car and the coach/trailer is that an operator’s cab compartment is provided at the leading end of the coach/cab car. The Metrolink bi-level cab car and coach/trailer units have seating to 15 Amtrak supplies the crews to operate Metrolink trains. 16 These “groups” are also referred to (by both Metrolink and Bombardier) as “generations,” or “series.”

Factual Information 15 Railroad Accident Report accommodate 142 and 149 passengers, respectively. Both coach railcar designs have a crush load17 capacity of about 360 passengers. Two stairwells in each Metrolink bi-level coach18 provide access between the lower-level deck, the intermediate level at each opposite end of the railcar, and the upper- level deck of the railcar. Four main passenger ingress/egress side pneumatically operated pocket door sets19 are on the lower-level deck of each railcar, with two sets of doors on each side. A vestibule area is provided between the main side-exit doors at each end of the lower-level deck. An emergency release handle adjacent to each main side-exit door may be used to release one of the sliding pocket door panels at each door location. A restroom is at one end of the lower-level deck. A door at each end bulkhead on the intermediate level provides passage to adjacent railcars. Passenger seating accommodations on board the Metrolink bi-level railcars consist of a combination of transverse and longitudinal-mounted fixed seat assemblies,20 with the seat assemblies installed on both sides of a longitudinally oriented center aisle passageway on all three deck levels. Almost all of the transverse mounted fixed seat assemblies in the Metrolink bi-level coach railcar fleet are arranged in a “2 + 2,” paired/side-by-side configuration (also referred to as a “paired seating sets” arrangement). Many of the paired seating sets are arranged in an opposing face-to-face layout with the balance of the paired seating sets arranged so that the paired seating sets are all facing in the same direction. Each Metrolink bi-level railcar is fitted with eight workstation tables, four on the upper level and two at each end of the intermediate level. These tables are fitted between paired seating sets of opposing passenger seats. The tables are a basic design consisting of a one-piece tabletop assembly that is cantilevered from and secured to the carbody sidewall. A single pedestal support leg is attached to the tabletop underside and is secured to the floor. The tabletops are trapezoidal in shape, approximately of a uniform size, and manufactured of a resilient plastic material. Bombardier representatives said all of the bi-level railcars delivered to its customers have been fitted with the workstation tables and that the company had not conducted any biomechanical engineering analysis, testing, or injury causation assessment of occupant impact against the workstation tables. Metrolink delivery series 200 and 207 railcars21 have three exterior sidewall emergency access windows on each side of the upper-level deck. The lower-level deck has two emergency access windows on each side. A retro-reflective decal on the car exterior 17 The crush load is the maximum number of passengers that can possibly be riding in the railcar (standing and sitting). 18 The stairwells are at approximately the 1/4 point and the 3/4 point along the length of the carbody. 19 A pocket door is a door that opens by sliding horizontally into a narrow compartment within the wall adjacent to the doorway. 20 A fixed seat is a passenger seat that is permanently configured in a given location such that it cannot otherwise be readily reconfigured (by operational or maintenance personnel) to face any other direction. 21 These delivery series include railcars 113, 167, and 634, all involved in this accident.

Factual Information 16 Railroad Accident Report near each upper- and lower-level emergency access window describes the emergency window removal procedure. The instructions are to use a screwdriver to pry out the seal (grommet) surrounding the windowpane. The decal also includes a grommet-removal pictorial and additional step-by-step instructions. On the intermediate-level deck, all of the exterior sidewall windows could be removed by using an axe, a sledgehammer, or a similar impact tool to break the window glazing. Although emergency exit windows on the intermediate level had instructional signage and pull rings on the inside of the railcar, no instructional signage describing the window removal procedure was provided on the exterior sidewall near the intermediate- level deck windows, and such signage was not specifically required by regulations. The upper- and lower-level decks of Metrolink delivery series 214 railcars22 are fitted with the same exterior sidewall emergency access window configurations and exterior instructional signage as the series 200 and 207 cars described above. The intermediate-level deck windows can be removed without breaking the window glazing. Although not specifically required by regulation, intermediate-level exterior instructional signage was installed on this series of cars before the accident. The signage consists of a retro-reflective decal stating: “USE SCREWDRIVER TO PRY OUT SEAL SURROUNDING THE WINDOW PANE,” along with additional step-by-step instructions. Wreckage The derailed Metrolink equipment came to rest substantially upright and somewhat in alignment with the track, although the aft end of the lead Metrolink railcar had skewed onto the adjacent track. The leading end of the Metrolink cab car,. 634, came to rest about 131 feet east of the Richfield Road grade crossing (centerline of the pavement). The lead BNSF locomotive 5340 came to rest lodged against the front bulkhead fascia of the Metrolink cab car. Metrolink Cab Car 634 Metrolink cab car 634 had both its truck assemblies derailed, and the aft end of the railcar had skewed about 11 feet to the north. The carbody received relatively moderate impact damage to the front exterior and operator’s cab. The aft end of the carbody structure was substantially damaged. The carbody in the vicinity of the aft stairwell was bent to the left (relative to the direction of travel) and displayed a 30° bend from its linear configuration. The aft end of the carbody was laterally displaced about 89 inches relative to its linear configuration, with the displacement point occurring about 178 inches from the aft bulkhead exterior fascia. Debris and crush damage rendered the aft stairwell impassable. There were no occupants reported in the stairwell area at the time of the accident. A section of the roof panel above the aft stairwell of the car had separated from 22 None of which were involved in this accident.

Factual Information 17 Railroad Accident Report its attachment and was buckled upward about 35 inches. A segment of the left sidewall panel near the aft stairwell of the car had been longitudinally displaced from its structural attachment. This resulted in a localized partial telescoping of the carbody sidewall panel structure in that area.23 On the underside, severe damage was apparent on the structural steel center sill assembly. On the interior, a number of the passenger seats and workstation tables throughout the railcar had shifted from their normal positions. Most of the emergency pull-windows had been removed. Metrolink Car 113 The leading end of the second Metrolink car, 113, was lodged against the aft end of the lead cab car with its lead truck assembly derailed. A preliminary visual inspection indicated that the carbody received relatively little structural damage, with the damage principally confined to the exterior fascia panel of the front bulkhead, which had fractured in several places. A later, more extensive examination by Metrolink identified that the center sill (under-frame) structure at the A-end of the railcar was substantially damaged. In the interior, many of the seat cushions were dislodged from their attachments to the seats. There was no significant interior crush damage or a loss of occupant survival space in this car. Metrolink Car 167 The leading end of the third Metrolink car, 167, was lodged against the aft end of the second railcar, and the aft end was coupled to the locomotive. This railcar had not derailed and was relatively undamaged during the accident. Metrolink Locomotive 859 Inspection of Metrolink locomotive 859, indicated that the shank of the coupler at the leading end of the unit was bent. The locomotive was otherwise undamaged, and it did not derail. BNSF Locomotive 5340 The lead locomotive of the freight train received minimal damage and did not derail, nor did the two other locomotives or any of the railcars in the BNSF train. 23 The sidewall panel had separated from the structural framing and then was displaced (aft) when the carbody structure (aft of that location) pivoted to the left such that the sidewall panel came to rest overlapping the adjacent sidewall panel.

Factual Information 18 Railroad Accident Report Operations Information Train Dispatching Train movements on the BNSF San Bernardino Subdivision and the Metrolink Olive Subdivision are governed by the General Code of Operating Rules, effective April 2, 2000, and by timetable instructions and the signal indications of a traffic control signal system. The train dispatcher at the BNSF control center in San Bernardino coordinates train movements with the signal system on the BNSF San Bernardino Subdivision. The BNSF train dispatcher controls CP Atwood and any diverging train movements between BNSF tracks and Metrolink tracks on the Olive Subdivision. The BNSF traffic control system between CP Fullerton and CP Atwood (approximately 4.5 miles) consisted of three-aspect searchlight-type signals. With three- aspect signals, the aspect sequence encountered by a train approaching a red signal is green, followed by yellow, then red. A red signal is displayed to approaching trains when a track signal circuit is occupied by another train or under certain other conditions. Signals are arranged for train movements in either direction, are continuously lit, and are controlled by electronic coded track circuits. Train Control On the nearby Metrolink Orange and San Diego Subdivisions, an intermittent automatic train stop system has been in operation since the 1960s. This system was installed by the predecessor railroad (the ATSF) to allow 90-mph passenger train operations. (Without an intermittent automatic train stop or similar system in place, Federal regulations restrict passenger train speeds to a maximum of 79 mph.) In an intermittent automatic train stop system, wayside inductors transmit signal information to receiving equipment on Amtrak or Metrolink locomotives. Any signal indication other than clear requires an acknowledgement from the locomotive engineer. If the engineer does not acknowledge the signal indication within 7 to 8 seconds, the train’s brakes will automatically apply. The intermittent automatic train stop system does not enforce speeds; that is, as long as the engineer acknowledges a more restrictive signal, the system takes no other action, even if the requirements of the signal are ignored. Nor is the system fail safe: if an inductor is removed or inoperative, the system no longer requires an acknowledgement of a restrictive indication, and the wayside signal system does not automatically restrict train movement. When Metrolink went into operation in the early 1990s, the signal system was renovated and spaced for cab signals.24 Pole lines were replaced with coded track circuits, but locomotives were not equipped for cab signals, nor was any field equipment installed 24 A cab signal system displays the governing signal aspect inside the cab of a locomotive so long as the locomotive is equipped to receive and display the signals and it is operating in territory equipped with a working cab signal system.

Factual Information 19 Railroad Accident Report for cab signals. The Metrolink Orange/San Diego Subdivision intermittent automatic train stop system is the only such equipment on Metrolink tracks, and no cab signal systems are operative on the Metrolink system or on the BNSF San Bernardino Subdivision. The BNSF freight trains that operate over Metrolink tracks under trackage rights agreements are not equiped with automatic train stop receiving equipment and are limited by Metrolink to a maximum speed of 55 mph. Signal Awareness Form BNSF procedures required the BNSF 5340 conductor to enter the name/aspect of each signal encountered during the trip on a signal awareness form.25 This form was recovered from BNSF locomotive 5340 after the accident. The first page of the form included the signals from MP 144.00 to MP 157.91. The train entered the territory at an intermediate point on the form, and the first signal encountered was at MP 146.98. The entry for this signal was “DA,” meaning diverging approach.26 This entry showed the speed and time (10 mph and 7:20 a.m.) as required by BNSF procedures. Some entries on the first page showed “A,” indicating that the signals displayed approach. Several entries were “AM,” or approach medium.27 Most remaining entries had a “C,” which the conductor explained meant clear. The second page contained the list of signals involved with the accident, from MP 159.48 to MP 40.71, the location of the stop signal. The conductor explained that he always entered a “C” in this column as shown on the first page of the signal awareness form. Furthermore, the conductor explained that he did not always make an entry each time he observed a clear signal; he said he often waited either until an approach signal was encountered or until it was time to turn to the next page of the awareness form and then backfilled the entries for the clear signals up to that point. The BNSF procedure requires that: All block signal names or aspects and yellow or yellow/red flags must be recorded. With the exception of CLEAR signals, which only require the name or aspect to be recorded, information must include the location of each flag, the train speed, time the signal or flag is passed and the name or aspect of the signal that was called. When speed indicator is not visible to the conductor, the engineer must call out the speed, in addition to the signal name or aspect, if other than CLEAR. Should the conductor be unable to record a signal aspect due to other activities, this fact must be noted on the form, including the reason. 25 The investigation determined that the Union Pacific Railroad also requires conductors to annotate signals on a special form, and the Norfolk Southern Railroad is considering such a requirement. 26 Upon receiving a diverging approach signal, a train must “Proceed on diverging route not exceeding prescribed speed through turnout; approach next signal preparing to stop, if exceeding 30 mph immediately reduce to that speed.” 27 Upon receiving an approach medium signal, a train must “Proceed prepared to pass next signal not exceeding 40 mph and be prepared to enter diverging route at prescribed speed.”

Factual Information 20 Railroad Accident Report Calling Signals The General Code of Operating Rules has a requirement for crew members to call signals. The rule specifies the following: Rule 5.16 Observe and Call Signals. Crew members in the engine control compartment must be alert for signals. As soon as signals become visible or audible, crew members must communicate clearly to each other the name or aspect of signals affecting their train. They must continue to observe signals and announce any change of aspect until the train passes the signal. If the signal is not complied with promptly, other crew members must remind the engineer and/or conductor of the rule requirement. If the crew members receive no response or if the engineer is unable to respond, they must immediately take action to ensure safety, using the emergency brake valve to stop the train, if necessary. During the investigation, the conductor described the signal at MP 44.03 (two signals in advance of Atwood) as the “first approach to Atwood” and said that this signal displayed green (clear). The conductor said that he next called out the signal at MP 42.31 (one signal in advance of the stop signal at CP Atwood) as clear. The engineer stated that he remembered the conductor’s calling this signal clear, but that he did not look at the signal himself. Because of the location of Metrolink 809 and the settings in the train dispatcher’s computer, the signal just before CP Atwood was displaying approach. Both the engineer and the conductor stated that the CP Atwood signal displayed stop. Meteorological Information At the time of the accident, the weather at Fullerton Airport (about 8 miles from CP Atwood) was reported as haze with a temperature of 58° F. The BNSF 5340 engineer stated that the weather at the time of the accident was clear and dry, with no smog or precipitation. Sunrise was at 6:11 a.m., and the altitude and azimuth of the sun at the time of the accident were reported to be 23.6° and 90.3°, respectively.28 Medical and Toxicological Information The BNSF 5340 engineer’s last company medical examination for vision and hearing was in the spring of 2002 as part of a required locomotive engineer recertification. 28 Source: U.S. Naval Observatory http://mach.usno.navy.mil/cgi-bin/aa_altazw.

Factual Information 21 Railroad Accident Report The examining physician indicated that he could operate in his current assignment with no restrictions. The engineer wore bifocals and said he was wearing them during the accident trip. The engineer indicated that he had not taken any medications during the 3 weeks leading up to the accident. The BNSF 5340 conductor’s last company medical examination was in 1998. The examining physician indicated that he could operate in his current assignment with no restrictions. He wore glasses for reading only. His most recent hearing test was on May 18, 1998; no operating restrictions were noted. The conductor indicated that he had not taken any medications before the accident. The Metrolink 809 engineer’s last company physical was on June 14, 2001. No operating restrictions were indicated. The Metrolink 809 conductor’s last physical examination was conducted on November 1, 1999. No operating restrictions were indicated. Pursuant to Federal Railroad Administration (FRA) postaccident toxicological test requirements as found at 49 Code of Federal Regulations (CFR) 219 Subpart C, each crewmember on the BNSF and Metrolink trains involved in the accident provided specimens that were tested for the presence of alcohol and drugs.29 All of the crewmembers on both trains tested negative for all tested substances. Tests and Research Signal System On April 23, 2002, investigators from the BNSF, Metrolink, Amtrak, the FRA, the Brotherhood of Railroad Signalmen, the California Public Utilities Commission, and the Safety Board began a field inspection of the railroad signal system. The postaccident inspection found all signal units, switches, and the signal cases at the intermediate signals and at CP Atwood locked and secured with no indications of tampering or vandalism. All relay positions were found to be in accordance with the physical location of the accident trains and with the displayed signal aspects. Ground tests were performed, signal searchlight mechanisms were inspected, and lamp operating voltages were verified. Movements of the spectacle arm30 were smooth with no binding. All mechanisms were found to be operating properly with no exceptions noted. Track connections and insulated joints were inspected, and no exceptions were noted. Information developed from signal system data loggers and dispatch center records during the investigation indicated that this signal at MP 42.31 was displaying approach at the time BNSF 5340 passed the signal. 29 Specimens were tested for cannabinoids, cocaine, opiates, amphetamines, methamphetamines, phencyclidine, barbiturates, and benzodiazapines. 30 A spectacle arm holds different color lenses that it positions in front of a single lamp to display the proper signal color.

Factual Information 22 Railroad Accident Report Sight-Distance Tests On April 25, 2002, Safety Board investigators conducted sight-distance tests by riding a locomotive of similar design to BNSF 5340 over the route the freight train traversed before striking the Metrolink train and observing the distances at which signal aspects could be seen and identified. The time of day and weather were similar to those on the day of the accident. Three trips were made, each starting at Fullerton and ending near the collision point. Investigators noted and recorded the visibility of the wayside signals at MP 44.03 (which showed clear when BNSF 5340 passed), MP 42.31 (which showed approach), and MP 40.71 (which showed stop). The distances recorded for the three runs were used to develop an average sight distance for each signal. On the first run, the signals were set (from west to east) at clear, approach, and stop, which duplicated their aspects during the passage of BNSF 5340. On the second run, all signals were set at clear. On the third run, signals were again set at clear, approach, and stop. The signal with the shortest average sight distance was the first one, at MP 44.03, which could be identified at about 1,960 feet. The next signal, at MP 42.31, could be seen and identified at approximately 3,010 feet. This was the signal that, on the day of the accident, was showing approach but that was called out as clear by the conductor. According to the locomotive event recorder, the accident train went by this location at 42 to 43 mph. With 3,010 feet of visibility and with the train moving at 42 mph, the signal would have been visible for about 48 seconds. The last signal before the collision point, signal 4EA at MP 40.71, could be seen and identified at an average distance of about 2,375 feet. Because of its weight and speed, train BNSF 5340 could not stop short of the signal. Placentia Police Department records indicate that shortly after the accident, the BNSF 5340 engineer told an officer that he could not see the approach signal, that the sun was very bright behind the signal, and that he could not distinguish the color. When the engineer was interviewed by Safety Board investigators on April 24, he said that he did not “catch” the signal but that the conductor told him it was clear. Locomotive Event Recorder Data Event recorder data were recovered from Metrolink locomotive unit 859, Metrolink cab car 634, and the three BNSF locomotive units. The data were reviewed by Safety Board staff. The data from the various recorders on each train were found to be in reasonable correlation. Metrolink cab car 634 (the lead car on Metrolink 809) experienced significant damage in the collision. The recorder installed on that car was removed and re- installed on cab car 636 in order to retrieve the data. The data from the Metrolink cab car 634 event recorder show that the train was placed into emergency braking, coming to a full stop at recorder time31 08:06:27 and was standing when it was struck by BNSF 5340. 31 Each event recorder records time independently from an internal clock. Typically, these clocks vary somewhat from actual time and from one other.

Factual Information 23 Railroad Accident Report The data from the recorder on BNSF 5340 (the lead locomotive on the freight train) show locomotive engineer activity, including a throttle movement and dozens of whistle activations as the train approached and traversed grade crossings in the 10 minutes before the accident. The data indicate that at recorder time 08:15:12 and at a train speed of 49 mph, an emergency brake application was initiated by the engineer. Between recorder time 08:15:13 and 08:16:00, train speed decreased from 49 to 0 mph. At recorder time 08:15:45, train speed was 23 mph. One second later, at 08:15:46, the train’s speed dropped to 17 mph. The recorder data indicate that the distance to a stop traveled by BNSF 5430 from the point where the speed rapidly decreased from 23 to 17 mph was 233 feet. Other Information Use of Cellular Telephones by BNSF 5340 Crew The BNSF 5340 conductor told Safety Board investigators that both he and the engineer had used their cellular telephones during the accident trip. The conductor stated that soon after they departed the yard, he had a brief conversation with his wife, after which the engineer made a personal call using his own cell phone. According to the conductor, the last conversation ended before the train reached Fullerton. The conductor said he was not aware of any BNSF rule prohibiting the use of a cellphone while operating a train. The BNSF 5340 engineer told investigators that he called his wife sometime before reaching Fullerton and that he did not use his cell phone again until after the collision, when he used it to contact BNSF officials. A review of cell telephone records for both the conductor’s and engineer’s numbers confirmed these accounts. Federal regulations do not prohibit a locomotive engineer from using a cell phone while at the controls of a moving train. Since April 10, 1994, the General Code of Operating Rules (which BNSF has followed since about 1985) has had the following rule (Rule 1.10, “Games, Reading, or Electronic Devices”) about the use of equipment not related to train operations: Unless permitted by the railroad, employees on duty must not: Play games, read magazines, newspapers, or other literature not related to their duties or use electronic devices not related to their duties. Additional guidance on cell phone use is provided by the BNSF published Safety Briefing on September 20, 2001 (SB-2001-04): Under no circumstances should a train crew on the head-end involve themselves in personal cell phone conversations while the train is moving. Inbound callers will understand that the employee will call back when the opportunity presents itself (usually while stopped in a siding - - and NOT while inspecting a passing train.) Refer to GCOR 1.10, which covers restriction in the use of non-authorized electronic devices not related to railroad duties.

Factual Information 24 Railroad Accident Report In its investigation of a May 28, 2002, collision between two BNSF freight trains in Clarendon, Texas,32 the Safety Board found that use of a cell phone by the engineer of one of the trains may have distracted him to the extent that he was unaware of the dispatcher’s instructions that he stop his train at a designated point. As a result of that accident, the Board. on June 13, 2003, recommended that the FRA: R-03-1 Promulgate new or amended regulations that will control the use of cellular telephones and similar wireless communication devices by railroad operating employees while on duty so that such use does not affect operational safety. After the Placentia and Clarendon accidents and as a result of a collision on a different BNSF subdivision,33 the BNSF, on June 18, 2002, issued instructions to operating employees that specifically prohibited the use of cell phones and laptop computers while on duty, with certain exceptions. Per these instructions, locomotive engineers “are prohibited from using cell phones/laptop computers while operating the controls of a locomotive.” BNSF Program of Operational Tests Under regulations at 49 CFR Part 217, the BNSF is required to periodically conduct operational tests and inspections34 to determine the extent of operating employee compliance with the code of operating rules, timetables, and timetables special instructions. To comply with the regulations, the BNSF program must: • Provide for operational testing and inspection under the various operating conditions on the railroad; • Describe each type of operational test and inspection adopted, including the means and procedures used to carry it out; • State the purpose of each type of operational test and inspection; • State, according to operating divisions where applicable, the frequency with which each type of operational test and inspection is conducted; and • Provide for a record-keeping system meeting the requirements of the regulation. 32 National Transportation Safety Board, Collision of Two Burlington Northern Santa Fe Freight Trains Near Clarendon, Texas, May 28, 2002. Railroad Accident Report NTSB/RAR-03/01 (Washington, D.C.: NTSB, 2003). 33 This collision was not investigated by the Safety Board. 34 Typically referred to as “efficiency tests.”

Factual Information 25 Railroad Accident Report The BNSF provided the Safety Board with a copy of its program, entitled Operations Testing Reference Guide.35 At the time of the accident, the FRA had not taken any exceptions to the program submitted by the BNSF. After the accident, the Consumer Protection and Safety Division of the California Public Utilities Commission issued an investigation report concerning the Placentia collision. One portion covered the postaccident inspections performed by the commission and the FRA. Following is an excerpt from that report: …audit results indicated that BNSF managers were not conducting quality operational efficiency tests.[36] As a result, [California Public Utilities Commission] inspectors[37] filed 10 federal operating practice violations against the BNSF as well as 85 Railroad Operating Rule (ROR) defects (CFR Part § 217.9). FRA representatives confirmed that these alleged violations were filed as five separate cases. Two of the cases involve alleged falsification of efficiency tests. As of this writing, one of the two cases has been dropped because of insufficient evidence, and the second case is expected to be dropped or settled by the end of FY '04. The other three cases, which did not involve allegations of falsification, were settled with the railroad at the end of FY '03. Postaccident Actions–BNSF After the Placentia accident, the BNSF revised its Operations Testing Reference Guide, adding a specific test entitled “Block Signal–Approach Aspects.” The test involves confirming that crews reduce train speed and handle trains appropriately when an approach signal is encountered. Also since the Placentia accident, the BNSF has developed a pilot program of signal rules compliance testing that is conducted remotely from the dispatching center. When remote testing is conducted, the dispatcher sets up a stop signal for a train. The train crew’s actions in response to the signal are captured by the locomotive event recorder. Through the use of wayside radio communication links, this event recorder data can then be downloaded remotely and evaluated for compliance by company officials. This system allows crew compliance with approach and stop signal indications to be evaluated on an almost real-time basis. The pilot program also involves querying historical computerized dispatching records to identify locations, such as CP Atwood, where trains have encountered stop signals infrequently. Those locations can then be highlighted for testing, either through local “on-the-ground” testing operations or through remote testing from the dispatch center. 35 Last update: April 8, 2002. 36 Efficiency tests involve setting up a scenario, such as a restrictive signal, and documenting the operating crew’s actions to verify that they comply with applicable rules. 37 The California Public Utilities Commission employs inspectors certified by the FRA to conduct oversight as part of a State participation program.

Factual Information 26 Railroad Accident Report Postaccident Actions–Metrolink Emergency Window Exterior Signage. After the on-scene investigation, Metrolink installed exterior instructional signage at the intermediate-level emergency windows on its delivery series 200 and 207 railcars. With this application, intermediate- level exterior window removal signage is in place on the entire railcar fleet. Emergency Window Grommet Design. Metrolink management informed Safety Board investigators that they are currently testing an intermediate deck-level emergency exit window grommet design that will allow the emergency exit/access windows to be removed without having to break the window. This grommet design uses removable “zip” or “filler” strips on both the interior and exterior at the four intermediate deck-level emergency windows. If the window grommet testing is successful, the new window grommet type will be installed on the emergency access windows of the 200 and 207 delivery series railcars of the Metrolink fleet. This would result in all of the emergency access windows in the Metrolink railcar fleet being removable from the railcar without the need to break the window glazing. Mass Casualty Training Drill Exercise Coincident to Accident On the morning of the accident, the Brea Fire Department38 was hosting a scheduled mass casualty training drill exercise39 to begin at 9:15 a.m. The Orange County Fire Authority and local fire and police agencies were to participate as mutual aid in this exercise, which was conducted in conjunction with the Orange County Hospital System annual accreditation drill. The training drill was in the final stages of preparation at the time of the accident and was to involve a request for 30 ambulances and almost 100 personal trauma transports (to 16 local hospitals). Upon learning of the actual train collision, officials suspended the training drill and immediately directed the emergency services resources to the Placentia accident. Local hospitals, as well as the local chapter of the American Red Cross (the hospitals and the Red Cross were participating in the drill), were also notified of the train collision and diverted their resources accordingly. Regulatory Framework Various aspects of BNSF and Metrolink operations fall under the regulatory authority of the FRA as outlined in CFR 49 Parts 200-299. California Public Utilities Commission personnel enforce FRA regulations in a State participation program outlined under CFR 49 Part 212. The FRA has contracted with the Volpe National Transportation Systems Center40 to perform research on passenger railcar crashworthiness. According to a Volpe Center representative, the research includes field studies of actual collision damage, and a contractor to the Volpe Center has gathered data on the Placentia accident. Also, the Volpe 38 Brea is a neighboring municipality to the northwest of Placentia. 39 The activity was organized by the Orange County Fire Operations Chiefs (a subgroup of the Orange County Fire Chief’s Association). 40 The Volpe Center is a Federal fee-for-service organization within the Department of Transportation.

Factual Information 27 Railroad Accident Report Center is currently performing finite element computer simulation modeling of carbody structural deformation and of occupant kinematics (as occurred in the Placentia collision) in order to identify an improved table design, possibly by incorporating exposed edge cushioning and a provision for no detachment from the wall. Volpe Center staff also anticipate conducting, in December 2003, a full-scale two-car passenger railcar crash test using crash test dummies and seats with a table similar to those that were in place in the Placentia accident. BNSF Train Collision Avoidance System Testing The BNSF is testing a global positioning system-based radio telemetry collision avoidance system. The system, designated ETMS for “electronic train management system,” involves a track system database, global positioning system units on locomotives, and train-to-wayside communications. A locomotive cab display tells the engineer the current authorized speed, the next signal aspect, upcoming speed restrictions, the distance to the next signal, and other information related to safety of operations. Allowable and actual speed are displayed; and as the train approaches a speed restriction, restricting signal, or misaligned switch, allowable speed decreases along a safe braking profile based on train tonnage and braking capability. The engineer must stay at or under the allowable speed or a warning sounds, followed by an automatic brake application that brings the train to a stop. Such stops are annunciated to the dispatcher as well. A beta test of the system was successful, and the BNSF plans a pilot installation on 135 miles of track between Beardstown and Centralia, Illinois, in 2004. The location was chosen because it offers a mix of operating conditions. About 50 locomotives will be equipped with the system and will be kept captive between the two points. If pilot tests are successful, some potential issues for future full implementation of such a system include cost (the BNSF has more than 4,000 locomotives and 33,500 route miles of track), mixing non-equipped foreign locomotives (Amtrak, Metrolink, etc.) on BNSF track, and interoperability with other railroads that use other communications technology. Testing of the BNSF system is partially funded by the FRA’s Office of Railroad Development.

28 Railroad Accident Report Analysis General The accident occurred during daylight hours and in clear weather. Inspection records and testing of the signal and train braking systems revealed no defects that would explain the failure of the BNSF 5340 crew to slow their train and stop short of signal 4EA at CP Atwood, which was displaying stop. Postaccident sight-distance tests revealed that the approach signal in advance of signal 4EA was clearly visible from more than 3,000 feet away. Federally mandated drug and alcohol test results were negative for all crewmembers involved in the accident. The Safety Board considered whether the BNSF crew’s performance was affected by fatigue. The engineer told Safety Board investigators he felt “pretty good” when his train departed Hobart Yard. Similarly, the conductor, who acknowledged that he felt tired when he reported for duty, said that he was “wide awake” after taking a 1 1/2 hour nap while waiting for clearance to depart Hobart Yard. During the early part of the accident trip, the crewmembers were conversing, which would have contributed to their being alert and awake. Data from locomotive event recorders also showed that as the train approached the misidentified signal, the engineer’s control inputs were appropriate and timely. Finally, the accident occurred at 8:16 a.m., a time when the average person has passed the period of circadian41 low and is typically experiencing a heightened level of alertness. The Safety Board therefore concludes that there was no evidence of fatigue impairment or alcohol or drug use in this accident, and the following factors were neither causal nor contributory to the accident: weather, signal visibility, and signal or train braking system malfunction. Accident Discussion At the time of the accident, that portion of the BNSF signal system governing eastbound trains, such as BNSF 5340, on track No. 2 approaching CP Atwood involved three signals. All three signals were capable of displaying clear, approach, or stop, and the signals changed automatically, depending on train traffic in the vicinity of the control point. 41 Circadian rhythms describe the regular recurrence, in cycles of about 24 hours, of biological processes or activities such as sensitivity to drugs and stimuli, hormone secretion, sleeping, and eating. Performance degradation is most likely to occur during the natural circadian low points that occur for most people between 2:00 a.m. and 6:00 a.m.

Analysis 29 Railroad Accident Report At the time of the accident, the signal governing eastbound movement at CP Atwood, signal 4EA at MP 40.71, was showing stop because of the presence of Metrolink 809. Information developed from signal system data loggers and dispatch center records during the investigation indicated that the signal in advance of signal 4EA, the signal at MP 42.31, was displaying approach and that the next signal to the west of this signal, at MP 44.03, was displaying clear. As BNSF 5340 proceeded toward CP Atwood, the first signal it encountered was the clear signal at MP 44.03. This signal required no special action on the part of the crew, and the train continued at track speed. The next signal was the approach signal at MP 42.31. Encountering this signal, the crew of BNSF 5340 should have slowed their train’s speed to 30 mph or less and been prepared to stop at the next signal. But when train BNSF 5340 approached the approach signal at MP 42.31, the crewmembers were engaged in a conversation, and the engineer said he was not watching the signal. The conductor called the signal, incorrectly, as clear. Although the engineer told BNSF investigators that he “confirmed” the conductor’s call out of the signal as “clear,” he indicated to Safety Board investigators that he did not, as required by BNSF operating rules, personally observe the signal and identify its aspect. He stated that when he did look toward the signal, his train had already passed it. In this case, the engineer took the word of the conductor that the signal was clear and continued to operate the train accordingly. The Safety Board therefore concludes that the BNSF 5340 train crew were insufficiently attentive to the operation of their train, with the result that they failed to see, identify, and respond appropriately to the approach signal indication at MP 42.31. By the time the engineer and conductor saw that the next signal, signal 4EA, was displaying stop and the engineer placed the train brakes in emergency, the train was traveling too fast (about 49 mph) to be brought to a stop before striking Metrolink 809. Ample distance existed between the approach and stop signals to allow the train to slow sufficiently to stop short of the stop signal and avoid the collision if the engineer had begun braking as required. The Safety Board therefore concludes that had the BNSF 5340 crew operated their train in accordance with the signal indications, the accident would not have occurred. Crew Alertness to Signals Inattention The General Code of Operating Rules required both crewmembers to remain alert for the signal, to call out the signal, and to continue observing the signal until the train passed. Investigators found that the approach signal was visible from more than 3,000 feet away, or for 48 seconds given the speed of BNSF 5340 at that time. As evidenced from their statements to investigators, the BNSF 5340 crewmembers were focusing attention on their conversation rather than on the signals governing the operation of their train.

Analysis 30 Railroad Accident Report Signal Recording Besides calling signals, one of the mechanisms the BNSF uses to encourage heightened crew alertness to signal indications is the signal awareness form. BNSF procedures require that conductors enter the time and train speed whenever a restrictive (less-than-clear) signal is encountered. A clear signal requires only that a check mark be made in a column on the form, and the procedures do not clearly specify that the entry must be made at the time the clear signal is observed. The BNSF 5340 conductor told Safety Board investigators that he routinely did not enter clear signals on the form when he observed them. Rather, he would wait until he encountered a restrictive signal and would then backfill the form in the clear column. This meant that the conductor did not need to take any action other than calling out the signal when clear signals were encountered. For efficiency, trains are generally operated such that the majority of signals encountered by an operating crew will be clear. Thus, conductors may inadvertently become passive in their observance of signals. In that case, the additional effort required by conductors to complete the signal awareness form when the signal displays either stop or approach (that is, the additional requirement to record the speed and time the signal was passed, as well as the aspect name) may prompt the crew to be more actively involved in observing the signals. In the view of the Safety Board, if conductors were also required to record speed and time information for clear signals, they would, of necessity, take a more active role in observing all signals. In this accident, for example, the BNSF 5340 conductor stated that he made an effort to observe the misidentified approach signal only when the train was close to the signal. That action was limited to making a single observation and calling out “clear” for the engineer to confirm. If the conductor had been required to complete the signal awareness form for a clear signal in a similar manner to other signals, he may have felt compelled to observe all signals earlier (even those expected to be clear) in order to have more time to accurately observe and record the signal-related information. This earlier observation of signals would also provide conductors with additional time to make repeated signal observations if necessary. At the same time, the added requirement would not in any way interfere with the conductor’s other duties. The Safety Board therefore concludes that had the BNSF 5340 conductor been more actively involved by entering clear signals on his signal awareness form at the time he observed them, his awareness of signal indications may have been increased, and he may not have misidentified an approach signal as clear. The BNSF conductor’s practice of not entering clear signals on his signal awareness form at the time he observed them was not specifically prohibited by BNSF rules, as those rules required different actions for clear signals than for more restrictive signals. The Safety Board therefore believes that the BNSF should revise its signal awareness form procedure to require recording of time, speed, and aspect name for all signals encountered at the time they are encountered.

Analysis 31 Railroad Accident Report Enforcement of Operating Rules FRA regulations in 49 CFR 217.9 specifically address a program of operational tests, inspections, and record-keeping on railroads subject to FRA jurisdiction. Such rules compliance programs typically include check rides, efficiency tests, and event recorder reviews to confirm that engineers are following the rules. After the accident, the BNSF revised its program, adding an approach signal test. Additionally, the BNSF reviewed dispatching and testing records on its system to identify locations, such as CP Atwood, where stopping trains was uncommon. Local railroad officials are now advised of these locations, and additional testing is conducted. The BNSF has also developed a remote testing program that allows stop signal testing to be conducted from the dispatch center. This is particularly useful for remote field locations, where access for testing by local railroad officials is difficult. While rules compliance enforcement programs can be effective accident prevention tools, such programs cannot be completely relied upon to eliminate human- error accidents. This is one of the reasons that the Safety Board has long recommended the installation of redundant systems to automatically take action and stop a train when a crew does not comply with signal indications. Survival Factors Workstation Tables and Injuries The workstation tables fitted to Metrolink bi-level railcars are rigid, unyielding structures that are attached to the railcar sidewall, thus affording little impact energy attenuation upon being struck by a train occupant. The initial collision speed was about 23 mph, and the distance the Metrolink train was shoved back was about 243 feet. There is minimal crush attenuation provided to the cab car, and no crush attenuation provided to the freight locomotive. The two individuals who sustained fatal injuries in this accident were seated at a workstation table in the lead Metrolink bi-level railcar, facing the direction of travel. The pathology reports of those two individuals indicated that both received severe blunt impact trauma injuries to the chest and upper abdomen. The deceleration forces of the accident would have been expected to thrust those forward-facing persons seated at workstation tables directly toward the exposed edge of the workstation table. The degree and types of injuries sustained by the forward-facing railcar occupants seated at several of the workstation tables in this accident are consistent with such a mechanism of injury. Therefore, the Safety Board concludes that the two fatal injuries and many of the serious abdominal injuries to passengers throughout the Metrolink train likely resulted from impact with the workstation table edges. Similar workstation tables have been installed in the entire Bombardier bi-level railcar fleet consisting of about 700 cars now in North American service. Bombardier did

Analysis 32 Railroad Accident Report not conduct any biomechanical injury causation assessment in the design and installation of these workstation tables. Further, there are no FRA standards that specifically address provisions for workstation tables in passenger railcars. The identification of crash injury causation hazards of workstation tables is accomplished only through a detailed biomechanical assessment using finite element simulation modeling or physical testing. The Volpe Center is currently performing finite element computer simulation modeling of carbody structural deformation and of occupant kinematics in order to identify an improved table design. The Safety Board has also been informed that the Volpe Center, in conjunction with the FRA, plans to conduct a full-scale two-car passenger railcar crash test in December 2003. The test will involve the use of crash test dummies and seats with tables similar to those that were in place in the Placentia accident. Data obtained from this test could form the basis for new standards or regulations regarding workstation tables in passenger railcars. Emergency Access to Car End Areas Through Designated Emergency Windows. Exterior instructional signage for first responders was not present at the intermediate-level deck emergency access windows in the Metrolink delivery series 200- 207 railcars. Impact forces in this accident resulted in blockage of the stairway and the end bulkhead door of Metrolink cab car 634, essentially isolating passengers in one end of the car. Fortunately, the passengers were not incapacitated, and they were able to remove these emergency windows that, at the time of the accident, had instructional signage and pull rings on the inside (but not on the outside) of the windows. Removal of the windows from the outside would have been more difficult than from the inside. While well- equipped and trained emergency responders may be able to break or remove emergency exit windows to gain access to incapacitated passengers inside, the first people on the scene of railroad accidents are often nearby residents or passersby. Emergency access instructions on all emergency windows could aid such “good Samaritans” in providing assistance. The Safety Board concludes that the absence of exterior instructional signage on emergency exit windows of the Metrolink cars could hinder emergency response in future accidents, particularly in a scenario in which first responders might be untrained and ill-equipped civilian “good Samaritans.” FRA regulations do not specifically require exterior instructional signage for emergency responders on exterior intermediate-level deck emergency windows. Regulatory requirements for emergency window exits in passenger railcars are under 49 CFR 238.113, which states “If the passenger car has multiple levels, each main level shall have a minimum of four emergency window exits, ….” Regulatory requirements under 49 CFR 223.9(d)(1), and 49 CFR 223.9(d)(2), respectively, require that instructional signage describing emergency removal procedures be provided at the emergency window locations on both the inside and the outside of the railcar. Metrolink representatives told investigators that the intermediate level of the railcars is not considered a “main” level; hence, the exterior emergency windows at that level of the railcars were not required to have instructional signage.

Analysis 33 Railroad Accident Report Since the accident, Metrolink has taken steps to install such instructional signage on this series of railcar (a later delivery series had such signage installed) and is testing an emergency window design that will allow responders to remove intermediate-level windows from the outside without breaking them. The Safety Board is encouraged that Metrolink is taking prompt action to improve emergency access to its railcars but is concerned that passengers and crew riding on other railroads in the intermediate level of this type of railcar,42 may not be afforded the same degree of emergency access protection that is afforded to persons riding in the main level of that same railcar. The Safety Board therefore believes that the FRA should revise the language of 49 CFR 238.113(a)(1) to reflect that appropriate exterior instructional signage describing the emergency removal procedure be required at emergency windows on all levels of a multiple-level passenger railcar. Emergency Response The initial notification to local emergency response resources occurred within 1 minute, and personnel were dispatched and en route almost immediately. Arrival of responders on scene occurred within about 3 minutes of dispatch. A mass casualty incident command system was established, and additional mutual aid resources were diverted to the scene from a scheduled training drill as support. Records indicate that all immediate transport priority injured persons were extricated, triaged, stabilized, and transported from the scene within about 1 hour of the initial response. All remaining injured were transported from the scene within about 2 hours. The Safety Board therefore concludes that the emergency response to this incident was timely, effective, and appropriate to the incident. Positive Train Control The Safety Board is concerned about the safety of railroad operations when backup systems are not available to intervene if a train crew operates a train improperly or fails to comply with wayside signals. Safety Board railroad accident investigations over the past 30 years have shown conclusively that the most effective way to avoid train-to- train collisions is through the use of positive train control systems that will automatically assume some control of a train when the train crew does not comply with the requirements of a signal indication. In fact, positive train control has been on the Safety Board’s list of “Most Wanted” transportation safety improvements since the list was developed in 1990.43 42 Approximately 300 railcars. 43 The Safety Board developed the “Most Wanted” list, drawn up from previously issued safety recommendations, to bring special emphasis to the safety issues the Board deems most critical. The Most Wanted list is reviewed, revised, and reissued as needed, or at least annually.

Analysis 34 Railroad Accident Report Most recently, in its investigation of the previously referenced May 28, 2002, collision of two BNSF freight trains near Clarendon, Texas, the Safety Board determined that the accident would have been prevented if an operational positive train control system had been in place on that section of track. Similarly, had such a system been in place and operational on the territory where the Placentia accident occurred, it would have intervened when the engineer failed to slow his train in response to the approach signal and would have stopped the train short of the stop signal. The Safety Board concludes that had a fully implemented positive train control system been in place on the BNSF San Bernardino Subdivision at the time of the accident, the system would have intervened to stop the freight train before it could enter the track area occupied by Metrolink 809, and the collision would not have occurred. Since 1969, the Safety Board has issued a number of safety recommendations related to positive train control. The most recent safety recommendation was issued as a result of the Safety Board’s investigation of a train collision involving three freight trains in Bryan, Ohio.44 That recommendation, issued to the FRA, was as follows: R-01-6 Facilitate actions necessary for development and implementation of positive train control systems that include collision avoidance, and require implementation of positive train control systems on main line tracks, establishing priority requirements for high-risk corridors such as those where commuter and intercity passenger railroads operate. In a response to the Safety Board’s request for an update on the status of this recommendation, which is currently classified “Open–Acceptable Response,” the FRA administrator, in a May 5, 2003, letter to the Safety Board, stated: FRA is doing everything within its power to prepare the way for PTC [positive train control] and encourage its rapid deployment. FRA shares the Board’s disappointment that certain aspects of this work have not proceeded as rapidly as projected. For instance, the Association of American Railroads has yet to provide standards for interoperability of PTC systems. Nevertheless, we remain convinced that the momentum achieved to date, together with the strong potential for PTC technology to support other business needs, will result in the safety advances that we both seek. In the letter, the FRA stated that it was “moving forward across a broad front to create the conditions under which [positive train control] systems can be more widely deployed on the national rail system.” The FRA provided the following examples of its support for the demonstration and deployment of candidate positive train control technologies: On the Northeast Corridor (NEC), FRA has issued an order requiring installation 44 National Transportation Safety Board, Collision Involving Three Consolidated Rail Corporation Freight Trains Operating in Fog at Bryan, Ohio, January 17, 1999, Railroad Accident Report NTSB/RAR- 01/01 (Washington, D.C.: NTSB, 2001).

Analysis 35 Railroad Accident Report and use of the Advanced Civil Speed Enforcement System (ACSES) where Amtrak has sought to increase speeds in order to reduce trip times. ACSES, working in concert with existing Automatic Train Control system[s], provides PTC core functions. New Jersey Transit has responded by developing a similar, interoperable system it is presently deploying. These new train control systems are now in service and are being rolled out progressively to larger territories within the NEC. Amtrak’s ownership and dispatching role over much of the corridor has made this process feasible. On Amtrak’s Michigan line, FRA has joined with Amtrak and the State of Michigan to develop and install the Incremental Train Control System (ITCS), which currently supports train speeds to 90 mph. Working with the State of Illinois, the Union Pacific Railroad, Amtrak, and the Association of American Railroads, FRA is a funding partner in the North American Joint PTC program. FRA’s Office of Safety is presently reviewing the first of the final safety documents constituting the Product Safety Plan for this systemin effect, making the first use of the proposed regulatory structure described above even before a final rule is issued. This system is the most technically ambitious of the PTC projects to date and will play a key role in convincing a skeptical railroad industry that a central-office PTC architecture can succeed by meeting the dual tests of safety and availability (reliability)…. FRA is working with the CSX [Railroad], Burlington Northern Santa Fe Railway, and the Alaska Railroad on additional ‘overlay’ systems that show potential for significant safety gains at reduced cost. According to the railroads, each intends to pursue the possibility of broad application of the technology. FRA’s role is to provide needed regulatory relief, technical assistance, and encouragement, as well as to raise appropriate safety issuesparticularly with respect to human factors. FRA has also provided funding towards both the BNSF and the Alaska Railroad projects. While the Safety Board understands that positive train control development is complex and expensive, the Board remains convinced that these systems provide the best approach to reduce human-error collisions. While the Safety Board is aware of the BNSF program to develop a train collision avoidance system, the Safety Board remains concerned that it has taken so long for the FRA to require and for the railroad industry to develop and implement such systems. Therefore, the Safety Board reiterates Safety Recommendation R-01-6 to the FRA. As noted in the FRA letter, one of the issues hindering development and deployment of positive train control systems is the lack of standards for interoperability. Such standards are necessary to ensure that the effectiveness of positive train control systems is not compromised by the sharing of locomotive units that is common among railroads. The Association of American Railroads is working with railroad industry representatives to formulate the interoperability standards, but progress thus far has been slow. The Safety Board is vitally interested in this issue and therefore believes that the Association of American Railroads should report to the Safety Board the milestones and activities needed for completion of the interoperability standards for positive train control systems and its priorities for completion of this effort.

36 Railroad Accident Report Conclusions Findings 1. There was no evidence of fatigue impairment or alcohol or drug use in this accident, and the following factors were neither causal nor contributory to the accident: weather, signal visibility, and signal or train braking system malfunction. 2. The BNSF 5340 train crew were insufficiently attentive to the operation of their train, with the result that they failed to see, identify, and respond appropriately to the approach signal indication at MP 42.31. 3. Had the BNSF 5340 crew operated their train in accordance with the signal indications, the accident would not have occurred. 4. Had a fully implemented positive train control system been in place on the Burlington Northern Santa Fe’s San Bernardino Subdivision at the time of the accident, the system would have intervened to stop the freight train before it could enter into the track area occupied by Metrolink 809, and the collision would not have occurred. 5. Had the BNSF 5340 conductor been more actively involved by entering clear signals on his signal awareness form at the time he observed them, his awareness of signal indications may have been increased, and he may not have misidentified an approach signal as clear. 6. The two fatal injuries and many of the serious abdominal injuries to passengers throughout the Metrolink train likely resulted from impact with the workstation table edges. 7. The absence of exterior instructional signage on emergency exit windows of the Metrolink cars could hinder emergency response in future accidents, particularly in a scenario in which first responders might be untrained and ill-equipped civilian “good Samaritans.” 8. The emergency response to this incident was timely, effective, and appropriate to the incident.

Conclusions 37 Railroad Accident Report Probable Cause The National Transportation Safety Board determines that the probable cause of the April 23, 2002, collision of a Burlington Northern Santa Fe freight train and a Metrolink commuter train in Placentia, California, was the freight train crew’s inattentiveness to the signal system and their failure to observe, recognize, and act on the approach signal at milepost 42.31. Contributing to the accident was the absence of a positive train control system that would have automatically stopped the freight train short of the stop signal and thus prevented the collision.

38 Railroad Accident Report Recommendations As a result of its investigation of the April 23, 2002, collision of a Burlington Northern Santa Fe freight train and a Metrolink commuter train in Placentia, California, the National Transportation Safety Board makes the following safety recommendations: New Recommendations To the Federal Railroad Administration: Revise the language of 49 Code of Federal Regulations 238.113(a)(1) to reflect that appropriate exterior instructional signage describing the emergency removal procedure be required at emergency windows on all levels of a multiple-level passenger railcar. (R-03-21) To the Burlington Northern Santa Fe Railway Company: Revise your signal awareness form procedure to require recording of time, speed, and aspect name for all signals encountered at the time they are encountered. (R-03-22) To the Association of American Railroads: Report to the National Transportation Safety Board the milestones and activities needed for completion of the interoperability standards for positive train control systems and your priorities for completion of this effort. (R-03-23) Recommendation Reiterated in This Report The National Transportation Safety Board reiterates the following safety recommendation to the Federal Railroad Administration: R-01-6 Facilitate actions necessary for development and implementation of positive train control systems that include collision avoidance, and require implementation of positive train control systems on main line tracks, establishing priority requirements for high-risk corridors such as those where commuter and intercity passenger railroads operate.

Recommendations 39 Railroad Accident Report BY THE NATIONAL TRANSPORTATION SAFETY BOARD Ellen G. Engleman Mark V. Rosenker Chairman Vice Chairman John J. Goglia Member Carol J. Carmody Member Richard F. Healing Member Adopted: October 7, 2003

this page intentionally left blank

41 Railroad Accident Report Appendix A Investigation The National Transportation Safety Board was notified of the Placentia, California, accident about 11:39 a.m., eastern standard time, on April 23, 2002, and dispatched a major railroad accident investigation team to the accident scene. Investigative groups examined the operation, track, signals, communications, mechanical, survival factors, human performance, and event recorder aspects of the accident. Then- Chairman Marion Blakey was on the scene during the on-site investigation. Parties to the investigation were the Federal Railroad Administration, the California Public Utilities Commission, Amtrak, Bombardier Transportation Company, the Burlington Northern Santa Fe Railway, Metrolink, the Brotherhood of Locomotive Engineers, the Brotherhood of Railroad Signalmen, the United Transportation Union, Orange County Fire Authority, and the Placentia Police Department. No public hearings or depositions were held in connection with this accident.

this page intentionally left blank

FD07285 ｜ 2004_美国_AAR0401.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2004 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Loss of Pitch Control During Takeoff Air Midwest Flight 5481 Raytheon (Beechcraft) 1900D, N233YV Charlotte, North Carolina January 8, 2003 Aircraft Accident Report NTSB/AAR-04/01 PB2004-910401 Notation 7545B National Transportation Safety Board Washington, D.C.

this page intentionally left blank

Aircraft Accident Report Loss of Pitch Control During Takeoff Air Midwest Flight 5481 Raytheon (Beechcraft) 1900D, N233YV Charlotte, North Carolina January 8, 2003 NTSB/AAR-04/01 PB2004-910401 National Transportation Safety Board Notation 7545B 490 L’Enfant Plaza, S.W. Adopted February 26, 2004 Washington, D.C. 20594 E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N

National Transportation Safety Board. 2004. Loss of Pitch Control During Takeoff, Air Midwest Flight 5481, Raytheon (Beechcraft) 1900D, N233YV, Charlotte, North Carolina, January 8, 2003. Aircraft Accident Report NTSB/AAR-04/01. Washington, DC. Abstract: This report explains the accident involving Air Midwest (doing business as US Airways Express) flight 5481, a Raytheon (Beechcraft) 1900D, N233YV, which crashed shortly after takeoff from Charlotte-Douglas International Airport, Charlotte, North Carolina. The safety issues discussed in this report include maintenance work practices, oversight, and quality assurance; maintenance training; aircraft weight and balance programs; Federal Aviation Administration oversight; and cockpit voice recorders on Beech 1900D airplanes. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2004-910401 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Aircraft Accident Report Contents Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x

1. Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
2. 1

History of Flight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.1.1 Maintenance Events Preceding the Accident Flight . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.2 Injuries to Persons. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.3 Damage to Airplane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.4 Other Damage. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.5 Personnel Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.5.1 The Captain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.5.2 The First Officer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.5.3 The Maintenance Personnel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1.5.3.1 The Quality Assurance Inspector. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1.5.3.2 The Foreman . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 1.5.3.3 The Mechanic. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 1.5.3.4 The Raytheon Aerospace Site Manager. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 1.5.3.5 The Air Midwest Regional Site Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 1.6 Airplane Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 1.6.1 Pitch Control System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 1.6.1.1 Pitch Trim Control System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 1.6.2 Maintenance Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 1.6.3 Elevator Control System Rigging Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 1.6.3.1 Rigging Procedure at the Time of the Accident. . . . . . . . . . . . . . . . . . . . . . . . . . 20 1.6.3.2 Applicable Steps That Were Skipped During Maintenance . . . . . . . . . . . . . . . . 22 1.6.3.3 Revised Rigging Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 1.6.4 Weight and Balance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 1.7 Meteorological Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 1.8 Aids to Navigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 1.9 Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 1.10 Airport Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 1.10.1 Aircraft Rescue and Firefighting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 1.10.2 Air Traffic Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 1.11 Flight Recorders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 1.11.1 Cockpit Voice Recorder. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 1.11.1.1 Safety Recommendations A-97-36 and A-02-25. . . . . . . . . . . . . . . . . . . . . . . . . 32 1.11.2 Flight Data Recorder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 1.11.2.1 Flight Data Recorder Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 1.12 Wreckage and Impact Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 1.12.1 General Wreckage Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 1.12.2 Fuselage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 1.12.3 Engines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 1.12.4 Pitch Control System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Contents iv Aircraft Accident Report 1.12.4.1 Pitch Trim Control System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 1.13 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 1.14 Fire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 1.15 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 1.15.1 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 1.16 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 1.16.1 Ground Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 1.16.1.1 Baseline Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 1.16.1.2 Turnbuckle Length Adjustments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 1.16.1.3 Cable Tension Adjustment Procedural Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 1.16.1.4 Cable Stretch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 1.16.2 Airplane Performance Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 1.16.2.1 Flight 5481 Weight and Balance Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 1.16.2.1.1 Air Midwest Weight and Balance Program . . . . . . . . . . . . . . . . . . . . . . . . . 44 1.16.2.1.2 Airplane Component Buildup Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 1.16.2.1.3 Takeoff Ground Roll Weight Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 1.16.2.2 Load Manifest Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 1.16.2.3 Elevator Control Authority Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 1.16.2.3.1 Relationship Between Pitch Control Position and Actual Elevator Position . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 1.16.2.3.2 Available Elevator Travel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 1.16.2.4 Beech 1900D Simulation Studies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 1.16.2.4.1 Elevator Required to Match Accident Flight Data . . . . . . . . . . . . . . . . . . . . 51 1.16.2.4.2 Elevator Required to Establish Controlled Flight . . . . . . . . . . . . . . . . . . . . . 52 1.16.2.4.3 Kinematics Extraction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 1.16.2.4.4 Simulator Trims. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 1.17 Organizational and Management Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 1.17.1 Air Midwest . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 1.17.1.1 Air Midwest Maintenance Training Program . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 1.17.1.2 Huntington Maintenance Station Operations. . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 1.17.1.3 Air Midwest Audits of the Huntington Maintenance Station . . . . . . . . . . . . . . . 58 1.17.1.4 Postaccident Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 1.17.2 Raytheon Aerospace. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 1.17.2.1 Contract Between Raytheon Aerospace and Air Midwest . . . . . . . . . . . . . . . . . 62 1.17.3 Structural Modification and Repair Technicians . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 1.17.3.1 Contract Between Structural Modification and Repair Technicians and Raytheon Aerospace . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 1.17.4 Federal Aviation Administration Oversight. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 1.17.4.1 Continuing Analysis and Surveillance System . . . . . . . . . . . . . . . . . . . . . . . . . . 65 1.17.4.2 Correspondence From the Federal Aviation Administration to Air Midwest. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 1.17.5 Raytheon Aircraft Company . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 1.18 Additional Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 1.18.1 Weight and Balance Procedures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 1.18.1.1 Federal Aviation Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 1.18.1.1.1 Postaccident Average Weight Survey . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 1.18.1.2 Air Midwest . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 1.18.1.2.1 Postaccident Weight and Balance Revisions. . . . . . . . . . . . . . . . . . . . . . . . . 74 1.18.1.3 US Airways Express . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

Contents v Aircraft Accident Report 1.18.2 Federal Aviation Administration Emergency Airworthiness Directive 2003-03-18 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 1.18.3 Federal Aviation Administration Guidance for On-the-Job Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 1.18.4 Other Related Accidents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 1.18.4.1 Ryan Air Service Flight 103, Homer, Alaska . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 1.18.4.2 ValuJet Airlines Flight 592, Everglades, Near Miami, Florida. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 1.18.4.2.1 Safety Recommendation A-97-70. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 1.18.4.2.2 Safety Recommendation A-97-74. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 1.18.4.3 Fine Airlines Flight 101, Miami, Florida. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 1.18.4.3.1 Safety Recommendation A-98-49. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 1.18.4.4 Emery Airlines Flight 17, Rancho Cordova, California . . . . . . . . . . . . . . . . . . . 84 1.18.4.4.1 Safety Recommendation A-03-31. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 1.18.4.5 Colgan Air Flight 9446, Yarmouth, Massachusetts. . . . . . . . . . . . . . . . . . . . . . . 85 1.18.4.5.1 Federal Aviation Administration Airworthiness Directive 2003-20-10. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 1.18.4.6 CommutAir Flight 8718, Albany, New York . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 1.18.5 Human Factors Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 1.18.6 Other Passenger and Baggage Weight Information . . . . . . . . . . . . . . . . . . . . . . . . . 90 1.18.6.1 Civil Aviation Authority Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 1.18.6.2 Australian Department of Transport and Communications Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 1.18.6.3 Civil Aviation Authority of New Zealand Survey. . . . . . . . . . . . . . . . . . . . . . . . 92

1. Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
2. 1

General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 2.2 Loading and Preflight Activities. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 2.3 Restricted Downward Elevator Travel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 2.3.1 Conspicuity of the Elevator Control System Misrig . . . . . . . . . . . . . . . . . . . . . . . . 97 2.3.2 Adequacy of On-the-Job Training Provided to the Mechanic. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 2.3.3 Skipped Steps in the Elevator Control System Rigging Procedure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 2.3.4 Lack of an Effective Postmaintenance Check . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 2.4 Aft Center of Gravity and Its Effect on the Restricted Elevator Travel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 2.4.1 Air Midwest’s Weight and Balance Programs. . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 2.5 Organizational and Management Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 2.5.1 Air Midwest . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 2.5.1.1 Required Inspection Item Maintenance Tasks and Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 2.5.1.2 Maintenance Training Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 2.5.1.2.1 Maintenance Training Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 2.5.1.2.2 Maintenance Training Oversight. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 2.5.1.3 Continuing Analysis and Surveillance System Program . . . . . . . . . . . . . . . . . . 111 2.5.1.4 Detail 6 Inspection Procedures Checklist . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 2.5.2 Federal Aviation Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 2.5.2.1 Oversight of Air Midwest . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

Contents vi Aircraft Accident Report 2.5.2.2 Oversight of Continuing Analysis and Surveillance System Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 2.5.2.3 Oversight of Maintenance Training Programs. . . . . . . . . . . . . . . . . . . . . . . . . . 119 2.5.2.3.1 Programs to Reduce Human Error in Aircraft Maintenance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 2.5.2.4 Oversight of Weight and Balance Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 2.5.2.4.1 Approval of Air Midwest’s Weight and Balance Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 2.5.2.4.2 Use of Average Weights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 2.5.2.4.3 Technological Advances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 2.5.3 Raytheon Aircraft Company . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 2.6 Cockpit Voice Recorders Installed in Beech 1900 Series Airplanes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

1. Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
2. 1

Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 3.2 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

1. Recommendations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
2. 1

New Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 4.2 Previously Issued Recommendation Reiterated in This Report . . . . . . . . . . . . . . . . . . 135 4.3 Previously Issued Recommendation Resulting From This Accident Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 4.4 Previously Issued Recommendation Classified in This Report . . . . . . . . . . . . . . . . . . 135

1. Appendixes

A: Investigation and Hearing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 B: Cockpit Voice Recorder Transcript . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 C: Air Midwest’s Elevator Control System Rigging Procedure at the Time of the Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192 D: Air Midwest’s Revised Elevator Control System Rigging Procedure . . . . . . . . . . . . . . . . 200

vii Aircraft Accident Report Figures

1. Detail six work card at the time of the accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2. Aircraft maintenance record of nonroutine items for January 6, 2003, at the Huntington,

West Virginia, maintenance station. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

1. Beech 1900D pitch control system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
2. Side view of Beech 1900D tail section. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3. Turnbuckle assemblies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
4. Turnbuckles as found in the wreckage. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
5. Weight and center of gravity information for flight 5481. . . . . . . . . . . . . . . . . . . . . . . . . . . 47
6. Flight data recorder pitch control and pitch trim control positions. . . . . . . . . . . . . . . . . . . . 49
7. Elevator travel available before and after the detail six maintenance check. . . . . . . . . . . . . 51
8. Organizational structure of Air Midwest’s Huntington, West Virginia, maintenance station

operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

1. Flight 5481 weight and center of gravity information compared with flight 103 weight and

center of gravity information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

viii Aircraft Accident Report Abbreviations A&P airframe and powerplant AC advisory circular AD airworthiness directive AFFF aqueous film forming foam AFT1 forward (cargo compartment) AFT2 aft (cargo compartment) ALB Albany International Airport AMM Airliner Maintenance Manual AMT aviation maintenance technician AND airplane nose down ANU airplane nose up ARFF aircraft rescue and firefighting ASOS automated surface observing system ATC air traffic control ATCT air traffic control tower C Celsius CAA Civil Aviation Authority CASS Continuing Analysis and Surveillance System CFD City of Charlotte Fire Department CFR Code of Federal Regulations CG center of gravity CLT Charlotte-Douglas International Airport CVR cockpit voice recorder D6 detail six (maintenance check) F Fahrenheit FAA Federal Aviation Administration FARs Federal Aviation Regulations FDR flight data recorder FSDO Flight Standards District Office GSP Greenville-Spartanburg International Airport Hg mercury HTS Tri-State/Milton J. Ferguson Field, Huntington, West Virginia

Abbreviations ix Aircraft Accident Report JAA Joint Aviation Authorities (European) JARs Joint Aviation Regulations LYH Lynchburg Regional Airport/Preston Glenn Field METAR meteorological aerodrome report msl mean sea level OAT outside air temperature OJT on-the-job training PAI principal avionics inspector PIC pilot-in-command PMI principal maintenance inspector POI principal operations inspector RALLC Raytheon Aerospace, LLC RAMS Regional Airline Maintenance Service RASIP Regional Aviation Safety Inspection Program RDU Raleigh-Durham International Airport RII required inspection item SB service bulletin SMART Structural Modification and Repair Technicians, Inc. STAN Sum Total Aft and Nose system TRACON terminal radar approach control TTS Tennessee Technical Services UTC coordinated universal time VHF very high frequency

x Aircraft Accident Report Executive Summary On January 8, 2003, about 0847:28 eastern standard time, Air Midwest (doing business as US Airways Express) flight 5481, a Raytheon (Beechcraft) 1900D, N233YV, crashed shortly after takeoff from runway 18R at Charlotte-Douglas International Airport, Charlotte, North Carolina. The 2 flight crewmembers and 19 passengers aboard the airplane were killed, 1 person on the ground received minor injuries, and the airplane was destroyed by impact forces and a postcrash fire. Flight 5481 was a regularly scheduled passenger flight to Greenville-Spartanburg International Airport, Greer, South Carolina, and was operating under the provisions of 14 Code of Federal Regulations Part 121 on an instrument flight rules flight plan. Visual meteorological conditions prevailed at the time of the accident. The National Transportation Safety Board determines that the probable cause of this accident was the airplane’s loss of pitch control during takeoff. The loss of pitch control resulted from the incorrect rigging of the elevator control system compounded by the airplane’s aft center of gravity, which was substantially aft of the certified aft limit. Contributing to the cause of the accident were (1) Air Midwest’s lack of oversight of the work being performed at the Huntington, West Virginia, maintenance station; (2) Air Midwest’s maintenance procedures and documentation; (3) Air Midwest’s weight and balance program at the time of the accident; (4) the Raytheon Aerospace quality assurance inspector’s failure to detect the incorrect rigging of the elevator control system; (5) the Federal Aviation Administration’s (FAA) average weight assumptions in its weight and balance program guidance at the time of the accident; and (6) the FAA’s lack of oversight of Air Midwest’s maintenance program and its weight and balance program. The safety issues in this report focus on maintenance work practices, oversight, and quality assurance; aircraft weight and balance programs; maintenance training; FAA oversight; and Beech 1900 cockpit voice recorder problems. Safety recommendations concerning these issues are addressed to the FAA.

1 Aircraft Accident Report 1. Factual Information 1.1 History of Flight On January 8, 2003, about 0847:28 eastern standard time,1 Air Midwest (doing business as US Airways Express) flight 5481, a Raytheon (Beechcraft) 1900D,2 N233YV, crashed shortly after takeoff from runway 18R at Charlotte-Douglas International Airport (CLT), Charlotte, North Carolina. The 2 flight crewmembers and 19 passengers aboard the airplane were killed, 1 person on the ground received minor injuries, and the airplane was destroyed by impact forces and a postcrash fire. Flight 5481 was a regularly scheduled passenger flight to Greenville-Spartanburg International Airport (GSP), Greer, South Carolina, and was operating under the provisions of 14 Code of Federal Regulations (CFR) Part 121 on an instrument flight rules flight plan. Visual meteorological conditions prevailed at the time of the accident. The accident airplane had been flown from the Tri-State/Milton J. Ferguson Field, Huntington, West Virginia (HTS), to CLT on January 7, 2003 (the day before the accident). Air Midwest records indicated that the accident pilots flew the accident airplane on six flight legs that day. The first officer (the nonflying pilot) of the flight from HTS to CLT told the accident first officer, when handing off the airplane, that “everything was normal” and “it was a good flying airplane.” The accident pilots began their trip sequence about 1340 and ended their trip sequence at CLT about 2045. Another flight crew met the accident airplane for a trip that night from CLT to Lynchburg Regional Airport/Preston Glenn Field (LYH), Lynchburg, Virginia. That flight crew flew the accident airplane back to CLT the next morning (January 8th), arriving at 0715. According to postaccident interviews, neither the captain nor the first officer of those two flight legs noticed anything unusual about the airplane. On January 8, 2003, the accident flight crew was scheduled to fly two flight legs on a 1-day trip sequence—CLT to GSP and GSP to Raleigh-Durham International Airport (RDU), Raleigh-Durham, North Carolina—and then to travel on duty as passengers from RDU to CLT. An Air Midwest pilot saw the captain in the gate area about 0745 and the first officer about 0800. The dispatch release for flight 5481 showed that a maximum of 32 bags was allowed on the flight. One of the two ramp agents3 working flight 5481 stated, in a postaccident interview, that 23 bags had been checked and that 8 bags were carried on the 1 Unless otherwise indicated, all times in this report are eastern standard time based on a 24-hour clock. 2 Raytheon Aircraft Company acquired Beech Aircraft Corporation in February 1980. 3 The ramp agents working this flight were employees of Piedmont Airlines, which runs US Airways Express ground operations at CLT.

Factual Information 2 Aircraft Accident Report airplane. The ramp agent stated that two of the checked bags were heavy, with an estimated weight of between 70 and 80 pounds. The ramp agent also stated that he told the captain that some of the bags were heavy, although they were not marked as such. According to the ramp agent, the captain indicated that the bags were fine because a child would be on board, which would allow for the extra baggage weight.4 The ramp agent estimated that the forward cargo compartment was about 98 percent full by volume.5 Cockpit voice recorder (CVR) information early in the recording indicated that the flight crew was completing the preflight paperwork regarding the airplane’s weight and balance. Air Midwest records indicated that flight 5481 departed the gate on time about 0830. The captain was the flying pilot, and the first officer was the nonflying pilot. Flight data recorder (FDR) data indicated that, beginning about 0835:16, the flight crew performed a control check of the elevators.6 The pitch control position parameter, which measures the position of the control column, recorded values from 15º ANU to 16.5º AND.7 These values corresponded to elevator positions from full ANU to 7º AND. About 0837:20, the CVR recorded the first officer contacting the CLT Air Traffic Control Tower (ATCT) ground controller and informing him that flight 5481 was ready to taxi. The ground controller instructed the flight crew to taxi to runway 18R. About 0846:18, the tower (local) controller cleared flight 5481 for takeoff and instructed the flight crew to turn right to a heading of 230º after takeoff. About 0846:35, the captain asked the first officer to set the takeoff power, and the first officer stated that the power had been set. About 0846:48, the airplane’s airspeed was above 102 knots,8 and the elevator position was 7º AND. About 3 seconds later, the elevator position was 1º AND, and the pitch attitude of the airplane began to increase. After 0846:53, the pitch trim started moving AND, and, about 3 seconds later, the captain called for the landing gear to be retracted. About 0846:57, the elevator position returned to 7º AND, and, about 2 seconds later, the CVR recorded the sound of the landing gear retracting. 4 In calculating the weight and balance of the airplane, the flight crew used Air Midwest’s standard adult weight figure (175 pounds) for this child, who was 12 years of age. 5 A cargo net separates the forward (AFT1) cargo compartment from the aft (AFT2) cargo compartment. A ramp agent stated that the cargo net was in place before the accident flight. 6 An elevator is an aerodynamic control surface hinged to the back of the horizontal stabilizer. An elevator moves up and down to control the airplane’s wing angle of attack, pitch, and climb. Normal elevator travel for the Beech 1900D is from 20º to 21º airplane nose up (ANU) to 14º to 15º airplane nose down (AND), and the elevator neutral position is 0º. The elevator control check in the Beech 1900D involves moving the control column from the full forward position to the full aft position. 7 In a properly rigged elevator control system, the FDR pitch control position parameter accurately reflects the elevator position. For the accident flight, however, the recorded pitch control positions did not reflect the actual elevator positions. The recorded pitch control positions were about 9º more AND than the actual elevator positions. For more information on this 9º AND shift, see sections 1.11.2.1, 1.16.1.2, and 1.16.2.3. In this section, all references to elevator positions reflect the actual elevator positions. 8 According to Air Midwest’s Beech 1900D Performance Manual, the rotation speed during takeoff is 105 knots.

Factual Information 3 Aircraft Accident Report About 0847:02, the first officer stated, “wuh,” and the captain stated, “oh.” About 0847:03, the captain stated, “help me.” At that point, the airplane was about 90 feet above ground level, and FDR data showed that the airplane’s pitch attitude was 20º ANU and airspeed was 139 knots. About 0847:04, the CVR recorded the captain asking, “you got it?” and FDR data indicated that the flight crew was forcefully commanding AND. During the next 8 seconds, the CVR recorded multiple statements and sounds from both flight crewmembers associated with their efforts to push the airplane’s nose down. Also, about 0847:09, the CVR recorded a change in engine/propeller noise and, about 1 second later, the beginning of a sound similar to the stall warning horn. About 0847:13, the FDR recorded a maximum pitch attitude of 54º ANU. About 0847:16, the captain radioed the ATCT and stated, “we have an emergency for Air [Midwest] fifty four eighty one,” and the CVR recorded the end of the sound similar to the stall warning horn. About 0847:18, the airplane’s pitch attitude decreased through 0º, and the elevator position began to move ANU. By 0847:19, the airplane was about 1,150 feet above ground level, and the FDR recorded a maximum left roll of 127º and a minimum airspeed of 31 knots. About 1 second later, the FDR recorded a pitch attitude of 42º AND. About 0847:21, the captain stated, “pull the power back,” the elevator position reached full ANU, and the airplane’s pitch attitude was 39º AND. At 0847:21.7, the CVR recorded the beginning of a sound similar to the stall warning horn, which continued to the end of the recording. About 0847:22, the airplane’s roll attitude stabilized at about 20º left wing down; the pitch attitude began to increase; and the elevator position moved in the AND direction, reaching about 8º ANU. About 1 second later, the elevator position began moving in the ANU direction. About 0847:24 the airplane rolled right through wings level, and the pitch attitude increased to about 5º AND. About 0847:26, the FDR recorded a maximum right roll of 68º and a maximum vertical acceleration of 1.9 Gs.9 About the same time, the captain stated, “oh my god ahh,” and the first officer stated something similar to, “uh uh god ahh [expletive].” The CVR recording ended at 0847:28.1. The FDR’s last recorded pitch attitude was 47º AND; roll attitude was 66º to the right; and pitch control position was 19.2º ANU, which corresponded to an elevator position of full ANU. The airplane struck a US Airways maintenance hangar on CLT property and came to rest about 1,650 feet east of the runway 18R centerline and about 7,600 feet beyond the runway 18R threshold. ATCT controllers heard an emergency locator transmitter signal beginning about 0847:29.10 The accident occurred at 35º 12' 25" north latitude and 80º 56' 46.85" west longitude during daylight hours. 9 One G is equivalent to the acceleration caused by the earth’s gravity (32.174 feet/second2). 10 See section 1.10.2 for information about the tower controllers’ observations regarding the accident flight.

Factual Information 4 Aircraft Accident Report 1.1.1 Maintenance Events Preceding the Accident Flight Between the night of January 6 and the morning of January 7, 2003, the accident airplane underwent a detail six (D6) maintenance check11 at Air Midwest’s HTS maintenance station. Air Midwest contracted with Raytheon Aerospace, LLC (RALLC),12 to provide mechanics, quality assurance inspectors, and a site manager for the HTS maintenance station. RALLC contracted with Structural Modification and Repair Technicians, Inc. (SMART), to supply the mechanic workforce. The RALLC quality assurance inspector on duty the night of January 6th was providing on-the-job training (OJT) to two SMART mechanics on specific tasks associated with the D6 maintenance check. Neither mechanic had previously performed the complete D6 check. One of the mechanics receiving OJT was assigned to inspect and check the elevator control cable tension. The D6 inspection procedures checklist (also known as the D6 work card), dated August 25, 2000, indicated that the cable tension was to be checked according to the procedures in chapter 27 of the Raytheon Aircraft Beech 1900D Airliner Maintenance Manual (AMM), as shown in figure 1. The first step on the D6 work card indicated that a temperature reading needed to be taken (to determine the tension values at which the control cables should be set) but did not specify how to take the temperature.13 The work card showed that the mechanic recorded the temperature as 55º Fahrenheit (F). 11 The D6 maintenance check comprises an elevator check, a rudder check, and a trim tab check. 12 On June 20, 2003, RALLC changed its name to Vertex Aerospace, LLC. On December 1, 2003, L-3 Communications acquired Vertex Aerospace and named the new business unit L-3 Communications AeroTech, LLC. 13 In a postaccident interview, the mechanic stated that he obtained a temperature reading from the outside air temperature (OAT) gauge located beneath the captain’s side window, but the quality assurance inspector subsequently indicated that the temperature was actually read from an OAT gauge that was going to be installed on the accident airplane during the maintenance visit. The quality assurance inspector provided the Safety Board with the following written statement, dated February 25, 2003: “at the time the cable tensions were adjusted on A/C [aircraft] 233 [the accident airplane] the OAT gage [sic] reading was taken while it was laying on the top shelf of the podium. The podium was located at the nose of the A/C approximately 6 ft from the right avionics bay door.”

Factual Information 5 Aircraft Accident Report Figure 1. Detail six work card at the time of the accident.

Factual Information 6 Aircraft Accident Report The next step on the D6 work card indicated that the ANU and AND elevator cable tensions needed to be measured. The mechanic stated that he used a cable tensiometer to check the tension in each cable and determined that the average tension was too low. The mechanic stated that he then referred to the Beech 1900D AMM, Section 27-30-02, “Elevator Control Rigging – Maintenance Practices” (dated February 22, 2002). The mechanic indicated that he used the elevator cable tension graph in section 27-30-02 to determine the proper cable tension.14 The mechanic stated that he worked under the supervision of the quality assurance inspector to adjust the cables to the proper tension range. According to the D6 work card, the mechanic adjusted the ANU cable tension to 57 pounds and the AND cable tension to 62 pounds.15 The aircraft maintenance record of nonroutine items for January 6, 2003, indicated, in a discrepancy block, that the airplane’s elevator cable tension was low. A required inspection item (RII)16 stamp appeared in this block, as shown at the bottom of figure 2. The form also indicated, in a nature of action block, that the elevator cable tension was adjusted per section 27-30-02 and that the operations check was normal. The mechanic’s and quality assurance inspector’s stamps appeared in their respective blocks on the form. In addition, the mechanic’s OJT records indicated that he completed training on the entire D6 aft fuselage/empennage inspection procedure on January 7, 2003. The mechanic stated, during a postaccident interview, that he performed the elevator and rudder checks but not the trim tab check on the night of January 6th. 14 The elevator cable tension graph showed temperature readings (in Fahrenheit) along one axis, pounds of tension along the other axis, and a reference line for optimum cable tension. The mechanic stated that he plotted 55º F on the graph and determined that the optimum cable tension would be an average of 61 pounds for the ANU and AND cables. The graph indicated that the tension tolerance was ±8 pounds. As a result, the mechanic could have adjusted the average cable tension to between 53 and 69 pounds. 15 Section 27-30-02 indicated that the ANU and AND cable tensions were to be added and then divided by two so that the average tension of both cables was 66 ±8 pounds (with the elevators at neutral). According to the D6 work card, the average tension of the accident airplane’s cables was 59.5 pounds. 16 According to Air Midwest’s Maintenance Procedures Manual (dated November 9, 1999), “Required Inspection Items are items of maintenance and/or alteration that must be inspected before [the aircraft’s] return to service, including at least those items that could result in a failure, malfunction, or defect endangering the safe operation of the aircraft, if not performed properly.” The rigging of elevator cables is identified in the manual as an RII. According to 14 CFR 121.371(c), “no person may perform a required inspection if [that person] performed the item of work required to be inspected.”

Factual Information 7 Aircraft Accident Report Figure 2. Aircraft maintenance record of nonroutine items for January 6, 2003, at the Huntington, West Virginia, maintenance station.

Factual Information 8 Aircraft Accident Report In addition, the mechanic stated that, while adjusting the cable tension, he bypassed several steps of the complete elevator control system rigging procedure (section 27-30-02).17 The Beech 1900D AMM did not contain a stand-alone procedure for checking elevator cable tension, as called for on the D6 work card, or for adjusting elevator cable tension without rigging the entire elevator control system.18 The quality assurance inspector stated, during a postaccident interview, that he and the mechanic discussed which steps to bypass and that he allowed the mechanic to adjust only the cable tension. The accident airplane returned to service on the morning of January 7, 2003. The airplane flew a total of nine flight legs before the accident flight. 1.2 Injuries to Persons Table 1. Injury chart. Note: The minor injury involved a US Airways mechanic who was treated for smoke inhalation. 1.3 Damage to Airplane The airplane was destroyed by impact forces and a postcrash fire. 1.4 Other Damage The airplane struck a US Airways maintenance hangar located on CLT property. 17 Section 1.6.3.1 discusses this procedure, and section 1.6.3.2 discusses the applicable steps that the mechanic bypassed. 18 After the accident, Raytheon Aircraft Company issued a revised elevator control system rigging procedure (see section 1.6.3.3), and Air Midwest issued a revised D6 work card (see section 1.17.1.4). As with the procedure and work card at the time of the accident, the revised procedure and revised work card do not contain a stand-alone procedure for checking elevator cable tension or for adjusting elevator cable tension without rigging the entire elevator control system. Injuries Flight Crew Cabin Crew Passengers Other Total Fatal 2 0 19 0 21 Serious 0 0 0 0 0 Minor 0 0 0 1 1 None 0 0 0 0 0 Total 2 0 19 1 22

Factual Information 9 Aircraft Accident Report 1.5 Personnel Information 1.5.1 The Captain The captain, age 25, was hired by Air Midwest in March 2000. She held an airline transport pilot certificate and a Federal Aviation Administration (FAA) first-class medical certificate dated November 19, 2002, with no limitations. The captain received a type rating on the Beech 1900D in March 2001. The captain received her private pilot certificate in February 1997 while she was an aviation student at Louisiana Tech University, Ruston, Louisiana. From February 1999 to March 2000, the captain was a flight instructor and flight school supervisor at the university. The captain’s résumé for employment with Air Midwest indicated that she had accumulated 925 hours total flying time (625 of which were as pilot-in-command [PIC] and 101 hours of which were in a multiengine airplane) in Beech 76 and Cessna 152, 172, and 310 airplanes. Air Midwest records indicated that the captain had accumulated 1,865 hours total company flying time, including 1,100 hours as a Beech 1900D PIC. She had flown approximately 134, 32, and 6 hours in the 90 days, 30 days, and 24 hours, respectively, before the accident. The captain’s last Beech 1900D proficiency check occurred on August 20, 2002; her last recurrent ground school occurred on September 18, 2002; and her last line check occurred on November 26, 2002. FAA records indicated no accident or incident history or enforcement action, and a search of the National Driver Register database found no record of driver’s license suspension or revocation. In postaccident interviews, Air Midwest pilots who had flown with the captain made favorable comments about her piloting skills. A check airman stated that the captain had no difficulties during upgrade training and that she demonstrated very good knowledge of the airplane’s systems and very good judgment. Another check airman described the captain as one of the better company pilots and stated that she made very good decisions about flying. First officers stated that the captain was a thorough and methodical pilot who controlled the airplane well and involved them with the flight by asking for opinions and letting them review paperwork. The captain was single and lived in the Charlotte area. She was reported to be in good health. She did not smoke and would occasionally have a glass of wine with dinner. Her personal situation was reported to be stable and her financial situation to be adequate during the months preceding the accident. She was described by her boyfriend as “healthy, happy, and not tired” on the morning of the accident. Between 0810 and 1144 on January 5, 2003, the captain traveled on duty as a passenger from CLT to Key West, Florida, for a trip that originated there. From about 1230 to 2330, the captain flew six flight legs and accumulated about 6 hours of flight time. She arrived at her hotel about 0035 on January 6th and, from about 1130 to 1600, traveled on duty as a passenger from Key West to CLT.

Factual Information 10 Aircraft Accident Report On January 7, 2003, the captain was on reserve duty for the airline. She awoke between 0900 and 0930 and was notified by crew scheduling, about 1000, that she would be flying a six-leg trip sequence with the accident first officer. The first leg of the trip sequence was scheduled to depart about 1200 but did not depart until 1340. The last leg of the trip sequence was scheduled to arrive at CLT about 1910 but did not arrive until 2045. The captain accumulated 6 hours of flight time during the trip sequence. She went to bed that night about 2230 and awoke about 0625 on January 8th to get ready for that day’s trip sequence. 1.5.2 The First Officer The first officer, age 27, was hired by Air Midwest in May 2001. He held a commercial pilot license dated November 12, 2000, and an FAA first-class medical certificate dated December 10, 2002, with no limitations. From August 1999 to February 2001, the first officer was enrolled at San Juan College, Farmington, New Mexico, as part of the Mesa Airlines19 Pilot Development Program. On his application for employment with Air Midwest, the first officer reported that he had accumulated 390 hours total flying time in Beech 36, 58, and 1900; Aeronca Champion; and Citabria airplanes. Air Midwest records indicated that the first officer had accumulated 706 hours total company flying time on Beech 1900D airplanes. He had flown approximately 210, 59, and 6 hours in the 90 days, 30 days, and 24 hours, respectively, before the accident. The first officer’s last line check occurred on August 20, 2001, and his initial Beech 1900D proficiency check occurred on May 4, 2002. FAA records indicated no accident or incident history or enforcement action, and a search of the National Driver Register database found no record of driver’s license suspension or revocation. In postaccident interviews, Air Midwest pilots who had flown with the first officer made favorable comments about his piloting skills. Pilots described the first officer as a talented and very precise pilot with good attention to detail and good communication skills. Pilots also stated that the first officer possessed good situational awareness and good knowledge of the Beech 1900D. The first officer was single and lived in the Charlotte area. He was reported to be in excellent health. He did not smoke and consumed alcohol occasionally in social settings. His personal and financial situations during the months preceding the accident were reported to be stable. On January 5, 2003, the first officer was off duty until 2035, when he departed CLT for a flight to LYH, which arrived about 2130. About 0620 on January 6th, the first officer flew back to CLT, arriving about 0715. On January 7th, the first officer flew the 19 Mesa Airlines is one of four airline liveries operated by Mesa Air Group, Inc., which is the parent company of Air Midwest. See section 1.17.1 for more information.

Factual Information 11 Aircraft Accident Report same trip sequence as the accident captain. The times that the first officer went to sleep on the night of January 7th and awoke on January 8th are not known. 1.5.3 The Maintenance Personnel Sections 1.5.3.1 through 1.5.3.3 provide information about the three HTS maintenance personnel who were involved with the maintenance of the accident airplane’s elevator control system. Sections 1.5.3.4 and 1.5.3.5 provide information about the HTS maintenance managers. For additional information about the maintenance personnel and the maintenance managers, see sections 1.17.1 through 1.17.3. 1.5.3.1 The Quality Assurance Inspector The quality assurance inspector, age 50, was hired by RALLC in July 2002. He was initially hired as a mechanic at the HTS maintenance station and was subsequently promoted to foreman and secondary (backup) quality assurance inspector.20 He received his airframe and powerplant (A&P) certificate in January 1985. On his application for employment with RALLC, the quality assurance inspector reported that he had between 3 and 4 years of aviation maintenance experience with light general aviation airplanes. From about 1988 to July 1999, the quality assurance inspector was not employed in the aviation maintenance field. Between July 1999 and October 2001, the quality assurance inspector worked on Beech 1900D airplanes at the maintenance station at Dubois Jefferson County Airport, Dubois, Pennsylvania. (He was employed at the Dubois maintenance station by Mesa Airlines between July and December 1999, Arctic Slope21 between December 1999 and September 2001, and RALLC between September and October 2001.) Between October 2001 and July 2002, the quality assurance inspector was not employed in the aviation maintenance field. According to RALLC time cards, the quality assurance inspector worked shifts from 1700 on January 4 to 1200 on January 5, 2003, and from 2100 on January 5th to 0630 on January 6th. He began work on the night of January 6th at 2100. The quality assurance inspector stated that he was providing OJT to two mechanics and that it was his first time training two mechanics while performing inspector duties. In addition, the quality assurance inspector performed an engine borescope inspection that took about 30 minutes to accomplish. His shift ended at 1230 on January 7th. The quality assurance inspector described his health as good and stated that he slept when his shift ended and that he awoke in the afternoon. The quality assurance inspector reported no significant life events in the months preceding the accident and stated that nothing affected his performance on the night of January 6th. In a postaccident interview, the Air Midwest HTS regional site manager (see section 1.5.3.5) stated that he 20 The primary quality assurance inspector was not at work on the night of January 6, 2003, so the foreman/secondary quality assurance inspector assumed his duties. 21 Arctic Slope was a maintenance contractor.

Factual Information 12 Aircraft Accident Report had “a lot of faith” in the quality assurance inspector. At the public hearing for this accident,22 the quality assurance inspector testified that he had performed elevator control system rigging work once. 1.5.3.2 The Foreman The foreman, age 36, was employed by SMART and had begun working at the HTS maintenance station in July 2002. He received his A&P certificate in July 1995. From 1984 to 1987, the foreman worked as a mechanic on B-52 and KC-135 airplanes with the U.S. Air Force. He gained experience as a foreman while working with the Air Force. Between 1993 and 1999, the foreman worked as a mechanic on general aviation and commuter airplanes. From December 2001 to July 2002, the foreman was employed by SMART and was assigned to RALLC at the Dubois maintenance station as a mechanic working on Beech 1900D airplanes. The foreman stated that he typically arrived at work between 2100 and 2130, about 30 minutes before the arrival of the airplane that was scheduled for maintenance. He then reviewed the work scheduled for the shift, organized the paperwork, and reviewed the personnel and equipment requirements. He assigned mechanics to the required tasks but did not do any of the maintenance himself. He indicated that work assignments were based on what work had to be done and which mechanic was best suited for a particular job. The foreman tried to keep the same mechanics on the same jobs throughout the shift. The foreman normally communicated with Air Midwest maintenance control about 0400 regarding the status of the airplane undergoing maintenance. During a postaccident interview, the foreman stated that, if a mechanic had not done a job before and someone was available who had previously done the job, he would assign the experienced mechanic to the job and would train the mechanic without experience as time permitted. The foreman indicated that he tried to train only one mechanic at a time but that, sometimes, more than one mechanic needed to be trained at the same time. According to SMART time cards, the foreman was off duty for the shift from January 4 to 5, 2003, but worked an 8-hour shift from January 5th to 6th. For the shift from January 6th to 7th, the foreman worked 15 hours. On the night of January 6th, he assigned the work tasks for the accident airplane’s D6 maintenance check. The foreman was aware that, besides he and the quality assurance inspector, none of the mechanics on duty that night had done an elevator control system rigging check on a Beech 1900D. 1.5.3.3 The Mechanic The mechanic, age 30, was employed by SMART and began working at the HTS maintenance station in November 2002. He attended the Pittsburgh Institute of Aeronautics, Pittsburgh, Pennsylvania, from 1991 to 1993 and received his A&P certificate in March 1993. 22 Appendix A provides details about the public hearing.

Factual Information 13 Aircraft Accident Report Between 1994 and 1999, the mechanic was not employed in the aviation maintenance field. From January to October 2000, the mechanic performed line maintenance for Piedmont Airlines, Philadelphia, Pennsylvania, on De Havilland Canada DHC-8 airplanes. From October 2000 to January 2002, the mechanic performed heavy maintenance for US Airways, Pittsburgh, Pennsylvania, on Boeing 737 and Fokker F.100 airplanes. In October and November 2002, he worked at Stambaugh Air Service, Harrisburg, Pennsylvania. The mechanic had no previous experience working on Beech 1900D airplanes before beginning work at the HTS maintenance station. According to SMART time cards, the mechanic worked 17.5 hours from January 4 to 5, 2003, and 8 hours from January 5th to 6th. For the shift from January 6th to 7th, the mechanic worked 14 hours, during which he performed the D6 maintenance check for the first time. The mechanic stated that he did not have any previous OJT for that inspection but that he had previous flight control rigging experience at Piedmont and US Airways. The mechanic thought that he was “properly trained” for the rigging task because he did not perceive any differences, in terms of rigging flight controls, between the Beech 1900D and previous airplanes on which he had worked. He estimated that it took about 7 hours to complete his assigned tasks for the D6 maintenance check and stated that he received proper oversight. In a postaccident interview, the RALLC site manager (see section 1.5.3.4) described the mechanic as capable. The site manager also stated that he had received positive reports about the mechanic from inspectors and foremen at the HTS maintenance station. 1.5.3.4 The Raytheon Aerospace Site Manager The RALLC site manager23 for the HTS maintenance station, age 50, began working for RALLC in July 2002. He received his A&P certificate in April 1979. Between June 2001 and July 2002, the RALLC site manager was employed by SMART as a mechanic assigned to the RALLC maintenance station in Panama City, Florida, where he worked on Beech 1900D airplanes. He became the foreman and was responsible for two crews. The RALLC site manager indicated that he had previous aviation manufacturing and maintenance experience with large commercial airplanes (the Boeing 727, Airbus A300, Lockheed L-1011, and Douglas DC-8 and DC-9), large military airplanes (the C-5B, C-130, and P-3), and general aviation airplanes (including the Learjet 25 and 35). The RALLC site manager worked from 0800 to 1700 Monday through Friday. During his shift, the RALLC site manager would typically review the paperwork from the previous night to identify what work was done and to check that the work had been properly documented, examine the status and condition of the hangar and its equipment, review attendance sheets and time cards, and coordinate with the parts manager to ensure that parts were available to meet maintenance needs. The RALLC site manager would also interact with other personnel at the HTS maintenance station who worked a day shift, 23 Air Midwest refers to this position as “maintenance manager.”

Factual Information 14 Aircraft Accident Report including the Air Midwest regional site manager. In addition, the RALLC site manager would participate in daily maintenance conference calls that addressed, among other things, upcoming maintenance needs. (RALLC site managers from the four other Air Midwest maintenance stations24 and Air Midwest maintenance personnel also participated in the daily conference calls.) The RALLC site manager stated that he occasionally visited the hangar at night. 1.5.3.5 The Air Midwest Regional Site Manager The Air Midwest regional site manager, age 44, has been employed by Air Midwest for 22 years and has been the regional site manager at the HTS maintenance station since August 2002. He received his A&P certificate in February 1995. Before his HTS assignment, the Air Midwest regional site manager worked for 8 years as a quality assurance inspector at the company’s Wichita, Kansas, maintenance station.25 He has performed aviation maintenance on various turboprop commuter airplanes. At the time of the accident, the Air Midwest regional site manager normally worked from 0830 to 1700 Monday through Friday. During his shift, he would typically review the previous night’s paperwork to determine if it had been properly signed off and, if he noted any discrepancies, would either speak with the RALLC site manager or write up a noncompliance form. He also participated in the daily maintenance conference calls and daily conference calls with Air Midwest flight operations personnel. The regional site manager stated that he occasionally visited the hangar at night. 1.6 Airplane Information Beech 1900 series airplanes entered service in 1984 and have accumulated more than 11 million flight hours since then. The Beech 1900D is a low-wing, twin-engine, propeller-driven, pressurized airplane. It has an overall length of 57 feet 10 inches, a height of 14 feet 11 inches, and a wingspan of 57 feet 11 inches. The accident airplane, serial number UE-233, was delivered new to Air Midwest from Raytheon Aircraft Company on August 30, 1996. The airplane was registered as N233YV on November 20, 1996. At the time of the accident, the airplane had 15,003 total flight hours and 21,332 total cycles. 26 The accident airplane was configured with a captain’s seat, a first officer’s seat, 16 single passenger seats, and a triple passenger seat in the rear of the airplane (for a total of 19 passenger seats in 9 rows). The airplane had a main entry door on the left forward 24 These maintenance stations are located in Dubois, Pennsylvania; Farmington, New Mexico; Little Rock, Arkansas; and Panama City, Florida. 25 Air Midwest closed its Wichita maintenance station on September 30, 2002, because of flight schedule changes. 26 An airplane cycle is one complete takeoff and landing sequence.

Factual Information 15 Aircraft Accident Report side of the fuselage and three emergency exits, two of which were on the right side of the cabin (at rows 4 and 6) and one of which was on the left side of the cabin (at row 6). The airplane also had a cargo door on the left aft side of the fuselage. The cargo storage area began at the partition immediately aft of the triple passenger seat and extended almost to the aft pressure bulkhead. According to Raytheon Aircraft Company, the airplane’s interior was installed in 1996 and was certified to meet Federal material flammability requirements. The accident airplane was equipped with two Pratt & Whitney Canada PT6A-67D turbopropeller engines and Hartzell model HC-E4A-3I four-bladed, constant-speed, full-feathering, reversible propellers. The PT6A-67D turbopropeller engine has a gas generator module and a power turbine module. The HC-E4A-3I propeller is hydraulically actuated and has model E10950 composite blades. The left engine gas generator module, serial number 114328, was installed on the accident airplane on November 2, 2001. At the time of the accident, the module had accumulated 14,659 hours and 21,142 cycles since new and 2,445 hours and 3,319 cycles since overhaul. The left engine power turbine module, serial number 114301, was installed on the accident airplane on October 25, 2000. At the time of the accident, the module had accumulated 14,557 hours and 21,514 cycles since new and 4,778 hours and 6,349 cycles since overhaul. The right engine gas generator module, serial number 114091, was installed on the accident airplane on May 28, 2002. At the time of the accident, the module had accumulated 18,447 hours and 25,612 cycles since new and 1,225 hours and 1,640 cycles since overhaul. The right engine power turbine module, serial number 114343, was installed on the accident airplane on May 24, 2002. At the time of the accident, the module had accumulated 13,548 hours and 22,093 cycles since new and 1,225 hours and 1,640 cycles since overhaul. The accident airplane was not equipped with an autopilot. 1.6.1 Pitch Control System The Beech 1900D airplane is equipped with a mechanically operated pitch control system.27 The three primary elements of the pitch control system are the elevators, the control column, and the connecting rods and cables. The elevators (left and right) are attached to the trailing edge of the horizontal stabilizer, which is mounted on top of the vertical stabilizer in a T-tail configuration. A pilot pushes forward on the control column to move the elevator trailing edges down (resulting in the airplane pitching AND) and pulls back on the control column to move the elevator trailing edges up (resulting in the airplane pitching ANU). Figure 3 shows the elements of the pitch control system, and figure 4 shows a side view of the airplane’s tail section. 27 The terms “pitch control system” and “elevator control system” are used synonymously in this report.

Factual Information 16 Aircraft Accident Report Figure 3. Beech 1900D pitch control system. Figure 4. Side view of Beech 1900D tail section.

Factual Information 17 Aircraft Accident Report The inboard end of each elevator has a control horn that is connected to the elevator surface by a shaft. Four primary stop bolts (left upper, left lower, right upper, and right lower) are mounted on airplane structure. The limit of travel for each of the elevator control horns is contact with an up stop bolt or a down stop bolt. The Beech 1900D AMM, section 27-30-02, indicates that the elevator primary stop deflection settings are 20º +1º/-0º up from the neutral position and 14º +1º/-0º down from the neutral position. The elevator’s neutral position is the point at which the position of the trailing edge of the elevator is aligned with the chord plane of the horizontal stabilizer. The left and right elevator control horns are connected by independent aft pushrods to the aft bellcrank, which is located near the junction of the horizontal and vertical stabilizers. Left and right tension springs connect the aft bellcrank arm to airplane structure and orient the pitch control system toward the AND direction. Attachment links connect the springs to the aft bellcrank arm. Structure adjacent to the aft bellcrank contains holes for a rig pin.28 Control cable assemblies (one ANU and one AND) connect the aft bellcrank to the forward bellcrank. The control cable assemblies have two cable sections joined by turnbuckle assemblies located in the base of the vertical stabilizer. Each control cable assembly comprises seven spirally wound strands and has one long and one short component. The turnbuckle assemblies establish the correct tension in the cables. Each turnbuckle assembly consists of a barrel and two threaded cable terminals. Figure 5 shows the ANU and AND turnbuckle assemblies. Each turnbuckle assembly can be lengthened or shortened during elevator rigging. Depending on the direction of the turnbuckle barrel’s rotation, both threaded cable terminals extend from or contract into the barrel at the same time. A tooling hole in the barrel is used by mechanics to rotate the barrel, and tooling holes in the terminals are used to hold the terminals in place while the turnbuckle barrel rotates. According to FAA Advisory Circular (AC) 43.13-1B, “Acceptable Methods, Techniques, and Practices – Aircraft Inspection and Repair” (dated September 27, 2001), up to three threads of a terminal can be visible on a turnbuckle assembly when maintenance is complete. A safety clip holds the terminals in place in the barrel after maintenance to ensure that the length of the turnbuckle assembly does not change. 28 A rig pin is a maintenance tool that is inserted into a flight control system to immobilize movable components at a specific position. A rig pin must be removed before maintenance is complete. For a rig pin to properly penetrate the aft bellcrank rig pin holes, the bellcrank must be moved to align with the holes in the structure on both sides of the bellcrank. The rig pin must enter the bellcrank through a hole on one side of the vertical stabilizer, pass through the bellcrank, and then pass through structure on the other side of the vertical stabilizer. When the aft bellcrank rig pin is in place, the elevators can be set to 0º by adjusting the aft pushrods.

Factual Information 18 Aircraft Accident Report The control cable assemblies are routed through pulleys from the aft bellcrank, through the rear pressure bulkhead, beneath the rear cargo compartment and cabin floor, and to the forward bellcrank beneath the cockpit pedestal and the floor under the first officer’s seat. The forward bellcrank contains two secondary stop bolts (one up and one down), which have AMM-specified deflection settings that allow slightly more travel than the primary stop bolts at the elevator control horns. Structure above and below the forward bellcrank contains holes for a rig pin.29 A forward push-pull tube, located beneath the cockpit pedestal, connects the forward bellcrank with the bottom of a T-shaped control column assembly. Two control wheels—one for the captain and one for the first officer—are located in front of each cockpit seat. The control wheels (also known as control yokes) are connected to the top of the T-shaped control column assembly by a shaft and a flexible coupling. Each shaft passes through a control column support assembly, with a roller slider assembly mounted inside, providing support to each shaft where it enters the instrument panel. Each roller slider assembly consists of three rollers, one of which has an eccentric screw that is adjusted to set roller clearance. The captain’s control column support and shaft assembly contains a hole for a gust lock pin, which is used only when the airplane is parked and shut down. The gust lock pin immobilizes pitch and roll controls to prevent wind damage to the control surfaces and control systems. Figure 5. Turnbuckle assemblies. 29 For this rig pin to be properly positioned, the forward bellcrank rig pin hole must align with two adjacent rig pin holes in the airplane structure. When the forward bellcrank rig pin is in place, the elevator should be near 0º.

Factual Information 19 Aircraft Accident Report The control column pivots forward and aft on bearings near the cockpit floor. A bob weight, attached through an interconnect link to the control column, provides control column feel and flight control stability. The bob weight installation has a tertiary down stop bolt. The FDR pitch control position sensor is located beneath the cockpit floor. The sensor is attached to structure located to the left of the base of the control column (looking forward). One rubber-cushioned, steel-band clamp (called an Adel clamp) holds the sensor to the structure. The sensor is connected to the elevator system by a short rod that extends from the sensor to a bracket attached to the lower part of the control column. 1.6.1.1 Pitch Trim Control System The accident airplane was equipped with a mechanically operated pitch trim control system. The pitch trim control system includes a single movable trim tab30 for each elevator and a cable-driven jackscrew actuator for each tab. The trim tabs, which are located on the inboard trailing edge of each elevator, relieve the force a pilot must hold on the control wheel to provide longitudinal control (for example, angle of attack or pitch) of the airplane. According to the Beech 1900D AMM, the trim tabs move from 5.75º ±0.25º up to 17º ±0.5º down. Movement of the trim tabs in the downward direction creates an upward aerodynamic moment on the elevator and results in an ANU pitching moment. 1.6.2 Maintenance Program The Air Midwest Maintenance Program Manual describes the company’s Continuous Airworthiness Maintenance Program. This program incorporates guidance from the Beech 1900D AMM. The program includes the following inspections: • Periodic service check. This check is accomplished during an airplane’s layover when applicable. The check involves a visual inspection of safety-of-flight items and servicing when necessary. • Routine check. This check is performed every 100 flight hours. The check includes a visual inspection and servicing of the airplane’s major components. • Detail check. This check is divided into six different phases, known as detail one through detail six, and a different phase is performed every 200 hours along with a routine check. One major airplane section is inspected during each phase. Detail one covers the wings, detail two covers the powerplants, detail three covers the flight compartment and cabin, detail four covers the environmental systems and nose, detail five covers the landing gear, and detail six covers the aft fuselage and empennage. Details one through six comprise one full cycle, and an airplane must complete one full cycle each year. • Structural check. This check is accomplished when the airplane has accumulated 12,000 flight hours and then every 3,000 flight hours afterward. 30 The trim tabs on the Beech 1900D are geared tabs, which move in relation to the position of the elevator.

Factual Information 20 Aircraft Accident Report The accident airplane’s last periodic service check and routine check occurred on January 6, 2003. The airplane’s last detail checks occurred as follows: detail one, July 31, 2002; detail two, September 16, 2002; detail three, October 11, 2002; detail four, November 7, 2002; detail five, December 5, 2002; and detail six, January 6, 2003. The airplane’s last structural check occurred on August 27, 2002. The maintenance paperwork for the accident airplane from January 2001 to January 2003 was reviewed for discrepancies related to elevator or pitch control. No trends or discrepancies were noted before the accident flight. FAA Service Difficulty Reports were reviewed for flight control maintenance discrepancies involving the accident airplane. No trends or discrepancies were noted before the accident flight. In addition, Air Midwest records indicated no previous accidents involving the airplane. 1.6.3 Elevator Control System Rigging Procedure As stated in section 1.1.1, the mechanic who performed the cable tension check bypassed several steps of the elevator control system rigging procedure in section 27-30-02 of the Beech 1900D AMM (with the quality assurance inspector’s concurrence). The procedure at the time of the accident is detailed in section 1.6.3.1, and the applicable steps that the mechanic skipped are discussed in section 1.6.3.2. After the accident, Raytheon Aircraft Company revised its elevator control system rigging procedure, and the revised procedure is presented in section 1.6.3.3. 1.6.3.1 Rigging Procedure at the Time of the Accident The Raytheon Aircraft elevator control system rigging procedure that was in effect at the time of the accident is summarized below and presented in its entirety in appendix C. ELEVATOR CONTROL SYSTEM RIGGING a. Disconnect the autopilot servo cables. b. Locate and remove all access panels from the vertical and horizontal stabilizers to gain access to the aft elevator bellcrank and the elevator cables. c. Locate and remove the flight compartment seats, carpet, and floorboards to gain access to the forward elevator bellcrank. d. Locate and remove the passenger seats, carpet, and floorboards on the right side of the passenger compartment to gain access to the elevator cable turnbuckles. e. Install an elevator travel board[31] on each elevator at station 50.00. 31 An elevator travel board is a template that is unique to a specific airplane design. The travel board attaches to the horizontal stabilizer to provide a reference for measuring movement of the elevators. The position of the elevator trailing edge aligns with 1º markings on the travel board that show the angular position of the elevator in degrees.

Factual Information 21 Aircraft Accident Report f. Adjust the center-to-center length of the push-pull tube assembly between the control column and the forward elevator bellcrank to a dimension of 15.12 ± 0.06 inch. g. Adjust the surface stop bolts on the elevator control horn support for up-travel of 20º + 1º - 0 and down-travel of 14º + 1º - 0º. h. Verify the bob weight stop bolt clearance is 0.5 ± 0.06 inch. Adjust if necessary. i. Adjust the forward bellcrank stops for 0.37 ± 0.06 inch clearance from the stop bolts. j. Verify the forward bellcrank stop bolts make contact before the bob weight stop bolts make contact with the weight. k. Install a rig pin in the aft elevator bellcrank. NOTE Verify threads are visible through the inspection holes at the end of the pushrods after adjustments are made. l. Adjust the pushrods between the aft elevator bellcrank and the elevator to position the elevator at neutral (0º deflection). m. Remove the rig pin from the aft elevator bellcrank. n. Remove the safety clips from the turnbuckles and release cable tension. o. Move the control yoke to install the rig pin in the forward elevator bellcrank. p. Tighten the elevator-up cable until the elevator rises to neutral (0º on the travel board). q. Tighten the elevator-down cable until the average tension of the up- and down-cables is 66 ± 8 pounds (the sum of up-cable and down-cable tensions, divided by two). Refer to Figure 203.[32] r. Continue to balance the adjustment of the two cables until the average tension is 66 ± 8 pounds while maintaining 0º deflection of the elevator. s. Perform the CONTROL COLUMN SUPPORT ROLLER INSPECTION procedure. t. Install safety clips on the turnbuckles. 32 Figure 203 was an elevator cable tension graph included in section 27-30-02 of the Beech 1900D AMM. The graph did not contain instructions on how to take a temperature reading.

Factual Information 22 Aircraft Accident Report u. On aircraft equipped with the F1000 Flight Data Recorder, calibrate the Pitch Position Potentiometer. Perform the FLIGHT DATA RECORDER (FDR) – PITCH ADJUSTMENT procedure.[33] v. Remove the travel boards from the horizontal stabilizers. w. Connect the autopilot servo cables to the elevator primary control cables. x. Install the seats, carpet and floorboards. y. Replace all access panels. Step a, to disconnect the autopilot servo cables, and step w, to connect the autopilot servo cables to the elevator primary control cables, were not applicable to the accident airplane because it did not have an autopilot. Step d, to locate and remove the passenger seats, carpet, and floorboards on the right side of the passenger compartment to gain access to the turnbuckles, was not applicable because the elevator cable turnbuckles for the Beech 1900D model are not located under the passenger compartment floorboards.34 1.6.3.2 Applicable Steps That Were Skipped During Maintenance The mechanic indicated that he bypassed step c, to locate and remove the flight compartment seats, carpet, and floorboards to gain access to the forward elevator bellcrank, because the quality assurance inspector told him that the flight compartment seats and floorboards did not need to be removed to comply with the rigging procedure. In fact, the mechanic stated that access to the rig pin hole was adequate without removing the seats and the floorboards because the foreman showed the mechanic a small access panel that needed to be opened to access the forward bellcrank rig pin hole.35 The mechanic also stated that he bypassed step f, to adjust the center-to-center length of the forward push-pull tube to a dimension of 15.12 inches ±0.06 inch, with the quality assurance inspector’s concurrence. The mechanic indicated that he bypassed step g, to adjust the stop bolts on the elevator control horn supports for a deflection setting of 20º +1º/-0º up and 14º +1º/-0º down, because he did not think that cable tensioning required a measurement of the deflection settings. The mechanic stated that he had manually pushed the elevators up and down before rigging to determine if the elevator control horns were hitting the stops. The mechanic stated that he decided, and the quality assurance inspector concurred, that the following steps were not required: step h, to verify the bob weight stop bolt clearance and adjust if necessary; step i, to adjust the forward bellcrank stops for 33 The pitch adjustment procedure involves setting the elevator to eight different data points, ranging from 14º AND to 20º ANU (including 0º), and recording the FDR readout. 34 The turnbuckles for the Beech 1900C model are located under the passenger compartment floorboards. 35 During ground tests (see section 1.16.1), Safety Board investigators noted that it was easier to view the inserted rig pin when the floorboard in front of the first officer’s seat was removed, as directed in part by step c of the rigging procedure, rather than when just the small access panel was opened.

Factual Information 23 Aircraft Accident Report clearance from the stop bolts; and step j, to verify that the forward bellcrank stop bolts make contact before the bob weight stop bolt makes contact with the weight. The mechanic stated that he bypassed part of step n, to release cable tension, because he could adjust cable tension by tightening the cables without releasing them before the adjustment. The mechanic stated that he bypassed step s, to perform the control column support roller inspection procedure, because he decided that it was not required. The quality assurance inspector concurred. The mechanic also stated that he bypassed step u, to calibrate the F1000 FDR pitch position potentiometer and to perform the FDR pitch adjustment procedure, because he did not think that the calibration needed to be done. The quality assurance inspector stated that he did not think that an FDR was installed on the airplane.36 During a postaccident interview, the mechanic and quality assurance inspector further stated that steps c, f, g, h, i, j, n, and s were not required because those steps were only necessary for cable replacement and not for cable tensioning. The Air Midwest regional site manager stated, during a postaccident interview, that all of these steps should have been followed, except for step n (releasing the cable tension before a readjustment of the cables). The regional site manager thought that loosening the cables would not have affected the final outcome of a proper rig. In addition, the mechanic stated that he bypassed the Elevator Control System Friction Test described in section 27-30-02 of the Beech 1900D AMM because he decided that the test was not required. The quality assurance inspector concurred. 1.6.3.3 Revised Rigging Procedure On February 12, 2003, Raytheon Aircraft revised its elevator control system rigging procedure for the Beech 1900D airplane. The revised procedure is summarized below and presented in its entirety in appendix D. 36 Most, if not all, Beech 1900D airplanes are outfitted with an FDR. The wiring and the sensor for the FDR are in the same area of the airplane where maintenance was being performed. Also, the FDR unit is mounted in the AFT1 cargo compartment and is readily visible. In addition, a circuit breaker for the FDR is located in the cockpit.

Factual Information 24 Aircraft Accident Report ELEVATOR CONTROL SYSTEM RIGGING WARNING THE GUST LOCK PIN MUST NOT BE USED FOR RIGGING THE ELEVATOR CONTROL SYSTEM EXCEPT WHEN PERFORMING THE GUST LOCK PIN CHECK PORTION OF THIS PROCEDURE. NOTE DISCONNECT THE AUTOPILOT SERVO CABLES TO THE ELEVATOR PRIMARY CONTROL CABLES. a. Locate and remove all access panels from the vertical and horizontal stabilizers to gain access to the aft elevator bellcrank and the elevator cables. b. Install a rig pin in the aft elevator bellcrank. c. Remove lock clips from turnbuckles. Release cable tension. d. Locate and remove the copilot’s seat, carpet, and floorboards to gain access to the forward elevator bellcrank. e. Adjust the center-to-center length of the push-pull tube assembly between the control column and the forward elevator bellcrank to a dimension of 15.17 +0.19/-0.06 inch. This push-pull tube is to be adjusted if needed to meet the bob weight stop clearance requirement or to meet the gust lock pin check. f. Install the rig pin in the forward elevator bellcrank (located below the floorboard forward of the copilot’s seat tracks). Move the control column as required to align the rig pin holes. NOTE CHECK ELEVATOR TRAVEL WITH TRAVEL BOARDS. ONE TRAVEL BOARD SHOULD BE MOUNTED ON EACH HORIZONTAL STABILIZER AT HSS [horizontal stabilizer station] 50.00. g. Disconnect the elevator pushrods from the aft bellcrank. h. Adjust the surface stops on the control horn support for up travel of 20° +1°/ -0°; and down travel of 14° +1° / -0°.

Factual Information 25 Aircraft Accident Report NOTE INSURE THAT THREADS ARE VISIBLE THROUGH THE INSPECTION HOLE AT THE END OF THE PUSHROD, AFTER ADJUSTMENTS ARE MADE. i. Adjust the elevator bellcrank pushrod ends as required to obtain 0 readings on the travel boards for both elevators. Tighten the locknuts. j. Connect pushrods to the aft elevator bellcrank. k. Use a cable tensiometer to measure control cable tension. l. Tighten elevator control cables uniformly to the center of the maximum and minimum tensions. m. Slowly adjust the elevator cable(s) as required until the rig pin in the forward bellcrank will fit with minimum insertion force. n. Remove the rig pin from the forward bellcrank. o. Read the cable tension of both cables. Record the values as T up and T down. The allowable limit for combined cable tension is 66 ± 8.0 lbs. Compute the combined tension load (Tc) by adding the up and down values together and dividing by 2, or: Tc = (T up + T down) / 2 Example: T up = 57 lbs., T down = 75 lbs. Tc = (T up + T down) / 2 Tc = 57 + 75 = 132 = 66 lbs. = acceptable 2 2 p. Compare the combined tension load to cable tension graph. q. If the combined tension load is above the maximum range, start the procedures over and set cable tension at the minimum, or shorten the pushrod of the forward elevator bellcrank and repeat Steps l through p. r. Install lock clips on turnbuckles. s. Remove the rig pin from the aft elevator bellcrank. t. Set the forward elevator bellcrank stop bolts for a clearance of 0.37 ± 0.06 inch. u. Verify the bob weight stop bolt clearance is 0.5 ± 0.06 inch. Adjust the stop bolt, if necessary. The push-pull tube assembly between the control column and the forward elevator bellcrank may need to be adjusted to achieve the required clearance (refer to Step e). v. The forward elevator bellcrank stop bolt is to make contact before the bob weight stop bolt makes contact with the bob weight. In order to verify that the forward bellcrank bolt makes contact before the bob weight stop bolt makes

Factual Information 26 Aircraft Accident Report contact with the bob weight it may be necessary to disconnect the pushrods at the elevator horns in order to allow enough travel to verify this action. Reconnect the pushrods after this contact has been verified. w. Gust Lock Pin Check - Install the gust lock pin. Verify the elevator is 7º to 15º down (the elevator does not need to be on the down stop with the gust lock pin installed). However, if the elevator is full down and resting on the primary stops, the force required to push on the pilot’s control wheel while inserting the gust lock pin must be a maximum of ten pounds. If the force is too high, adjust (shorten) the push-pull tube per Step e, then repeat Step u to check the bob weight clearance. Remove the gust lock pin. x. Connect the autopilot servo cables to the elevator primary control cables. y. Perform the CONTROL COLUMN SUPPORT ROLLER INSPECTION procedure. z. On aircraft equipped with the F1000 Flight Data Recorder, calibrate the Pitch Position Potentiometer. Perform the FLIGHT DATA RECORDER (FDR) - PITCH ADJUSTMENT procedure. aa. Move the control wheel aft and verify the elevator moves up 20º +1º/-0º and that the surface stops make contact. Move the control wheel forward and verify the elevator moves down 14º +1º/-0º and that the surface stops make contact. If these requirements are not met, repeat this rigging procedure in its entirety. bb. Remove the travel boards from the horizontal stabilizers, install floorboards, copilot’s seat, and replace access panels. 1.6.4 Weight and Balance This section discusses the accident airplane’s calculated weight and balance, which was determined using Air Midwest’s FAA-approved weight and balance program (see section 1.18.1.2), and the loading conditions that existed on the day of the accident. Section 1.16.2.1 discusses the airplane’s actual weight and balance. The accident airplane’s last weighing on September 8, 2002, determined that the airplane’s empty weight was 10,293 pounds. The airplane’s balance was determined by the location of the center of gravity (CG), which is usually described as a given number of inches aft of the reference datum.37 At the time of the airplane’s weighing, the CG was determined to be located 282.1 inches aft of the reference datum, which corresponds to a CG location of 14.4 percent mean aerodynamic chord (MAC).38 37 The reference datum is an imaginary vertical plane, arbitrarily fixed somewhere along the longitudinal axis of the airplane, from which all horizontal distances are measured for weight and balance purposes. 38 According to the FAA’s Aircraft Weight and Balance Handbook, the MAC is the chord of an imaginary airfoil that has all of the aerodynamic characteristics of the actual airfoil. The chord is drawn through the geographic center of the plan area of the wing. The location of the CG with respect to the MAC is important because it predicts the handling characteristics of the aircraft.

Factual Information 27 Aircraft Accident Report According to the Air Midwest Beech 1900D load manifest form for flight 5481, the operating empty weight was 10,673 pounds,39 the passenger weight was 3,325 pounds, the weight in the coat closet was 10 pounds, the AFT1 cargo compartment weight was 775 pounds, the AFT2 cargo compartment weight was 45 pounds, the zero fuel weight was 14,818 pounds, the fuel weight at takeoff was 2,200 pounds, and the gross takeoff weight was 17,018 pounds. The flight crew made a 10-pound addition error when summing the weights that comprise the zero fuel weight. As a result, the calculated zero fuel weight was actually 14,828 pounds,40 and the calculated gross takeoff weight was actually 17,028 pounds. The Beech 1900D maximum gross takeoff weight is 17,120 pounds. The load manifest form also indicated that the calculated CG index for the accident flight was 81 (37.8 percent MAC). The Air Midwest CG takeoff limits range from indexes of about 23 to 85 (16.7 to 39.2 percent MAC) when a Beech 1900D airplane is at a gross takeoff weight of 17,028 pounds. The Beech 1900D aft CG limit is 40 percent MAC. Table 2 shows information reported on Beech 1900D load manifest forms for flights flown by the accident airplane after the January 6, 2003, D6 maintenance check. The table shows that the accident flight was calculated to be the most aft loaded of all of the postmaintenance flights. Table 5 in section 1.16.2.2 provides information from the load manifest forms of selected flights before the D6 maintenance check. Table 2. Weight and balance information for the 10 flights after maintenance. Note: The accident flight appears in bold face print. LWB, Greenbrier Valley Airport, Lewisburg, West Virginia; AHN, Athens/Ben Epps Airport, Athens, Georgia. a The CG indexes that correspond to these CG positions are 81, 48, 32, 28, 31, 19, 35, 42, 43, and 20, respectively. b This figure includes the 10-pound addition error made by the flight crew on the load manifest form. 39 The operating empty weight consisted of the airplane’s empty weight, 170 pounds for each pilot, and 20 pounds for each crew bag (one per pilot). 40 The Beech 1900D maximum zero fuel weight is 15,165 pounds. Date Flight number and route Gross takeoff weight (pounds) CG (percent MAC)a Number of passengers Cargo (pounds) 01-08-03 5481/CLT-GSP 17,028b 37.8 19 820 01-08-03 5434/LYH-CLT 16,278 25.9 15 470 01-07-03 5461/CLT-LYH 15,118 19.6 6 195 01-07-03 5441/LYH-CLT 13,303 17.3 2 70 01-07-03 5441/CLT-LYH 14,528 19.0 3 120 01-07-03 5514/LWB-CLT 12,618 12.6 0 45 01-07-03 5514/CLT-LWB 14,653 20.8 7 345 01-07-03 5585/AHN-CLT 14,278 23.7 9 320 01-07-03 5585/CLT-AHN 14,413 24.2 5 455 01-07-03 5428/HTS-CLT 13,318 13.6 0 45

Factual Information 28 Aircraft Accident Report 1.7 Meteorological Information Weather observations at CLT are made by an automated surface observing system (ASOS), which records continuous information on wind speed and direction, cloud cover, temperature, precipitation, and visibility.41 The ASOS transmits an official meteorological aerodrome report (known as a METAR) that is valid at 51 minutes past each hour and a special weather observation as conditions warrant; such conditions include a relevant wind shift, visibility change, and ceiling change (cloud cover or height). Weather observations are transmitted in coordinated universal time (UTC). Eastern standard time is 5 hours behind UTC time. The 1251Z42 METAR (0751 local time) indicated that the winds were 260º at 6 knots, visibility was 10 miles, clouds were scattered at 14,000 feet and broken at 25,000 feet, the temperature was 3º Celsius (C), the dew point was -7º C, and the altimeter setting was 29.75 inches of mercury (Hg). The 1351Z METAR (0851 local time) indicated that the winds were 230º at 7 knots, visibility was 10 miles, clouds were scattered at 14,000 feet and broken at 25,000 feet, the temperature was 4º C, the dew point was -6º C, and the altimeter setting was 29.76 inches of Hg. CLT is also equipped with a terminal doppler weather radar system, which provides windshear and microburst alerts. During the time surrounding the accident, the system did not transmit an alert. 1.8 Aids to Navigation No problems with any navigational aids were reported. 1.9 Communications No communications problems were reported between the pilots and any of the air traffic controllers who handled the flight. 1.10 Airport Information CLT is located about 4 miles west of the city of Charlotte at an elevation of 748 feet mean sea level (msl). An average of 1,250 aircraft operate at the airport daily, about 90 percent of which are scheduled air carrier or air taxi operations; the remainder are general aviation and military operations. The airport has two parallel runways, 18L/36R and 18R/36L, and a third runway, 5/23. Runway 18R, from which flight 5481 41 Cloud cover is expressed in feet above ground level. Visibility is expressed in statute miles. 42 The “Z” designation that follows the time in a weather observation stands for Zulu, which indicates UTC time.

Factual Information 29 Aircraft Accident Report took off, is 10,000 feet long and 150 feet wide and is made of wire-combed concrete. The airport was certificated under 14 CFR Part 139. CLT Airport Operations personnel perform airport inspections two times each day. The first inspection, which begins about 0800, includes all of the airport movement areas. The second inspection, which begins about 1600, includes all of the airport movement areas and the airfield lighting facilities. The self-inspection log sheet indicated no discrepancies for the first inspection performed on the day of the accident. CLT Airport Operations personnel performed a special inspection after the accident. The special inspection, which began about 0906, examined runways 18R/36L and 5/23 and several taxiways for foreign object debris; none was recorded on the log sheet. CLT has an airport emergency plan detailing response, recovery, and resolution actions in the event of an accident or incident involving aircraft at the airport or within the boundary of Mecklenburg County, North Carolina. (The city of Charlotte is within Mecklenburg County.) CLT is responsible for conducting a full-scale mock disaster drill once every 3 years to test this plan. On May 13, 2000, CLT conducted a full-scale triennial drill with participation from the following organizations: the FAA; CLT Airport Operations, Airport Law Enforcement, and Aircraft Rescue and Firefighting (ARFF); the CLT ATCT; the Charlotte-Mecklenburg Police Department; the City of Charlotte Fire Department (CFD); the North Carolina Air National Guard; the Mecklenburg County Medical Examiner; the American Red Cross; and US Airways. 1.10.1 Aircraft Rescue and Firefighting CLT and the North Carolina Air National Guard maintain an index D ARFF facility43 on the airfield. The ARFF station (Station 17), which is owned by the Air National Guard, is continuously staffed with a minimum of nine CFD firefighters. The station houses eight crash trucks, six of which are owned by the Air National Guard (Blaze 1, Blaze 2, Blaze 3, Blaze 5, Blaze 8, and Blaze 18) and two of which (Blaze 7 and Engine 17) are owned by the CFD. An off-airport fire station (Station 30) is the backup facility for all alerts on airport property. ARFF personnel receive 56 hours of initial training, including classroom instruction and a live burn pit/mobile trainer fire exercise. ARFF personnel use the FAA’s aircraft rescue and firefighter computer-based training program, which covers 13 subject areas, to accomplish recurrent training. In addition, the State of North Carolina requires ARFF personnel to have a minimum of 24 hours of continuing education each year in the 13 FAA-required subject areas. To meet this requirement, CFD conducts training during quarterly sessions consisting of 4 hours of classroom instruction and 5 hours of practical skills, for a total of 9 hours per quarter and 36 hours per year. 43 According to 14 CFR 139.317, an index D ARFF facility is required to have (1) either one firefighting vehicle with 500 pounds of sodium-based dry chemical or Halon 1211 or 450 pounds of potassium-based dry chemical and water with a commensurate quantity of aqueous film forming foam (AFFF) to total 100 gallons and (2) two firefighting vehicles with water and a commensurate quantity of AFFF so that the total quantity of water for foam production carried by all three vehicles is at least 4,000 gallons.

Factual Information 30 Aircraft Accident Report 1.10.2 Air Traffic Control The CLT ATCT is an FAA-staffed combined terminal approach radar control (TRACON)44 and tower with about 500,000 operations per year. The tower cab is continuously open and is located on the north side of the airport, centered between runways 18L/36R and 18R/36L. Air traffic control (ATC) radar data are provided by an airport surveillance radar-9 sensor located midfield on the airport between runways 18R/36L and 5/23. Radar data processing is performed by an automated radar terminal system-3A processor. Flight 5481 was handled by three air traffic controllers on the day of the accident: the clearance delivery controller, the ground control west controller, and the local control west controller. Two local control east controllers (one of which was at the developmental level), a ground control east controller, and a tower supervisor were also present at the CLT ATCT at the time of the accident. The ground control west controller has been a controller at the CLT ATCT since June 1982. He was a controller for the U.S. Air Force before beginning work for the FAA. He first became aware of a problem with flight 5481 when the local control west controller stated that the airplane might stall. The ground control west controller then noticed the airplane climbing from about 200 feet. He stated that the climb was steep and that, at an altitude of about 1,000 feet, the airplane “winged over to the left.” He also stated that he saw the airplane descend in a nose-down attitude, pick up speed, and level off at about the height of the US Airways hangar. He thought that the pilot had briefly recovered control of the airplane, but then its nose went down. He stated that the airplane hit the hangar and that he then saw a ball of fire. He further stated that both engines appeared to be running throughout the flight and that he did not notice anything fall from the airplane. The local control west controller has been a controller at the CLT ATCT since

1. He was a controller at the RDU ATCT and with the U.S. Air Force before beginning

work at the CLT ATCT. The local control west controller stated that the airplane lifted off about 3,200 feet down the runway and started a normal climb that kept getting steeper. He added that, rather than entering a departure turn to the right, the airplane continued to pitch higher and was nearly vertical between 800 and 1,000 feet. The local control west controller stated that he realized something was wrong with the airplane and that he said aloud, “that guy’s gonna stall.” He stated that the airplane’s rate of pitchup was smooth and not like an aerobatic demonstration. He saw the airplane fall to the left, in an apparent stall, and then regain a somewhat-level flight attitude. Next, he saw the airplane roll to the right, flip upside down, and hit the hangar. He stated that he saw a ball of fire afterward. The ground control east controller was positioned closest to the crash phone. (The crash phone links the ATCT directly with ARFF Station 17, the CLT Airport Operations Center, and the North Carolina Air National Guard.) The controller stated that she heard 44 TRACON personnel did not interact with the accident flight.

Factual Information 31 Aircraft Accident Report someone yell, “crash phone,” and that she picked up the phone while the airplane was still in the air. The controller stated that she saw the airplane “wiggle,” “go nose down,” and crash just as the phone was answered. Emergency response information is detailed in section 1.15.1. 1.11 Flight Recorders 1.11.1 Cockpit Voice Recorder The accident airplane was equipped with a Fairchild model A-100A CVR, serial number 61979. The exterior of the CVR was heavily covered with soot and showed evidence of significant heat exposure. The interior surfaces and components were covered with soot. Some of the internal components appeared to be partially melted. The exterior of the case that housed the tape spool assembly was covered with soot but was generally intact, with little or no mechanical damage noted. The tape spool assembly and other components inside the case were not damaged and were generally in good condition. No apparent evidence of heat or mechanical damage to the tape was found. The CVR was sent to the National Transportation Safety Board’s audio laboratory in Washington, D.C., for readout and evaluation. The tape was played back normally and without difficulty. The CVR data started about 0815:41 and continued uninterrupted until 0847:28.1. The recording consisted of four separate channels of audio information: the cockpit area microphone, the captain’s and first officer’s audio panels, and the public address system. Hot microphone transmissions from the captain and the first officer were also captured on their respective audio channels. The cockpit area microphone and public address system information were good quality.45 The captain’s and first officer’s audio panel information was fair to poor quality with respect to the audio captured from the airplane’s very high frequency (VHF) radio systems, but the audio information from the captain’s and the first officer’s hot microphones was excellent to good quality. A transcript was prepared of the entire 31-minute 47-second recording (see appendix B). The volume of the incoming VHF radio messages during the accident flight was extremely low compared with the volume of the audio captured by the flight crew’s hot microphones. Because the audio from the captain’s (or first officer’s) hot microphone was recorded on the same channel as the audio from the VHF radio, the two audio signals could not be isolated from each other on the recording. (The mixing of these two audio signals onto the same CVR channel is normal and is not unique to this CVR system.) 45 The Safety Board rates the quality of CVR recordings according to a five-category scale: excellent, good, fair, poor, and unusable. See appendix B for a description of these ratings.

Factual Information 32 Aircraft Accident Report 1.11.1.1 Safety Recommendations A-97-36 and A-02-25 Beech 1900 series airplanes had previously experienced problems with the low signal volume of VHF radio messages as recorded by the CVR. On May 22, 1997, the Safety Board issued Safety Recommendation A-97-36, which asked the FAA to Promptly require the inspection of the cockpit voice recorder (CVR) and associated equipment on all Beech 1900 aircraft and ensure that operators take corrective action to repair deficient CVR systems so that the intelligibility of recorded communications, including radio transmissions to and from the airplane, is as high as practicable. In response to the Safety Board’s recommendation, Raytheon Aircraft Company issued Service Bulletin (SB) 23-3094, which recommended the incorporation of an improved CVR amplifier and new circuitry for the wiring. Subsequently, the FAA issued Airworthiness Directive (AD) 2000-20-07, which required that all applicable Beech 1900 series airplanes comply with Raytheon Aircraft’s SB. On January 30, 2001, the Board stated that, with the issuance of AD 2000-20-07, the FAA had completed the recommended action, and, as a result, Safety Recommendation A-97-36 was classified “Closed—Acceptable Action.” The accident airplane’s maintenance records indicated that the actions required by the AD were accomplished on March 3, 2001. On August 29, 2002, the Safety Board issued Safety Recommendation A-02-25 as a result of longstanding concerns regarding the availability of CVR information for reportable accidents or incidents. Specifically, the Board was concerned about tape or memory that had been overwritten by events subsequent to an accident or incident and recording systems that had malfunctioned or were inoperative at the time of an accident or incident. Safety Recommendation A-02-25 asked the FAA to Require that all operators of airplanes equipped with a cockpit voice recorder (CVR) test the functionality of the CVR system prior to the first flight of each day, as part of an approved aircraft checklist. This test must be conducted according to procedures provided by the CVR manufacturer and shall include, at a minimum, listening to the recorded signals on each channel to verify that the audio is being recorded properly, is intelligible, and is free from electrical noise or other interference. Safety Recommendation A-02-25, which was classified “Open—Acceptable Response” on January 16, 2003, is discussed in detail in section 2.6. 1.11.2 Flight Data Recorder The accident airplane was equipped with an L3 Communications Fairchild model F-1000 FDR, serial number 01110. The FDR used a solid-state flash memory module, stored in a crash-protected memory case, as the recording medium. The FDR system, as

Factual Information 33 Aircraft Accident Report delivered by the airframe manufacturer, was designed to record 18 parameters.46 In response to a 1997 FAA rule that mandated additional recording requirements, the airplane’s FDR was upgraded in 2001 to record 4 additional parameters,47 for a total of 22 parameters. The FDR was sent to the Safety Board’s laboratory for readout and evaluation. The fire and impact damage to the exterior of the FDR prevented the data from being extracted in the normal manner. The solid-state memory module, which was in good condition, was extracted from the crash-protected memory case, and a new connector was attached to the module. The module was then inserted into a surrogate F-1000 FDR, and the data were downloaded and decompressed using the manufacturer’s software. About 95 hours of data were recorded on the FDR, including data from the accident flight. The FDR powered up for the accident flight just before 0825:00, and the last valid data were recorded just after 0847:28. Two parameters—left engine torque and lateral acceleration—did not yield expected values. The left engine torque parameter did not show any activity during the accident flight but was intermittently active during other flights for which recorded data existed. The lateral acceleration parameter exhibited values that were characteristic of lateral acceleration (based on an examination of the magnetic heading and yaw control values) but only on an intermittent basis. As a result, these two parameters were deemed inoperable. 1.11.2.1 Flight Data Recorder Study The Safety Board conducted an FDR study to examine the relationship between the 10 flights before the D6 maintenance check on January 6, 2003, and the 9 flights after the D6 maintenance check. (The accident flight was the 10th flight after D6 maintenance.) The study results showed that, before maintenance, the pitch control position values during cruise flight were normally about 4º AND and that, after maintenance, the cruise values were normally about 13º AND. (As previously stated, the FDR pitch control position sensor is attached to structure located to the left of the base of the control column; thus, the pitch control position parameter represents the control column position and not the elevator position.) Additional information regarding the 9º AND shift in the FDR pitch control position is discussed in sections 1.16.1 (ground test results) and 1.16.2 (airplane performance study results). The FDR study also examined the pitch control position values recorded during each preflight elevator control check. The study results indicated that, for the 10 flights before the D6 maintenance check, the full forward position recorded by the FDR was usually 15.6º AND. The study results further indicated that, for the nine flights after the 46 The 18 parameters were airspeed, comm1 keying, comm2 keying, flap position, frame counter, longitudinal acceleration, magnetic heading, pitch attitude, pitch control position, pressure altitude, prop rpm left, prop rpm right, prop reverse left, prop reverse right, roll attitude, torque left, torque right, and vertical acceleration. 47 The four parameters were lateral acceleration, pitch trim control, roll control, and yaw control.

Factual Information 34 Aircraft Accident Report D6 maintenance check, the full forward position recorded by the FDR was usually 16.5º AND.48 During the accident flight, the FDR recorded a maximum full forward position of 17.2º AND and a maximum full aft position of 19.2º ANU.49 In addition, the FDR study examined the maximum aft pitch control position that the FDR recorded during the takeoff rotation. Before the D6 maintenance check, the maximum aft pitch control position value at rotation ranged from 2.7º AND to 7.1º ANU; after the D6 maintenance check, the value ranged from 4.2º AND to 0.2º ANU. During the accident flight, the maximum aft pitch control position value at rotation was 9.5º AND. 1.12 Wreckage and Impact Information 1.12.1 General Wreckage Description The airplane’s main wreckage was located about 30 feet west of the southwest corner of the US Airways maintenance hangar. The debris path extended from the main wreckage site about 160 feet to the southwest and about 170 feet to the southeast. In addition, a few airplane parts were found north of the main wreckage. All of the airplane structure was accounted for along the debris path. The postcrash fire destroyed most of the airplane structure. The main wreckage site contained the remnants of the fuselage, both wings, both engines, and the empennage. The forward section of the fuselage, the left wing, and the inboard right wing were found in a normal, upright orientation. The fuselage from the trailing edge of the wing to the forward edge of the cargo door was found in an inverted position. The fuselage surrounding the cargo compartment was lying on its right side. The horizontal stabilizer was found inverted (that is, lying on its upper surface). Remnants of fire-damaged elevators and trim tabs remained attached to the horizontal stabilizer. A large portion of the northwest front side of the hangar wall showed severe fire and impact damage. The wall, which was constructed of reinforced cinder block and exterior metal flashing that extended from about 20 feet above the ground to the roof, had a 19- by 38-inch hole and was cracked vertically and horizontally. Also, a 16- by 17-foot section of the wall was displaced inward. In addition, wall debris was scattered about the base of the wall, and several pieces of wall material were found mixed with the airplane wreckage at the main wreckage site. 48 For these nine postmaintenance flights, the elevator position was limited to a maximum of about 7º AND. 49 Ground testing (see section 1.16.1) showed that these values exceeded the usual values and were consistent with high forces applied to the control column, resulting in cable stretch.

Factual Information 35 Aircraft Accident Report 1.12.2 Fuselage The nose of the airplane was crushed rearward. The cockpit exhibited fire and impact damage. Between the main entry door and the front wing spar, the lower fuselage was intact but crushed, and the upper fuselage was consumed by fire. The fuselage structure above the wing center section was consumed by fire except for the right forward emergency exit and surrounding structure, which remained intact but was distorted and fire damaged. The aft fuselage, from just forward of the aft emergency exits to the cargo compartment partition, had separated from the forward fuselage, with the rudder and elevator cables stretched between the two sections. The fuselage had also separated near the cargo compartment partition, and the aft fuselage section containing the cargo compartment was found on top of the right wing and was mostly consumed by fire. The portion of the fuselage from the front wing spar to the nose was on a magnetic heading of about 238°, and the portion of the fuselage from just forward of the aft emergency exits to the cargo compartment partition was on a magnetic heading of about 90°. The captain’s four-point, rotary-vaned seatbelt buckle was found unlatched in the cockpit wreckage. The captain’s fixed (left) lapbelt fitting was the only part attached to the buckle; the shoulder strap fittings and right lapbelt fitting were missing. The first officer’s fixed (right) lapbelt fitting and shoulder strap fitting were found attached to his four-point, rotary-vaned seatbelt buckle. (See section 1.15 for information about the location of the captain’s and first officer’s bodies.) On February 24, 2003, the Safety Board examined the captain’s seatbelt buckle at Pacific Scientific (the manufacturer of the buckle), Duarte, California. The buckle was charred, and the buckle handle was warped. The buckle handle could be rotated in the counter-clockwise direction but could not be rotated in the clockwise direction. The buckle’s five spring-loaded locking pawls, which retain the fittings when they are inserted into the buckle, were examined. Four of the locking pawls—the left shoulder harness pawl, the right shoulder harness pawl, the right lap pawl, and the crotch strap pawl—were depressed.50 The left lap pawl (for the left fixed lapbelt fitting) was partially raised. When the left lap pawl was manually depressed, the left fixed lapbelt fitting released from the buckle. Also on February 24, 2003, the Safety Board conducted a test to determine whether a control wheel could contact and release a pilot’s seatbelt buckle. The test was conducted at Northrop Grumman, Los Angeles, California, using a Beech 1900C, N19NG, owned by the company.51 A subject who was 5 feet 4 inches tall and weighed 135 pounds52 sat in the captain’s seat. When the captain’s seat was in the second most forward position 50 The crotch strap pawl was not used because the Beech 1900 does not have a crotch strap. 51 Raytheon Aircraft Company verified that the cockpit seats, seat tracks, control wheels, and crew restraints installed in N19NG were representative of those in the accident airplane. 52 The captain’s most recent FAA medical certificate indicated that she was 5 feet 6 inches tall and weighed 148 pounds.

Factual Information 36 Aircraft Accident Report along the seat track53 and the subject pulled the control wheel full aft and rotated it clockwise, the control wheel did not contact the seatbelt buckle. When the captain’s seat was in the full forward and full up position and the subject pulled the control wheel full aft and rotated it clockwise, the control wheel contacted the seatbelt buckle and released it.54 In addition, the locking pawls from the captain’s and the first officer’s seatbelt buckles, as well as those from another Air Midwest seatbelt buckle (which had been removed from service), were examined by microscope at the Safety Board’s Materials Laboratory. The locking pawls on the captain’s seatbelt buckle did not show any significant witness marks. The locking pawls on the first officer’s seatbelt buckle showed impression marks. The locking pawls on the other Air Midwest seatbelt buckle showed minor wear but no impression marks. More than 10 years before the flight 5481 accident, engineers from Pacific Scientific and The Boeing Company designed a guarded seatbelt buckle with a protective circular guard around the rotary vanes of the seatbelt to prevent the inadvertent release of the restraint. Because unguarded rotary seatbelt buckles pose an unnecessary safety risk to flight crewmembers since the buckles may become unlatched, the Safety Board issued Safety Recommendation A-03-57 on January 2, 2004. Safety Recommendation A-03-57 asked the FAA to “identify all airplanes equipped with unguarded flight crewmember rotary seatbelt buckles and require replacement with guarded buckles that cannot be inadvertently unlatched.” 1.12.3 Engines The left engine was lying upright immediately forward of the engine nacelle and was displaced about 45º to the left of the airframe centerline. The right engine was lying on its right side forward of the left wing center spar and was displaced about 90º to the left of the airframe centerline. Both propeller assemblies were found outside the main wreckage area and separate from their respective engines. No impact marks were found on the left propeller assembly that could positively determine the exact blade pitch angle at the time of the accident. However, the position of the cylinder buckles around the piston suggested that the piston was not in reverse or in feather but was at some point within the propeller blade operating range. One impact mark (a puncture hole) found on the right propeller assembly’s spinner was consistent in size and shape with a blade counterweight. According to Hartzell Propeller, the location of the puncture hole in relation to the blade plane of rotation corresponded to a blade pitch angle of about 22º. 53 The captain’s seat was found in this seat track position, but the seat height could not be determined because of the damage to the seat. 54 During the on-site investigation of this accident, an Air Midwest Beech 1900 pilot informed the Safety Board that he had experienced the uncommanded release of his seatbelt when the control wheel was pulled aft, striking one of the buckle’s vanes. In addition, the Air Line Pilots Association reported five instances of a pilot’s seatbelt becoming unbuckled when the control wheel was pulled aft and the wheel, or a clipboard attached to the wheel, contacted a buckle vane.

Factual Information 37 Aircraft Accident Report From January 27 to 31, 2003, the engines were disassembled and examined at Pratt & Whitney Canada’s facility in St-Hubert, Quebec, Canada. On February 12, 2003, the propellers were disassembled and examined at Hartzell Propeller’s facility in Piqua, Ohio. No preexisting defects or anomalies were found that would have prevented normal operation of the engines or the propellers. 1.12.4 Pitch Control System The rivets connecting the elevator control horns to the elevator shafts were tight, and the control horns were solidly fixed to the elevator shafts. The control horns moved freely in their respective bearings. The primary stop bolts were attached to the elevator control horn supports and were found safety wired. The aft end of each aft pushrod was connected to its respective elevator control horn, and the forward end of each pushrod was connected to the aft bellcrank and its respective aft bellcrank link. The length of the left aft pushrod was 20.53 inches, and the length of the right aft pushrod was 20.44 inches. Most of the structure that contained the rig pin holes for the aft bellcrank was missing, and the part that remained was heavily fire damaged. The left tension spring was found with its upper end attached to its attachment link and its lower end attached to structure. The right tension spring was found with its upper end separated from its attachment link and its lower end attached to structure. Examination of the right tension spring at the Safety Board’s Materials Laboratory showed partial surface melting of the bellcrank adjacent to the right spring attachment link (the upper end of the spring) and some resolidified metal adjacent to the lower end of the spring. Magnified visual examination of the unattached end of the right spring and the right attachment link showed no evidence of unusual wear patterns, scratching, or other damage related to the separation of the spring from the link.55 The elevator control cables generally had numerous bends and kinks. Two of the elevator AND cable’s seven spirally wound strands were completely broken and unwound, and one strand was partially broken and unwound. (These strands were located near the trailing edge of the wing, where the fuselage had folded toward the right wing tip.) The unwound sections of the cable were examined at the Safety Board’s Materials Laboratory, and no evidence of fatigue cracking or a preexisting condition was found. The ANU turnbuckle was almost fully contracted, and the AND turnbuckle was almost fully extended. The measurement from the center of the tooling hole in one threaded cable terminal to the center of the tooling hole in the other cable terminal was 5.54 inches for the ANU turnbuckle and 7.30 inches for the AND turnbuckle. In addition, the AND turnbuckle had one thread visible, and the ANU turnbuckle did not have any threads visible. Figure 6 shows the turnbuckles as found in the wreckage and a drawing that shows a turnbuckle barrel and threaded cable terminals. 55 During ground tests on January 21 and 22, 2003, a tension spring was disconnected from the test airplane to determine the effect of a disconnected spring on the forces felt at the control column. This test revealed that about 6 additional pounds of force were required to move the control column forward.

Factual Information 38 Aircraft Accident Report The AND turnbuckle was extended 1.76 inches more than the ANU turnbuckle. After the accident, Air Midwest surveyed its entire fleet of 42 Beech 1900D airplanes, which represented 25 percent of the 164 Beech 1900D airplanes active in the North American fleet. Air Midwest data submitted to the Safety Board indicated that, on average, the AND turnbuckle was extended 0.04 inch less than the ANU turnbuckle. The forward bellcrank had fractured into two pieces, and the fractured surface did not exhibit the soot that covered the bellcrank side surfaces and surrounding structure. The forward bellcrank forward (AND) stop bolt was bent and measured 0.93 inch in length. The control cables and the aft end of the forward push-pull tube were attached to the forward bellcrank. The forward push-pull tube and rod end were bent. The push-pull tube was measured in segments at the Safety Board’s Materials Laboratory, and the total length of the rod was 15.33 inches. The rod end had six threads visible.56 Figure 6. Turnbuckles as found in the wreckage. 56 The number of visible threads can differ among Beech 1900D airplanes.

Factual Information 39 Aircraft Accident Report The control column was dented and slightly crushed but was intact. The left and right pivot bearings were found in the wreckage. The captain’s and the first officer’s control column shaft and support assemblies had separated from the forward subpanel structure, and their control wheels had separated from the control column shaft assembly. The roller slider assemblies contained within the captain’s control column support assembly were burned; the shaft was displaced away from the center of the rollers, and the slider rollers were unable to rotate. The roller slider assemblies contained within the first officer’s control column support assembly were able to rotate. The roller containing an eccentric screw rotated freely on its bearing, and a clearance of about 0.06 inch existed between the rollers and the control column shaft assembly.57 The bob weight and its surrounding structure were displaced from their normally rigged positions and exhibited impact damage that was consistent with the impact damage found on the nose of the airplane. The gap between the head of the stop bolt and the bob weight could not be measured because of the severe impact damage in that area. 1.12.4.1 Pitch Trim Control System The elevator trim tab control wheel was intact and was attached in the cockpit. The pitch trim appeared to be near the full AND position. The pitch trim control cables were broken. The control cables were in the correct orientation. The left and right drums had their respective cables wrapped around to the middle position. 1.13 Medical and Pathological Information Tissue specimens from the captain and the first officer tested negative for ethanol and a wide range of drugs, including major drugs of abuse. Postaccident drug tests on the two ramp agents who handled the accident flight and their supervisor as well as the mechanic and the quality assurance inspector who worked on the accident airplane were negative for drugs of abuse.58 1.14 Fire No evidence of an in-flight fire was found. A postcrash fire developed after airplane impact. According to interviews with ARFF personnel and a videotape taken by the CFD and the Charlotte-Mecklenburg Police Department, the main fire was at the wreckage site, and spot fires occurred along the grass strip on the parking lot side of the airport perimeter fence and in a gully south of the accident site. Thick black smoke emanated from the southwest corner of the US Airways hangar. ARFF personnel estimated that it took about 3 minutes of AFFF application to knock down the main fire. 57 The Beech 1900D AMM specifies a 0.01-inch gap between the rollers and the control column shaft assembly. 58 Urine samples were obtained on January 8, 2003, at 1530 for one ramp agent, 1745 for the other ramp agent, 1230 for their supervisor, and 1542 for the quality assurance inspector. The mechanic’s urine sample was obtained on January 9, 2003, at 1000.

Factual Information 40 Aircraft Accident Report 1.15 Survival Aspects Autopsy results from the Mecklenburg County Medical Examiner indicated that the cause of death for all of the airplane occupants was “multiple blunt force injuries due to airplane crash.” The captain’s body was found about 4 feet in front of the cockpit wreckage. The medical examiner did not find any significant markings on her torso that would have been left by the lapbelt or shoulder harness on airplane impact. The first officer was found restrained in his seat with his lapbelt and shoulder harness buckled. 1.15.1 Emergency Response According to the crash phone transcript,59 the crash alarm sounded at ARFF Station 17, the CLT Airport Operations Center, and the North Carolina Air National Guard about 0847:28. The ground control east controller stated, about 0847:37, “an emergency…landing right now at the US Air maintenance ramp…right at the corner of the building…there’s a fire.” About 0847:47, a CFD firefighter at the ARFF station asked the controller what type of airplane had crashed and, about 0847:49, whether the airplane was commercial or small. About 0847:52, the controller responded that the airplane was a Gulfstream III. About 0847:55, the controller stated, “no no no,” and a hangup sound was recorded. One second later, the controller stated that a Beech 1900 had crashed, but, in a postaccident interview, the controller indicated that she was not able to complete this transmission before the hangup sound occurred. About 0848:31, an ARFF captain notified the CFD dispatch center of the airplane crash. The CFD dispatch center then dispatched CFD fire rescue personnel and notified the Charlotte-Mecklenburg Police Department and Mecklenburg Emergency Medical Service dispatch center.60 Four ARFF vehicles (Blaze 1, Blaze 2, Blaze 5, and Blaze 7) and nine ARFF personnel responded to the initial call to the ARFF station. Blaze 2 had a speed restriction of 30 mph during emergency operations because the hubs on the vehicle were subject to a U.S. Air Force restriction notice.61 One of the firefighters aboard Blaze 2 reported that the vehicle traveled to the accident site at a speed of about 50 mph. In addition, Engine 30, with four ARFF personnel, responded to the initial call. Engine 30 is normally based at the off-airport fire station that responds to emergencies on 59 The crash phone transmissions were recorded in the CLT Airport Operations Center. 60 CFD was also responsible for notifying the Charlotte-Mecklenburg Emergency Management Office, which was responsible for notifying the American Red Cross and the North Carolina Department of Emergency Management. The Mecklenburg Emergency Medical Service was responsible for notifying area hospitals and dispatching area ambulances, medical evacuation helicopters, triage teams, medical examiners, medical mutual aid responders, and volunteer departments. 61 In March 1998, the U.S. Air Force issued a restriction notice for all P-23 trucks (such as Blaze 2) in its fleet because of an increasing number of hub axle failures. Although the P-23 truck, an eight-wheel-drive vehicle, would remain stable in the event of a hub axle failure, the Air Force determined that a separated wheel resulting from the failure could be dangerous to people near the truck at the time.

Factual Information 41 Aircraft Accident Report airport property but was at Station 17 in place of Engine 17, which was at training. Engine 17, with four ARFF personnel, left training to respond to the accident. CFD radio logs indicated that the first ARFF unit arrived at the accident site about 0849:10, about 1 minute 42 seconds after the time of the crash alarm.62 A captain from ARFF Station 17 was the initial fire incident commander at the accident site. He established a staging area for emergency response vehicles at gate 17, an access point along the airport perimeter fence, and an initial triage area on a taxiway southwest of the accident site. The staging area location was later changed to gate 66 when it was determined that the accident site was located closer to that gate. ARFF personnel indicated that the first unit on scene (Blaze 2) was directed to disperse AFFF from the turret nozzle located on the top of the vehicle’s cab. The initial dispersion consisted of two or three sweeps of the main wreckage area. The ARFF personnel paused for the visibility to clear and then dispersed AFFF during two more sweeps. Afterward, ARFF personnel used hand lines from Blaze 2 and Blaze 7 to suppress and control spot fires and flareups. In addition, ARFF personnel from Engine 17 used hand lines to suppress the fire along the grass strip on the parking lot side of the airport perimeter fence and in the gully area. A CFD battalion chief arrived on scene about 0858:49 and assumed control of the accident site about 0859:21. According to the CFD radio log, a “bulk of fire knock down” call was transmitted about 0901:45. The CFD radio logs also indicated that a “fire control” call was transmitted about 0912:25, about 23 minutes after the initial dispersion of AFFF. US Airways personnel from inside the hangar responded to the accident, and ARFF personnel observed the US Airways personnel using three portable fire extinguishers. CLT Airport Law Enforcement and the Charlotte-Mecklenburg Police Department also responded to the accident. In addition, the Mecklenburg Emergency Medical Service arrived at the accident scene within 5 to 7 minutes of notification of the accident. The medical incident commander notified local area hospitals while she was en route to the accident site and set up a formal triage area near gate 66 when she arrived on scene. The CFD emergency medical service coordinator told the medical incident commander that no one had survived the accident, so the medical incident commander indicated that the additional units responding to the scene and to hospitals should return to normal operations. 62 Title 14 CFR 139.319(i) requires at least one ARFF vehicle (at airports certificated under Part 139) to be capable of achieving a 3-minute response time from the time of the alarm to the beginning of fire-fighting agent application. The ARFF vehicle is required to travel from its assigned post to “the midpoint of the furthest runway serving air carrier aircraft” or “any other specified point of comparable distance on the movement area which is available to air carriers.” All other ARFF vehicles are required to reach the same specified point and begin fire-fighting agent application within 4 minutes.

Factual Information 42 Aircraft Accident Report 1.16 Tests and Research 1.16.1 Ground Tests From July 29 to 31, 2003, the Safety Board conducted ground tests on the pitch control system of a Beech 1900D, N46YV,63 at Raytheon Aircraft Company’s Wichita facility. One purpose of the tests was to compare the test airplane’s elevator position with the pitch control position recorded on the FDR for various elevator control system configurations. Another purpose of the tests was to observe which elevator control system stops were contacted in each system configuration when the control column was pushed full forward. 1.16.1.1 Baseline Configuration For the baseline configuration, the elevator control system was rigged according to the Beech 1900D AMM revised elevator control system rigging procedure (section 27-30-02). When the control column was at neutral, the elevator deflection was 0º (as measured by Raytheon Aircraft’s master travel board), and the pitch control position recorded on the FDR was 0.1º AND. When the control column was moved full forward, the elevator deflection was 14.5º AND (as measured by the travel board), the pitch control position recorded on the FDR was 14.6º AND, and the elevator control system made contact with the primary stop at the elevator control horn. 1.16.1.2 Turnbuckle Length Adjustments The test airplane’s elevator cable turnbuckles were adjusted a total of 3.1 inches to replicate the accident airplane’s 9º AND shift. To achieve this shift, the test airplane’s elevator cable turnbuckles were adjusted to matching lengths while maintaining proper cable tension. The elevator was held at the 4º AND position (to replicate the accident airplane’s premaintenance pitch control position values during cruise flight),64 and the turnbuckles were adjusted until the FDR showed that the control column position was 13º AND (to replicate the accident airplane’s postmaintenance pitch control position cruise values). While the turnbuckles were being adjusted, the control column moved forward, and the travel board showed that the elevator did not move, as designed. When the elevator was released, the control column moved forward and stopped when the elevator reached 6.8º AND, but the pitch control position recorded on the FDR was 16.3º AND. The elevator control horns no longer made contact with the primary stops; instead, the forward bellcrank rested on the secondary stop. 63 The complete results of the July 2003 ground tests can be found in the public docket for this accident, DCA03MA022, on the Safety Board’s Web site at http://www.ntsb.gov. See the Systems Group Factual Addendum for Ground Tests at Raytheon Aircraft Company on July 29-31, 2003. On January 21 and 22, 2003, a set of less extensive ground tests was performed at Raytheon’s Wichita facility on the pitch control system of another Beech 1900D, N116YV. The results of the January 2003 ground tests can be found in the Systems Group Factual Report in the public docket for this accident. 64 The 4º AND position is typical for cruise flight.

Factual Information 43 Aircraft Accident Report 1.16.1.3 Cable Tension Adjustment Procedural Errors This test altered or omitted specific steps in the elevator control system rigging procedure. Some of these alterations or omissions were intended to replicate actions reported by the mechanic who adjusted the elevator cable tension on the accident airplane and the quality assurance inspector who was providing OJT to the mechanic. The forward and aft pushrod lengths and elevator control stop settings were adjusted so they matched those found in the accident airplane wreckage. A rig pin was installed in the aft bellcrank, and the cable tensions were released, which allowed the control column to move forward while the elevator was held at neutral by the aft rig pin. The forward bellcrank rig pin was installed without engaging the bellcrank arm. The rig pin was not in the rig pin hole of the forward bellcrank arm but was aft of the arm. The control column could not be returned from forward to neutral because the aft side of the forward bellcrank arm would contact the forward rig pin. Elevator tension was then increased by tightening the turnbuckle on the AND cable (which is located above the ANU cable). This adjustment caused the forward bellcrank to move aft until the aft side of the bellcrank arm contacted the forward rig pin. The turnbuckle barrels were then rotated to maintain this position while establishing cable tension. When the aft rig pin was removed and the control column was moved full forward, the ANU turnbuckle length was 5.12 inches, and the AND turnbuckle length was 7.70 inches. The elevator deflection was 7.7º AND (as measured by the travel board), and the pitch control position recorded on the FDR was 13.3º AND. The elevator control horns did not contact the primary stops; instead, the forward bellcrank rested on the secondary stop. 1.16.1.4 Cable Stretch This test was performed to measure the amount of cable stretch that could be introduced by applying force to the control column while the forward bellcrank engaged the secondary up and down stops. (In the misrigged position, the forward bellcrank contacted the secondary down stop.) When 120 pounds of forward force was applied to the control column, the FDR recorded a column position that was 0.5º AND beyond the point at which the elevator stopped moving. The amount of aft force required to pull the control column from its resting position to the up stop was 37 pounds. When an additional 87 pounds of aft force was applied to the control column, the FDR recorded a column position that was 2.4º ANU beyond the point at which the elevator stopped moving. 1.16.2 Airplane Performance Study The Safety Board conducted an airplane performance study for the accident airplane.65 The study included a weight and balance study, a load manifest study, an elevator control authority study, and Beech 1900D simulations. As part of the study, ATC transcript, ATC radar, CVR transcript, and FDR data were correlated to a common 65 The complete airplane performance study can be found in the public docket for this accident, DCA03MA022, on the Safety Board’s Web site.

Factual Information 44 Aircraft Accident Report reference time. The airplane performance study determined that the accident airplane’s actual weight was 17,700 ±200 pounds and that the accident airplane’s actual CG position was 45.5 ±2 percent MAC. The study also determined that the actual elevator travel available was from about 20º ANU to about 7º AND and that about 9º to 10º AND elevator was required to establish a controlled climb at the accident airplane’s actual weight and CG position. The study results are discussed in detail in sections 1.16.2.1 through 1.16.2.4. 1.16.2.1 Flight 5481 Weight and Balance Study The Safety Board calculated the accident airplane’s weight using three methods: the Air Midwest weight and balance program, which was used by the flight crew (see section 1.16.2.1.1); an airplane component buildup based on the available physical evidence (see section 1.16.2.1.2); and an analysis of the airplane’s takeoff ground roll dynamics using FDR data (see section 1.16.2.1.3). The Board calculated the accident airplane’s balance by distributing the calculated airplane weight according to available component weight and component location information. 1.16.2.1.1 Air Midwest Weight and Balance Program The load manifest for flight 5481 indicated that the airplane had a calculated gross takeoff weight of 17,028 pounds and a calculated CG position of 37.8 percent MAC. According to the Air Midwest weight and balance program at the time of the accident, flight 5481 was operating within the Beech 1900D weight and CG envelope (17,120 pounds and 40 percent MAC, respectively). If the extra weight of the two reportedly heavy bags (see section 1.1) had been included in the Air Midwest weight and balance program calculation, flight 5481 would have had a gross takeoff weight of 17,078 pounds and a CG position of 38.8 percent MAC. Also, if the Air Midwest weight and balance program calculation had accounted for the two reportedly heavy bags, estimated an additional 110 pounds of fuel at takeoff,66 and recorded the 12-year-old passenger’s weight as 80 pounds rather than 175 pounds,67 flight 5481 would have had a gross takeoff weight of 17,093 pounds and a CG position of 38.8 percent MAC. Thus, under these two scenarios, flight 5481 would still have been operating within the Beech 1900D weight and CG envelope. 1.16.2.1.2 Airplane Component Buildup Method The Safety Board calculated the weight and balance for flight 5481 by adding the airplane component weights, which included the empty weight; the crew weight, including crew baggage; the passenger weight, including carry-on baggage; the cargo 66 The flight 5481 dispatch release indicated that the airplane was loaded with 2,420 pounds of fuel before takeoff. Given Air Midwest’s taxi fuel burn assumption of 110 pounds, the airplane would have had 2,310 pounds of fuel at takeoff. The load manifest indicated 2,200 pounds of fuel at takeoff. 67 The Air Midwest Flight Operations Procedures Manual at the time of the accident (see section 1.18.1.2) stated that an average weight of 175 pounds could be used for each adult passenger during the winter and that an average weight of 80 pounds could be used for children between the ages of 2 and 12 years.

Factual Information 45 Aircraft Accident Report weight (in the coat closet and the AFT1 and AFT2 cargo compartments); and the fuel weight. The information sources for the airplane component weights used in the Board’s weight and balance study are shown in table 3. Table 3. Information sources for airplane component weights. Note: The Air Midwest average weight program in effect at the time of the accident is discussed in section 1.18.1.2. The results of the airplane component buildup method for flight 5481’s weight and CG position were based on the following: the airplane operating empty weight reported on maintenance records; the flight crew and passenger weights documented by the medical examiner; the dry weight of personal effects and the dry weight of checked, carry-on, and crew baggage;68 45 pounds in the AFT2 cargo compartment (the actual weight of a tire stored in the compartment); 10 pounds in the coat closet; and 2,310 pounds of fuel. On the basis of this information, the Safety Board estimated that flight 5481 had a minimum gross takeoff weight of 17,443 pounds and a CG position of 43.3 percent MAC, which was outside of the Beech 1900D weight and CG envelope. Component Air Midwest average weights Medical examiner FAA medical certificate Next of kin Wreckage evidence Actual weights Load manifest Dispatch release Airplane empty weight X Crew weight X X X Crew baggage weight X X Passenger weight X X X Carry-on baggage weight X X Checked baggage weight (AFT1) X X Cargo weight (AFT2) X Coat closet weight X Fuel weight X 68 The weight of checked, carry-on, and crew baggage; personal effects; and manuals and logs was 1,384 pounds. Because the weight for these items included the weight of AFFF, the items were dried and reweighed, and the dry weight was 1,199 pounds.

Factual Information 46 Aircraft Accident Report 1.16.2.1.3 Takeoff Ground Roll Weight Analysis Because the accident airplane was partially consumed by a postcrash fire, some of the wreckage evidence was not recoverable. As a result, the Safety Board used FDR data from the accident flight and a model of the airplane’s takeoff ground roll dynamics to calculate the airplane’s actual weight. The accident airplane’s weight during takeoff was calculated by evaluating the forces and moments on the airplane during the takeoff ground roll. Engine, groundspeed, and downrange distance data provided by Raytheon Aircraft Company for three Beech 1900D flight test takeoffs were used to validate this approach. As shown in table 4, the Safety Board’s force and moment model predicted the actual flight test airplane weights within about ±200 pounds for groundspeeds between the 70- and 100-knot range. Table 4. Validation of takeoff ground roll model. The accident flight’s weight was subsequently derived using FDR data for the left and right engine rpm, right engine torque, altitude, airspeed, and corrected longitudinal acceleration.69 Thrust was calculated using the FDR airspeed and the radar-derived groundspeed data. Because of the lack of reliable FDR data for left engine torque, FDR right engine torque data were used for both of the engines. The FDR left and right engine rpm values were averaged to define the propeller rpm. On the basis of these FDR data, radar data, the validated force and moment model, and component weight and location information, the Safety Board determined that the accident airplane had an actual weight of 17,700 ±200 pounds and an actual CG position of 45.5 ±2 percent MAC. Figure 7 shows the results of the Board’s calculations overlaid on the Beech 1900D weight and CG envelope. Flight test identifier Raytheon Aircraft Company flight test weight (pounds) Safety Board calculated weight (pounds) Difference (pounds) 1 17,300 17,510 +210 2 17,510 17,460 -50 3 13,860 14,010 +150 69 The FDR longitudinal acceleration was corrected with a bias term calculated to provide the best accelerometer integration match for altitude, groundspeed, and position.

Factual Information 47 Aircraft Accident Report 1.16.2.2 Load Manifest Study The Safety Board reviewed load manifest data for 86 flights of the accident airplane that occurred between December 22, 2002, and January 8, 2003, and identified 9 flights that were documented to be similarly loaded to the accident flight. As shown in table 5, flight 5512 on December 27, 2002, was the most closely loaded to the accident flight. FDR data from flight 5512 were used (along with other data) to validate the Board’s Beech 1900D simulator and kinematics extraction tool (see section 1.16.2.4). Figure 7. Weight and center of gravity information for flight 5481.

Factual Information 48 Aircraft Accident Report Table 5. Flights documented to be similarly loaded to the accident flight. Note: The accident flight appears in bold face print. a The CG indexes that correspond to these CG positions are 81, 70, 69, 74, 72, 75, 81, 67, 67, and 72, respectively. b This figure includes the 10-pound addition error made by the flight crew on the load manifest form. c One of the 15 passengers was a child between 2 and 12 years of age. In calculating the weight and balance of the airplane, the flight crew used the weight figure for children between 2 and 12 years of age for this passenger (80 pounds). 1.16.2.3 Elevator Control Authority Study The Safety Board conducted an elevator control authority study based on data from the accident airplane’s FDR to determine (1) the relationship between the FDR pitch control position and the actual elevator position and the change in that relationship before and after the D6 maintenance check and (2) the elevator travel that was available after maintenance. The results of the elevator control authority study are discussed in sections 1.16.2.3.1 and 1.16.2.3.2, respectively. 1.16.2.3.1 Relationship Between Pitch Control Position and Actual Elevator Position The Safety Board analyzed the pitch control position and pitch trim control position data that were recorded during the climb and cruise portions of 84 flights available on the accident airplane’s FDR.70 The flight phase (climb or cruise) and the Date Flight number and route Gross takeoff weight (pounds) CG (percent MAC)a Number of passengers Cargo (pounds) 01-08-03 5481/CLT-GSP 17,028b 37.8 19 820 01-06-03 5515/GSP-CLT 16,393 34.2 19 595 01-02-03 5464/HTS-CLT 16,444 33.8 15 546 12-29-02 5464/HTS-CLT 16,883 35.4 19 670 12-29-02 5573/AHN-CLT 16,528 34.9 18 745 12-27-02 5464/HTS-CLT 16,893 35.7 18 770 12-27-02 5512/LYH-CLT 17,018 37.8 19 820 12-22-02 5576/CLT-HTS 16,598 33.0 15c 645 12-22-02 5464/CLT-HTS 17,019 32.7 17 656 12-22-02 5573/AHN-CLT 16,433 34.9 18 695 70 As indicated in section 1.16.2.2, the accident airplane made 86 flights between December 22, 2002, and January 8, 2003. FDR climb and cruise data with the airplane in a clean configuration (that is, gear up and flaps up) were available for 84 of those flights.

Factual Information 49 Aircraft Accident Report flight date (before or after the D6 maintenance check) were recorded for each FDR pitch control position and pitch trim control position data pair. Raytheon Aircraft Company provided flight test certification data for elevator and elevator trim tab climb and cruise positions for various Beech 1900D weights and CG positions. These data were used to verify the absolute position of the accident airplane’s elevator for a given FDR pitch control position and pitch trim control position pair. The position of the trim tab is the predominant predictor of elevator position during climb and cruise flight. Figure 8 shows that a strong correlation exists between elevator (FDR pitch control position) and trim tab (FDR pitch trim control) data. The figure shows two distinct data groups: the larger group represents flights before the D6 maintenance check, and the smaller group represents flights after the D6 maintenance check. The larger group of data shown in figure 8 (that is, the flights before D6 maintenance) compared well with the Beech 1900D flight test certification data, indicating that the premaintenance FDR pitch control position data represented the actual elevator position to within about 1°. However, the smaller group of data (that is, the flights Figure 8. Flight data recorder pitch control and pitch trim control positions.

Factual Information 50 Aircraft Accident Report after D6 maintenance) showed that, for a given pitch trim control position value, the postmaintenance pitch control position value was shifted about 9° AND compared with the premaintenance pitch control position value. The flight conditions (that is, altitude, airspeed, weight, and CG) associated with the postmaintenance flights are similar to the flight conditions associated with the premaintenance flights. Thus, the actual elevator position as a function of trim tab position for all 84 flights was consistent, despite the 9° AND shift in indicated elevator position (FDR pitch control position) for the group of postmaintenance flights. 1.16.2.3.2 Available Elevator Travel The Safety Board assumed that the D6 maintenance check did not affect the accident airplane’s elevator hinge moment characteristics, the elevator trim tab hinge moment characteristics, or the relationship between the elevator trim tab and the elevator. With the use of these assumptions, FDR pitch control and pitch trim control data for the flights before the accident flight, and Raytheon Aircraft Company’s flight test certification data (see section 1.16.2.3.1), the Board derived the accident airplane’s actual elevator travel range for the accident flight. The minimum and maximum FDR pitch control position values recorded during the preflight elevator control checks for the 10 flights that occurred after the D6 maintenance check defined the postmaintenance indicated elevator travel range. The actual elevator travel range was determined by plotting the postmaintenance indicated elevator position (FDR pitch control position) against the postmaintenance actual elevator position for the given FDR pitch trim control position. For example, as shown in figure 8, a postmaintenance FDR pitch trim control position of 0º corresponded to an indicated elevator position (FDR pitch control position) of about 13.5º AND and an actual elevator position of 4.5º AND. Figure 9 shows flight 5481’s indicated elevator position as a function of its actual elevator position. The maximum forward postmaintenance indicated elevator (FDR pitch control position) of 16.5º AND resulted in a maximum forward postmaintenance actual elevator position of about 7º AND. The maximum aft postmaintenance indicated elevator position of 15.1º ANU resulted in a maximum aft postmaintenance actual elevator position of about 21º ANU. The maximum forward premaintenance indicated elevator position of 15.6º AND resulted in a maximum forward premaintenance actual elevator position of 14.7º AND. The maximum aft premaintenance indicated elevator position of 20.1º ANU resulted in a maximum aft premaintenance actual elevator position of 21º ANU. 1.16.2.4 Beech 1900D Simulation Studies The Safety Board requested and obtained Beech 1900D linearized aerodynamic, propulsion, and mechanical models from Raytheon Aircraft Company. The models and their supporting data were used to develop a Beech 1900D simulation capability and a complementary kinematics extraction tool. Simulation results were compared with flight test certification data provided by Raytheon Aircraft Company to validate the models and their implementation.

Factual Information 51 Aircraft Accident Report The Safety Board’s Beech 1900D simulator was subsequently used to derive the elevator required to (1) match the accident airplane’s flight motion recorded on the FDR using the actual airplane weight and CG position and (2) establish controlled flight from an initial upset condition defined by the accident flight profile using the actual airplane weight and CG position. The results of the simulation studies are presented in sections 1.16.2.4.1 and 1.16.2.4.2, and the results of the kinematics extraction are presented in sections 1.16.2.4.3 and 1.16.2.4.4. 1.16.2.4.1 Elevator Required to Match Accident Flight Data The Safety Board’s simulator requires that the aircraft flight condition (altitude, airspeed, weight, and CG), the configuration (flaps and gear), the flight control inputs or control surface inputs, and engine data be specified.71 The aerodynamic, propulsion, and mechanical models were used to compute the forces and moments acting on the airplane. The integration of the governing equations of motion yielded the resulting aircraft motion as a function of time. Figure 9. Elevator travel available before and after the detail six maintenance check. 71 The flight control inputs are the control column, control wheel, rudder pedal, and their respective trim settings. The control surface inputs are the elevator, aileron, rudder, and their respective tab positions. The engine data consist of throttle, torque, and propeller rpm.

Factual Information 52 Aircraft Accident Report Unless otherwise noted, the accident flight simulations used an airplane weight of 17,700 pounds and a CG position of 45.5 percent MAC (based on the results of the Safety Board’s weight and balance work). Simulator values for engine torque, propeller rpm, elevator trim tab, and flap position were defined by FDR data from the accident airplane. Elevator, control wheel, and rudder pedal positions were defined as a function of time to match the FDR altitude, airspeed, and attitude data. Simulation results were compared with FDR and FDR-derived data for the portion of the flight from the takeoff ground roll to shortly before the sound of the stall warning horn recorded on the CVR (at 0847:10.8). The simulation indicated that the accident airplane’s uncontrolled pitch maneuver could be reproduced with an elevator position that was limited to a constant value of about 8º AND. 1.16.2.4.2 Elevator Required to Establish Controlled Flight The Safety Board evaluated the elevator required to establish controlled flight from an initial upset condition defined by the data from the accident airplane’s FDR and CVR. FDR data indicated that, during the uncontrolled pitch maneuver, the flight crew was commanding AND inputs to stabilize the airplane’s pitch attitude while maintaining the airplane’s power (engine torque and propeller rpm) and trim tab and flap settings. These AND commands corresponded with the first officer’s comment, “wuh,” at 0847:02.1; the captain’s comment, “oh,” at 0847:02.2; and evidence that the landing gear had been completely stowed. The Beech 1900D simulation indicated that the airplane required an elevator position of about 9.5º AND to recover from the initial upset and establish controlled flight at a nearly constant 15º pitch attitude. 1.16.2.4.3 Kinematics Extraction The Safety Board’s kinematics extraction tool requires that the aircraft motion (accelerations and attitudes), flight condition, and configuration be specified. The kinematics extraction tool then calculates the control or control surface inputs required to produce the specified aircraft motion. For the flight 5481 accident investigation, the kinematics extraction tool was used to calculate the elevator time histories for four flight segments flown by the accident airplane before the D6 maintenance check, two flight segments flown by the accident airplane after the D6 maintenance check, and the accident flight. The extracted elevator time histories were compared with the elevator time histories recorded on the accident airplane’s FDR. The kinematics extraction results showed that the airplane’s premaintenance pitch control position matched the extracted elevator time history within about 1º for a range of airplane weights and CG positions, as previously confirmed by Raytheon Aircraft Company’s flight test certification data (see section 1.16.2.3.1). The results also confirmed that the postmaintenance pitch control position was offset from the actual elevator position by about 9º AND. Moreover, an actual elevator position of 6º to 6.5º AND was required for the postmaintenance flight before the accident flight that was the most heavily loaded and had the most aft CG position.

Factual Information 53 Aircraft Accident Report The kinematics extraction for the accident flight determined the flight control deflections required to produce the airplane motion recorded on the FDR. As with the results of the simulation, about 8º of AND elevator was required to reproduce the motion recorded during the airplane’s uncontrolled pitch maneuver. The accident airplane’s motion during takeoff was input into the Safety Board’s kinematics extraction tool to calculate the elevator sensitivity to CG position for a fixed airplane weight of 17,700 pounds and CG positions of 43.5, 45.5, and 47.5 percent MAC. The calculation showed that elevator positions of about 7º, 8º, and 9º AND were required to reproduce the uncontrolled pitch maneuver for CG positions of 43.5, 45.5, and 47.5 percent MAC, respectively. A 2-percent CG shift in this range required slightly less than 1º of elevator to trim. The kinematics extraction tool was then used to calculate the elevator sensitivity to the accident airplane’s weight for a fixed CG position of 45.5 percent MAC and weights of 17,500, 17,700, and 17,900 pounds. This calculation verified that the weight magnitude had little to no effect on the elevator required to reproduce the accident airplane’s uncontrolled pitch maneuver. 1.16.2.4.4 Simulator Trims The simulation was also used to calculate the Beech 1900D speed stability for the following conditions: (1) trimmed power for level, free air flight; flaps 17.5º; and gear deployed; (2) reduced takeoff power, flaps 17.5º, gear deployed, and free air flight (to determine the effects of power); (3) reduced takeoff power, flaps 17.5º, gear stowed, and free air flight (to determine the effects of landing gear position); and (4) reduced takeoff power, flaps 17.5º, gear stowed, full trim tab AND, and free air flight (to determine the effects of trim tab position). Condition number 4 simulated the accident airplane’s configuration during the uncontrolled pitch maneuver. The Safety Board determined that elevator positions of between 7.5º and 8.5º AND were required to match the airplane’s motion and that elevator positions of between 9º and 10º AND were required to trim the airplane.

Factual Information 54 Aircraft Accident Report 1.17 Organizational and Management Information 1.17.1 Air Midwest Air Midwest, Inc., is a domestic Part 121 air carrier based in Wichita. The company was founded in May 1965 and became a wholly owned subsidiary of Mesa Air Group,72 which is based in Phoenix, Arizona, in 1991. At the time of the accident, the airline had 743 employees and 43 Beech 1900D 19-seat airplanes (including the accident airplane). The airline operated its fleet under code-share agreements with US Airways Express, America West Express, Mesa Airlines, and Midwest Express (now known as Midwest Airlines), with 389 daily departures to 72 destinations. Air Midwest conducted its maintenance program according to guidance in three company manuals: Manual 210, Maintenance Procedures Manual; Manual 240, Maintenance Training Manual; and Manual 260, Maintenance Program Manual.73 Mechanics working on Air Midwest airplanes at the contract maintenance stations (HTS; Dubois, Pennsylvania; Farmington, New Mexico; Little Rock, Arkansas; and Panama City, Florida) were required to be familiar with the policies and procedures in these manuals.74 Although Air Midwest’s maintenance work was distributed among regional main- tenance stations and was performed exclusively by contracted maintenance personnel, the air carrier remained responsible for the airworthiness of its airplanes and all of the mainte- nance performed. Specifically, 14 CFR 121.363 states that an air carrier is responsible for ensuring the airworthiness of the aircraft it operates and that an air carrier is not relieved of this responsibility when maintenance is contracted to another party. Also, AC 120-16D, “Continuous Airworthiness Maintenance Programs,” states the following: 75 72 According to a July 11, 2002, press release posted on the Mesa Air Group Web site (http://www.mesa-air.com), Mesa Air Group was awarded a contract by the Department of Transportation in July 2002 for seven new essential air service markets in Arkansas, Oklahoma, and Texas. (The essential air service program ensured that, after the Airline Deregulation Act was enacted in 1978, smaller communities would retain a link to the national air transportation system.) The new markets include Enid and Ponca City, Oklahoma; Brownwood, Texas; and Harrison, Hot Springs, El Dorado/Camden, and Jonesboro, Arkansas. According to the press release, the air service was to be provided beginning in the fall of 2002 by Air Midwest operating as Mesa Airlines, and four Beech 1900D airplanes were dedicated to the new routes. Also, Mesa Air Group would receive a federally guaranteed subsidy of $13.4 million for providing this air service during the 2-year term of the contract. 73 Title 14 CFR 121.367(a) states that aircraft maintenance, preventive maintenance, and alterations are to be performed in accordance with operators’ maintenance manuals. Title 14 CFR 121.369(b) states that operators’ maintenance manuals must describe the method to be followed in performing routine and nonroutine maintenance, preventive maintenance, and alterations and the method to be followed in performing RII inspections. Title 14 CFR 25.1529 requires manufacturers to prepare “Instructions for Continued Airworthiness” for operators of transport-category airplanes. Appendix H of Part 25 contains these instructions, which often become the basis for the operators’ maintenance manuals required by Section 121.369. 74 Air carriers are required by 14 CFR 121.367(b) to ensure the competence of their maintenance personnel for the proper performance of maintenance, preventive maintenance, and alterations. 75 Additional information about AC 120-16D appears in section 1.17.4.1.

Factual Information 55 Aircraft Accident Report As an air carrier, you are responsible for the maintenance of your aircraft. Under FAA’s regulations, you must perform and/or approve all maintenance alterations on your aircraft. You may arrange for a maintenance provider, such as a repair station, to perform your maintenance for you. However, you retain responsibility for the performance and approval of that maintenance even if someone else performs the work for you….The air carrier also has the option to authorize another person to perform the maintenance, but the maintenance must be carried out in accordance with the air carrier’s maintenance program and maintenance manual. The air carrier still retains the responsibility for the proper accomplishment of the maintenance. According to the Air Midwest regional site manager at HTS, the regional site manager at each contract maintenance station is responsible for quality control functions. These functions include reviewing all maintenance and engineering paperwork to ensure that it meets Air Midwest standards. This paperwork is forwarded to company headquarters on Mondays, Wednesdays, and Fridays. The regional site managers are also responsible for performing station and fuel audits to ensure that the contractors adhere to Air Midwest standards. In addition, the regional site managers conduct indoctrination training. (See section 1.17.1.1 for more information about Air Midwest’s maintenance training program.) The regional site managers report to the Air Midwest Chief Inspector/Director of Quality Assurance. As indicated in section 1.5.3.5, the Air Midwest regional site manager at HTS worked the day shift at the time of the accident. His tasks included receiving verbal briefings from the foreman regarding the previous night’s assignments; taking part in 0900, 0930, and 1600 maintenance calls with the other regional site managers and upper-level managers from Air Midwest and RALLC; and reviewing maintenance paperwork and OJT records for quality and accuracy. He stated that he did not typically have direct contact with mechanics except when he was providing training or was correcting problems with paperwork. The Air Midwest regional site manager stated that he had “no authority over anybody.” For example, if he had a problem with the mechanics or their paperwork, he would have to notify the RALLC site manager, who then would raise the issue with the mechanic and take appropriate action. There is no backup for the Air Midwest regional site manager position at HTS. If the regional site manager is not there for an extended period, Air Midwest either sends a regional site manager from another station to cover the HTS site manager’s duties or the paperwork that is normally reviewed at HTS by the site manager and sent to Wichita every Monday, Wednesday, and Friday is sent directly to Wichita for review instead. 1.17.1.1 Air Midwest Maintenance Training Program Air Midwest is responsible for conducting its maintenance training program in accordance with 14 CFR 121.375, which requires airline maintenance training programs to “ensure that each person (including inspection personnel) who determines the adequacy of work done is fully informed about procedures and techniques and new equipment in use and is competent to perform his duties.” The Vice President/Director of Maintenance and

Factual Information 56 Aircraft Accident Report the Chief Inspector/Director of Quality Assurance are both responsible for ensuring that all required training is performed. The Maintenance Training Coordinator ensures that training records are properly retained, develops training and testing programs, oversees indoctrination training, and ensures that OJT is completed and recorded in a timely manner. As stated in section 1.17.1, the Air Midwest regional site manager at each of the contract maintenance stations is responsible for conducting indoctrination training for all employees, including contractors. The training, which lasts 4 hours, is presented to employees before they begin work for Air Midwest. The purpose of the training is to familiarize the employees with Air Midwest’s paperwork, tooling, equipment, safety policies, and training practices. The employees take a written, 50-question, open-book test at the end of the training session; a grade of 70 percent is a passing score. Quality assurance inspectors, foremen, and mechanics are required to take the test each year to make sure that they have retained the information that was taught during indoctrination training. The regional site manager forwards indoctrination training records to the Maintenance Training Coordinator. Air Midwest does not provide Beech 1900D familiarization classroom training. All airplane-specific training is learned through OJT.76 According to Air Midwest’s Maintenance Training Manual, OJT will be used to learn and demonstrate knowledge and practical skills of normal job related duties. OJT training will be performed under the guidance of a qualified technician or staff member. The OJT will use practical situations found everyday [sic] on the job. The person providing the training shall have documentation of previously completed OJT training. 1.17.1.2 Huntington Maintenance Station Operations Air Midwest opened the HTS maintenance station in July 2002 after the airline took over routes previously operated by CC Air, which was owned by the Mesa Air Group. Figure 10 shows the organizational structure of Air Midwest’s HTS maintenance station operations. 76 According to training records for HTS maintenance personnel, only one of the quality assurance inspectors had received formal systems training before his employment with RALLC.

Factual Information 57 Aircraft Accident Report During weekdays at HTS, the overnight shift started about 2200, an airplane arrived about 2230, and the shift ended about 0630. During weekends at HTS, the overnight shift started about 1800; an airplane arrived about 1830; and the shift ended between about 0200 and 0400, depending on the workload. Between five and seven maintenance personnel normally worked the overnight shift. The maintenance personnel indicated that they would remain on duty until the work was completed and that they were not pressured to return an airplane to service. The RALLC site manager stated that the workload at HTS was “fairly stable.” He indicated that HTS was scheduled for one airplane per night and that a detail check would normally be scheduled only on 1 or 2 nights per week. The workload was managed according to Air Midwest maintenance control’s 3-day forecast. Seven maintenance personnel (a quality assurance inspector, a foreman, and five mechanics) were on duty when the accident airplane received its D6 maintenance check on January 6, 2003. The quality assurance inspector and the foreman had been employed at HTS since it opened in July 2002. The five mechanics had been employed at HTS between 2 and 7 weeks. The quality assurance inspector and the foreman had completed Figure 10. Organizational structure of Air Midwest’s Huntington, West Virginia, maintenance station operations. SMART Mechanics HTS Raytheon Aerospace Foreman HTS Raytheon Aerospace Site Manager HTS Raytheon Aerospace RAMS Operations Manager Little Rock, Arkansas Air Midwest Regional Site Manager HTS Raytheon Aerospace Quality Assurance Inspector HTS Raytheon Aerospace RAMS Quality Assurance Manager Panama City, Florida Raytheon Aerospace RAMS Executive Program Manager, Airline Support Madison, Mississippi Air Midwest Chief Inspector/ Director of Quality Assurance Wichita, Kansas Air Midwest Vice President/Director of Maintenance Wichita, Kansas Note: RAMS, Regional Airline Maintenance Service.

Factual Information 58 Aircraft Accident Report training for the D6 maintenance check, but the five mechanics had not completed the training. The Air Midwest regional site manager stated that HTS had experienced a high turnover of its mechanic workforce. The RALLC site manager at HTS estimated that the average tenure for SMART employees was about 3 months. Both site managers indicated that the turnover occurred because mechanics received better contracts, wanted to work closer to their home, or wanted to work in another part of the country. The RALLC site manager did not think that there was any difference in the attitude, tenacity, skills, or competency between RALLC and SMART employees but thought that RALLC employees might have a greater level of commitment to the company. The Air Midwest regional site manager also did not think that there was any difference between RALLC and SMART employees, except that SMART personnel “come in for a couple months and leave.” 1.17.1.3 Air Midwest Audits of the Huntington Maintenance Station On November 5, 2002, an Air Midwest auditor from Wichita conducted an audit of the HTS maintenance station using the Air Midwest maintenance station audit guide checklist. One item on the checklist was to determine whether proper training was being provided for new hires, training records were being kept up to date, and proper recurrent training was being provided. The auditor found that those areas were satisfactory. The auditor also determined that overall staffing was not sufficient. Specifically, the auditor indicated on the checklist that HTS had only one foreman and one quality assurance inspector but should have two foremen and two inspectors. A letter from Air Midwest’s quality assurance auditor, dated November 21, 2002, to the RALLC site manager detailed the audit findings and indicated that HTS had 30 days to respond to the findings. The letter also stated that the quality assurance auditor needed to know, in writing, when resolution of the findings was complete. In a January 3, 2003, letter to the quality assurance auditor, the RALLC site manager indicated that HTS had increased its maintenance staff by 20 percent in the last month. At the public hearing on this accident, the RALLC site manager indicated that two mechanics had been hired but that an inspector and a foreman had not been hired. On January 14, 2003, an Air Midwest auditor from Wichita conducted another audit of the HTS maintenance station. The auditor had concerns about whether proper training was being provided for new hires and training records were kept up to date, whether the shift overlap was adequate and verbal turnovers were used properly, and whether sufficient staff existed for each shift. The auditor determined that maintenance manual revisions were not complete and that foremen were not ensuring that training forms were properly stamped by instructors. A letter from Air Midwest’s quality assurance auditor, dated January 17, 2003, to the Air Midwest regional site manager detailed the audit findings and indicated that HTS had 30 days to respond to the findings. In a February 20, 2003, letter to the quality assurance

Factual Information 59 Aircraft Accident Report auditor, the Air Midwest regional site manager responded to the audit findings. The letter stated that the following corrective actions had been accomplished: • All of the items on the mechanics’ OJT training that were signed off by the mechanic but not the instructor had been corrected. The Air Midwest regional site manager indicated that he explained to the mechanics that, when they sign for something in their OJT records, the instructor has to sign at the same time. • The RALLC site manager comes to work for a verbal turnover before the foreman leaves. The foreman also provides a daily written turnover. • RALLC was hiring more people so that the total number of maintenance personnel at HTS would increase from 9 to 11. • The Air Midwest regional site manager verified that all manual revisions that HTS received were added to the maintenance manuals and were properly documented. He also ensured that all manuals were up to date. 1.17.1.4 Postaccident Actions In February 2003, Air Midwest reassigned the HTS regional site manager to work the night shift so that his work schedule would be aligned with those of the RALLC and SMART maintenance personnel. (The regional site managers at the other Air Midwest maintenance stations were also reassigned to work the night shift.) The regional site manager stated that the change in shift allowed him to be present at HTS when work was being performed but prevented him from participating in the maintenance calls. (The RALLC site manager still worked the day shift; thus, his work schedule still did not align with the overnight shift of the regional site manager, quality assurance inspector, foreman, and mechanics.) Air Midwest removed the quality assurance inspector’s authorization to perform maintenance and RII inspections on company airplanes. The quality assurance inspector is still employed by RALLC but is working as a mechanic at the Dubois maintenance station. Air Midwest also removed the mechanic’s authorization to perform maintenance on company airplanes. The mechanic no longer works for SMART. The RALLC site manager is still employed by RALLC but now works as a mechanic at the Panama City maintenance station. In addition, Air Midwest gave disciplinary time off to another SMART mechanic and the primary quality assurance inspector at HTS because they falsely indicated on the mechanic’s OJT record that he had completed training on the D6 aft fuselage/empennage inspection procedure on January 6, 2003. (The primary quality assurance inspector was not on duty on the night of January 6th. The mechanic inspected and checked the engines but did not perform the entire D6 maintenance procedure, including the elevator check.) The mechanic and primary quality assurance inspector were subsequently retrained and then reinstated to their former positions. In a February 12, 2003, letter to the Safety Board, the Air Midwest Vice President/Director of Maintenance expressed the air carrier’s concerns regarding the manufacturer’s elevator control system rigging procedure. The letter stated, “a review of the Raytheon Aircraft Beech 1900D Maintenance Manual revealed a lack of explicit

Factual Information 60 Aircraft Accident Report instructions, which if included, could have avoided the elevator mis-rigging.” The letter detailed numerous deficiencies in the rigging procedure that were identified by Air Midwest. On July 18, 2003, Air Midwest revised its D6 work card. The revised work card included the following steps for performing an elevator cable tension check and blocks beside each step for the mechanic’s and quality assurance inspector’s stamps: Let aircraft temperature stabilize for three hours. Take the temperature reading with the aircraft OAT temperature gauge. Gain access to the elevator…cables under the cargo compartment floorboard. Using a calibrated tensiometer with the proper riser installed, take the elevator cable tension readings I.A.W. [in accordance with] Raytheon Maintenance Manual. Compare readings from the aircraft to the proper cable tension charts in the Beech Maintenance Manual. (For the elevator tension chart, ref. *Raytheon [Maintenance] Manual Chapter 27-30-02, fig 203….) If cable tensions are within tolerance, no adjustment to the cable tension is required. If tensions are not within tolerance of the tension chart, perform the complete elevator…control system rigging procedure. (For elevator rigging, ref. *Raytheon [Maintenance] Manual 27-30-02….) “N/A” [not applicable] this block if no adjustments were made. List all work performed on the AMR [aircraft maintenance record of nonroutine items], if adjustments were made. “N/A” this block if no adjustments were made. Air Midwest also revised its weight and balance procedures. These revisions are presented in section 1.18.1.2.1 after a discussion of the procedures that were in effect at the time of the accident (section 1.18.1.2). 1.17.2 Raytheon Aerospace RALLC is headquartered in Madison, Mississippi. At the time of the accident, RALLC provided one site manager, two quality assurance inspectors (one of whom was designated as the primary quality assurance inspector and the other of whom was designated as the foreman), and seven SMART A&P-certified mechanics to Air Midwest’s HTS maintenance station. Air Midwest paid RALLC for its services. RALLC paid salaries and benefits for its employees. RALLC also paid SMART for its maintenance personnel, but SMART employees received their salaries and benefits directly from SMART.

Factual Information 61 Aircraft Accident Report The RALLC site manager stated that he reported to the RAMS operations manager in Little Rock, who reported to the Air Midwest Vice President/Director of Maintenance in Wichita.77 The primary quality assurance inspector reported to the RAMS quality assurance manager in Panama City, Florida.78 The foreman reported to the RALLC site manager. According to public hearing testimony, the SMART mechanics reported to a SMART manager through an HTS on-site coordinator (one of the mechanics). The RALLC site manager was responsible for the daily operations at the HTS maintenance station and the work performed there. The foreman assigned maintenance work and followed the progress of the mechanics in accomplishing the work, and the quality assurance inspector checked the RIIs.79 As previously stated, when the primary quality assurance inspector was not at work (as on the night of January 6, 2003), the foreman would assume his duties. A SMART mechanic would then assume the foreman’s duties.80 The foreman was responsible for providing OJT to the mechanics and for signing off their OJT records. The quality assurance inspector who was not on duty on the night of January 6, 2003, stated, in a postaccident interview, that the quality assurance inspector who was on duty should not have been providing OJT.81 The RALLC site manager did not personally oversee the work performed by the mechanics because he worked the day shift. As a result, the site manager depended “very heavily” on the quality assurance inspector and the foreman for information about the mechanics’ work. In addition, the site manager indicated that, even though he was the maintenance administrator, he performed employee job performance reviews for the quality assurance inspectors. The site manager further stated that the RAMS quality assurance manager performed the part of the performance review covering quality assurance issues. 77 The Air Midwest Maintenance Procedures Manual indicated that the RALLC site manager reported directly to the Air Midwest Vice President/Director of Maintenance. 78 The RAMS quality assurance manager reported to the RAMS Executive Program Manager for Airline Support in Madison, Mississippi, who reported to the Air Midwest Chief Inspector/Director of Quality Assurance in Wichita. 79 Title 14 CFR 121.365(c) states, “each person performing required inspections in addition to other maintenance, preventive maintenance, or alterations, shall organize the performance of those functions so as to separate the required inspection functions from the other maintenance, preventive maintenance, or alteration functions.” In addition, AC 120-16D states, “a primary concept of the RII function is that the person performing the work may not perform the required inspection of that item of work.” 80 On the basis of the work schedule in effect at the time of the accident, a SMART mechanic acted as the foreman 4 nights per week. 81 Air Midwest Maintenance Procedures Manual stated that the foreman’s duties include performing and documenting OJT on aircraft maintenance practices, company policies, and safety procedures, as required. The manual did not include these duties as part of the quality assurance inspector’s job description.

Factual Information 62 Aircraft Accident Report 1.17.2.1 Contract Between Raytheon Aerospace and Air Midwest The contract between RALLC and Air Midwest was a 60-month agreement that became effective on January 1, 2003.82 The contract contained 29 statements of understanding and 3 appendixes that detailed the conditions of the agreement. The contract stated that RALLC would provide a manager, foremen, mechanics, and inspectors to Air Midwest to meet its maintenance requirements and that RALLC would confer with Air Midwest before any changes were made to the number of personnel provided. No language in the contract prevented RALLC from contracting with another party for maintenance personnel. The contract stated that scheduled maintenance and unscheduled on-call maintenance would be performed according to the procedures in Air Midwest’s maintenance manuals and that all maintenance actions, parts, and documentation would meet Federal Aviation Regulations (FARs) and Air Midwest requirements. The contract further stated that RALLC would work toward achieving a 99-percent reliability rate for scheduled maintenance. According to the contract, Air Midwest would supply all parts, materials, and equipment and would be responsible for technical data management, quality control/quality assurance inspection, a technical library, and a tracking system for time-compliance and hard-time items. The contract specified the allocation of cost at each of the Air Midwest maintenance stations. According to the contract, Air Midwest was solely responsible for the hangar facility at HTS. 1.17.3 Structural Modification and Repair Technicians SMART, which is headquartered in Edgewater, Florida, recruits maintenance personnel for its aviation industry clients. SMART accepts résumés through recruiters or on its Web site and then qualifies applicants by conducting a 5-year background check, a 10-year security check,83 and drug testing. SMART mechanics indicated that the company does not interview applicants in person to determine their experience level, but public hearing testimony by SMART’s Director of Recruiting indicated that the company conducts telephone interviews to make such determinations. Applicants that pass the reference checks and the drug testing are hired as SMART employees. They bid on open job postings for placement with an aviation industry client. SMART employees work for SMART and not the aviation industry client. SMART does not oversee, evaluate, or direct its employees at the client’s work site. 82 The contract between RALLC and Air Midwest was originally negotiated in September 2001 and was renegotiated in September 2002. 83 SMART employees that were hired before September 11, 2001, were subject to a 5-year security check.

Factual Information 63 Aircraft Accident Report 1.17.3.1 Contract Between Structural Modification and Repair Technicians and Raytheon Aerospace The contract between SMART and RALLC was signed on March 25, 2002. The contract contained 22 agreement statements that identified the conditions in which the two companies would work together. The contract stated that SMART would provide aircraft maintenance personnel to perform services at locations designated by RALLC but that the personnel would not be considered employees of RALLC. The contract also stated that SMART was responsible for all matters concerning the maintenance personnel’s working conditions, termination, working hours, vacation and other leave, expenses, wages, and worker’s compensation insurance. The contract further stated that SMART was responsible for instructing their employees to follow RALLC policies and regulations as long as they were communicated in writing in a timely manner. The contract stated that SMART would use its sole discretion in deciding which maintenance personnel would be provided to RALLC.84 The contract also stated that RALLC was solely responsible for supervising the work of SMART employees and that RALLC would provide each SMART employee with a daily time card and would approve the time cards. In addition, the contract specified that the use of any SMART employee could be terminated at any time by RALLC85 and that, if the employee’s performance in the first 8 hours of work was not satisfactory, SMART would not charge for the employee’s services. 1.17.4 Federal Aviation Administration Oversight The Air Midwest principal operations inspector (POI) has been in that position since October 1999. The Air Midwest certificate is the only one he oversees. Two assistant POIs and one aircrew program manager help the POI with his oversight duties. The POI’s office (the Wichita Flight Standards District Office [FSDO]) is located about 3 miles from Air Midwest’s office. The POI indicated that he reviewed Air Midwest’s Flight Operations Procedures Manual and training program. He stated that oversight of Air Midwest’s weight and balance procedures was accomplished during en route inspections. The POI indicated that an en route inspector or geographic inspector would check the cargo bin, count the number of bags, and look at the size of the bags and then compare the findings to the information documented on the load manifest form. The inspector would also examine the weight scales at the stations. 84 The RALLC site manager indicated that he reviewed the résumés of the SMART employees that worked at the HTS maintenance station before they were hired by SMART. 85 Although RALLC has the right to terminate a SMART employee, RALLC must depend on SMART to carry out the termination.

Factual Information 64 Aircraft Accident Report The Air Midwest principal maintenance inspector (PMI) began work for the FAA in 1988 and has been in his current position, which is based in Wichita, since December 1998. The Air Midwest certificate is the only one the PMI oversees. Two assistants help the PMI carry out his responsibilities. During postaccident interviews, the PMI stated that he had 40 years of aviation-related experience, including 30 years as an A&P mechanic and 25 years as a maintenance inspector. The PMI stated that he tried to visit all of the Air Midwest maintenance stations two to three times per year for at least 3 days each time. The PMI stated that he rarely announced his inspections of Air Midwest’s maintenance stations. The PMI stated that he usually took a morning flight to a maintenance station, visited the station after arriving, and met with the maintenance managers to discuss any of their concerns. The PMI also stated that he would return to the station at night to observe maintenance operations. The PMI visited the HTS maintenance station before it opened in July 2002. The PMI also visited HTS in September 2002. According to postaccident interviews, the PMI spoke with the quality assurance inspector and the foreman but did not speak with the mechanics. Also, the RALLC site manager and the Air Midwest regional site manager stated that the PMI reviewed training records and other documentation and observed maintenance operations during the overnight shift. The RALLC site manager further stated that the PMI told him that the mechanics “seemed very competent.”86 In a postaccident interview, the PMI stated that, before the accident, he was unaware that third-party maintenance contractors were being used at HTS. During public hearing testimony, the PMI stated that he would not readily find problems concerning OJT at the maintenance stations and that the only way he would discover such a problem would be to “work some kind of a spreadsheet where [he] could correlate whoever signed it [the OJT] off on the job card versus the training folder,” which was “a little bit of work.” The PMI did state his concern that HTS personnel did not follow the Air Midwest maintenance manual while conducting OJT. In addition, the RALLC site manager and the Air Midwest regional site manager stated that flight standards inspectors from the Charleston, West Virginia, FSDO had visited HTS once for an informal introduction and that the visit was not an inspection of the facility. The Air Midwest regional site manager further stated that airworthiness inspectors from the Charleston FSDO visited HTS once while he and the RALLC site manager were at lunch. Finally, in addition to the POI and PMI, a principal avionics inspector (PAI) was assigned to the Air Midwest certificate. The PAI, who was based in Wichita, reviewed all of Air Midwest’s maintenance training manual submissions. The PMI stated, in a January 2004 interview, that the PAI had worked as a maintenance inspector before becoming an avionics inspector and that he understood both areas very well. 86 The RALLC site manager also stated that, about the time of the PMI’s visit, HTS “had people training us from other sites on a regular basis and so we had two guys that were really knowledgeable, plus the staff that we normally had.”

Factual Information 65 Aircraft Accident Report 1.17.4.1 Continuing Analysis and Surveillance System In 1964, the FAA introduced the requirement for air carriers to have a Continuing Analysis and Surveillance System (CASS) because maintenance program ineffectiveness had been identified as a primary causal factor in some maintenance-related air carrier accidents. Specifically, 14 CFR 121.373, “Continuing Analysis and Surveillance,” required air carriers to establish and maintain a system for the continuing analysis and surveillance of the performance and effectiveness of its inspection program and the program covering other maintenance, preventive maintenance, and alterations and for the correction of any deficiency in those programs, regardless of whether those programs are carried out by the certificate holder or by another person. Between August 1980 and March 2003, the primary CASS guidance available to air carriers was contained in AC 120-16C, “Continuing Airworthiness Maintenance Programs,” and was less than 1 page in length. The guidance stated that a CASS program should be designed to monitor for, and provide timely corrective action in response to, decreases in mechanical reliability and should provide a continuous auditing function that examines a broad range of issues, including the currency and availability of publications, conformity between maintenance practices and company policies, adequacy of record-keeping and training, and handling of deferred maintenance items. In March 2003, the FAA revised AC 120-16C. The revised AC (AC 120-16D) presented expanded CASS guidance in a dedicated chapter that was several pages in length. The guidance defined CASS as an “air carrier quality assurance system” designed to detect and correct air carrier maintenance program deficiencies through a closed-loop, continuous cycle of surveillance and investigations, data collection and analysis, corrective actions, and monitoring and feedback. The guidance stated that an air carrier’s CASS program should monitor the following nine elements of the carrier’s continuous airworthiness maintenance program: airworthiness responsibility, maintenance manual, maintenance organization, maintenance schedule, maintenance record-keeping system, accomplishment and approval of maintenance and alterations, contract maintenance, CASS, and personnel training. The CASS guidance in AC 120-16D also stated that a CASS program should include “detailed policy and procedures” for determining whether an air carrier needed to amend its maintenance program or manual and for making amendments. In addition, the guidance stated that, “proactive surveillance and analysis forecasts faults in your [the air carrier’s] maintenance program or manual through the collection and analysis of a wide variety of data. It corrects those faults, including human factors87 issues, in advance of any specific event, accident, or incident.” Further, the guidance stated that an air carrier’s “CASS audit schedule should include…all manuals, publications, and forms [to ensure that they] are useable, current, accurate, and readily available to the user.” 87 The discipline of human factors identifies capabilities and limitations of humans and ways to adapt human and system components accordingly to increase efficiency, effectiveness, and safety.

Factual Information 66 Aircraft Accident Report In April 2003, the FAA published AC 120-79, “Developing and Implementing a Continuing Analysis Surveillance System,” which was a comprehensive guide for the development of CASS programs.88 The AC provided information on CASS-related topics, including the following: the desired purpose and structure of a CASS program, CASS policy and documentation, major CASS activities, CASS personnel requirements, communication between CASS personnel and other departments, comparison of CASS and other required maintenance programs, CASS program evaluation, and the role of the FAA in an air carrier’s CASS program. The AC also described model CASS programs for air carriers in three different size ranges. 1.17.4.2 Correspondence From the Federal Aviation Administration to Air Midwest In an October 16, 2000, letter, the Air Midwest PMI stated that a recent FAA inspection conducted at Air Midwest headquarters could not be completed because the air carrier lacked adequate records to determine whether it was in compliance with 14 CFR 121.371(a) and 121.375.89 The PMI noted that, among other things, “required [maintenance] training records are either not at the Wichita facility or are not up to date and complete,” and advised Air Midwest of the need to comply with 14 CFR 121.371(a) and 14 CFR 121.375. The PMI requested a meeting with Air Midwest officials to “avoid further investigation of these areas,” and this meeting was held on October 26, 2000. In a November 9, 2000, letter, the Air Midwest PMI stated that Air Midwest’s CASS program did not include a reliable way of charting operational data at specified intervals to reveal trend-related information. In a December 18, 2000, letter, the Air Midwest assistant PMI asked the air carrier to submit a strategy to resolve the inadequacy of the carrier’s training manual and training records.90 The Air Midwest Vice President/Director of Maintenance indicated that the air carrier would, by February 1, 2001, audit training records, rewrite its maintenance training manual, forward copies of training records to company headquarters, and add a manager to the training department. 91 In a September 6, 2001, letter, the Air Midwest PAI stated that he was returning Air Midwest’s April 1, 2001, revised maintenance training manual so that numerous 88 AC 120-79 provided one method of compliance with the requirements of 14 CFR 121.373. 89 Title 14 CFR 121.371(a) requires that carriers operating under 14 CFR Part 121 use only persons who are properly certificated, trained, qualified, and authorized for performing required inspections. See section 1.17.1.1 for a description of 14 CFR 121.375. 90 A followup inspection of Air Midwest’s training files was conducted on December 4, 2000. This inspection revealed evidence of continuing deficiencies in the training files as well as deficiencies in the air carrier’s training manual. The PMI gave Air Midwest a deadline of February 1, 2001, to remedy these deficiencies. 91 A Regional Aviation Safety Inspection Program (RASIP) inspection, conducted between March 12 and 29, 2001, found that deficiencies in the maintenance training manual still existed and that training was not being conducted in accordance with company procedures. The RASIP inspection also found that Air Midwest was not performing the biannual audits required by the company’s CASS procedures.

Factual Information 67 Aircraft Accident Report changes could be made.92 Air Midwest resubmitted its revised maintenance training manual on October 9, 2001, but, in a letter dated January 16, 2002, the PAI cited deficiencies in the manual, some of which had been previously identified, and asked Air Midwest to make the necessary corrections. In a February 11, 2002, letter to the Air Midwest Vice President/Director of Maintenance, the Air Midwest PMI stated that he could still not determine whether Air Midwest was in compliance with the FARs and asked Air Midwest to develop and initiate a plan within 2 weeks to address maintenance training program deficiencies in need of immediate improvement or be subject to an in-depth audit. The Air Midwest Vice President/Director of Maintenance responded to this letter by notifying the PMI of actions the air carrier was taking to resolve some of his concerns and by stating that solutions to other problems would be implemented after the revised maintenance training manual was accepted by the FAA. On February 11, 2002, Air Midwest submitted another revised maintenance training manual for the FAA’s review. In a letter dated February 19, 2002, the PAI again cited deficiencies in the manual and asked Air Midwest again to make the necessary corrections. On February 28, 2002, the FAA accepted Air Midwest’s revised maintenance training manual. In the February 19, 2002, letter, the Air Midwest PAI also communicated his concern that Air Midwest’s CASS program lacked an auditor training curriculum. In an April 26, 2002, letter, the Wichita FSDO manager and the Air Midwest PMI stated that Air Midwest had a written audit program but no dedicated program manager and that this and other issues needed to be resolved before Air Midwest would be allowed to change its route structure.93 (The other issues involving Air Midwest included that its infrastructure had not kept up with its growth, its pilot training program had deficiencies, RASIP issues were unresolved, and procedures in its General Maintenance Manual were inadequate.) In an August 19, 2002, letter, the Air Midwest PMI cited deficiencies that Air Midwest needed to address before route structure changes could be approved, including actions to ensure that the audit procedures contained in the company’s audit manual were being followed. 92 Air Midwest’s revised training manual and audit manual were submitted to the FAA for review about the same time. The FAA asked Air Midwest which manual should have priority, and it was decided that the audit manual would have priority. The audit manual was accepted by the FAA on December 19, 2001. 93 The POI was the FAA official responsible for approving any proposed route expansion. His operations supervisor advised him against delaying Air Midwest’s proposed route changes (see section 1.17.1). In a January 2004 interview, the operations supervisor told the Safety Board that she could not recall the details of that conversation. She stated that she did recall that the FAA had sent Air Midwest letters of concern before a prior route expansion in Dallas, Texas, and that Air Midwest had consistently been willing to meet with the FAA to address its concerns, had made needed improvements in flight operations, and was essentially in compliance with the FARs. In a January 2004 interview, the PMI said that Air Midwest had been responsive in communicating with the FAA but that Air Midwest management did not always adequately follow through in resolving all of his concerns, including the need for aircraft familiarization training and better supervision of OJT.

Factual Information 68 Aircraft Accident Report 1.17.5 Raytheon Aircraft Company On December 10, 2003, the President of Raytheon Airline Aviation Services met with the Safety Board to discuss Beech 1900 series maintenance initiatives. According to the Raytheon official, these initiatives were undertaken to reinforce with operators the importance of properly maintaining Beech 1900 series airplanes. In a December 16, 2003, facsimile, the Raytheon official summarized the initiatives he discussed at the meeting. The facsimile included the following initiatives: • communicating more actively with all levels of Beech 1900 operator personnel, including the chief executive officer/owner, Director of Maintenance, and mechanics; • providing all Beech 1900 operators with a CD-ROM of all Beech 1900 safety and model communiqués and SBs; • posting all Beech 1900 safety and model communiqués and SBs on the Raytheon Aircraft Company Web site; • conducting Beech 1900 Airliner Operators Conferences, the first of which was held in Wichita on October 21 through 23, 2003, so that operators, suppliers, and Raytheon Airline Aviation Services have a forum to discuss maintenance issues; • developing “easy-to-follow” text and illustrations to improve the explanation of certain procedures, including flight control rigging and functional testing; subjecting these procedures to “validation and verification;” and issuing changes to the procedures as temporary revisions to the Beech 1900 AMMs; and • sending technical teams to Beech 1900 operators to provide on-site training for mechanics and launching a Web-based training site that will be accessible to all Beech 1900 mechanics. 1.18 Additional Information 1.18.1 Weight and Balance Procedures 1.18.1.1 Federal Aviation Administration Air carriers are required to have procedures in place for the control of weight and balance of airplanes. Title 14 CFR 121.153 permits air carriers with more than nine passenger seats to use an approved average weight program instead of actual weights for aircraft weight and balance calculations. The use of average weights instead of actual weights allows air carriers to board passengers, load baggage and cargo, and calculate weight and balance more quickly. Air carriers can use actual weights, average weights established by survey data, or a combination of both to determine the weight of crewmembers, crew baggage, passengers and personal items, carry-on baggage, and checked baggage.94

Factual Information 69 Aircraft Accident Report The FAA published its aircraft weight and balance guidance in AC 121-5, “Aircraft Weight and Balance Control,” in January 1965 and then in AC 120-27, “Aircraft Weight and Balance Control,” in October 1968. The content in AC 120-27 was subsequently revised three times: AC 120-27A was issued in May 1980, AC 120-27B was issued in October 1990, and AC 120-27C was issued in November 1995 and was the version in effect at the time of the flight 5481 accident.95 According to AC 120-27C, an operator may submit, for inclusion into its operations specifications, any method and procedure which shows that an aircraft will be properly loaded and will not exceed approved weight and balance limitations during operation. The approval of such a weight and balance control system is based on an evaluation of the program presented for a particular aircraft and of a particular operator’s ability to implement that program. The average weight suggested in AC 120-27C for an adult passenger was 180 pounds in the spring and summer months and 185 pounds in the fall and winter months; both weights included 20 pounds for carry-on baggage. The average weight suggested in the AC for checked baggage was at least 25 pounds. The AC warned that the standard average passenger weights presented were developed for a conventional airline passenger group and that the weights “cannot be arbitrarily adopted for operations with passenger groups that appreciably differ from the basis or where the mix of male and female passengers is known to be different than a 60 percent male/40 percent female operation.”96 The guidance in AC 120-27C was not intended to address all possible air carrier weight and balance configurations. As a result, the AC noted that air carriers should consider conducting a reliable survey to establish average weights for their specific operations and providing the results of the survey to the FAA. An appendix in the AC listed procedures for conducting surveys and establishing average passenger and baggage weights based on statistical analyses. Also, the guidance in AC 120-27C advised air carriers that their weight and balance program should (1) account for all probable loading conditions that may be experienced in service, (2) ensure satisfactory loading within the aircraft weight and CG limits during ground and flight operations, (3) maintain the aircraft weight and CG limits, and (4) stress that the aircraft must be operated at or below its maximum certificated operating weight. PMIs oversee and evaluate air carriers’ weight and balance programs according to the guidance in FAA Order 8300.10, Airworthiness Inspector’s Handbook. The guidance states that the use of average weights may be authorized as long as the weights are based 94 Actual weights are required to be used for the aircraft empty weight, fuel, U.S. mail, and company material. 95 Flight Standards Handbook Bulletin for Airworthiness 95-14 and Flight Standard Handbook Bulletin for Air Transportation 95-15, “Adherence to Advisory Circular 120-27C, ‘Aircraft Weight and Balance Control,’” were issued in November 1995 and provided guidance to assist regional air carriers with limited carry-on baggage programs, such as Air Midwest, with the development of their weight and balance program. 96 AC 120-27C stated that actual passenger weights were to be used for nonstandard weight groups (such as athletic teams) unless average weights had been established for such groups.

Factual Information 70 Aircraft Accident Report on acceptable data that were collected during actual operations (for example, by weighing passengers and baggage and documenting the weights). The order also states that the average passenger and baggage weights listed in AC 120-27C are not regulatory and do not constitute authorization as a method for controlling aircraft weight and balance. In addition, the order states that average passenger and baggage weights must be evaluated for applicability to individual air carriers. Regardless of the weight and balance program in place or the source of the data used to establish average weights, the air carrier is ultimately responsible for ensuring proper aircraft weight and CG loading before each flight is dispatched. 1.18.1.1.1 Postaccident Average Weight Survey Because the flight 5481 accident raised concerns about aircraft loading and average weights used in weight and balance control programs, the FAA issued Notice 8400.40, “Weight and Balance Control Programs for 10 to 19 Seat Airplanes Operated Under 14 CFR 121,” on January 27, 2003. The notice requested that all operators of 10- to 19-passenger seat airplanes operated under 14 CFR Part 121 conduct a survey to validate the average weights contained in their weight and balance program.97 Of the 22 operators that have 10- to 19-passenger seat airplanes, 15 operators used average weight programs, and 7 operators used actual weight programs. The survey was to be conducted during a 3-day period that included 2 heavier traveled days—Sunday and Monday—and 1 lighter traveled day—Tuesday. The survey was to include 30 percent of the operators’ stations and was to sample 15 percent of the stations’ flights.98 In conducting the survey, the operators either asked the passengers their weight and added 10 pounds (for personal items) to the number reported or actually weighed the passengers. The operators also weighed all checked baggage and all carry-on baggage that were checked at the airplane. Table 6 shows the results of the survey by operator, and table 7 shows the overall survey results. 97 Another purpose of the notice was for operators to determine the condition of cargo restraint systems, such as tie-down rings, locking devices, and cargo nets. 98 Air Midwest indicated that it surveyed 100 percent of its flights during the 3-day period (540 flights) at 98 percent of its stations.

Factual Information 71 Aircraft Accident Report Table 6. Federal Aviation Administration Notice 8400.40 survey results by operator. Note: Operator “A” is Air Midwest. Operator “J” did not properly conduct the survey; thus, that operator’s data are not reflected in the survey results. The symbol * in this table indicates that the operator used actual weights. Table 7. Federal Aviation Administration Notice 8400.40 survey results by category. If the average sample weights were greater than the average weights in the operators’ weight and balance program, the operators were to use the new average weights. If an operator thought that the increased weights were inappropriate, then the operator could either conduct a new validation survey using the criteria prescribed in AC 120-27C to determine new average weights or use actual weights. At the public hearing on this accident, an FAA air safety investigator from the Air Carrier Operations Branch stated that all 15 operators that used average weight programs adjusted the weights in one or more categories by 5 to 25 percent. Operator Average adult weight (pounds) Number of adults in sample Average carry-on baggage weight (pounds) Number of carry-on bags in sample Average checked baggage weight (pounds) Number of checked bags in sample A 200.00 3,018 20.00 1,538 30 2,510 B 177.86 148 * * 24 211 C 192.60 326 11.03 297 29.88 485 D 184.00 66 9.00 30 24.00 120 E 192.00 739 15.80 488 25.50 828 F 193.60 106 13.90 90 34.00 171 G 164.00 16 5 86 27.29 7 H 193.57 106 13.93 90 33.98 171 I 199.10 132 16.90 108 24.70 125 J 165.00 179 * * * * K 196.00 365 7 222 * * L 190.00 216 7.8 215 24.80 266 M 189.47 77 14.45 59.00 25.54 64 N 191.18 229 18.26 111 29.24 186 O 187.90 396 14.70 485 30.80 378 Category Average weight (pounds) Increase (pounds) Average adult passenger weight 195.63 20.63 Average carry-on baggage weight 15.72 5.72 Average checked baggage weight 28.81 3.81

Factual Information 72 Aircraft Accident Report On May 12, 2003, the FAA issued Notice 8300.112, “Revision to All Average Weight Programs,” which required all 14 CFR Part 121, 125, and 135 operators, by August 11, 2003, either to revise their average weight program or complete an average weight survey.99 Operators that chose to revise their average weight program were to add 10 pounds per passenger for personal items, add 5 pounds for each domestic checked bag, and use actual weights for U.S. mail and company material. In addition, the FAA plans to revise AC 120-27C and other related guidance after considering the advice and recommendations of an Aircraft Weight and Balance Control Program Aviation Rulemaking Committee. This committee is composed of government, union, and industry representatives from the aviation community.100 The committee will address several issues, including average passenger, carry-on, and checked baggage weights; seasonal operations; time interval between average weight validations; oversized bag weights; and male/female ratios in average weight programs. The committee will also consider whether the FAA should implement different average weights based on aircraft passenger seating capacity. The Aviation Rulemaking Committee provided the FAA with draft revisions to AC 120-27C on January 30, 2004. The FAA expects to release the new version of AC 120-27 (AC 120-27D) for comment at the end of 2004. 1.18.1.2 Air Midwest Air carriers are required by 14 CFR 119.49(a)(9) to have, in their operations specifications, FAA authorization for the method of controlling weight and balance of their aircraft. Paragraph E-96 of Air Midwest’s operations specifications contained the air carrier’s weight and balance control procedures, which were approved by the Air Midwest PMI on April 9, 2001. The PMI approved Air Midwest’s average weight program without validating that the program was viable. During the public hearing on this accident, the air safety investigator from the FAA’s Air Carrier Operations Branch stated that air carriers were responsible for evaluating the program’s impact on weight and balance. The Air Midwest passenger and baggage weight procedures that were in effect at the time of the accident were detailed in the company’s Flight Operations Procedures Manual, chapter 7, revision 02-02, dated January 18, 2002. The manual stated the following under the heading, “Passenger Weight Calculations”: We are authorized to use average passenger weights in lieu of actual passenger weights to compute passenger loads over any route, except in those cases where nonstandard weight passenger groups are carried. 99 The operators that participated in the average weight survey under Notice 8400.40 (see table 6) are exempt from this requirement. 100 The first meeting of the Aviation Rulemaking Committee was held on August 26, 2003, in Washington, D.C. A second meeting was held on December 3 and 4, 2003, in Washington D.C. Four steering committee meetings have also been held.

Factual Information 73 Aircraft Accident Report Either method may be used interchangeably, provided only one method is used for any flight segment. 1) Actual weight Actual weight may be determined by scale weighing of each passenger prior to boarding the aircraft, with such weight including minor articles carried on board by the passenger. If such articles are not weighed, account for the estimated weight. The actual passenger weight may also be determined by asking each passenger his weight, adding ten pounds per passenger during the calendar period from November 1 through April 30. 2) Average Passenger Weight a. An average weight of 170 pounds (summer) may be used for adult passengers during the calendar period of May 1 through October 31. b. An average weight of 175 pounds (winter) may be used for each adult passenger during the calendar period from November 1 through April 30. c. An average of 80 pounds may be used for children between the ages of 2 and 12. Two children are counted as one passenger only for entering the Passenger Index Table and determining the index. When determining the passenger index, if there is an odd number (1, 3, 5, etc.) of children in a section, the last child is ignored if seated in the forward section and counted as an adult passenger if seated in the aft section. Children above 12 years of age are classified as adults for the purpose of weight and balance computations. Children less than 2 years old are considered “babes in arms”. NOTE: These passenger weights include minor items normally carried by a passenger and include ten pounds per passenger for carry-on luggage. These minor items may be stowed under the seats if they are the size and shape that fit under the seat, or may be stowed in the coat closet. The articles stowed in the coat closet will be added as weight at 10 lbs. estimated weight or actual weight as deemed appropriate by the PIC. Carry-on luggage not fitting in the seat or in the coat closet will be put in the aft cargo bin and considered as 25 pounds for weight and balance purposes. Carry-on baggage/cargo that must be secured in a passenger seat, (musical instruments, television cameras, etc.) shall be secured forward of the most forward seated passenger. These items may be viewed as a child for the purpose of calculating index units.

Factual Information 74 Aircraft Accident Report The Flight Operations Procedures Manual stated the following under the heading, “Passenger and Baggage”: The following average passenger baggage weights may be used in lieu of actual weights: 1) For each piece of checked baggage, an average of not less than 25 pounds, and 2) For each military duffle, average weight of 50 pounds. 3) Carry-on baggage is assumed at ten pounds per item. NOTE: Carry-on baggage weight is included in the average passenger weights shown in Paragraph (c) [in the “Passenger Weight Calculation” section]. The Flight Operations Procedures Manual detailed the method to establish the CG for a Beech 1900D airplane with a 19-seat configuration. The method required that index units for the airplane’s basic operating weight, passengers, AFT1 and AFT2 cargo compartments, coat closet, and fuel be computed and added together. The index unit total was to be cross-referenced with the gross takeoff weight on a weight and CG envelope graph, and a mark was to be made on the graph to indicate where the gross takeoff weight and the index unit total intersected. This point of intersection was required to fall within the forward and aft limits of the CG envelope. Also, the gross takeoff weight was required to be cross-referenced with the gross takeoff weight index on the weight and CG envelope graph, and the point of intersection was to fall within the forward and aft limits for both takeoff and landing. In addition, the zero fuel weight and the corresponding zero fuel weight index were required to be cross-referenced, and the point of intersection was to fall within the forward and aft limits of the CG envelope. If the point of intersection fell within a forward shaded area on the graph, passengers were to be seated fully aft within the forward and aft sections of the airplane; if the point fell within an aft shaded area, passengers were to be seated fully forward in both sections.101 The Flight Operations Procedures Manual also discussed Air Midwest’s Beechcraft 1900D Load Manifest (form F-0001E). In normal operations, the flight crew is responsible for filling out most of the information on the form.102 One copy of the form is left at the station, and one copy remains aboard the airplane. The manual stated that, before takeoff, both flight crewmembers were responsible for reviewing the manifest for errors and omissions. 1.18.1.2.1 Postaccident Weight and Balance Revisions After the accident, Air Midwest implemented new average adult passenger and baggage weights, as shown in table 8, based on the results of the FAA-required survey (see section 1.18.1.1.1). According to Air Midwest, the new average weights became effective 101 Rows 1 through 5 are in the airplane’s forward section; rows 6 through 9 are in the airplane’s aft section. 102 Station operations personnel fill out the basic information in the upper right-hand corner of the form, but flight crewmembers are not precluded from filling out the entire form.

Factual Information 75 Aircraft Accident Report on May 11, 2003, and effectively reduced the Beech 1900D airplane capacity to a maximum of 17 passengers. The average weight for adult passengers increased from 175 pounds (November through April) and 170 pounds (May through October) to 200 pounds all year.103 These passenger weights still include 10 pounds for items that are normally carried on board by passengers, such as handbags, briefcases, and laptop computers. Articles that are stored in the coat closet are counted as 10 pounds per bag or item. The average weight for checked baggage increased from 25 to 30 pounds, and the average weight for carry-on baggage stowed in the AFT1 cargo compartment decreased from 25 to 20 pounds. These weight and baggage revisions were incorporated into the Flight Operations Procedures Manual on June 12, 2003. Table 8. Air Midwest revised weights compared with previous weights. Air Midwest also revised its Beech 1900D load manifest form. The revised form showed the new passenger and checked baggage average weights and added the carry-on baggage weights. The revised form also included a table to calculate the total weight and CG index number for the flight crew, which was previously calculated as part of the airplane’s basic operating weight, and an updated passenger index table. The revised load manifest form and instructions were incorporated into the Flight Operations Procedures Manual on April 25, 2003. 1.18.1.3 US Airways Express Because Air Midwest flight 5481 was operating under a code-share agreement with US Airways Express, the flight was subject to US Airways Express’ procedures for passenger, baggage, and cargo loading. Gate and ramp agents use the US Airways Express Load Report, form OF-11E, to account for all passengers, baggage, and cargo loaded on a US Airways Express flight. The OF-11E must be given to the flight crew on all flights except for ferry flights. The flight crew uses this information to complete the load manifest form. The Air Midwest Flight Operations Procedures Manual and the US Airways Express Ground Operations Manual, Section 5, “Baggage & Cargo Loading,” dated September 1, 2002, cited the specific items that needed to be completed on the OF-11E. 103 The average weight for a child passenger between 2 and 12 years of age remained at 80 pounds. Category Revised weight (pounds) Former weight (pounds) Adult passenger Carry-on baggage and personal items in cabin Total 190 (all year) 0 for carry-on baggage, 10 for personal items 200 165 (winter), 160 (summer) 10 for both carry-on baggage and personal items 175 (winter), 170 (summer) Checked baggage in AFT1 cargo compartment 30 25 Carry-on baggage checked at airplane and stored in AFT1 cargo compartment 20 25

Factual Information 76 Aircraft Accident Report These items included the total number of passengers, including children; the total number of pieces of checked, carry-on, and crew baggage; and the combined weight of all cargo in each bin. One copy of the OF-11E is left at the station, and the other copy is given to the flight crew. The US Airways Express manual indicated that the flight crew must be notified if passengers or bags were added after the OF-11E was completed and given to the crew. Any changes had to be noted in the “remarks” section of the station copy. In a postaccident interview, the Director of US Airways Express Training stated that any bag weighing up to 70 pounds was accounted for under the average baggage weight program. She also stated that a bag weighing between 70 and 100 pounds was considered to be an overweight bag. Ticket agents are responsible for putting a “heavy bag” tag on such bags at check-in but are not required to list the weight of the bags on the heavy bag tags. Ramp agents are required to indicate “heavy bag” in the remarks section of the OF-11E for those bags with heavy bag tags. At the time of the accident, no formal procedures existed for reporting overweight bags in the weight and balance paperwork (except for military duffle bags, which were considered to have an average weight of 50 pounds).104 The Director of US Airways Express Training further stated that bags that weigh more than 100 pounds were considered air freight. Procedures were in place for reporting air freight in the weight and balance paperwork. According to the US Airways Express Ground Operations Manual, carry-on items that are too large to fit in the cabin of aircraft operated by US Airways Express must be tagged with a carry-on tag and placed in the cargo compartment of the aircraft. The items are to be loaded in the cargo compartment last, off-loaded first, and returned to the customer upon deplaning. The US Airways Express Ramp Lesson Plan and Student Workbook states that the Beech 1900D AFT1 cargo compartment has a maximum weight allowance of 1,000 pounds and that the AFT2 cargo compartment has a maximum weight allowance of 630 pounds. The workbook cautions that “the rear section of the cargo compartment is only to be used at the instruction of the crew. The netting must stay in place at all other times.” 1.18.2 Federal Aviation Administration Emergency Airworthiness Directive 2003-03-18 FAA Emergency AD 2003-03-18, dated January 27, 2003, was sent to all owners and operators of Beech 1900, 1900C, and 1900D airplanes. The AD indicated that recent ground testing and a review of the rigging procedures of a 1900D airplane revealed that the elevator control system could be misrigged to restrict elevator travel if current maintenance procedures were not properly followed. Such restricted travel might not be detected until the airplane was operating in a loading condition that required full elevator authority to control the pitch. The 1900 and 1900C models were included in this AD because their elevator control system design is similar to that of the 1900D model. 104 The revised Air Midwest average baggage weight guidance states that, in the absence of an actual weight, an average weight of 60 pounds can be used for each heavy or oversized bag.

Factual Information 77 Aircraft Accident Report The FAA determined, among other things, that inspections and verifications should be accomplished on all affected airplanes to ensure that the elevator surfaces had full travel. Specifically, Emergency AD 2003-03-18 required owners and operators of Beech 1900 series airplanes, by January 31, 2003, to perform a control column sweep inspection to verify full elevator travel to the primary up and down stops and a stop bolt inspection to verify that the stop bolt length was not excessive. For those airplanes that did not pass the initial control column sweep and stop bolt inspections, the AD required another rig of the elevator control system and/or a more detailed inspection of the system. For those airplanes that did pass the initial control column sweep and stop bolt inspections, the AD required a more detailed inspection of the elevator control system within 100 hours time in service. In addition, the AD required that owners and operators of Beech 1900 series airplanes report the results of the initial inspections and the 100-hour time-in-service inspection (if applicable). Air Midwest complied with Emergency AD 2003-03-18 and found that, of the 42 Beech 1900D airplanes in its inventory, 5 airplanes had maximum elevator deflections that were less than 20º or greater than 21º ANU (design range is between 20º and 21º ANU) or less than 14º AND (design range is between 14º and 15º AND).105 In addition, one airplane’s elevator control horn did not contact the left and right AND stop bolts, and another airplane’s elevator control horn did not contact the left AND stop bolt. According to the FAA, Raytheon Aircraft Company received 296 reports from the initial control column sweep and stop bolt inspection. The reports showed that 40 airplanes failed this initial check and thus required another rig. The FAA also indicated that Raytheon Aircraft received 227 reports from the 100-hour time-in-service inspection. According to the reports, 39 airplanes failed the 100-hour inspection, 18 of which failed by more than 1º in either the ANU or AND direction. Both the left and the right elevators on 9 of these 18 airplanes had insufficient AND travel. Specifically, the AND travel for these nine airplanes were as follows: four airplanes had left and right elevator deflections that were limited to 12º AND; one airplane had left and right elevator deflections limited to 13º and 11.3º AND, respectively; one airplane had left and right elevator deflections limited to 12.5º and 10.5º AND, respectively; one airplane had left and right elevator deflections limited to 12º and 13º AND, respectively; one airplane had left and right elevator deflections limited to 11.5º and 12.5º AND, respectively, and the airplane with the worst AND travel had left and right elevator deflections limited to 16.5º AND. The discrepancies in ANU travel ranged from 16.5º to 26º for the left elevator and from 17.5º to 26º for the right elevator. 105 The first of the five airplanes had a maximum left elevator deflection of 19º ANU. The second airplane had a maximum right elevator deflection of 19º ANU. The third airplane had a maximum left elevator deflection of 21.5º ANU and a maximum right elevator deflection of 22.5º ANU. The fourth airplane had maximum left and right elevator deflections of 13º AND. The fifth airplane had a maximum left elevator deflection of 12.5º AND.

Factual Information 78 Aircraft Accident Report 1.18.3 Federal Aviation Administration Guidance for On-the-Job Training The FAA’s Human Factors Guide for Aviation Maintenance and Inspection106 described OJT as follows: On-the-job training (OJT) is the generic name describing a variety of training methods in which trainees work while they learn job skills. On-the-job training follows the apprenticeship model of education where a new employee is mentored by a seasoned employee thought to be an expert in the field. This is sometimes called the “buddy” system. Demonstration and supervised practice with equipment and procedures within the work environment is what is normally considered OJT. OJT has several positive aspects: trainees perform many job tasks while becoming more proficient; trainees observe highly skilled technicians perform the tasks they are learning; and the trainees have an opportunity to build one-to-one relationships with mentors. Improperly used however, OJT can be inefficient from both the points-of-view of learning and cost. The results of OJT are highly dependent on the trainer’s teaching and interpersonal skills. In most OJT situations, the trainer is an AMT [aviation maintenance technician] whose primary job is maintenance, not training. At its worst, OJT is idiosyncratic, incomplete, haphazard, and time-consuming. The Human Factors Guide for Aviation Maintenance and Inspection also explained the following: Certain aviation maintenance training practices have been frequently criticized. Recurrent training tends to receive less emphasis than the constant technological changes in the industry demand. Mechanics sent to school for training on a specific aircraft may not receive formal training again on that aircraft type for 10 years or more. Training related to technological changes tends to be done on the job, instead of in formal, structured settings. There is ample evidence that OJT is not the best training method for a variety of skills needed by today’s AMT. Even when using OJT is appropriate, the current system has been criticized for its lax OJT training practices, which tend to be unstructured. Younger mechanics turn to more senior employees for ad hoc OJT, although there is no systematic way to ensure that the senior AMTs work or teaching skills are adequate to ensure the efficient transfer of skills and knowledge. The Human Factors Guide for Aviation Maintenance and Inspection included voluntary guidelines for air carriers that wanted to develop OJT programs. These guidelines recommended that structured OJT be 106 Maddox, M. (Ed.) Human Factors Guide for Aviation Maintenance and Inspection, Version 3.0 (Atlanta: Galaxy Scientific Corporation, 1998).

Factual Information 79 Aircraft Accident Report • based on measurable performance standards; • designed and delivered in a systems framework that includes information presentation, demonstration, practice, and evaluation; • designed to provide initial, recurrent, and remedial training; • used to standardize procedures and to provide consistent training among workers; • conducted by experienced employees trained in structured OJT techniques and adult learning principles; • delivered in segments that are planned, scheduled, and frequent and include keeping complete, up-to-date trainee performance records; and • audited annually to identify areas in need of improvement. In addition, the guide recommended that OJT be conducted in the following sequence: orientation, demonstration, practice, and evaluation and closure. 1.18.4 Other Related Accidents 1.18.4.1 Ryan Air Service Flight 103, Homer, Alaska On November 23, 1987, Ryan Air Service flight 103, a Beech 1900C,107 N401RA, crashed short of the runway during arrival at the Homer, Alaska, airport. Flight 103 was a scheduled 14 CFR Part 135 flight operating from Kodiak, Alaska, to Anchorage, Alaska, with intermediate stops in Homer and Kenai, Alaska. The 2 flight crewmembers and 16 passengers were killed, and 3 passengers were seriously injured. The accident investigation revealed that the airplane was loaded with about 600 pounds more cargo than the first officer had requested. The airplane was 400 to 500 pounds over the airplane’s maximum takeoff weight and 100 to 200 pounds over its maximum landing weight. In addition, the CG position was 12 to 16 percent MAC aft of the allowable aft limit, and the flight crew did not comply with company and FAA procedures in computing the CG position. Even with an extreme aft CG, the airplane was able to take off and establish cruise flight. Evidence indicated that the flight crew lost control of the airplane as its flaps were lowered for landing. The Safety Board determined that the probable cause of this accident was the failure of the flight crew to properly supervise the loading of the airplane, which resulted in the CG being displaced to such an aft location that airplane control was lost when the flaps were lowered for landing.108 107 The Beech 1900C is generally similar in size and capacity to the 1900D. The airplanes have numerous similar components and share a common FAA type certificate. 108 For more information, see National Transportation Safety Board, Ryan Air Service, Inc., Flight 103, Beech 1900C, N401RA, Homer, Alaska, November 23, 1987, Aircraft Accident Report NTSB/AAR-88/11 (Washington, DC: NTSB, 1988).

Factual Information 80 Aircraft Accident Report Figure 11 shows flight 5481’s weight and CG information compared with that for the flight 103 accident airplane. Two data points in the figure show the CG range for the flight 103 airplane. 1.18.4.2 ValuJet Airlines Flight 592, Everglades, Near Miami, Florida On May 11, 1996, ValuJet Airlines flight 592, a Douglas DC-9-32, N904VJ, crashed into the Everglades, near Miami, Florida, about 10 minutes after takeoff from Miami International Airport. The 2 pilots, 3 flight attendants, and all 105 passengers were killed. Flight 592 was operating under 14 CFR 121 with a scheduled destination of the William B. Hartsfield International Airport, Atlanta, Georgia. A fire erupted in the airplane’s class D cargo compartment. The fire was initiated by the actuation of one or more oxygen generators being improperly carried as cargo. The oxygen generators were prepared and packaged for carriage aboard flight 592 by SabreTech, a 14 CFR Part 145 repair station in Miami that performed heavy maintenance for ValuJet Airlines. Figure 11. Flight 5481 weight and center of gravity information compared with flight 103 weight and center of gravity information.

Factual Information 81 Aircraft Accident Report The Safety Board’s investigation of the FAA’s oversight of ValuJet Airlines revealed that inspectors from the Aircraft Maintenance Division within the Office of Flight Standards had recommended recertification of the airline 3 months before the accident. Specifically, in a February 14, 1996, summary report, the inspectors indicated, “consideration should be given to an immediate FAR 121 recertification of this airline” because of safety-related issues, such as the absence of adequate policies and procedures for maintenance personnel. The inspectors also indicated that the overall surveillance of ValuJet Airlines should be increased with special attention directed toward “manuals and procedures, structural inspections, the adequacy of the maintenance program, and shops and facilities.” The Safety Board determined that the probable causes of this accident were (1) the failure of SabreTech to properly prepare, package, and identify unexpended chemical oxygen generators before presenting them to ValuJet for carriage; (2) the failure of ValuJet to oversee its contract maintenance program to ensure compliance with maintenance, maintenance training, and hazardous materials requirements and practices; and (3) the failure of the FAA to require smoke detection and fire suppression systems in class D cargo compartments. Contributing to the accident was the failure of the FAA to adequately monitor ValuJet’s heavy maintenance programs and responsibilities, including ValuJet’s oversight of its contractors, and SabreTech’s repair station certificate; the failure of the FAA to adequately respond to prior chemical oxygen generator fires with programs to address the potential hazards; and ValuJet’s failure to ensure that both ValuJet and contract maintenance facility employees were aware of the carrier’s “no-carry” hazardous materials policy and had received appropriate hazardous materials training.109 1.18.4.2.1 Safety Recommendation A-97-70 During its investigation of the ValuJet Airlines flight 592 accident, the Safety Board determined that the SabreTech mechanics had many shortcomings, including their failure to install safety caps, their improper maintenance entries, their use of improper tags, and their inadequate communications between the maintenance shop floor and stores department. In its final report on the accident, the Board indicated that these shortcomings resulted from human failures that might have been avoided if more attention were given to human factors issues in the maintenance environment. As a result, the Board issued Safety Recommendation A-97-70 on September 9, 1997. Safety Recommendation A-97-70 asked the FAA to Include, in its development and approval of air carrier maintenance procedures and programs, explicit consideration of human factors issues, including training, procedures development, redundancy, supervision, and the work environment, to improve the performance of personnel and their adherence to procedures. 109 For more information, see National Transportation Safety Board, In-flight Fire and Impact With Terrain, ValuJet Airlines Flight 592, DC-9-32, N904VJ, Everglades, Near Miami, Florida, May 11, 1996, Aircraft Accident Report NTSB/AAR-97/06 (Washington, DC: NTSB, 1997).

Factual Information 82 Aircraft Accident Report On October 2, 2000, the FAA stated that it had reviewed the information contained in its report, Human Factors in Aviation Maintenance and Inspection, Strategic Program Plan, and that it was amending AC 120-16C, “Continuous Airworthiness Maintenance Programs,” to include information from the report. The FAA indicated that the revisions to the AC would also expand on CASS programs. On April 24, 2001, the Safety Board stated that it was difficult to determine whether the revisions to AC 120-16C would address the issues in this recommendation. On July 21, 2003, the FAA stated that chapter 10 of AC 120-16D included human factors as part of initial training. On February 23, 2004, the Safety Board stated that, although AC 120-16D addressed many of the human factors issues related to training, procedures development, redundancy, supervision, and work environment, the AC would be significantly strengthened if the FAA added specific references to its available human factors information related to aviation maintenance operations, such as the Human Factors Guide for Aviation Maintenance and Inspection. The Board also stated that it continued to investigate major accidents in which incorrect maintenance led to a loss of control of the airplane and that human factors in aviation maintenance was an important safety issue. Pending the inclusion in AC 120-16D of references to FAA-published guidance on human factors in aviation maintenance, Safety Recommendation A-97-70 was classified “Open— Acceptable Response.” 1.18.4.2.2 Safety Recommendation A-97-74 In its final report on the ValuJet Airlines flight 592 accident, the Safety Board determined that the FAA’s surveillance of ValuJet before the accident did not include any significant oversight of the air carrier’s heavy maintenance contractors, including SabreTech. The Board further determined that the FAA’s limited oversight of ValuJet’s maintenance contractors was not sufficient to detect potential problems. The ValuJet PMI was not required to conduct surveillance of the air carrier’s contract maintenance facilities. Thus, the Board concluded that the lack of an explicit requirement for a PMI of a 14 CFR Part 121 air carrier to regularly inspect repair stations that are performing heavy maintenance for the carrier is a significant deficiency in the FAA’s oversight of the carrier’s total maintenance program. As a result, the Board issued Safety Recommendation A-97-74 on September 9, 1997. Safety Recommendation A-97-74 asked the FAA to Ensure that Part 121 air carriers’ maintenance functions receive the same level of FAA surveillance, regardless of whether those functions are performed in house or by a contract maintenance facility. On April 22, 1998, the FAA stated that it issued Flight Standards Handbook Bulletin for Airworthiness 96-05C, “Air Carrier Operations Specifications Authorization to Make Arrangements With Other Organizations to Perform Substantial Maintenance,” on December 15, 1997. The FAA indicated that the bulletin described

Factual Information 83 Aircraft Accident Report detailed procedures to ensure that surveillance of each 14 CFR Part 121 air carrier’s maintenance function entails the performance of the maintenance, the adequacy of the maintenance organization, the competency of maintenance personnel, and the adequacy of maintenance facilities and equipment, regardless of whether those functions are performed in-house or by a contract maintenance facility. On July 23, 1999, the Safety Board stated that the FAA’s actions met the intent of Safety Recommendation A-97-74 and classified it “Closed—Acceptable Action.” 1.18.4.3 Fine Airlines Flight 101, Miami, Florida On August 7, 1997, Fine Airlines flight 101, a Douglas DC-8-61, N27UA, crashed after takeoff from Miami International Airport. The three flight crewmembers and one passenger on board the airplane were killed, one person on the ground was killed, and the airplane was destroyed by impact forces and a postcrash fire. The cargo flight, which had a scheduled destination of Santo Domingo, Dominican Republic, was operated under 14 CFR Part 121 as a supplemental air carrier. The accident airplane was loaded incorrectly, which resulted in an aft CG. Also, an incorrect stabilizer trim setting precipitated an extreme pitchup at rotation. The Safety Board determined that the probable cause of this accident was the failure of Fine Air to exercise operational control over the cargo loading process and the failure of Aeromar (a cargo shipper) to load the airplane as specified by Fine Air. Contributing to the accident was the failure of the FAA to adequately monitor Fine Air’s operational control responsibilities for cargo loading and to ensure that known cargo-related deficiencies were corrected at Fine Air.110 1.18.4.3.1 Safety Recommendation A-98-49 In its final report on the Fine Airlines accident, the Safety Board discussed the Sum Total Aft and Nose (STAN) system, which is an electronic system installed on some cargo airplanes that allows flight crews to verify an airplane’s weight and balance before departure. According to the report, the STAN system uses pressure transducers to convert main gear and nose gear shock strut air pressure to an electronic signal. The system then provides flight crews with a digital readout in the cockpit (on the flight engineer’s instrument panel) of the airplane’s gross weight and CG values. The Safety Board’s final report on the Fine Airlines accident concluded that, if the flight crew had an independent method in the cockpit for verifying the airplane’s actual weight and balance and gross weight, it might have alerted them to loading anomalies and prevented the accident. As a result, on July 10, 1998, the Safety Board issued Safety Recommendation A-98-49 to the FAA. Safety Recommendation A-98-49 asked the FAA to 110 For more information, see National Transportation Safety Board, Uncontrolled Impact With Terrain, Fine Airlines Flight 101, Douglas DC-8-61, N27UA, Miami, Florida, August 7, 1997, Aircraft Accident Report NTSB/AAR-98/02 (Washington, DC: NTSB, 1998).

Factual Information 84 Aircraft Accident Report Evaluate the benefit of the STAN (Sum Total Aft and Nose) and similar systems and require, if warranted, the installation of a system that displays airplane weight and balance and gross weight in the cockpit of transport-category cargo airplanes. On December 30, 1998, the FAA stated that it had completed an evaluation of the reliability of onboard weight and balance systems. The FAA found that some operators had reliability and accuracy concerns with such systems because of factors such as wind, ramp slope, oleo stiction, low hydraulic pressure, and asymmetrical gear loads. The FAA stated that the results of its evaluation did not support imposing a requirement to install a system that displays airplane weight and balance and gross weight in the cockpit of transport-category cargo airplanes. On January 11, 2000, the Safety Board stated that, on the basis of the FAA’s evaluation and subsequent determination that onboard weight and balance systems do not yet meet the quality standards for a mandatory system, Safety Recommendation A-98-49 was classified “Closed—Acceptable Action.” 1.18.4.4 Emery Airlines Flight 17, Rancho Cordova, California On February 16, 2000, Emery Airlines flight 17, a McDonnell Douglas DC-8-71F, N8079U, crashed in an automobile salvage yard shortly after takeoff while attempting to return to Sacramento Mather Airport, Rancho Cordova, California, for an emergency landing. Flight 17 was a scheduled 14 CFR Part 121 cargo flight from Sacramento to James M. Cox Dayton International Airport, Dayton, Ohio. The two pilots and the flight engineer were killed, and the airplane was destroyed. The Safety Board’s investigation of this accident determined that the bolt attaching the accident airplane’s right elevator control tab crank fitting to the pushrod was improperly secured and inspected during either the airplane’s most recent D inspection (heavy maintenance accomplished every 12 years) or subsequent maintenance. Tennessee Technical Services (TTS), an Emery Airlines maintenance contractor, performed the accident airplane’s last D inspection between August 27 and November 17, 1999. Eight days after the D inspection was completed, a pilot reported increased control column forces. Emery maintenance personnel found that the left and the right elevator dampers were reversed, and the maintenance logbook indicated that the maintenance personnel moved the dampers to their correct positions. Emery maintenance personnel could have come in contact with the bolt at the control tab crank fitting while troubleshooting the reported problem. The Safety Board determined that the probable cause of the accident was a loss of pitch control resulting from the disconnection of the right elevator control tab. The disconnection was caused by the failure to properly secure and inspect the attachment bolt.111 111 For more information, see National Transportation Safety Board, Loss of Pitch Control on Takeoff, Emery Worldwide Airlines, Inc., Flight 17, McDonnell Douglas DC-8-71F, N8079U, Rancho Cordova, California, February 16, 2000, Aircraft Accident Report NTSB/AAR-03/02 (Washington, DC: NTSB, 2003).

Factual Information 85 Aircraft Accident Report 1.18.4.4.1 Safety Recommendation A-03-31 In its final report on the Emery Airlines flight 17 accident, the Safety Board discussed the accident airplane’s last B-2 maintenance inspection (the second of four segmented inspections generally accomplished at 136-hour intervals) on January 21 and 22,

1. The B-2 inspection includes a visual check of the elevators and tabs for general

condition, corrosion, leakage, and security of attachment. The DC-8 elevator assembly design requires the elevator control tab inboard fairing to be removed for maintenance personnel to inspect the inboard hinge fitting and the control tab crank fitting to pushrod attachment. During postaccident interviews, Emery Airlines maintenance personnel stated that, when performing the accident airplane’s last B-2 maintenance, they did not remove the elevator control tab inboard fairing or inspect the crank fitting to pushrod attachment. During public hearing testimony, witnesses from Emery Airlines indicated that its B-2 inspection was intended to be a general visual inspection that was to be accomplished without removing access or inspection panels or fairings. However, witnesses from TTS stated that removal of the control tab fairing was necessary to satisfactorily perform the tasks described on the Emery Airlines B-2 work card, even though that step was not specifically listed on the work card. The Safety Board noted that several air carriers have tried to clarify the intended scope of maintenance tasks by including, on their work cards, an enumeration of the actions that are necessary for the proper accomplishment of the associated work task. The Board stated that the inclusion of this additional detail on work cards, although not required by the FAA, should result in more consistent accomplishment of maintenance tasks. As a result, the Board issued Safety Recommendation A-03-31 on August 18, 2003. Safety Recommendation A-03-31 asked the FAA to Require all 14 CFR Part 121 air carrier operators to revise their task documents and/or work cards to describe explicitly the process to be followed in accomplishing maintenance tasks. On January 12, 2004, the FAA stated that Safety Recommendation A-03-31 was limited to DC-8 operators only. The FAA also stated that the Boeing Company issued temporary revisions to the DC-8 AMM on May 8, 2002, and that these revisions explicitly described the maintenance task process to be followed. On January 23, 2004, the Safety Board classified Safety Recommendation A-03-31 “Open—Response Received.” 1.18.4.5 Colgan Air Flight 9446, Yarmouth, Massachusetts On August 26, 2003, Colgan Air (doing business as US Airways Express) flight 9446, a Beech 1900D, N240CJ, crashed into water near Yarmouth, Massachusetts. The two flight crewmembers were killed, and the airplane was substantially damaged. The repositioning flight, which was conducted under 14 CFR Part 91, departed Barnstable Municipal Airport, Hyannis, Massachusetts, for Albany International Airport (ALB), Albany, New York.

Factual Information 86 Aircraft Accident Report Shortly after takeoff, the flight crewmembers declared an emergency and reported a trim problem. The airplane had reached an altitude of about 1,100 feet msl. The flight crew requested to land on a specific runway, and the controller cleared the flight to land on any runway. No further transmissions were received from the flight crew. FDR data indicated that the airplane’s airspeed continued to increase to about 250 knots and that the airplane’s last recorded altitude was about 300 feet msl. The accident airplane’s FDR pitch trim control position parameter had been placed on the minimum equipment list (deferred maintenance) for the flight because the parameter was not calibrated. The Safety Board’s airplane performance study for this accident determined that the recorded pitch trim control positions did not reflect the actual pitch trim control positions. The difference between the recorded and actual pitch trim control positions was about 2.1º ANU. According to the airplane performance study, the airplane began the flight with a pitch trim control position of about 0.5º ANU. Shortly after takeoff, the pitch trim control position moved to about 0.8º AND and remained there for about 10 seconds. The pitch trim control position then moved to about 5º AND and remained there for the rest of the flight. Calculations showed that the airplane would have required about 200 pounds of aft (pulling) control force to maintain level flight in the out-of-trim condition. The accident flight was the first flight after maintenance had been performed on the airplane. The maintenance work included replacement of both elevator trim tab actuators (because of a failed freeplay check) in accordance with Beech 1900D AMM section 27-30-06, “Elevator Trim Tab Actuator, Removal and Installation and the Actuator Cable Replacement.” The procedure required that the elevator be removed before the actuators were replaced. The Safety Board’s investigation of this accident determined that the mechanics skipped this procedural step and replaced the actuators with the elevators installed. The mechanics thought that the forward elevator trim tab cable had become jammed or kinked during the replacement of the trim tab actuator. The mechanics then tried to replace the cable according to the procedure in Beech 1900D AMM section 27-30-04, “Elevator Trim Tab Cables, Removal and Installation.” A postaccident examination of a section of the forward elevator trim cable revealed evidence consistent with a misrouted cable. The Beech 1900D AMM and Colgan Air work cards did not include a trim system check at the end of the elevator trim tab cable procedure. Although the mechanics stated that they checked the trim system, evidence was consistent with the trim system operating in a direction opposite from the command of the trim wheel.112 The Safety Board’s investigation of this accident revealed that the illustration of the forward elevator trim tab cable drum appeared backward in section 27-30-04 in the Beech 1900D AMM. On October 22, 2003, Raytheon Aircraft Company revised its Beech 1900D AMM elevator trim tab cable rigging procedure to show the correct illustration for the forward elevator trim tab cable drum. 112 Additional information about this accident, NYC03MA183, can be found on the Safety Board’s Web site.

Factual Information 87 Aircraft Accident Report 1.18.4.5.1 Federal Aviation Administration Airworthiness Directive 2003-20-10 On October 15, 2003, the FAA issued AD 2003-20-10, which applied to all Beech model 1900, 1900C, and 1900D airplanes. The FAA reviewed Raytheon Aircraft’s current maintenance procedures for the elevator trim system and determined that the figures in the applicable maintenance manuals depicted the elevator trim cable drum at 180º from the installed position and showed the open, keyed side of the drum instead of the flat side of the drum.113 The FAA’s review of the maintenance procedure also identified the need to add a step to visually confirm that the trim wheel position and the trim tab position were consistent. According to the FAA, such a check would detect and correct any problems with the elevator trim system installation before problems occur during operation. AD 2003-20-10 warned that an incorrectly installed elevator trim system component, if not detected and corrected, could result in difficulties in controlling the airplane or a total loss of pitch control. As a result, the AD required operators of Beech 1900 series airplanes to replace the incorrect figure in the elevator trim system maintenance procedures with the corrected figure, incorporate a temporary revision to the applicable maintenance manual that describes the elevator trim operational check, and perform an elevator trim operational check each time maintenance is accomplished on the elevator trim system.114 1.18.4.6 CommutAir Flight 8718, Albany, New York On October 16, 2003, CommutAir (doing business as Continental Connection) flight 8718, a Beech 1900D, N850CA, aborted takeoff from ALB because of an elevator control system discrepancy. The pilot stated that, during the takeoff roll, the control column would not move aft when the airspeed reached V1.115 The intended destination for the positioning flight, which was conducted under 14 CFR Part 91, was Westchester County Airport, White Plains, New York. The two flight crewmembers were not injured, and the airplane was not damaged. Maintenance was performed on the airplane 1 day before the incident, and the incident flight was the first postmaintenance flight. Maintenance records showed that a worn detent pin was replaced on the right thrust lever assembly. The mechanic who replaced the detent pin stated that he looked in the Beech 1900D AMM for a procedure to replace the pin or a procedure to access the thrust lever assembly. The mechanic indicated 113 The FAA indicated that, although the figures in the manuals were incorrectly depicted, the step-by-step instructions in the procedure, if followed correctly, would result in the proper installation and action of the elevator trim system. If only the figures were used, a reversing of the action of the elevator manual trim system could result. 114 Raytheon Aircraft Company addressed these issues in its Safety Communiqué number 234, dated September 2003. 115 According to 14 CFR Part 1, “V1 means the maximum speed in the takeoff at which the pilot must take the first action (e.g., apply brakes, reduce thrust, deploy speed brakes) to stop the airplane within the accelerate-stop distance. V1 also means the minimum speed in the takeoff, following a failure of the critical engine at VEF [the speed at which the critical engine is assumed to fail during takeoff], at which the pilot can continue the takeoff and achieve the required height above the takeoff surface within the takeoff distance.”

Factual Information 88 Aircraft Accident Report that the Beech 1900D AMM did not contain either procedure, so he looked in a CommutAir manual that contained a list of the manufacturer’s field service kits, found a reference to a field service kit for “thrust lever, replaceable detent pin,” and obtained the kit. The field service kit installation instructions included a step to remove the thrust control assembly from the center pedestal, but the instructions did not provide information about how to access the thrust lever assembly so that it could be removed from the pedestal. The instructions also did not provide any reference to technical documents that contained instructions for the removal and installation of the thrust lever assembly. The mechanic stated that he accessed the thrust lever assembly by removing the elevator trim wheel and an access panel from the left side of the cockpit pedestal. No writeup was generated for the trim wheel removal, and no markings or tags were placed on the trim wheel to ensure proper reinstallation. The investigation of this incident determined that, when the elevator trim wheel was reinstalled, the mechanic did not properly align the elevator trim tab position indicator with the elevator trim tab position.116 As a result, the trim wheel was reinstalled incorrectly. The mechanic did not perform a functional test of the elevator trim control system, as required by AD 2003-20-10 (see section 1.18.4.5.1).117 The Safety Board and Raytheon Aircraft Company performed a functional check of the elevator trim control system. The check verified that the elevator trim tab position indicator did not accurately reflect the elevator trim tab position. Specifically, when the elevator trim tab position indicator was set at 3 units of ANU trim, the elevator trim tab was deflected 4.6º AND from its neutral position. (The elevator trim tab’s full AND position is 5.5º from neutral.) The functional check determined that the elevator trim tab position indicator pointer was off by about 6 units, which equates to about 8.8º of elevator trim tab, or about 37 percent of the trim tab’s full range of travel. After the cause of the elevator trim control system discrepancy was determined, a CommutAir mechanic properly aligned the elevator trim tab position indicator to the elevator trim tab position. Elevator and elevator trim control system functional tests were accomplished to verify that the systems were operating according to the requirements described in the Beech 1900D AMM. A high-speed taxi test and a flight test were accomplished to verify the functionality of the elevator and elevator trim control systems.118 116 When the elevator trim tab position indicator is at 0°, the elevator trim tab position should also be at 0°. 117 The quality assurance inspector also did not perform a functional test of the elevator trim control system. The inspector stated that he did not know that the mechanic’s work involved the trim system. 118 Additional information about this incident, NYC04IA010, can be found on the Safety Board’s Web site.

Factual Information 89 Aircraft Accident Report 1.18.5 Human Factors Research Since 1989, the FAA has sponsored a research program on human factors in aviation maintenance and produced guidance on countermeasures to mitigate human factors problems in aviation maintenance. For example, the FAA’s Guide to Human Factors in Maintenance and Inspection provides information on work shift scheduling programs, workplace design, and procedural guidance design. The guide also addresses developing and implementing structured OJT programs, maintenance error reporting programs, and maintenance resource management training.119 The European Joint Aviation Authorities (JAA)120 association has also sponsored initiatives addressing human factors problems in aviation maintenance. The JAA focused its efforts on revising the regulatory framework under which aviation maintenance is performed. In its May 2001 Human Factors in Maintenance Working Group Report,121 the JAA proposed revisions to its Joint Aviation Regulations (JARs). These proposed revisions included the following requirements for maintenance organizations: • communicate information about deficiencies in maintenance procedures to aircraft certificate holders, • publish an organizational safety policy, • consider human factors principles when writing maintenance procedures, • develop appropriate shift turnover procedures, • consider human fatigue limitations in the organization’s planning, • consider performing duplicate maintenance inspections, • plan maintenance work better, • ensure thorough inspection of maintenance work before inspector signoff, and • require initial and recurrent training of maintenance personnel to ensure that human factors principles are effectively applied within maintenance organizations. In September 2003, the JAA revised JAR Part 145, “Approved Maintenance Organizations,” to include this information. 119 AC 120-72, “Maintenance Resource Management Training,” which provides guidelines for specialized voluntary training programs for improving communication, effectiveness, and safety in maintenance organizations, is an example of the FAA’s efforts to encourage voluntary human factors programs in the aviation industry. 120 The JAA is an associated body of the European Civil Aviation Conference, which represents the civil aviation regulatory authorities of those European States that have agreed to cooperate in developing and implementing common regulatory safety standards and procedures. 121 Joint Aviation Authorities Maintenance Human Factors Working Group, Human Factors in Maintenance Working Group Report (Hoofddorp, the Netherlands: JAA, 2001).

Factual Information 90 Aircraft Accident Report 1.18.6 Other Passenger and Baggage Weight Information 1.18.6.1 Civil Aviation Authority Report The Civil Aviation Authority (CAA), the FAA’s counterpart in the United Kingdom, conducted a survey between November 1981 and January 1982 to determine the distribution of passengers and their carry-on baggage aboard scheduled air carrier flights. The survey was conducted 18 times at Heathrow Airport because of its high turnover during the day and its wide variety of international and domestic flights. Departing international and domestic passengers and their carry-on baggage were weighed on a scale with a digital readout; testing at the beginning and the end of the survey found that the scale was accurate to within 0.5 percent. International passengers were asked about where they were traveling, whether they were traveling for business or leisure, and whether they had checked any baggage. The international passengers and their carry-on baggage were then weighed. Domestic passengers were asked whether they had checked any baggage, and then the passengers and their carry-on baggage were weighed. The CAA’s survey results appear in table 9.122 Table 9. Results of the Civil Aviation Authority’s weight and carry-on baggage survey. a For this report, the average weights were converted from kilograms to pounds and then were rounded to the nearest whole number. b Of the 1,928 male passengers surveyed, 1,632 were international passengers, and 296 were domestic passengers. c Of the 769 female passengers surveyed, 692 were international passengers, and 77 were domestic passengers. d The child and infant passengers surveyed were not categorized according to whether they were international or domestic passengers. A child was considered to be between 2 and 11 years of age, and an infant was considered to be under 2 years of age. e The carry-on baggage was not categorized according to whether the bags belonged to international or domestic passengers. According to the CAA’s report, the average weight for male passengers was between 13 and 16 pounds more than the CAA’s male passenger weight at the time of the survey (about 165 pounds). The average weight for female passengers was between 2 and 122 For more information, see Civil Aviation Authority, Passenger and Hand Baggage Weight Survey, Heathrow Airport – Winter 1981/1982, CAA Paper 83003 (London: CAA, 1983). Category Number surveyed Average weights (in pounds)a International Domestic Male passenger 1,928b 178 181 Female passenger 769c 141 140 Child passenger 72d 56 56 Infant passenger 6d 25 25 Carry-on baggage 2,775e 12 12

Factual Information 91 Aircraft Accident Report 3 pounds less than the CAA’s female passenger weight at the time (about 143 pounds). The average weight for carry-on baggage was 5 pounds more than the CAA’s carry-on baggage weight at the time (about 7 pounds). 1.18.6.2 Australian Department of Transport and Communications Report The Flight Standards Division of the Australian Department of Transport and Communications conducted a project to investigate the methodology of standard weights and weight surveys. The Flight Standards Division was concerned about the use of 170 pounds (converted from kilograms) as the standard adult passenger weight in aircraft of all passenger capacities. The 170-pound figure, which was derived from a survey conducted in 1946, made no distinction between male and female passengers and included carry-on baggage. The Flight Standards Division found that the adult standard weight of 170 pounds was based on inaccurate and outdated passenger weight data. The 1988 report on this project123 included a discussion of the following issues: • the need for new weight surveys, • the basic statistics theory applicable to standard weights, • the errors in the criteria used to determine the then-current standard weights, • the maximum probability of overload and its relation to safety, • the effect on the maximum probability of overload when the standard passenger weight was constant, • the effect on standard passenger weight when the maximum probability of overload was constant, • a proposed method for calculating future standard passenger weights (a sliding-scale formula that based passenger weight on the maximum seating capacity of the airplane), and • interim standard weights based on then-current data from the Australian National Heart Foundation for adult males and females and the Australian National Health and Medical Research Council for infants (under 3 years of age), children (4 to 12 years of age), and adolescent males and females (13 to 16 years of age). The Flight Standards Division concluded that the use of one adult standard weight for all aircraft capacities was no longer acceptable because smaller aircraft had a significant risk of being overloaded and larger aircraft were being unnecessarily penalized. The Flight Standards Division further concluded that all aircraft should have a similar level of safety with respect to the uncertainty of passenger load and that a 123 For more information, see Airworthiness Branch, Flight Standards Division, Department of Transport and Communications, Standard Weights for Passenger and Baggage in Australian Aircraft, Airworthiness Report AF 51 (Canberra: Department of Transport and Communications, 1988).

Factual Information 92 Aircraft Accident Report sliding-scale method of calculating standard weights particular to the aircraft capacity should be adopted. The Flight Standards Division proposed passenger standard weights to be used when actual passenger weights are not used. The proposed standard weights for adult males and females, infants, children, and adolescent males and females decreased as the maximum seating capacity of the airplane increased. The standard weights for an airplane with a maximum seating capacity of 15 to 19 passengers and crewmembers are shown in table 10. (The Beech 1900D has a maximum seating capacity of 19 seats.) Table 10. Australian Department of Transport and Communications proposed standard passenger weights for airplanes with a maximum seating capacity of 15 to 19 seats. a For this report, the average weights were converted from kilograms to pounds and then were rounded to the nearest whole number. 1.18.6.3 Civil Aviation Authority of New Zealand Survey In 2003, the CAA of New Zealand commissioned a survey to identify the current average weight of domestic passengers traveling aboard large airplanes with more than 30 passenger seats, medium-sized airplanes with 10 to 30 passenger seats, and helicopters and airplanes with 9 or fewer passenger seats. Previous passenger weight surveys by the CAA of New Zealand showed that the current standard weight at the time—equivalent to about 170 pounds—was out of date. A 1999 study showed that the average weight for passengers traveling aboard airplanes with more than 30 passenger seats was equivalent to about 187 pounds. Also in 1999, the New Zealand Ministry of Health found that the average weight of New Zealanders was increasing by 3 kilograms (6.6 pounds) per decade. During October and November 2003, 15,414 domestic passengers who were 13 years of age and older were weighed, first with their carry-on baggage and then without the baggage. Most of the passengers were weighed at three major airports—Auckland, Wellington, and Christchurch—and a small number of passengers were weighed at the Queenstown airport. Of the 15,414 survey participants, 8,491, or 55 percent, were male, and 6,923, or 45 percent, were female. The results of the survey are shown in table 11. Category Standard weight (in pounds)a Adult male 187 Adult female 152 Infant 35 Child 95 Adolescent male 139 Adolescent female 126

Factual Information 93 Aircraft Accident Report Table 11. Results of the Civil Aviation Authority of New Zealand’s weight and carry-on baggage survey. a For this report, the average weights were converted from kilograms to pounds and were then rounded to the nearest whole number. The 2003 average weight for male passengers with their carry-on baggage increased from the 1999 figure by about 3 pounds. The 2003 average weight for female passengers with their carry-on baggage increased from the 1999 figure by about 7 pounds. According to the survey report,124 the results of the survey will be incorporated into proposed rule amendments that are expected to become effective in the second quarter of 2004. Category Average weight (in pounds)a Male passenger 195 Female passenger 159 Male passenger with carry-on baggage 207 Female passenger with carry-on baggage 169 124 2003 Survey of Passenger Weights Market Research Report (Lower Hutt, New Zealand: CAA, 2003).

94 Aircraft Accident Report 2. Analysis 2.1 General The captain and the first officer were properly certificated and qualified under Federal regulations. No evidence indicated any preexisting medical or behavioral conditions that might have adversely affected their performance during the accident flight. Flight crew fatigue was not a factor in this accident. The accident airplane was properly certified and equipped in accordance with Federal regulations. Except for the elevator control system (which is discussed in section 2.3), no evidence indicated that the airplane was improperly maintained. The recovered components showed no evidence of any preexisting structural, engine, or systems failures. Weather was not a factor in this accident. The air traffic controllers that handled the accident flight were properly trained and provided appropriate air traffic control services. The emergency response for this accident was timely and effective. The accident was not survivable for the airplane occupants because they were subjected to impact forces that exceeded the limits of human tolerance. This analysis discusses why the flight crew lost control of the airplane during its takeoff rotation and initial climb and what effect the airplane’s elevator and center of gravity (CG) had on this accident. The analysis also examines organizational and management issues that played a role in the circumstances of this accident and provides information about an ongoing problem with cockpit voice recorders (CVR) installed on Beech 1900 series airplanes. 2.2 Loading and Preflight Activities On the day of the accident, the accident first officer was seen conducting a walk-around inspection of the airplane. He did not report anything unusual about the airplane, including its elevator control system.125 The accident flight crew filled out the Air Midwest Beechcraft 1900D Load Manifest form for the flight using the average weight values for passengers and baggage in Air Midwest’s weight and balance program at the time of the accident.126 The load 125 The three previous flight crews who flew the accident airplane also did not report anything unusual about the elevator control system. In fact, the first officer of the flight from Huntington, West Virginia (HTS), to Charlotte, North Carolina, on January 7, 2003, stated that “everything was normal” and “it was a good flying airplane.” 126 The flight crew made a 10-pound addition error when summing the weights that comprise the zero fuel weight. This addition error was not a factor in the accident.

Analysis 95 Aircraft Accident Report manifest indicated a taxi fuel burn of 220 pounds, even though Air Midwest assumes a taxi fuel burn of 110 pounds. These figures resulted in a calculated airplane weight of 17,028 pounds and a CG position of 37.8 percent mean aerodynamic chord (MAC), which were within the Beech 1900D certified weight and CG limits of 17,120 pounds and 40 percent MAC, respectively. The two ramp agents assigned to the accident flight handled the baggage according to company procedures and interacted appropriately with the flight crew. In a postaccident interview, one of the ramp agents reported that he told the captain that 2 of the 31 bags aboard the airplane had an estimated weight of between 70 and 80 pounds. However, the bags did not have a heavy bag tag attached to them. (Gate agents use these tags to indicate an overweight bag, that is, a bag that weighs between 70 and 100 pounds.) Also, the bags were not identified as overweight on the OF-11E form (the US Airways Express Load Report that is used to account for all passengers, baggage, and cargo loaded on a US Airways Express flight). As a result, the flight crew was not required to account for the extra weight of the reportedly heavy bags on the load manifest form. Even if the flight crew had (1) accounted for the two reportedly heavy bags or (2) accounted for the two heavy bags, estimated an additional 110 pounds of fuel at takeoff,127 and recorded the 12-year-old passenger’s weight as 80 pounds rather than 175 pounds,128 the Air Midwest weight and balance program would still have indicated that flight 5481 was within the Beech 1900D certified weight and CG limits, as shown in table

1. However, for the second scenario, flight 5481’s calculated weight would have

exceeded the Beech 1900D weight limit if the 12-year-old passenger’s weight had remained 175 pounds. Table 12. Calculations for Air Midwest flight 5481 using the weight and balance program in effect at the time of the accident. 127 According to the flight 5481 dispatch release, the airplane was loaded with 2,420 pounds of fuel before takeoff. Given Air Midwest’s taxi fuel burn assumption of 110 pounds, the airplane would have had 2,310 pounds of fuel at takeoff. The load manifest indicated that the airplane had 2,200 pounds of fuel at takeoff. 128 The Air Midwest Flight Operations Procedures Manual at the time of the accident (see section 1.18.1.2) stated that an average weight of 175 pounds could be used for each adult passenger during the winter and that an average of 80 pounds could be used for children between the ages of 2 and 12 years. Load manifest Load manifest plus two bags Load manifest plus two bags and 110 pounds of fuel but with 80 pounds for the child passenger Weight (pounds) CG (percent MAC) Weight (pounds) CG (percent MAC) Weight (pounds) CG (percent MAC) 17,028 37.8 17,078 38.8 17,093 38.8

Analysis 96 Aircraft Accident Report 2.3 Restricted Downward Elevator Travel Flight data recorder (FDR) and CVR data from the accident flight showed that the airplane was rotating airplane nose up (ANU) after takeoff, even though the flight crew was pushing the control column fully forward and trimming the airplane in the airplane-nose-down (AND) direction. Neither of these actions allowed the flight crew to control the airplane’s pitch attitude. FDR data, ground test results, and the airplane performance study for this accident showed that, before the accident airplane’s detail six (D6) maintenance check on January 6, 2003, at Air Midwest’s HTS maintenance station, the airplane’s full range of downward elevator travel was available. FDR data, ground test results, and the airplane performance study also showed that, after the D6 maintenance check, the airplane’s downward elevator travel was limited to about 7º rather than the 14º to 15º specified in the Beech 1900D Airliner Maintenance Manual (AMM). Before the D6 maintenance check, the accident airplane’s actual elevator position (derived from Beech 1900D aerodynamic characteristics and performance data from the FDR) was consistent with the pitch control position recorded on the FDR. Specifically, before maintenance, the actual elevator position during a typical cruise flight was 4º AND, and the pitch control position recorded on the FDR was also 4º AND. After the D6 maintenance check, the accident airplane’s actual elevator position (derived from Beech 1900D aerodynamic characteristics and performance data from the FDR) was not consistent with the pitch control position recorded on the FDR. Specifically, the actual elevator position during a typical cruise flight was again determined to be 4º AND, but the pitch control position recorded on the FDR was 13º AND. Thus, the FDR pitch control position sensor (which is attached to structure located to the left of the base of the control column) indicated a 9º AND shift, even though the actual elevator position remained at 4º AND. Further, when the maximum elevator available was achieved or commanded during postmaintenance ground operations and during the accident flight, the actual elevator position was 7º AND; however, as a result of the 9º AND shift, the FDR recorded a pitch control position of 16º AND. The Safety Board examined the maintenance work performed at HTS during the accident airplane’s D6 maintenance check to determine whether any of the work resulted in the airplane’s restricted downward elevator movement. Part of the D6 check involved checking the tension of the elevator control system cables and adjusting the tension if necessary. The Structural Modification and Repair Technicians (SMART) mechanic who performed this work had not previously performed it on a Beech 1900D. As a result, the mechanic was receiving on-the-job training (OJT) from a Raytheon Aerospace, LLC (RALLC), quality assurance inspector for the tasks associated with that part of the D6 check. (The OJT provided to the mechanic is discussed in section 2.3.2.) The SMART mechanic determined that the accident airplane’s cables needed to be adjusted because their average tension was too low. He stated that he adjusted the cables

Analysis 97 Aircraft Accident Report and performed some, but not all, of the steps of the elevator control system rigging procedure (section 27-30-02) in the Beech 1900D AMM. However, whenever cable tension adjustments are made, the entire elevator control system rigging procedure needs to be performed and not just those steps that apply to cable tensioning. (The issue of skipped procedural steps is discussed in section 2.3.3.) Examination of the accident airplane’s pitch control cable turnbuckles as found in the wreckage revealed that the AND turnbuckle, which measured 7.30 inches in length, was extended 1.76 inches more than the ANU turnbuckle, which measured 5.54 inches in length. However, according to data from Air Midwest’s postaccident survey of its entire fleet of 42 Beech 1900D airplanes, the AND turnbuckle was extended, on average, only 0.04 inch less than the ANU turnbuckle. Further, ground tests showed that turnbuckles adjusted to the lengths of those found in the wreckage would result in limited downward elevator travel, although the FDR would indicate that full downward travel was available. The Safety Board could not determine the exact measurements of the accident airplane’s ANU and AND cable turnbuckles and other adjustable components129 when the airplane entered the D6 maintenance check. However, it is clear that the adjustments to the cable turnbuckles (and possibly other adjustable components) during maintenance resulted in FDR pitch control measurements that showed a 9º AND loss of travel, which restricted the accident airplane’s elevator travel to 7º AND. The Safety Board could not precisely determine the changes that were made to the elevator control system during the D6 maintenance check to restrict the accident airplane’s elevator travel to 7º AND. However, during the ground tests, the Board discovered one scenario that provided results that were reasonably consistent with FDR data from the accident airplane. Specifically, when the rig pin for the aft bellcrank was not removed from the test airplane and the cable tension was released and then the rig pin for the forward bellcrank was installed aft of the bellcrank arm, adjustments to the turnbuckles resulted in an ANU turnbuckle length of 5.12 inches and an AND turnbuckle length of 7.70 inches. After the aft rig pin was removed, the test airplane’s elevator moved to 7.7º AND. The Safety Board concludes that the accident airplane entered the D6 maintenance check with an elevator control system that was rigged to achieve full elevator travel in the downward direction. The Safety Board further concludes that the accident airplane’s elevator control system was incorrectly rigged during the D6 maintenance check and that the incorrect rigging restricted the airplane’s elevator travel to 7º AND, or about one-half of the downward travel specified by the airplane manufacturer. 2.3.1 Conspicuity of the Elevator Control System Misrig The only visible sign of the misrig during the first officer’s external preflight inspection would have been a change in the elevator resting position. The normal elevator 129 The other adjustable components are the forward push-pull tube; the left and right aft pushrods; and the primary, secondary, and tertiary control stops.

Analysis 98 Aircraft Accident Report resting position is between 14º and 15º AND; after the misrig, the elevator resting position was about 7º AND. Because the horizontal stabilizer on a parked Beech 1900D is located about 15 feet above the ground, it would be difficult to detect the change in the elevator resting position from the ground. In fact, during ground tests, Safety Board investigators, while on the ground, observed the test airplane’s elevator before and after the elevator control system was misrigged. The investigators did not observe a conspicuous change in the elevator resting position. The ground tests also showed that, in both rigging positions, the control column was fully forward. When the control column was pulled fully aft, the range of total control column travel for the misrigged position was 1 inch less than for the properly rigged position. However, the 1-inch reduction in the range of travel was not noticeable to Board investigators. The ground tests further showed that the only evidence during flight of the misrig would have been a forward shift of the control column’s neutral (0°) position by about 0.72 inch. No control column markings or other visual indications would have alerted the flight crew that the control column position corresponding to the elevator’s neutral position had changed. In addition, three Beech 1900D type-rated pilots conducted control sweeps (full forward and full aft movement of the control column) on a test airplane with the elevator control system rigged according to the Beech 1900 AMM and then with the system rigged to match the accident airplane. The pilots did not report any noticeable change in the feel or position of the control wheel between the two sets of control sweeps. The Safety Board concludes that the changes in the elevator control system resulting from the incorrect rigging were not conspicuous to the flight crew. 2.3.2 Adequacy of On-the-Job Training Provided to the Mechanic Five of the six SMART mechanics who were on duty on the night of January 6, 2003, had worked at HTS for less than 8 weeks. None of these mechanics had completed training for the D6 maintenance check. The mechanic assigned by the foreman (the other SMART mechanic on duty at HTS on January 6th) to perform the elevator control cable check was selected for the task because he had previously accomplished flight control rigging work on DHC-8 airplanes. The RALLC quality assurance inspector, who was providing the mechanic’s OJT, stated that he did not think he needed to closely supervise the mechanic because of his previous flight control rigging experience. The mechanic stated that, before he inspected the elevator control system, the foreman helped him locate the access panel for the forward bellcrank rig pin and the elevator cable turnbuckles. The mechanic also stated that he and the quality assurance inspector discussed the low cable tensions, the need to adjust the tensions, and the steps that could be skipped. The mechanic indicated that the quality assurance inspector then left to attend to other duties. The mechanic further stated that another mechanic held the turnbuckles while he adjusted them and that the quality assurance inspector returned after the rigging work was completed to observe the final check of the elevator control system.

Analysis 99 Aircraft Accident Report The quality assurance inspector stated that, after he verified that the forward bellcrank rig pin had been inserted (he did not actually observe the rig pin being inserted), he left the mechanic unsupervised during the elevator control cable inspections and turnbuckle adjustments. The quality assurance inspector indicated that he had to conduct other duties, which included providing OJT to another mechanic and performing a borescope inspection on an engine. The inspector also indicated that he returned to inspect the elevator control system after the mechanic had completed his work. (Section 2.3.4 provides information about the inspector’s inspection.) Even though the mechanic possessed previous flight control rigging experience, he had never performed rigging work on the Beech 1900D airplane. As a result, the mechanic needed more training and supervision than the quality assurance inspector had provided. It would have been prudent for the quality assurance inspector to have described the components of the elevator control system; explained the steps in the rigging procedure, demonstrated the critical steps, and insisted that all steps needed to be accomplished; and observed the mechanic while he examined the elevator control cable tensions and performed the rigging work. The insufficient training and supervision resulted in the mechanic making mistakes that led to the incorrect rigging and the restricted downward elevator travel. If the quality assurance inspector had provided better training and supervision, the likelihood of such errors would have been minimized. The Safety Board concludes that the RALLC quality assurance inspector did not provide adequate OJT and supervision to the SMART mechanic who examined and incorrectly adjusted the elevator control system on the accident airplane. 2.3.3 Skipped Steps in the Elevator Control System Rigging Procedure The Beech 1900D elevator control system rigging procedure (section 27-30-02) does not include provisions for adjusting cable tension as an isolated task. However, the mechanic decided to adjust the cables as an isolated task and, as a result, did not follow each step included in the rigging procedure. The quality assurance inspector was aware that the mechanic was selectively performing steps from the rigging procedure and that he was only adjusting cable tension. In fact, the inspector stated, during a postaccident interview, that he did not think the manufacturer intended for mechanics to follow the entire rigging procedure and that the entire procedure had not been followed when past cable tension adjustments were made.

Analysis 100 Aircraft Accident Report The mechanic skipped nine applicable steps in the Beech 1900D elevator control system rigging procedure (see section 1.6.3.2).130 One of these steps indicated that, for airplanes equipped with an F-1000 FDR, the pitch position potentiometer needed to be calibrated (step u). The mechanic was required to perform this step because the accident airplane had an F-1000 FDR installed. Step u indicated that, to calibrate the pitch position potentiometer, the mechanic needed to perform the FDR pitch adjustment procedure described in another section of the Beech 1900D AMM. This procedure referred the mechanic to a table that specified eight different elevator settings, ranging from 14º AND to 20º ANU (including 0º), and instructed the mechanic to record the FDR readout for these settings. The mechanic, however, would not have been able to move the elevator to the first setting, 14º AND, because elevator travel was restricted to about 7º AND. The performance of step u would have likely alerted the mechanic or the quality assurance inspector that the elevator control system was not properly rigged. However, the mechanic indicated that he skipped step u because he thought the calibration did not need to be done. The quality assurance inspector stated that he did not think that an FDR was installed on the airplane, but the inspector should have known that the airplane was equipped with an FDR because most, if not all, Beech 1900D airplanes were outfitted with an FDR. Also, the inspector could have easily determined that the airplane was equipped with an FDR. Specifically, the wiring and the sensor for the FDR were in the same area of the airplane where maintenance was being performed. Also, the FDR unit is mounted in the forward (AFT1) cargo compartment and is readily visible. In addition, a circuit breaker for the FDR is located in the cockpit. Title 14 Code of Federal Regulations (CFR) 121.367 states that aircraft maintenance, preventive maintenance, and alterations are to be performed in accordance with operators’ maintenance manuals. Thus, maintenance personnel are expected to follow all procedural steps unless authorization has been granted. The SMART mechanic and RALLC quality assurance inspector were not authorized to decide whether a specific step of the maintenance manual could be skipped. Air carriers have procedures in place for making such determinations on a one-time or short-term basis. These determinations are made by managers and engineers in accordance with the air carrier’s maintenance manual.131 For long-term changes, the Continuing Analysis and Surveillance System (CASS) is used to change an air carrier’s maintenance procedure if it is deficient or needs correction. Title 14 CFR 121.373(a), “Continuing Analysis and Surveillance,” requires operators to establish and maintain a system for the continuing analysis and surveillance 130 The Safety Board is aware of another recent instance in which mechanics skipped a step of a Beech 1900D AMM procedure. Specifically, the investigation into the August 26, 2003, Colgan Air flight 9446 accident determined that the mechanics had to replace both elevator trim tab actuators because of excessive freeplay. Beech 1900D AMM section 27-30-06 required the mechanics to remove the elevators before the actuators were replaced. However, the mechanics skipped that procedural step and replaced the actuators with the elevators installed. 131 The Air Midwest General Maintenance Manual required that deviations to maintenance procedures be approved by the Federal Aviation Administration (FAA), but the HTS maintenance station did not have the necessary support during the night shift to receive such approval.

Analysis 101 Aircraft Accident Report of the performance and effectiveness of their maintenance and inspection programs and for the correction of any deficiency found in those programs. Also, FAA Advisory Circular (AC) 120-16D, “Continuous Airworthiness Maintenance Programs,” states that CASS programs must ensure that all elements of an air carrier’s maintenance program are being accomplished in accordance with its maintenance manual and that any deficiencies in an air carrier’s manual are identified and corrected. (Sections 2.5.1.3 and 2.5.2.2 provide details about Air Midwest’s CASS program and the FAA’s oversight of CASS programs, respectively.) The findings of the flight 5481 investigation suggest that air carriers may not have adequate CASS programs despite the requirements of 14 CFR 121.373. The Safety Board concludes that, because the RALLC quality assurance inspector and the SMART mechanic did not diligently follow the elevator control system rigging procedure as written, they missed a critical step that would have likely detected the misrig and thus prevented the accident. Therefore, the Safety Board believes that the FAA should adopt a program for performing targeted surveillance and increased oversight of maintenance practices at 14 CFR Part 121 air carriers to ensure that maintenance instructions are being followed as written and that maintenance personnel (including, but not limited to, management, quality assurance, tooling, and training personnel, as well as mechanics) are following all steps in the instructions unless authorization has been granted in accordance with the air carrier’s maintenance program. In addition, the Safety Board believes that the FAA should verify that 14 CFR Part 121 air carriers have procedures in their CASS program for identifying deficiencies and incorporating changes to the carrier’s maintenance program and that maintenance personnel for these air carriers (including, but not limited to, management, quality assurance, tooling, and training personnel, as well as mechanics) use these procedures. 2.3.4 Lack of an Effective Postmaintenance Check The mechanic indicated that he conducted control sweeps from the cockpit after the cable tension had been adjusted. He stated that he “ran the elevator full travel a few times” and then checked the cable tensions to make sure that they had not changed. However, the mechanic also stated that no one was at the tail of the airplane observing the elevator travel when he conducted the control sweeps. The quality assurance inspector stated that he observed the elevator at a neutral position on the travel board with the rig pin installed at the forward bellcrank. The inspector also stated that, after the rig pin was removed, he grasped the elevator with the travel board still attached and moved the elevator throughout the available travel. The inspector thought that the elevator could be fully deflected with the forward bellcrank rig pin removed and stated that elevator travel was “within limits.” However, results from the Safety Board’s investigation, including simulations, ground tests, and FDR data, indicated that elevator travel could not have been within the limits specified in Beech 1900D AMM section 27-30-02. The quality assurance inspector further stated that he was present when the mechanic verified cable tension by attaching a tensiometer on both cables and checking the tensions.

Analysis 102 Aircraft Accident Report The postmaintenance checks performed by the quality assurance inspector and the mechanic were not adequate to detect the elevator control system misrig. As stated in section 2.3.3, if step u of the rigging procedure (the calibration of the pitch position potentiometer) had been performed on the accident airplane, it is likely that the quality assurance inspector and the mechanic would have caught the misrigging problem. Also, if a functional check had been included at the end of the procedure, the quality assurance inspector and the mechanic would have had another opportunity to detect the misrigging problem. A functional check at the end of the procedure would have provided a more comprehensive, systematic, and direct method to ensure that any misrigging problem was caught before an airplane was returned to service.132 Such a functional check would consist of a mechanic in the cockpit pushing the control wheel full forward and then pulling the wheel full aft while another mechanic, who was at eye level with the horizontal stabilizer, measured the position of the elevator using a travel board. This process would determine whether the elevator achieved the correct deflection for the full forward and full aft movement of the control column. The Safety Board recognizes that Raytheon Aircraft Company added a postmaintenance functional check to its revised elevator control system rigging procedure issued on February 12, 2003. Specifically, step aa indicates that the mechanic is to move the control wheel aft and forward and verify that the elevator moves up 20º +1º/-0º and down 14º +1º/-0º, respectively, and that the control stops make contact. The lack of a functional check at the end of a maintenance procedure is also an issue with the Colgan Air flight 9446 accident. During the replacement of the elevator trim tab actuators, the mechanics thought that the forward elevator trim tab cable had become jammed or kinked and thus needed to be replaced. The mechanics tried to replace the cable in accordance with Beech 1900D AMM section 27-30-04. This procedure does not describe in detail how to manipulate the electric and manual trim systems in each direction and verify that the full range of motion in the commanded direction is observed at the trim tabs. The mechanics stated, during a postaccident interview, that they moved the trim tabs through a full range of motion using the electric and manual systems and observed no anomalies. However, without a detailed procedure to ensure that the trim tabs are moving in the proper direction, it is possible that the trim tabs could move in a reversed direction and remain unnoticed. In addition, the investigation of the October 16, 2003, CommutAir flight 8718 incident determined that the mechanic did not perform a functional test of the elevator trim control system, as required by FAA Airworthiness Directive (AD) 2003-20-10. A functional check of the system would have indicated that the elevator trim wheel had been reinstalled incorrectly. The Safety Board concludes that a complete functional check at the end of maintenance for critical flight systems or their components133 would help to ensure their 132 The Safety Board notes that some elevator control system maintenance procedures do not include an FDR check and that FDRs can be placed on an air carrier’s minimum equipment list, as was the case with Colgan Air flight 9446.

Analysis 103 Aircraft Accident Report safe operation, but no such check is currently required. Therefore, the Safety Board believes that the FAA should modify (1) appendix G of 14 CFR Part 23 and appendix H of 14 CFR Part 25 and (2) 14 CFR 121.369 to require that the Instructions for Continued Airworthiness and air carrier maintenance manuals, respectively, include a complete functional check at the end of maintenance for each critical flight system. The Safety Board also believes that the FAA should require manufacturers of aircraft operated under 14 CFR Part 121 to identify appropriate procedures for a complete functional check of each critical flight system; determine which maintenance procedures should be followed by such functional checks; and modify their existing maintenance manuals, if necessary, so that they contain procedures at the end of maintenance for a complete functional check of each critical flight system. The Safety Board further believes that the FAA should require 14 CFR Part 121 air carriers to modify their existing maintenance manuals, if necessary, so that they contain procedures at the end of maintenance for a complete functional check of each critical flight system. 2.4 Aft Center of Gravity and Its Effect on the Restricted Elevator Travel The airplane performance study for flight 5481 determined that the accident airplane’s actual weight was about 17,700 pounds and that its actual CG position was about 45.5 percent MAC. As a result, flight 5481 had exceeded the Beech 1900D certified weight limit of 17,120 pounds and the certified aft CG limit of 40 percent MAC. Of the accident airplane’s 10 flights after the D6 maintenance check, the accident flight was by far the most aft loaded.134 When an airplane is loaded so that the CG is aft of the aft limit, greater-than-normal AND pitch control is required. The Safety Board made several calculations to determine the conditions under which the accident airplane would have been flyable during different flight segments. The calculations showed that, with full elevator travel (14º to 15º AND) and the accident airplane loaded to the weight and balance of the accident flight, the airplane should have been able to maintain flight during the takeoff and climb (requiring 9º to 10º AND elevator), cruise and descent (requiring 5º to 6º AND elevator), and approach and land (requiring 8º to 9º AND elevator) segments. The calculations also showed that, with reduced elevator travel (7º to 8º AND) and the accident airplane loaded to, but not exceeding, the Beech 1900D weight and CG limits, the airplane might have been able to fly during the takeoff and climb (requiring 7º to 8º AND elevator), cruise and descent (requiring 4º to 5º AND elevator), and approach and land (requiring 7º to 8º AND elevator) segments. Even if the required AND elevator slightly exceeded the available AND elevator, the airplane would have been controllable. The airplane would have 133 A flight system or component is considered critical if its failure can be catastrophic. 134 Although the other nine flights after the D6 maintenance check had a CG position that was farther forward, the airplane was still being operated in a potentially dangerous situation as a result of the restricted downward elevator travel.

Analysis 104 Aircraft Accident Report entered a climb before achieving cruise speed, but takeoff and climb, cruise and descent, and approach and land could have been controllable with the available elevator and changes in engine power. The restricted elevator travel alone and the aft CG alone would not have been sufficient to cause the uncontrolled pitchup that led to the flight 5481 accident. The Safety Board concludes that flight 5481 had an excessive aft CG, which, combined with the reduced downward elevator travel resulting from the incorrect elevator rigging, rendered the airplane uncontrollable in the pitch axis. 2.4.1 Air Midwest’s Weight and Balance Programs If Air Midwest’s revised (May 2003) weight and balance program had been in effect for flight 5481, the flight crew would have had to take some action to bring the airplane within the Beech 1900D certified weight and balance envelope (17,120 pounds and 40 percent MAC, respectively). If the flight crew had, for example, off-loaded two passengers seated in the last row of the airplane and three bags from the AFT1 cargo compartment, a calculated weight of 17,106 pounds and CG position of 35.9 percent MAC would have resulted. Even though this calculated weight and CG position would have indicated that the airplane was within the Beech 1900D weight and CG envelope, the actual weight would have been almost 100 pounds more than the weight limit (17,233 pounds), and the actual CG position would have been slightly under the aft CG limit (39.9 percent MAC). Under this scenario, Air Midwest’s revised weight and balance program would have produced a much safer condition than the weight and balance program that was in effect at the time of the accident: the revised actual takeoff weight (17,233 pounds) would have been about 500 pounds less than the accident flight’s actual takeoff weight (17,700 pounds), and the revised actual CG position (39.9 percent MAC) would have been about 5 percent MAC closer to the aft CG limit than the accident airplane’s actual CG position (45.5 percent MAC). However, the revised weight and balance program would have underestimated the actual CG position by about 4 percent MAC by producing a calculated CG position of 35.9 percent MAC instead of an actual CG position of 39.9 percent MAC. The Safety Board considered another hypothetical scenario that showed unacceptable results when using Air Midwest’s revised weight and balance program. If the accident airplane had 50 fewer gallons of fuel at the time of departure and eight checked bags were off-loaded to meet the airplane’s weight limit, the calculated airplane weight and CG position, based on Air Midwest’s revised weight and balance program, would be 17,016 pounds and 36.7 percent MAC, respectively. Thus, the calculated weight and CG position for this scenario indicated that the airplane would be within the Beech 1900D weight and CG envelope. However, the airplane’s actual weight and CG position for this scenario would be 17,129 pounds and 42.1 percent MAC. As a result, the calculated CG position would be in error by more than 5 percent MAC, and, more importantly, the CG position would be aft of the aft limit by more than 2 percent MAC. This calculation shows that Air Midwest’s current weight and balance program is still susceptible to unacceptable errors in determining an airplane’s actual CG position.

Analysis 105 Aircraft Accident Report Table 13 compares the weight and CG position for flight 5481 using Air Midwest’s weight and balance program that was in effect at the time of the accident and Air Midwest’s revised weight and balance program with the actual weights and CG positions that would have been present at takeoff. Table 13. Weight and center of gravity calculations for flight 5481. a These calculations assume that two passengers seated in the last row of the airplane and three bags from the AFT1 cargo compartment were off-loaded. b These calculations are based on a scenario in which the airplane had 50 fewer gallons of fuel at the time of departure and eight checked bags were off-loaded. The Safety Board concludes that Air Midwest’s weight and balance program at the time of the accident was not correct and resulted in a substantially inaccurate weight and balance calculation for flight 5481. The Safety Board further concludes that Air Midwest’s revised weight and balance program is also unacceptable because it may result in an inaccurate calculation of an airplane’s CG position. Section 2.5.2.4 discusses the FAA’s oversight of air carrier average weight and balance programs and other sources of error in weight and balance calculations. 2.5 Organizational and Management Factors 2.5.1 Air Midwest As previously stated, Air Midwest contracted with RALLC for maintenance work at HTS, and RALLC contracted with SMART to provide mechanics for this work. According to AC 120-16D, air carriers can use contractors to accomplish maintenance as long as the air carrier retains the responsibility for the performance and approval of that maintenance. Thus, Air Midwest was responsible for all of the maintenance that was performed on its airplanes. However, none of the seven maintenance personnel who were on duty at HTS on the night of January 6, 2003, were Air Midwest employees. In fact, Air Midwest’s sole representative at the HTS maintenance station, the regional site manager, Weight and balance method Calculated weight (pounds) Actual weight (pounds) Calculated CG (percent MAC) Actual CG (percent MAC) Air Midwest’s weight and balance program at the time of the accident 17,028 17,700 37.8 45.5 Air Midwest’s revised weight and balance programa 17,106 17,233 35.9 39.9 Air Midwest’s revised weight and balance program off-load scenariob 17,016 17,129 36.7 42.1

Analysis 106 Aircraft Accident Report worked the day shift at the time, so he was not present when the maintenance work was actually being performed. As stated in section 2.3.3, 14 CFR 121.367 requires aircraft maintenance, preventive maintenance, and alterations to be performed in accordance with an air carrier’s maintenance manual. Also, AC 120-16D indicates that it is the air carrier’s responsibility to make sure that a contractor is performing maintenance according to the air carrier’s maintenance program and maintenance manual. Thus, although the SMART mechanic decided to skip several steps in the elevator control system rigging procedure and the RALLC quality assurance inspector concurred with the mechanic’s decision to skip steps, it was still Air Midwest’s responsibility to ensure that its maintenance manual was being followed. In its final report on the ValuJet Airlines flight 592 accident, the Safety Board recognized that air carriers could successfully subcontract maintenance. However, the Board noted that air carriers engaging in subcontracting had to properly oversee their contractors to ensure the airworthiness of their airplanes. The Board stated that, although subcontractors bear independent responsibility for their activities, an air carrier cannot delegate its responsibility for the safety of its operations and maintenance to its subcontractors. The Board concluded that ValuJet failed to adequately oversee SabreTech (a heavy maintenance contractor) and that this failure was causal to the accident. The Air Midwest flight 5481 accident presents another example of an air carrier that did not adequately oversee airplane maintenance being performed by contractors. Title 14 CFR 121.363 states that an air carrier is responsible for ensuring the airworthiness of the aircraft it operates and that an air carrier is not relieved of this responsibility when maintenance is contracted to another party. Also, 14 CFR 121.367 states that an air carrier is responsible for determining that each aircraft released to service is airworthy and has been properly maintained. Thus, although the SMART mechanic incorrectly rigged the accident airplane’s elevator control system and the RALLC quality assurance inspector failed to detect the problem, Air Midwest was ultimately responsible for returning the airplane to service in an airworthy condition. The Safety Board concludes that Air Midwest did not adequately oversee the work performed by RALLC and SMART personnel at its HTS maintenance station and did not ensure that the accident airplane was returned to service in an airworthy condition. 2.5.1.1 Required Inspection Item Maintenance Tasks and Inspections Air Midwest’s Maintenance Procedures Manual states that elevator control system rigging is a required inspection item (RII), which means that maintenance work performed on the system must be inspected before the airplane can be returned to service. Title 14 CFR 121.371(c) states, “no person may perform a required inspection if [that person] performed the item of work required to be inspected.” The aircraft maintenance record of nonroutine items for January 6, 2003, at HTS showed, in a discrepancy block about the airplane’s low elevator cable tension, an RII stamp and the quality assurance inspector’s stamp (see figure 2 in section 1.1.1).

Analysis 107 Aircraft Accident Report RII maintenance tasks that are not performed properly could result in a failure, malfunction, or defect that would endanger the safe operation of the airplane. Thus, it is imperative to have an independent inspection of RII maintenance tasks by a second, fully qualified mechanic to ensure that the work has been properly completed. Current regulations do not explicitly prohibit inspectors from training a mechanic on a task and then inspecting that same task.135 However, the inspectors cannot properly fulfill their RII responsibilities in such a situation. The purpose of an RII inspection is to provide “a second set of eyes” to ensure that any error made in performing maintenance work is detected and corrected before an airplane is returned to service. The Safety Board concludes that, when an inspector provides OJT for an RII maintenance task and then inspects that same task, the independent nature of the RII inspection is compromised. Therefore, the Safety Board believes that the FAA should prohibit inspectors from performing RII inspections on any maintenance task for which the inspector provided OJT to the mechanic who accomplished the task. According to AC 120-16D, Air Midwest was responsible for overseeing the performance of RII inspections. In fact, Air Midwest acknowledged in its contract with RALLC that Air Midwest would be responsible for quality control and quality assurance inspections. However, oversight of the quality assurance function at HTS went through two different levels of management at RALLC (the Regional Airline Maintenance Service [RAMS] quality assurance manager in Panama City, Florida, and the RAMS Executive Program Manager for Airline Support in Madison, Mississippi) before becoming the responsibility of the Air Midwest Chief Inspector/Director of Quality Assurance in Wichita, Kansas (see figure 10). In addition, the only Air Midwest employee at HTS (the regional site manager) normally worked the day shift, and he was only sporadically present when the maintenance work and inspections were being accomplished. As a result, Air Midwest was not sufficiently overseeing the RII inspections at HTS, which is especially troublesome considering the importance of these inspections. Sufficient oversight of RII maintenance tasks and inspections requires air carrier personnel to maintain an on-site presence and to be thoroughly involved in, and familiar with, all aspects of a maintenance facility’s operations relating to RII tasks and inspections. Such oversight requires, at a minimum, that air carrier personnel be physically present when a substantial amount of the RII planning, tasking, maintenance work, and inspections are performed and that air carrier personnel be readily available when they are not physically present. In addition, air carriers need to ensure that the processes and procedures used by contractors to perform RII maintenance tasks and inspections are the same as those used by air carrier maintenance personnel. 135 On March 26, 2003, the quality assurance inspector at HTS on the night of January 6, 2003, was advised that the FAA would be investigating the inspector’s actions in “giving on-the-job training after work was assigned.” On September 30, 2003, the FAA notified the inspector that the investigation “did not establish a violation of the Federal Aviation Regulations [FAR].” (The FAA also investigated the mechanic’s actions “involving work being accomplished” and the foreman’s actions “involving work being assigned,” and the investigation found that their actions did not violate the FARs.)

Analysis 108 Aircraft Accident Report The Safety Board concludes that air carriers that use contractors to perform RII maintenance tasks and inspections need to provide substantial and direct oversight during each work shift to ensure that this work is being properly conducted. Therefore, the Safety Board believes that the FAA should require 14 CFR Part 121 air carriers that use contractors to perform RII maintenance tasks and inspections to have air carrier personnel who are physically present when a substantial amount of the RII planning, tasking, maintenance work, and inspections are performed and are readily available when they are not physically present and who ensure that the processes and procedures used by contractors to perform RII maintenance tasks and inspections are the same as those used by air carrier maintenance personnel. 2.5.1.2 Maintenance Training Program 2.5.1.2.1 Maintenance Training Guidelines Air Midwest required mechanics to complete OJT for a procedure before they could perform that procedure unsupervised. However, Air Midwest had little guidance on how to effectively provide OJT. The only guidance in Air Midwest’s Maintenance Training Manual about OJT as a training method stated that (1) OJT would teach knowledge and practical skills of normal job-related duties and would include practical situations found every day on the job and (2) OJT would be performed under the guidance of a qualified technician or staff member who has documentation of previously received OJT. The Maintenance Training Manual did not include other issues related to the delivery of OJT, including how many students should be permitted per instructor, how tasks should be demonstrated before being performed, how the learning environment should be controlled, and how to ensure that the skills learned through OJT would be retained. Because Air Midwest lacked specific OJT guidance, the OJT provided to new mechanics at the HTS maintenance station varied based on the instructors’ teaching style. For example, the quality assurance inspector on the night of January 6, 2003, stated, during a postaccident interview, that it was not necessary to “hold [a mechanic’s] hand” if he thought the mechanic knew what he was doing based on past experience. Also, the mechanic who performed the elevator cable inspection and adjustments on the accident airplane indicated that it was routine for mechanics to work independently during OJT and receive little supervision. However, a mechanic who assisted the quality assurance inspector with the engine borescope inspection on the night of January 6th stated that, when he last received OJT, the instructor (who was at HTS from the Panama City maintenance station) walked him through the task “step by step.” The Safety Board concludes that Air Midwest did not have maintenance training policies and procedures in place to ensure that each of its maintenance stations had an effective OJT program. Air carriers are required by 14 CFR 121.367(b) to ensure the competence of their maintenance personnel for the proper performance of maintenance, preventive

Analysis 109 Aircraft Accident Report maintenance, and alterations. However, according to AC 120-16D, FAA regulations contain the flexibility necessary to allow each air carrier to develop a training program that fits its particular needs. Many air carriers have provided, and will continue to provide, airplane-specific maintenance training through OJT programs. During a 1993 Safety Board public hearing on commuter airline safety, representatives from the commuter airline industry indicated that the quality of air carrier maintenance training varied throughout the industry, with some airlines doing an excellent job of training mechanics and other airlines providing mechanics with only minimal training.13637 Also, a 1998 FAA study of personnel training and qualifications at aviation maintenance facilities13738 found that, although airline mechanics reported that they were generally satisfied with the maintenance training provided by their companies, one area of concern involved informal OJT. Specifically, a significant number of mechanics indicated that they would prefer OJT that was more formal, with task objectives, checklists, and specific task signoffs. In addition, the FAA’s 1998 Guide for Human Factors in Aviation Maintenance and Inspection (see section 1.18.3) stated that OJT had several positive aspects but that OJT practices were lax and tended to be unstructured. The FAA’s Guide for Human Factors in Aviation Maintenance and Inspection contained voluntary guidelines for developing structured OJT programs. However, air carriers are not currently required to follow these guidelines when developing OJT programs. The Safety Board concludes that it is important that air carrier OJT programs are developed in accordance with detailed guidance that emphasizes effective training practices. Therefore, the Safety Board believes that the FAA should develop detailed OJT requirements for 14 CFR Part 121 air carriers that rely on OJT as a maintenance training method. These requirements should include, but not be limited to, best practices, procedures, and methods for accomplishment and administration of this training. The Safety Board also believes that the FAA should ensure that these OJT requirements are incorporated into 14 CFR Part 121 air carrier maintenance training programs. 2.5.1.2.2 Maintenance Training Oversight The Safety Board identified deficiencies in Air Midwest’s oversight of its maintenance training program. First, because only one RALLC quality assurance inspector and one RALLC foreman (the backup quality assurance inspector) worked at HTS at the time of the accident, a SMART mechanic was appointed as foreman 4 nights per week (when the quality assurance inspector was not on duty and the foreman assumed the inspector’s responsibilities). One of the foreman’s responsibilities was to follow the progress of the mechanics in accomplishing the assigned maintenance work. However, the SMART mechanic who was the foreman on the night of January 6, 2003, had not completed OJT for the Beech 1900D. 136 For more information, see National Transportation Safety Board, Commuter Airline Safety, Special Study NTSB/SS-94/02 (Washington, DC: NTSB, 1994). 137 R.P. Goldsby and J. Watson, Comparative Study of Personnel Training and Qualifications at Aviation Maintenance Facilities (Washington, DC: Office of Aviation Medicine, FAA, 1998).

Analysis 110 Aircraft Accident Report Second, according to Air Midwest’s Maintenance Procedures Manual, the foreman was responsible for ensuring that OJT was provided to mechanics by someone other than the quality assurance inspector. However, the quality assurance inspector routinely provided OJT. In fact, the quality assurance inspector on duty on the night of January 6th stated that he had received most of his training at Mesa Airlines, Arctic Slope, and Air Midwest from inspectors and that he believed it was standard practice for inspectors to provide OJT. Also, the foreman stated that a quality assurance inspector had been providing OJT to mechanics since he began working for RALLC in December 2001. The Air Midwest regional site manager was aware that inspectors were providing most of the OJT because he reviewed maintenance training records on a daily basis. However, the regional site manager should have been aware that this situation increased the inspector’s workload (providing OJT and performing RII inspections) and did not separate maintenance and inspection tasks. The quality assurance inspector stated that the regional site manager never mentioned to him that inspectors should not provide OJT. Last, according to Air Midwest’s Maintenance Training Manual and Maintenance Procedures Manual, the regional site manager was responsible for maintaining training records and ensuring that the training was properly documented. As previously stated, the regional site manager reviewed maintenance training records daily, and he indicated that he attempted to have discrepancies corrected quickly. The regional site manager forwarded the training records to Air Midwest’s Maintenance Training Coordinator in Wichita, who reviewed the records for completeness and accuracy. However, an FAA inspection conducted by geographic inspectors from the Charleston, West Virginia, Flight Standards District Office (FSDO) 2 days after the accident found that maintenance training records for employees at HTS were “not complete or current.” Also, the Safety Board discovered numerous discrepancies in the training records of HTS maintenance personnel, including the following: • The mechanic who performed the elevator control cable work had his training records signed as complete for the D6 aft fuselage/empennage inspection procedure and for “rudder, aileron, or elevator cable tension adjustment” by the quality assurance inspector. However, the mechanic had not been trained on the rudder and aileron rigging procedures. Air Midwest’s maintenance training program considered mechanics to be fully trained on all three major control cable rigging procedures after the mechanics had received training on only one of the procedures, despite significant differences among the procedures. • Another SMART mechanic and the primary quality assurance inspector incorrectly indicated on that mechanic’s OJT record that he had completed training on the D6 aft fuselage/empennage inspection procedure on January 6th. The mechanic inspected and checked the engines but did not perform the entire D6 procedure, including the elevator check. • The mechanics that were on duty on the night of January 6th had numerous items (dating as far back as December 14, 2002) signed as complete in their training records, but these items did not have the required instructor signature stamps.

Analysis 111 Aircraft Accident Report • The foreman’s training records indicated that he had received OJT for the detail 2 through detail 5 checks all on the same day. It is unrealistic for any mechanic to have completed OJT for all those tasks on a single day because one detail check generally takes an entire shift to complete. Further, the Air Midwest principal maintenance inspector (PMI) stated that the FAA has had longstanding concerns with Air Midwest’s management of its maintenance training program. These concerns included that mechanics received no formal (classroom) training, OJT records were not being properly maintained, no one was adequately monitoring the quality of the OJT provided, and the training was not consistent with guidelines set forth in Air Midwest’s Maintenance Training Manual. Letters from the FAA to Air Midwest showed that, during a 2-year period beginning in October 2000, the FAA had encouraged Air Midwest to improve its maintenance training program (see section 2.5.2.1 for more information). However, evidence discovered during the investigation of the flight 5481 accident showed that deficiencies still existed in Air Midwest’s maintenance training program. The Safety Board concludes that Air Midwest did not ensure that its maintenance training was conducted and documented in accordance with the company’s maintenance training program, which degraded the quality of training and inspection activities at the HTS maintenance station. Because of the numerous discrepancies in the training records of HTS maintenance personnel, the Safety Board believes that the FAA should audit training records for personnel who are currently performing maintenance on Air Midwest airplanes to verify that the training was properly accomplished in accordance with the company’s Maintenance Procedures Manual and Maintenance Training Manual. 2.5.1.3 Continuing Analysis and Surveillance System Program The Safety Board identified numerous deficiencies in Air Midwest’s maintenance program during the investigation of the flight 5481 accident. These deficiencies included inadequate oversight of maintenance at the HTS maintenance station, poorly designed maintenance procedures, lack of adherence to maintenance procedures, inadequate inspection of accomplished maintenance, and poorly developed policies and procedures for training maintenance personnel. During the public hearing on this accident, the FAA’s Technical Advisor for Aircraft Maintenance stated that Air Midwest’s primary tool for detecting and correcting such deficiencies should have been its CASS program. However, FAA and Air Midwest documents indicated that deficiencies existed in Air Midwest’s CASS program, which prevented it from fulfilling its intended purpose. The FAA notified Air Midwest about CASS deficiencies several times, including the following:

Analysis 112 Aircraft Accident Report • In a November 9, 2000, letter, the Air Midwest PMI stated that Air Midwest’s CASS program did not include a reliable way of charting operational data at specified intervals to reveal trend-related information. • A Regional Aviation Safety Inspection Program (RASIP) inspection, conducted between March 12 and 29, 2001, found that Air Midwest was not performing the biannual audits required by the company’s CASS procedures. • In a February 19, 2002, letter, the Air Midwest principal avionics inspector communicated his concern that Air Midwest’s CASS program lacked an auditor training curriculum. • In an April 26, 2002, letter, the Wichita FSDO manager and the Air Midwest PMI stated that Air Midwest had a written audit program but no dedicated program manager. • In an August 19, 2002, letter, the Air Midwest PMI told Air Midwest that action was needed to ensure that the audit procedures contained in the company’s audit manual were being followed. Air Midwest’s CASS program did not identify some maintenance training program deficiencies. For example, Air Midwest performed its first audit of the HTS maintenance station on November 5, 2002. One item on the Air Midwest maintenance station audit guide checklist was to determine whether proper training was being provided for new hires, training records were being kept up to date, and proper recurrent training was being provided. An Air Midwest auditor found that those areas were satisfactory; however, letters from the FAA to Air Midwest (described in sections 1.17.4.2 and 2.5.2.2) indicated that deficiencies in those areas existed and were well known to Air Midwest officials. Further, postaccident interviews, training records, public hearing testimony, and findings from an Air Midwest audit conducted 6 days after the accident indicated that maintenance training program deficiencies existed at HTS in the months before the accident. Air Midwest’s CASS program also did not correct deficiencies that were identified through company audits. For example, the November 2002 audit of HTS found that supervisory staffing was inadequate; specifically, HTS was only staffed with one quality assurance inspector and one foreman but should have been staffed with two quality assurance inspectors and two foremen. In a January 3, 2003, letter to the Air Midwest quality assurance auditor, the RALLC site manager indicated that staffing at HTS had increased 20 percent during the last month. During the public hearing on this accident, however, the RALLC site manager stated that no new quality assurance inspectors or foremen were hired during that period but that one mechanic was authorized to work as a foreman. As stated in section 2.3.3, 14 CFR 121.373 required Air Midwest to have a CASS program and to correct deficiencies in its maintenance program identified through the CASS program, including deficiencies in its maintenance manuals. Air Midwest’s Maintenance Procedures Manual stated that the company’s Vice President/Director of Maintenance was responsible for ensuring compliance with requirements of the CASS

Analysis 113 Aircraft Accident Report program and for ensuring that appropriate corrective actions were taken on issues identified through the CASS program. However, the Safety Board further questioned the effectiveness of Air Midwest’s CASS program after the Board received a February 12, 2003, letter from the Air Midwest Vice President/Director of Maintenance. This letter stated, “a review of the Raytheon Aircraft Beech 1900D Maintenance Manual revealed a lack of explicit instructions, which if included, could have avoided the elevator mis-rigging.” The letter also described numerous deficiencies in the elevator control system rigging procedure, including the following: • Step d, which requires the removal of passenger seats, carpet, and floorboards on the right side of the passenger compartment to access the elevator control cable turnbuckles, was not required because the turnbuckles on the Beech 1900D model are located in the tail of the airplane. • Steps f, g, h, i, and l did not include procedures for making adjustments to the push-pull tube, elevator control horn stop bolts, bob weight stop bolt, forward bellcrank stop bolts, and aft pushrods, respectively. • Step q refers the mechanic to the elevator cable tension graph (figure 203) in section 27-30-02 for performing cable tensioning, but no instructions were given regarding whether the airframe, outside air, or cable temperature was to be taken when determining the amount of cable tension; whether the flight compartment cabin temperature gauge or an outside air temperature gauge was to be used in determining the temperature; and what type of device was to be used to measure cable tension. Air Midwest and its predecessor companies had been operating Beech 1900D airplanes since the 1990s; as a result, it is highly unlikely that the maintenance manual deficiencies that Air Midwest identified in its February 2003 letter first came to light after the flight 5481 accident. Each of the deficiencies raised in the letter would have been apparent every time the elevator control system rigging procedure was accomplished. Thus, Air Midwest’s CASS program was ineffective. The Safety Board notes that the flight 5481 accident investigation is not the first time that problems have been found with an air carrier’s CASS program. The Board’s investigation of the January 31, 2000, Alaska Airlines flight 261 accident found that a postaccident FAA special inspection of the air carrier revealed deficiencies in its CASS program,138 and the Board’s final report on the accident concluded that “at the time of the flight 261 accident, Alaska Airlines’ maintenance program had widespread systemic 138 These deficiencies included that Alaska Airlines’ manuals did not contain facsimiles of audit checklists to be used in administering its CASS program, data-gathering was periodic rather than continuous, and audit checklists did not address compliance with regulatory safety standards checklists but instead were modeled after a generic audit program that was not specifically designed for Alaska Airlines.

Analysis 114 Aircraft Accident Report deficiencies.”139 (Section 2.5.2.2 discusses the results of an investigation conducted by the Department of Transportation Office of Inspector General in response to these findings.) The Safety Board concludes that Air Midwest’s CASS program was not being effectively implemented because it did not adequately identify deficiencies in the air carrier’s maintenance program, including some that were found by the FAA before the flight 5481 accident. 2.5.1.4 Detail 6 Inspection Procedures Checklist The Air Midwest D6 inspection procedures checklist (also known as the D6 work card) was the document that mechanics used for inspecting and adjusting elevator control cables. The work card referred the mechanics to the Beech 1900D AMM for additional details regarding the cable inspection and adjustments. The work card and the AMM contained general instructions to guide the mechanics in performing these tasks. The D6 work card instructed mechanics to check cable tension according to Beech 1900D AMM chapter 27.140 However, the D6 work card did not specifically refer the mechanics to section 27-30-02 of the AMM, which contained the only reference—an elevator cable tension graph—in chapter 27 for determining cable tension. Further, to use the graph, the mechanic was first required to determine cable temperature, but neither the D6 work card nor the elevator cable tension graph described how to prepare the airplane for temperature measurement or how and where to obtain temperature readings. The Safety Board’s January 2003 ground tests showed that temperature readings varied depending on the method used by individual mechanics for measuring cable temperature and that the method used for measuring temperature could affect cable tension. Interviews with Air Midwest and Raytheon Aircraft Company officials revealed that, when cable tension was found to be outside of acceptable parameters, mechanics were expected to perform the entire elevator control system rigging procedure. Neither the D6 work card nor the Beech 1900D AMM explicitly stated that the entire rigging procedure needed to be performed or that the elevator cable tension adjustment could not be accomplished as an isolated task. 139 For more information, see National Transportation Safety Board, Loss of Control and Impact With Pacific Ocean, Alaska Airlines Flight 261, McDonnell Douglas MD-83, N963AS, About 2.7 Miles North of Anacapa Island, California, January 31, 2000, Aircraft Accident Report NTSB/AAR-02/01 (Washington, DC: NTSB, 2002). 140 The only other details provided on the work card regarding elevator cable tensioning were blank lines on which a mechanic recorded the cable temperature and the number of pounds of tension for the ANU and AND cables (see figure 1 in section 1.1.1).

Analysis 115 Aircraft Accident Report Maintenance procedures are developed and are expected to be followed to ensure that maintenance work is properly performed. When a maintenance procedure contains multiple steps that are not applicable to the airplane on which a mechanic is working,141 a mechanic may decide to skip applicable steps. Although well-trained mechanics may be more capable of distinguishing between steps that are and are not applicable to a particular aircraft than mechanics with less training, maintenance procedures should be written so they minimize the possibility that any mechanic would need to make such distinctions. Errors can be made if applicable steps are skipped along with inapplicable steps, as demonstrated by the elevator control system maintenance on the accident airplane. Mechanics would be less likely to skip applicable steps and more likely to follow a maintenance procedure in its entirety if the procedure were well written. The FAA has sponsored human factors research regarding the quality of maintenance procedures and instructions, and this research has found a link between the usability of maintenance procedures and the likelihood that mechanics will follow the procedures. For example, a 2002 survey142 found that only 18 percent of mechanics thought that their organization’s maintenance manual described the best way to perform a maintenance procedure. The survey also found that 62 percent of the mechanics had performed maintenance using methods that they considered to be better than those detailed in their organization’s written procedures. The results of the survey suggest that the usability of work cards may be a factor affecting whether mechanics will adhere to their organization’s accepted procedures when performing maintenance. In its final report on the Emery Airlines flight 17 accident, the Safety Board determined that unclear maintenance work card instructions might have contributed to maintenance errors involved in that accident. The Board concluded that all air carriers should provide maintenance personnel with more detailed information regarding the steps or actions that are necessary to satisfactorily accomplish a maintenance task. Also, the Board issued Safety Recommendation A-03-31, which asked the FAA to “require all 14 CFR Part 121 air carrier operators to revise their task documents and/or work cards to describe explicitly the process to be followed in accomplishing maintenance tasks.” The mechanics’ failure to follow the general guidance provided on Air Midwest’s D6 work card and in the Beech 1900D AMM supports the need for the actions recommended in Safety Recommendation A-03-31. However, Safety Recommendation A-03-31 focused only on the role of the air carrier in revising work cards and did not consider the safety benefit of involving the aircraft manufacturer in the process of reviewing and revising maintenance procedures. Placing this responsibility solely on air carriers raises the possibility that individual carriers could identify deficiencies in flight-critical 141 Three steps in section 27-30-02 were not applicable to the accident airplane. Two steps pertained to the autopilot, but the airplane was not equipped with an autopilot. One step pertained to the removal of passenger seats and passenger cabin floorboards, but the airplane’s elevator cable turnbuckles were not located beneath those components. 142 A. Chaparro, and L.S. Groff, “Human Factors Survey of Aviation Maintenance Technical Manuals,” Proceedings of the 16th Human Factors in Aviation Maintenance Symposium (Washington, DC: FAA, 2002).

Analysis 116 Aircraft Accident Report maintenance procedures but fail to share this information with other air carriers that operate the same airplane. If aircraft manufacturers were involved in the process of reviewing and revising maintenance procedures, safety information would more likely be shared among air carriers. In addition, the flight 5481 accident demonstrated that the usability of aircraft maintenance manuals is as important to safety as the usability of work cards, but Safety Recommendation A-03-31 did not address the added safety benefit of revising procedures contained in aircraft maintenance manuals. As a result, the Safety Board classifies Safety Recommendation A-03-31 “Closed—Superseded.” The Safety Board concludes that accurate and usable work cards developed jointly by air carriers and aircraft manufacturers would improve the performance of maintenance for critical flight systems. Therefore, the Safety Board believes that the FAA should require 14 CFR Part 121 air carriers to implement a program in which carriers and aircraft manufacturers review all work card and maintenance manual instructions for critical flight systems and ensure the accuracy and usability of these instructions so that they are appropriate to the level of training of the mechanics performing the work. 2.5.2 Federal Aviation Administration 2.5.2.1 Oversight of Air Midwest The Air Midwest PMI had identified several deficiencies in the air carrier’s maintenance training program during the 2 years before the accident. These deficiencies included inadequate oversight of training, inadequate record-keeping, inadequate training procedures, and lack of adherence to company training procedures. In letters to Air Midwest, the FAA expressed its concerns and urged the air carrier to improve. For example, in an October 16, 2000, letter, the Air Midwest PMI stated that a recent FAA inspection conducted at Air Midwest headquarters could not be completed because the air carrier lacked adequate records to determine whether it was in compliance with 14 CFR 121.371 and 121.375.143 Specifically, the PMI noted that required maintenance training records were either not at company headquarters or were not up to date and complete. A followup inspection of Air Midwest’s training files was conducted on December 4, 2000. This inspection revealed evidence of continuing deficiencies in the air carrier’s training records as well as deficiencies in its training manual. The PMI gave Air Midwest a deadline of February 1, 2001, to remedy these deficiencies. The FAA’s March 2001 RASIP inspection found that deficiencies still existed in the maintenance training manual and that training was not being conducted in accordance with company procedures. Specifically, the inspection found that Air Midwest did not have adequate procedures for verifying the experience of new hires,144 information in the 143 Title 14 CFR 121.371 requires, among other things, that air carriers use only properly trained personnel for performing required inspections. Title 14 CFR 121.375 requires air carriers to have a training program that ensures that each person is fully informed about procedures, techniques, and new equipment and is competent to perform applicable duties.

Analysis 117 Aircraft Accident Report maintenance training manual was inconsistent and obsolete, mechanics were not completing OJT within the company’s 2-year time limit,145 and training was not being properly documented. During the next year, discussions between the FAA and Air Midwest continued regarding the adequacy of the air carrier’s training manuals and the completion of required training for its maintenance personnel. In an April 26, 2002, letter, the Wichita FSDO manager and the Air Midwest PMI notified Air Midwest that the FAA intended to delay the air carrier’s planned expansion to its route structure because of unresolved concerns, including the air carrier’s CASS and maintenance training programs. The planned route expansion related to a 2-year contract awarded in July 2002 by the Department of Transportation to Mesa Air Group (Air Midwest’s parent company) for seven new essential air service markets in Arkansas, Oklahoma, and Texas. The new markets included Enid and Ponca City, Oklahoma; Brownwood, Texas; and Harrison, Hot Springs, El Dorado/Camden, and Jonesboro, Arkansas. The air service was to be provided beginning in the fall of 2002 by Air Midwest doing business as Mesa Airlines, and four Beech 1900D airplanes were dedicated to the new routes. Mesa Air Group would receive a federally guaranteed subsidy of $13.4 million for providing air service during the 2-year term of the contract. As of August 2002, the Air Midwest PMI and principal operations inspector had still planned to delay the expansion; however, an FAA operations supervisor advised them against the delay. The Safety Board is concerned that, even though deficiencies in Air Midwest’s maintenance training program were clearly documented by the FAA in its letters to the air carrier, the FAA did not use Air Midwest’s subsidized route expansion as leverage to effect improvements in the carrier’s maintenance training program. The FAA could also have insisted that Air Midwest improve its maintenance training program before allowing the air carrier to open the HTS maintenance station in July 2002. The Safety Board’s investigation into the flight 5481 accident found that HTS had the same persistent problems that had been identified at other Air Midwest maintenance stations, including the poor quality of OJT. This problem is especially evident in the training records of the HTS mechanic who examined and adjusted the elevator control system on the accident airplane. Specifically, on January 7, 2003, the mechanic was signed off on the entire D6 aft fuselage/empennage inspection procedure, even though he clearly received none of the orientation, demonstration, practice, evaluation, and closure that FAA’s guidelines for OJT recommended. In addition, the mechanic performed the elevator control system adjustment incorrectly, and he did not perform any of the other tasks associated with the D6 maintenance check. The Safety Board notes that the flight 5481 accident investigation is the not first time that the FAA was unable or unwilling to follow the judgment of its aviation safety inspectors. In its final report on the ValuJet Airlines flight 592 accident, the Board 144 This finding was the only one cited by the RASIP inspection team as a FAR violation. 145 This requirement was replaced in the February 2002 revision of Air Midwest’s maintenance training manual with a requirement stating that a mechanic would not be assigned work until OJT was accomplished.

Analysis 118 Aircraft Accident Report criticized the FAA for its failure to act on its inspectors’ concerns about that air carrier and found that the FAA’s inability to provide adequate oversight of ValuJet and its maintenance contractors contributed to the cause to the accident. It is critical that proper FAA oversight is provided for every air carrier maintenance training program to ensure that any program deficiencies are identified. It is even more critical for the FAA to forcefully pursue maintenance training program improvements when deficiencies have been identified. The Safety Board concludes that the FAA’s failure to aggressively pursue the serious deficiencies in Air Midwest’s maintenance training program that were previously and consistently identified permitted the practices that prevailed at the HTS maintenance station and during the accident airplane’s D6 maintenance check. 2.5.2.2 Oversight of Continuing Analysis and Surveillance System Programs The FAA developed the requirement for air carrier CASS programs so that the carriers would have internal quality control systems to reduce safety hazards and improve operational performance. However, the regulation requiring air carrier CASS programs— 14 CFR 121.373—did not describe program requirements in detail. The primary CASS program guidance that was in effect at the time of the flight 5481 accident was contained in FAA AC 120-16C, “Continuing Airworthiness Maintenance Programs,” and was less than 1 page in length. After the Alaska Airlines flight 261 accident and the FAA’s postaccident inspection of the air carrier, the Department of Transportation Office of Inspector General conducted an investigation of the FAA’s oversight of CASS programs. The office’s December 12, 2001, report on the investigation stated that the findings of the FAA’s postaccident inspection raised questions regarding why the FAA’s routine surveillance had not identified deficiencies in Alaska Airlines’ CASS program and ensured that they were corrected. The report also stated that the FAA “placed limited emphasis on CASS in its oversight” and recommended that the FAA improve CASS program oversight and expand existing program guidance to better describe what an effective CASS program should include.146 In its comments on a draft of the report (dated October 4, 2001), the FAA agreed, among other things, to revise existing guidance for CASS development and implementation, conduct annual CASS inspections, develop CASS training for inspectors, and require that all inspectors be trained by January 2004. In March 2003, the FAA revised AC 120-16C. The revised AC (AC 120-16D) presented expanded CASS guidance in a dedicated chapter that was several pages in length. The guidance indicated that an air carrier’s CASS program should detect and correct air carrier maintenance program deficiencies through a closed-loop, continuous cycle of surveillance and investigations, data collection and analysis, corrective actions, and monitoring and feedback. 146 U.S. Department of Transportation, Office of the Secretary of Transportation, Office of Inspector General, Oversight of Aircraft Maintenance, Continuing Analysis and Surveillance Systems, Federal Aviation Administration (Washington, DC: Department of Transportation, 2001).

Analysis 119 Aircraft Accident Report AC 120-16D stated that an air carrier’s CASS program should monitor nine elements of the carrier’s continuous airworthiness maintenance program, including its maintenance manual. The guidance also stated that a CASS program should include “detailed policy and procedures” for determining whether an air carrier needed to amend its maintenance program or manual and for making such amendments. In addition, the guidance stated, “proactive surveillance and analysis forecasts faults in your [the air carrier’s] maintenance program or manual through the collection and analysis of a wide variety of data. It corrects those faults, including human factors issues, in advance of any specific event, accident, or incident.” Further, the guidance stated that an air carrier’s “CASS audit schedule should include…all manuals, publications, and forms [to ensure that they] are useable, current, accurate, and readily available to the user.” In April 2003, the FAA published AC 120-79, “Developing and Implementing a Continuing Analysis Surveillance System,” which was a comprehensive guide for the development of CASS programs. The AC provided information on many CASS-related topics and described model CASS programs for air carriers in three different size ranges. The Safety Board commends the FAA for issuing improved, detailed guidance for the development and implementation of CASS programs. However, the FAA has not yet included this guidance in FAA Order 8300.10, Airworthiness Inspector’s Handbook.147 Also, the FAA has not completed the development of CASS training for aviation safety inspectors. The Board notes that, on January 26, 2004, the FAA provided the Board with the draft lesson plan for the CASS portion of an air carrier indoctrination course that is to be taught to all new inspectors.148 The Board hopes that the FAA will complete the development of CASS training and begin training aviation safety inspectors as soon as possible. The Safety Board concludes that updated CASS guidance would help FAA aviation safety inspectors ensure that CASS programs are being effectively implemented at 14 CFR Part 121 air carriers. Therefore, the Safety Board believes that the FAA should include the CASS guidance from AC 120-16D, “Continuing Airworthiness Maintenance Programs,” and AC 120-79, “Developing and Implementing a Continuing Analysis Surveillance System,” in FAA Order 8300.10, Airworthiness Inspector’s Handbook. 2.5.2.3 Oversight of Maintenance Training Programs The Safety Board notes that, in contrast to other air carrier training programs, such as those for pilots, flight attendants, dispatchers, flight instructors, check airmen, and personnel handling hazardous materials,149 maintenance training programs do not require formal approval by the FAA. For those training programs that require formal approval, the air carrier submits its program plans to the FAA, which reviews those plans and either 147 Inspector guidance on the CASS program is currently found in volume 2, chapter 65, and volume 3, chapter 37, of the handbook. These handbook sections were developed in 1992 and 1993, respectively. 148 The FAA reported that the initial indoctrination course was taught during the week of January 12, 2004. 149 See 14 CFR 121.401, “Training Program: General.”

Analysis 120 Aircraft Accident Report approves them in writing or sends them back to the carrier for revision and resubmission. FAA staff indicated that managing the content of, and ensuring compliance with, air carrier training programs that are not approved (such as maintenance training programs) can be more difficult than for programs that are approved. As a result, the FAA’s oversight of maintenance training programs may not be as effective as its oversight of air carrier training programs that are required to be approved. The Safety Board concludes that, because proper aircraft maintenance is crucial to safety, air carrier maintenance training programs should be subject to the same standard that exists for other air carrier training programs (that is, FAA approval). Therefore, the Safety Board believes that the FAA should require that all 14 CFR Part 121 air carrier maintenance training programs be approved. 2.5.2.3.1 Programs to Reduce Human Error in Aircraft Maintenance The FAA’s research program on human factors in aviation maintenance has primarily resulted in the publication of guidance material and the promotion of voluntary human factors programs for the aviation industry. The Safety Board commends the FAA for its efforts to address issues related to human factors in aviation maintenance. However, major maintenance-related airplane accidents in the United States during the past decade (see section 1.18.4) suggest that the guidance for voluntary human factors programs may be insufficient to prevent accidents resulting from human error in aviation maintenance. The Safety Board concludes that the lessons learned by the FAA through its human factors research program need to be used to develop mandatory programs to prevent human error in aviation maintenance. Therefore, the Safety Board believes that the FAA should require that 14 CFR Part 121 air carriers implement comprehensive human factors programs to reduce the likelihood of human error in aviation maintenance. 2.5.2.4 Oversight of Weight and Balance Programs As stated in section 2.4.1, flight 5481 clearly exceeded the Beech 1900D certified weight limit of 17,120 pounds and aft CG limit of 40 percent MAC, even though the flight crew adhered to Air Midwest’s weight and balance program in effect at the time of the accident. In addition, even Air Midwest’s revised weight and balance program could result, in certain conditions, in an airplane operating with an unacceptably aft CG position. The Air Midwest weight and balance procedures used by the flight crew were based on the use of average weights for the flight crewmembers, crew baggage, passengers, personal items, carry-on baggage stored in the cabin, checked baggage, and carry-on baggage checked at the airplane and stored in the AFT1 cargo compartment. The Air Midwest average passenger and checked baggage weight values were consistent with the FAA guidance detailed in AC 120-27C, “Aircraft Weight and Balance Control,” and Flight Standards Handbook Bulletin for Airworthiness 95-14 and Flight Standards Handbook Bulletin for Air Transportation 95-15, “Adherence to Advisory Circular 120-27C, ‘Aircraft Weight and Balance Control.’” However, as demonstrated by the flight 5481 accident, these values did not ensure that the airplane would be operating within its certified weight and CG envelope.

Analysis 121 Aircraft Accident Report Wreckage evidence indicated that 4 of the 31 bags aboard flight 5481 weighed more than 50 pounds. None of these bags were formally recorded on any of the flight’s paperwork. The heaviest of the four bags weighed 69 pounds, 44 pounds more than the 25-pound average weight value attributed to it for weight and balance purposes. Although the Director of US Airways Express Training stated, in a postaccident interview, that any bag weighing up to 70 pounds was accounted for under the average baggage weight program, the program underestimated the average weight of each of the 31 bags by 4 pounds and, thus, the total baggage weight by at least 124 pounds. AC 120-27C permits air carriers to assign the FAA’s standard weight value (25 pounds) for each checked bag. The AC, however, does not provide guidance to air carriers regarding what weight cutoff should be used to avoid weight and balance errors resulting from heavy bags. In addition, flight crews, gate agents, and baggage handlers have only minimal guidance on how to recognize situations that necessitate the use of actual rather than average baggage weights. The average weight of passengers aboard flight 5481 was 185 pounds, 10 pounds more than the 175-pound average weight value attributed to each passenger. Of the 19 passengers aboard the accident flight, 16 (about 84 percent) were male, and 3 (about 16 percent) were female. AC 120-27C stated that the standard average passenger weights “cannot be arbitrarily adopted for operations with passenger groups that appreciably differ from the basis or where the mix of male and female passengers is known to be different than a 60 percent male/40 percent female operation.” However, neither the FAA’s guidance nor Air Midwest’s weight and balance program identified specific nonstandard passenger weight cues or thresholds to indicate when to use actual rather than average passenger weights. The Safety Board concludes that the use of average weights does not necessarily ensure that an aircraft will be loaded within its weight and CG envelope. Therefore, the Safety Board believes that the FAA should identify those situations that would require the use of actual instead of average weights in weight and balance computations and should incorporate this information into AC 120-27, “Aircraft Weight and Balance Control.” 2.5.2.4.1 Approval of Air Midwest’s Weight and Balance Program On April 9, 2001, the Air Midwest PMI approved the weight and balance procedures contained in the air carrier’s operations specifications at the time of the accident. However, the PMI approved Air Midwest’s weight and balance program without first validating the program. During the public hearing for this accident, an FAA air safety investigator from the Air Carrier Operations Branch stated that air carriers were responsible for evaluating the program’s impact on weight and balance. The air safety investigator also stated that the air carrier was responsible for ensuring that its weight and balance program complied with the manufacturer’s limitations and that the FAA was responsible for promoting safety and providing oversight. According to the Air Midwest PMI, oversight of the air carrier’s weight and balance program occurred only during en route inspections, when an inspector would

Analysis 122 Aircraft Accident Report check the cargo bin, count the number of bags, and look at the size of the bags and then compare the findings with the information on the load manifest. If the FAA had provided effective oversight by performing a survey to determine the average passenger and baggage weights, it would have realized that these weights were significantly different from the average passenger and baggage weights in Air Midwest’s program and in AC 120-27C. For example, FAA Notice 8400.40, which was issued less than 3 weeks after the flight 5481 accident, required 14 CFR Part 121 air carriers with 10- to 19-passenger seat airplanes and average weight programs (including Air Midwest) to survey passenger and baggage weights. The survey results showed that the average adult passenger, average carry-on baggage, and average checked baggage weights were greater than the average weights included in AC 120-27C by almost 21, 6, and 4 pounds, respectively. As a result, all 15 operators that were required to participate in the survey had to adjust the weights in one or more categories of their average weight program by 5 to 25 percent.150 It is very likely that, if the FAA had conducted such a survey in 2001 before approving Air Midwest’s weight and balance program, the FAA could have easily discovered that the average weight assumptions in its weight and balance program guidance were flawed. Thus, the Safety Board concludes that the FAA’s average weight assumptions in AC 120-27C, “Aircraft Weight and Balance Control,” were not correct. As demonstrated by the results of the FAA Notice 8400.40 survey, periodic sampling can easily identify and track changing trends in passenger or baggage weights. Periodic sampling of passenger and baggage weights can also identify and track regional, seasonal, or passenger demographic variances that may result in loadings that are significantly different from those based on average weights. In addition, periodic sampling can identify and track those aircraft or routes that carry passengers or baggage with weights that are significantly different from the average weights. Analysis of the survey results would provide a sound basis for future adjustments to average weights so that they would more closely reflect actual passenger and baggage loads. The Safety Board concludes that periodic sampling of passenger and baggage weights would determine whether air carrier average weight programs were accurately representing passenger and baggage loads. Therefore, the Safety Board believes that, unless an actual weight program is developed and implemented, the FAA should establish a weight and balance program that requires 14 CFR Part 121 air carriers to periodically sample passenger and baggage weights and determine appropriate statistical distribution characteristics for regional, seasonal, demographic, aircraft, and route variances. In addition, the Safety Board believes that the FAA should establish a program to periodically review 14 CFR Part 121 air carrier weight and balance data to ensure that regional, seasonal, demographic, aircraft, and route trends among carriers are valid. Further, the Safety Board believes that the FAA should require 14 CFR Part 121 air carriers to retain all survey data and products, as well as documentation of the methodology used to justify their average weight programs, and should audit these data as necessary. 150 Recent international survey data (see section 1.18.6.3) substantiate the trend of increasing passenger and carry-on baggage weights.

Analysis 123 Aircraft Accident Report 2.5.2.4.2 Use of Average Weights The Safety Board is concerned that air carrier average weight programs do not generally account for variances in passenger and baggage weights and weight distribution.151 As a result, it is possible for a flight crew to mistakenly determine that an airplane is within its certified weight and CG envelope when the airplane is actually outside the envelope. The use of a predetermined average weight assumes that, although an individual passenger or bag may weigh more or less than the average weight, the variance will be appropriately distributed throughout an aircraft. However, deviations from the average weight value and average weight distribution can negatively affect an aircraft’s CG if the heavier passengers and baggage are not appropriately distributed. Further, it is possible that some airplane types may be more susceptible than others to errors in CG loading. Specifically, the FAA air safety investigator from the Air Carrier Operations Branch stated, during public hearing testimony, “aircraft that have a larger seating capacity have the ability to spread the deviation from standard across a larger population. So…aircraft with…a smaller seating capacity could have…a greater chance for error than a larger aircraft.” Several factors besides aircraft type (including region of travel, season, passenger mix, number of bags, and amount of personal items) can influence the accuracy of average weight assumptions, and no current method of calculating passenger and baggage weights can ensure, with 100-percent certainty, that an airplane’s loading will not exceed its certified weight and CG limits. An airplane’s susceptibility of operating outside its weight and CG limits could be minimized if additional safety margins were determined and factored into weight and balance calculations. The Safety Board concludes that the current safety margins in air carrier average weight and balance programs do not ensure that aircraft will be loaded within their manufacturer-certified and FAA-approved weight and CG envelope. Therefore, the Safety Board believes that the FAA should require 14 CFR Part 121 air carriers that use average weight and balance programs to develop and implement weight and CG safety margins to account for individual passenger and baggage variances. 2.5.2.4.3 Technological Advances As a result of its findings from the August 7, 1997, Fine Airlines flight 101 accident (see section 1.18.4.3), the Safety Board issued Safety Recommendation A-98-49 in July 1998. Safety Recommendation A-98-49 asked the FAA to evaluate and, if warranted, require the installation of a system that provides a cockpit display of weight and balance information for transport-category cargo airplanes. One such system at the time was the Sum Total Aft and Nose system (commonly referred to as the “STAN” system), which derived weight and balance information from pressure transducers on the main gear and nose gear shock struts. The FAA evaluated onboard weight and balance systems and found that the existing systems could not meet the reliability and accuracy standards for a mandatory system (because of unresolved operational challenges such as 151 The average passenger, checked baggage, and carry-on baggage weights suggested by the FAA in AC 120-27C also do not consider weight variances and weight distribution variances.

Analysis 124 Aircraft Accident Report wind, ramp slope, oleo stiction, low hydraulic pressure, and asymmetrical gear loads). Thus, the Safety Board classified Safety Recommendation A-98-49 “Closed—Acceptable Action.” The Safety Board is aware of current efforts in private industry to develop aircraft onboard weight and balance systems. In fact, the FAA’s Aircraft Weight and Balance Control Program Aviation Rulemaking Committee is considering adding onboard weight and balance system certification specifications to the guidance in the next version of AC 120-27 (AC 120-27D). The Board is also aware of efforts to develop systems to rapidly weigh and automatically track passenger and baggage weight and location data as passengers board aircraft. Technological advances in hand-held computing devices, wireless bar code scanners, inventory tracking algorithms, and overnight package shipping logistics suggest that it may be feasible to compile actual weight data and account for the weight location, enabling a rapid and reliable calculation of actual aircraft weight and balance. The Safety Board concludes that technology may enable air carriers to accurately determine weight and effectively control balance while maintaining operational efficiency. Therefore, the Safety Board believes that FAA should conduct or sponsor research to develop systems that are capable of delivering actual aircraft weight and balance data before flight dispatch. These systems should rapidly provide accurate and reliable weight and balance data. The Safety Board further believes that FAA should promote the use of systems that deliver accurate weight and balance data as a preferred alternative to the use of average weight and balance programs. 2.5.3 Raytheon Aircraft Company During its investigation into the Air Midwest and Colgan Air accidents and the CommutAir incident, the Safety Board identified several areas in the Beech 1900D AMM (which each operator used as the basis for its maintenance work) that could be improved to help mechanics follow each step completely and accomplish procedures correctly. Regarding the Air Midwest accident, the elevator cable tension graph (figure 203) in the elevator control system rigging procedure did not contain instructions on how to take a temperature reading, which was needed to determine the tension values at which the cables should be set. Regarding the Colgan Air accident, the elevator trim system rigging procedure showed an incorrect illustration of the forward elevator trim cable drum. This error could have resulted in the incorrect installation of the elevator trim cable and elevator tab operation in the direction opposite of that commanded by the trim wheel. Regarding the CommutAir incident, the Beech 1900D AMM did not contain a procedure for replacing a thrust lever detent pin.152 152 Because the AMM did not contain this procedure, the mechanic used the installation instructions in a Beech 1900D field service kit for “thrust lever, replaceable detent pin.” However, the installation instructions did not describe how to remove the thrust lever control assembly from the center pedestal, which is required to replace a thrust lever detent pin. Also, the installation instructions did not provide any references to specific maintenance manual sections or procedures for removing the thrust lever control assembly from the center pedestal.

Analysis 125 Aircraft Accident Report The Safety Board notes that Beech 1900 series airplanes have been in service since 1984 and have accumulated about 11 million flight hours without significant problems with the AMMs.153 However, the three recent events involving Beech 1900D airplanes raise concerns that the Beech 1900 series AMMs may no longer be adequate in the current air carrier maintenance environment (less experienced mechanics, an increased prevalence of contracting out maintenance work, and an increased number of startup operations). On December 10, 2003, the President of Raytheon Airline Aviation Services met with the Safety Board to discuss Beech 1900 maintenance initiatives. On December 16, 2003, the Raytheon official sent the Board a facsimile detailing the initiatives the company would be taking to help Beech 1900 operators “achieve the best possible maintenance and safety practices.” The facsimile stated, among other things, that Raytheon Airline Aviation Services would be “developing easy-to-follow text and illustrations designed to improve the explanation of certain procedures, including flight control rigging and functional testing, which are then subject to ‘validation and verification.’” The facsimile also stated that Raytheon would issue these changes as temporary revisions to its Beech 1900 series AMMs. Because the three recent events involving Beech 1900D airplanes demonstrated that mechanics for the three operators did not adequately perform their duties, the Safety Board concludes that Beech 1900 mechanics would benefit from using AMMs with more specific instructions for critical flight system procedures. Therefore, the Safety Board believes that the FAA should ensure that Raytheon Aircraft Company revises the maintenance procedures for critical flight systems in its Beech 1900, 1900C, and 1900D AMMs to ensure that the procedures can be completely and correctly accomplished. 2.6 Cockpit Voice Recorders Installed in Beech 1900 Series Airplanes Before the flight 5481 accident, Beech 1900 series airplanes had experienced problems with the low signal volume of very high frequency (VHF) radio messages that were recorded by CVRs installed on the airplanes. As a result, the Safety Board issued Safety Recommendation A-97-36 on May 22, 1997. Safety Recommendation A-97-36 asked the FAA to require the inspection of CVRs aboard Beech 1900 airplanes and ensure that the operator take corrective actions so that the intelligibility of recorded communications was as high as practicable. Raytheon Aircraft Company issued Service Bulletin (SB) 23-3094, which recommended the incorporation of an improved CVR amplifier and new circuitry for the wiring. Subsequently, the FAA issued AD 2000-20-07, which required that all applicable Beech 1900 airplanes comply with Raytheon Aircraft’s SB. On January 30, 2001, the Safety Board classified Safety Recommendation A-97-36 “Closed—Acceptable Action.” 153 The Safety Board’s accident and incident database included two Beech 1900 events in which inadequate maintenance manual procedures were part of the probable cause. For information about these events, see MIA00IA266 and NYC00IA150 on the Safety Board’s Web site.

Analysis 126 Aircraft Accident Report The accident airplane’s maintenance records indicated that the actions required by the AD were accomplished on March 3, 2001. However, the volume of the incoming VHF radio messages during the accident flight was extremely low compared with the volume of the audio captured by the flight crew’s hot microphones. Because the audio from the captain’s, or first officer’s, hot microphone was recorded on the same channel as the audio from the VHF radio, the two audio signals could not be isolated from each other on the recording. On August 29, 2002, the Safety Board issued Safety Recommendation A-02-25 as a result of its longstanding concerns about the availability of CVR information after reportable accidents or incidents. Safety Recommendation A-02-25 asked the FAA to Require that all operators of airplanes equipped with a cockpit voice recorder (CVR) test the functionality of the CVR system prior to the first flight of each day, as part of an approved aircraft checklist. This test must be conducted according to procedures provided by the CVR manufacturer and shall include, at a minimum, listening to the recorded signals on each channel to verify that the audio is being recorded properly, is intelligible, and is free from electrical noise or other interference. On December 12, 2002, the FAA stated current regulations (14 CFR 23.1457 and 25.1457) require CVR equipment to have “an aural or visual means for preflight checking of the recorder for proper operation.” The FAA also stated that it would survey current maintenance practices of air carrier and general aviation aircraft to determine if corrections to the operators’ maintenance programs were necessary to ensure expected recorder reliability. On January 16, 2003, the Safety Board stated its concern that that the FAA’s maintenance survey would address only one part of the CVR reliability problem. The Board’s safety recommendation letter stressed that it was the flight crew’s responsibility to check the CVR for proper operation each day before the first flight; consequently, the Board encouraged the FAA to include maintenance procedures and crew checklist operational procedures in its survey. The Safety Board was concerned that the FAA might have misunderstood the portion of the recommendation concerning a daily test of the equipment. Even though the FAA stated that 14 CFR 23.1457 and 25.1457 required CVR equipment to have “an aural or visual means for preflight checking of the recorder for proper operation,” the Board stated that it was unaware of any CVR installations that did not have the ability to monitor the audio using a headphone jack in the cockpit. The Board indicated that the intended minimum for the daily test outlined in the safety recommendation would be similar to the procedures outlined in FAA Order 8300.10, Chapter 143, “Monitor Cockpit Voice Recorders.” This chapter states, among other things, to “check all channels to ensure that the quality of the reproduction has not deteriorated below an optimal audible level.”154 The Board urged the FAA to ensure that a similar check is required before the first flight of the day in all aircraft equipped with a CVR. Pending full implementation of this 154 The Safety Board’s letter also cited an example of a required daily check in the FAA’s Flight Standards Information Bulletin for Airworthiness 99-04. The bulletin indicated that the Beech 1900C Airplane Flight Manual contained a preflight inspection by the flight crew, which included monitoring the area microphone.

Analysis 127 Aircraft Accident Report requirement, Safety Recommendation A-02-25 was classified “Open—Acceptable Response.” Because the captain and the first officer’s audio panel information was fair to poor quality with respect to the audio captured from the airplane’s VHF radio systems, it is possible that important CVR information from flight 5481 might not have been transcribed if the audio information from the captain’s and the first officer’s hot microphones had not been excellent to good quality. The Safety Board concludes that, because the CVR can be one of the most valuable tools used for accident investigation, reliable daily test procedures are needed to safeguard CVR data. Therefore, the Safety Board reiterates Safety Recommendation A-02-25.

128 Aircraft Accident Report 3. Conclusions 3.1 Findings 1. The captain and the first officer were properly certificated and qualified under Federal regulations. No evidence indicated any preexisting medical or behavioral conditions that might have adversely affected their performance during the accident flight. Flight crew fatigue was not a factor in this accident. 2. The accident airplane was properly certified and equipped in accordance with Federal regulations. Except for the elevator control system, no evidence indicated that the airplane was improperly maintained. The recovered components showed no evidence of any preexisting structural, engine, or systems failures. 3. Weather was not a factor in this accident. The air traffic controllers that handled the accident flight were properly trained and provided appropriate air traffic control services. The emergency response for this accident was timely and effective. The accident was not survivable for the airplane occupants because they were subjected to impact forces that exceeded the limits of human tolerance. 4. The accident airplane entered the detail six maintenance check with an elevator control system that was rigged to achieve full elevator travel in the downward direction. 5. The accident airplane’s elevator control system was incorrectly rigged during the detail six maintenance check, and the incorrect rigging restricted the airplane’s elevator travel to 7º airplane nose down, or about one-half of the downward travel specified by the airplane manufacturer. 6. The changes in the elevator control system resulting from the incorrect rigging were not conspicuous to the flight crew. 7. The Raytheon Aerospace quality assurance inspector did not provide adequate on-the-job training and supervision to the Structural Modifications and Repair Technicians mechanic who examined and incorrectly adjusted the elevator control system on the accident airplane. 8. Because the Raytheon Aerospace quality assurance inspector and the Structural Modifications and Repair Technicians mechanic did not diligently follow the elevator control system rigging procedure as written, they missed a critical step that would have likely detected the misrig and thus prevented the accident.

Conclusions 129 Aircraft Accident Report 9. A complete functional check at the end of maintenance for critical flight systems or their components would help to ensure their safe operation, but no such check is currently required.

1. Flight 5481 had an excessive aft center of gravity, which, combined with the reduced

downward elevator travel resulting from the incorrect elevator rigging, rendered the airplane uncontrollable in the pitch axis.

1. Air Midwest’s weight and balance program at the time of the accident was not correct

and resulted in substantially inaccurate weight and balance calculations for flight 5481.

1. Air Midwest’s revised weight and balance program is also unacceptable because it

may result in an inaccurate calculation of an airplane’s center of gravity position.

1. Air Midwest did not adequately oversee the work performed by Raytheon Aerospace

and Structural Modifications and Repair Technicians personnel at its Huntington, West Virginia, maintenance station and did not ensure that the accident airplane was returned to service in an airworthy condition.

1. When an inspector provides on-the-job training for a required inspection item (RII)

maintenance task and then inspects that same task, the independent nature of the RII inspection is compromised.

1. Air carriers that use contractors to perform required inspection item maintenance

tasks and inspections need to provide substantial and direct oversight during each work shift to ensure that this work is being properly conducted.

1. Air Midwest did not have maintenance training policies and procedures in place to

ensure that each of its maintenance stations had an effective on-the-job training program.

1. It is important that air carrier on-the-job training programs are developed in

accordance with detailed guidance that emphasizes effective training practices.

1. Air Midwest did not ensure that its maintenance training was conducted and

documented in accordance with the company’s maintenance training program, which degraded the quality of training and inspection activities at the Huntington, West Virginia, maintenance station.

1. Air Midwest’s Continuing Analysis and Surveillance System program was not being

effectively implemented because it did not adequately identify deficiencies in the air carrier’s maintenance program, including some that were found by the Federal Aviation Administration before the flight 5481 accident.

1. Accurate and usable work cards developed jointly by air carriers and aircraft

manufacturers would improve the performance of maintenance for critical flight systems.

Conclusions 130 Aircraft Accident Report

1. The Federal Aviation Administration’s failure to aggressively pursue the serious

deficiencies in Air Midwest’s maintenance training program that were previously and consistently identified permitted the practices that prevailed at the Huntington, West Virginia, maintenance station and during the accident airplane’s detail six maintenance check.

1. Updated Continuing Analysis and Surveillance System (CASS) guidance would help

Federal Aviation Administration aviation safety inspectors ensure that CASS programs are being effectively implemented at 14 Code of Federal Regulations Part 121 air carriers.

1. Because proper aircraft maintenance is crucial to safety, air carrier maintenance

training programs should be subject to the same standard that exists for other air carrier training programs (that is, Federal Aviation Administration approval).

1. The lessons learned by the Federal Aviation Administration through its human factors

research program need to be used to develop mandatory programs to prevent human error in aviation maintenance.

1. The use of average weights does not necessarily ensure that an aircraft will be loaded

within its weight and center of gravity envelope.

1. The Federal Aviation Administration’s average weight assumptions in Advisory

Circular 120-27C, “Aircraft Weight and Balance Control,” were not correct.

1. Periodic sampling of passenger and baggage weights would determine whether air

carrier average weight programs were accurately representing passenger and baggage loads.

1. Current safety margins in air carrier average weight and balance programs do not

ensure that aircraft will be loaded within their manufacturer-certified and Federal Aviation Administration-approved weight and center of gravity envelope.

1. Technology may enable air carriers to accurately determine weight and effectively

control balance while maintaining operational efficiency.

1. Beech 1900 mechanics would benefit from using Airliner Maintenance Manuals with

more specific instructions for critical flight system procedures.

1. Because the cockpit voice recorder (CVR) can be one of the most valuable tools used

for accident investigation, reliable daily test procedures are needed to safeguard CVR data.

Conclusions 131 Aircraft Accident Report 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the airplane’s loss of pitch control during takeoff. The loss of pitch control resulted from the incorrect rigging of the elevator control system compounded by the airplane’s aft center of gravity, which was substantially aft of the certified aft limit. Contributing to the cause of the accident were (1) Air Midwest’s lack of oversight of the work being performed at the Huntington, West Virginia, maintenance station; (2) Air Midwest’s maintenance procedures and documentation; (3) Air Midwest’s weight and balance program at the time of the accident; (4) the Raytheon Aerospace quality assurance inspector’s failure to detect the incorrect rigging of the elevator control system; (5) the Federal Aviation Administration’s (FAA) average weight assumptions in its weight and balance program guidance at the time of the accident; and (6) the FAA’s lack of oversight of Air Midwest’s maintenance program and its weight and balance program.

132 Aircraft Accident Report 4. Recommendations 4.1 New Recommendations As a result of the investigation of this accident, the National Transportation Safety Board makes the following recommendations to the Federal Aviation Administration: Adopt a program for performing targeted surveillance and increased oversight of maintenance practices at 14 Code of Federal Regulations Part 121 air carriers to ensure that maintenance instructions are being followed as written and that maintenance personnel (including, but not limited to, management, quality assurance, tooling, and training personnel, as well as mechanics) are following all steps in the instructions unless authorization has been granted in accordance with the air carrier’s maintenance program. (A-04-4) Verify that 14 Code of Federal Regulations Part 121 air carriers have procedures in their Continuing Analysis and Surveillance System program for identifying deficiencies and incorporating changes to the carrier’s maintenance program and that maintenance personnel for these air carriers (including, but not limited to, management, quality assurance, tooling, and training personnel, as well as mechanics) use these procedures. (A-04-5) Modify (1) appendix G of 14 Code of Federal Regulations (CFR) Part 23 and appendix H of 14 CFR Part 25 and (2) 14 CFR 121.369 to require that the Instructions for Continued Airworthiness and air carrier maintenance manuals, respectively, include a complete functional check at the end of maintenance for each critical flight system. (A-04-6) Require manufacturers of aircraft operated under 14 Code of Federal Regulations Part 121 to identify appropriate procedures for a complete functional check of each critical flight system; determine which maintenance procedures should be followed by such functional checks; and modify their existing maintenance manuals, if necessary, so that they contain procedures at the end of maintenance for a complete functional check of each critical flight system. (A-04-7) Require 14 Code of Federal Regulations Part 121 air carriers to modify their existing maintenance manuals, if necessary, so that they contain procedures at the end of maintenance for a complete functional check of each critical flight system. (A-04-8)

Recommendations 133 Aircraft Accident Report Prohibit inspectors from performing required inspection item inspections on any maintenance task for which the inspector provided on-the-job training to the mechanic who accomplished the task. (A-04-9) Require 14 Code of Federal Regulations Part 121 air carriers that use contractors to perform required inspection item (RII) maintenance tasks and inspections to have air carrier personnel who are physically present when a substantial amount of the RII planning, tasking, maintenance work, and inspections are performed and are readily available when they are not physically present and who ensure that the processes and procedures used by contractors to perform RII maintenance tasks and inspections are the same as those used by air carrier maintenance personnel. (A-04-10) Develop detailed on-the-job (OJT) training requirements for 14 Code of Federal Regulations (CFR) Part 121 air carriers that rely on OJT as a maintenance training method. These requirements should include, but not be limited to, best practices, procedures, and methods for accomplishment and administration of this training. Ensure that these OJT requirements are incorporated into 14 CFR Part 121 air carrier maintenance training programs. (A-04-11) Audit training records for personnel who are currently performing maintenance on Air Midwest airplanes to verify that the training was properly accomplished in accordance with the company’s Maintenance Procedures Manual and Maintenance Training Manual. (A-04-12) Require 14 Code of Federal Regulations Part 121 air carriers to implement a program in which carriers and aircraft manufacturers review all work card and maintenance manual instructions for critical flight systems and ensure the accuracy and usability of these instructions so that they are appropriate to the level of training of the mechanics performing the work. (A-04-13) Include the Continuing Analysis and Surveillance System guidance from Advisory Circular (AC) 120-16D, “Continuing Airworthiness Maintenance Programs,” and AC 120-79, “Developing and Implementing a Continuing Analysis Surveillance System,” in Federal Aviation Administration Order 8300.10, Airworthiness Inspector’s Handbook. (A-04-14) Require that all 14 Code of Federal Regulations Part 121 air carrier maintenance training programs be approved. (A-04-15) Require that 14 Code of Federal Regulations Part 121 air carriers implement comprehensive human factors programs to reduce the likelihood of human error in aviation maintenance. (A-04-16)

Recommendations 134 Aircraft Accident Report Identify those situations that would require the use of actual instead of average weights in weight and balance computations and incorporate this information into Advisory Circular 120-27, “Aircraft Weight and Balance Control.” (A-04-17) Unless an actual weight program is developed and implemented, establish a weight and balance program that requires 14 Code of Federal Regulations Part 121 air carriers to periodically sample passenger and baggage weights and determine appropriate statistical distribution characteristics for regional, seasonal, demographic, aircraft, and route variances. (A-04-18) Establish a program to periodically review 14 Code of Federal Regulations Part 121 air carrier weight and balance data to ensure that regional, seasonal, demographic, aircraft, and route trends among carriers are valid. (A-04-19) Require 14 Code of Federal Regulations Part 121 air carriers to retain all survey data and products, as well as documentation of the methodology used to justify their average weight programs, and audit these data as necessary. (A-04-20) Require 14 Code of Federal Regulations Part 121 air carriers that use average weight and balance programs to develop and implement weight and center of gravity safety margins to account for individual passenger and baggage variances. (A-04-21) Conduct or sponsor research to develop systems that are capable of delivering actual aircraft weight and balance data before flight dispatch. These systems should rapidly provide accurate and reliable weight and balance data. (A-04-22) Promote the use of systems that deliver accurate weight and balance data as a preferred alternative to the use of average weight and balance programs. (A-04-23) Ensure that Raytheon Aircraft Company revises the maintenance procedures for critical flight systems in its Beech 1900, 1900C, and 1900D Airliner Maintenance Manuals to ensure that the procedures can be completely and correctly accomplished. (A-04-24)

Recommendations 135 Aircraft Accident Report 4.2 Previously Issued Recommendation Reiterated in This Report The Safety Board reiterates the following recommendation to the Federal Aviation Administration: Require that all operators of airplanes equipped with a cockpit voice recorder (CVR) test the functionality of the CVR system prior to the first flight of each day, as part of an approved aircraft checklist. This test must be conducted according to procedures provided by the CVR manufacturer and shall include, at a minimum, listening to the recorded signals on each channel to verify that the audio is being recorded properly, is intelligible, and is free from electrical noise or other interference. (A-02-25) 4.3 Previously Issued Recommendation Resulting From This Accident Investigation As a result of the investigation of this accident, the Safety Board issued the following recommendation to the Federal Aviation Administration on January 2, 2004: Identify all airplanes equipped with unguarded flight crewmember rotary seatbelt buckles and require replacement with guarded buckles that cannot be inadvertently unlatched. (A-03-57) For additional information about this recommendation, see section 1.12.2 of this report. 4.4 Previously Issued Recommendation Classified in This Report Safety Recommendation A-03-31 (previously classified “Open—Response Received”) is classified “Closed—Superseded” in section 2.5.1.4 of this report. For more information about this recommendation, see sections 1.18.4.4.1 and 2.5.1.4 of this report.

Recommendations 136 Aircraft Accident Report BY THE NATIONAL TRANSPORTATION SAFETY BOARD ELLEN ENGLEMAN CONNERS Chairman JOHN J. GOGLIA Member MARK V. ROSENKER Vice Chairman CAROL J. CARMODY Member RICHARD F. HEALING Member Adopted: February 26, 2004

137 Aircraft Accident Report 5. Appendixes Appendix A Investigation and Hearing Investigation The National Transportation Safety Board was initially notified of this accident on January 8, 2003, about 0900. A full go-team was assembled and departed at 1300 from Ronald Reagan National Airport, Washington, D.C., for Charlotte, North Carolina. The team arrived on scene about 1500. Accompanying the team to Charlotte was Board Member John Goglia. The following investigative teams were formed: Aircraft Operations and Human Performance, Aircraft Structures, Aircraft Systems, Powerplants, Aircraft Maintenance and Records, Air Traffic Control, Meteorology, Aircraft Performance, Survival Factors, and Airport and Emergency Response. Specialists were also assigned to conduct the readout of the flight data recorder and transcribe the cockpit voice recorder at the Safety Board’s laboratory in Washington, D.C. Parties to the investigation were the Federal Aviation Administration (FAA); Raytheon Aircraft Company; Raytheon Aerospace, LLC; Structural Modification and Repair Technicians, Inc. (SMART); International Association of Machinists; Air Midwest, Inc.; Air Line Pilots Association; National Air Traffic Controllers Association; and Hartzell Propeller. Also, in accordance with the provisions of Annex 13 to the Convention on International Civil Aviation, the Transportation Safety Board of Canada participated in the investigation as the representative of the State of Design and Manufacture of the Engines. Public Hearing A public hearing was held on May 20 and 21, 2003, in Washington, D.C. Chairman Ellen Engleman Conners presided over the hearing; Vice Chairman Mark Rosenker and Members John Goglia, Carol Carmody, and Richard Healing also participated in the hearing. The issues presented at the public hearing were average versus actual passenger and baggage weights; contractor maintenance work practices, oversight, and quality assurance; maintenance training; and FAA oversight. Parties to the public hearing were the FAA, Raytheon Aircraft, Raytheon Aerospace, International Association of Machinists, Air Midwest, Air Line Pilots Association, and SMART.

138 Aircraft Accident Report Appendix B Cockpit Voice Recorder Transcript The following is the transcript of the Fairchild A-100A cockpit voice recorder, serial number 61979, installed on Air Midwest flight 5481, a Raytheon (Beechcraft) 1900D, N233YV, which experienced a loss of pitch control during takeoff from Charlotte, North Carolina, on January 8, 2003.

Appendixes 139 Aircraft Accident Report Appendix B

Appendixes 140 Aircraft Accident Report Appendix B

Appendixes 141 Aircraft Accident Report Appendix B

Appendixes 142 Aircraft Accident Report Appendix B

Appendixes 143 Aircraft Accident Report Appendix B

Appendixes 144 Aircraft Accident Report Appendix B

Appendixes 145 Aircraft Accident Report Appendix B

Appendixes 146 Aircraft Accident Report Appendix B

Appendixes 147 Aircraft Accident Report Appendix B

Appendixes 148 Aircraft Accident Report Appendix B

Appendixes 149 Aircraft Accident Report Appendix B

Appendixes 150 Aircraft Accident Report Appendix B

Appendixes 151 Aircraft Accident Report Appendix B

Appendixes 152 Aircraft Accident Report Appendix B

Appendixes 153 Aircraft Accident Report Appendix B

Appendixes 154 Aircraft Accident Report Appendix B

Appendixes 155 Aircraft Accident Report Appendix B

Appendixes 156 Aircraft Accident Report Appendix B

Appendixes 157 Aircraft Accident Report Appendix B

Appendixes 158 Aircraft Accident Report Appendix B

Appendixes 159 Aircraft Accident Report Appendix B

Appendixes 160 Aircraft Accident Report Appendix B

Appendixes 161 Aircraft Accident Report Appendix B

Appendixes 162 Aircraft Accident Report Appendix B

Appendixes 163 Aircraft Accident Report Appendix B

Appendixes 164 Aircraft Accident Report Appendix B

Appendixes 165 Aircraft Accident Report Appendix B

Appendixes 166 Aircraft Accident Report Appendix B

Appendixes 167 Aircraft Accident Report Appendix B

Appendixes 168 Aircraft Accident Report Appendix B

Appendixes 169 Aircraft Accident Report Appendix B

Appendixes 170 Aircraft Accident Report Appendix B

Appendixes 171 Aircraft Accident Report Appendix B

Appendixes 172 Aircraft Accident Report Appendix B

Appendixes 173 Aircraft Accident Report Appendix B

Appendixes 174 Aircraft Accident Report Appendix B

Appendixes 175 Aircraft Accident Report Appendix B

Appendixes 176 Aircraft Accident Report Appendix B

Appendixes 177 Aircraft Accident Report Appendix B

Appendixes 178 Aircraft Accident Report Appendix B

Appendixes 179 Aircraft Accident Report Appendix B

Appendixes 180 Aircraft Accident Report Appendix B

Appendixes 181 Aircraft Accident Report Appendix B

Appendixes 182 Aircraft Accident Report Appendix B

Appendixes 183 Aircraft Accident Report Appendix B

Appendixes 184 Aircraft Accident Report Appendix B

Appendixes 185 Aircraft Accident Report Appendix B

Appendixes 186 Aircraft Accident Report Appendix B

Appendixes 187 Aircraft Accident Report Appendix B

Appendixes 188 Aircraft Accident Report Appendix B

Appendixes 189 Aircraft Accident Report Appendix B

Appendixes 190 Aircraft Accident Report Appendix B

Appendixes 191 Aircraft Accident Report Appendix B

192 Aircraft Accident Report Appendix C Air Midwest’s Elevator Control System Rigging Procedure at the Time of the Accident

Appendixes 193 Aircraft Accident Report Appendix C

Appendixes 194 Aircraft Accident Report Appendix C

Appendixes 195 Aircraft Accident Report Appendix C

Appendixes 196 Aircraft Accident Report Appendix C

Appendixes 197 Aircraft Accident Report Appendix C

Appendixes 198 Aircraft Accident Report Appendix C

Appendixes 199 Aircraft Accident Report Appendix C

200 Aircraft Accident Report Appendix D Air Midwest’s Revised Elevator Control System Rigging Procedure

Appendixes 201 Aircraft Accident Report Appendix D

Appendixes 202 Aircraft Accident Report Appendix D

Appendixes 203 Aircraft Accident Report Appendix D

this page intentionally left blank

FD07286 ｜ 2004_美国_AAR0402.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2004 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Collision With Trees on Final Approach Federal Express Flight 1478 Boeing 727-232, N497FE Tallahassee, Florida July 26, 2002 Aircraft Accident Report NTSB/AAR-04/02 PB2004-910402 Notation 7501B National Transportation Safety Board Washington, D.C.

THE CORRECTIONS BELOW ARE INCLUDED IN THIS VERSION OF THE PUBLISHED REPORT AIRCRAFT ACCIDENT REPORT NTSB/AAR-04/02 (PB2004-910402)

Collision With Trees on Final Approach Federal Express Flight 1478 Boeing 727-232, N497FE Tallahassee, Florida July 26, 2002

• Pages iii and iv of the Table of Contents has been updated with the correct page numbers. Corrections are noted in the table below.

Section Number Section Title Previous Incorrect Page Number Correct Page Number

1. 18

Additional Information 47 48 1.18.1 Hypoxia-Related Information 47 48 2 Analysis 52 53 2.1 General 52 53 2.2 The Accident Approach 53 54 2.3 Fatigue 55 56 2.3.1 Role of Fatigue−Captain 55 56 2.3.2 Role of Fatigue−First Officer 56 57 2.3.3 Role of Fatigue−Flight Engineer 58 59 2.3.4 Fatigue Management Training 59 60 2.5 Crew Coordination/Monitoring Information 63 64 3 Conclusions 66 67 3.1 Findings 66 67 3.2 Probable Cause 67 68 4 Recommendations 68 69

Aircraft Accident Report Collision With Trees on Final Approach Federal Express Flight 1478 Boeing 727-232, N497FE Tallahassee, Florida July 26, 2002 NTSB/AAR-04/02 PB2004-910402 National Transportation Safety Board Notation 7501B 490 L’Enfant Plaza, S.W. Adopted June 8, 2004 Washington, D.C. 20594 E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N

National Transportation Safety Board. 2004. Collision With Trees on Final Approach, Federal Express Flight 1478, Boeing 727-232, N497FE, Tallahassee, Florida, July 26, 2002. Aircraft Accident Report NTSB/AAR-04/02. Washington, DC. Abstract: This report explains the accident involving Federal Express flight 1478, a Boeing 727-232F, N497FE, which struck trees on short final approach and crashed short of runway 9 at the Tallahassee Regional Airport, Tallahassee, Florida. Safety issues in this report focus on flight crew performance, flight crew decision-making, pilot fatigue, and Federal Aviation Administration (FAA) certification of pilots with color vision deficiencies. Safety recommendations concerning these issues are addressed to the FAA. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2004-910402 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Aircraft Accident Report Contents Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

1. Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
2. 1

History of Flight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.2 Injuries to Persons. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1.3 Damage to Aircraft . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1.4 Other Damage. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1.5 Personnel Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1.5.1 The Captain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 1.5.2 The First Officer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 1.5.3 The Flight Engineer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 1.6 Airplane Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 1.7 Meteorological Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 1.8 Aids to Navigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 1.9 Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 1.10 Airport Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 1.10.1 Airport/Approach Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 1.10.2 Runway 9 Lighting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 1.11 Flight Recorders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 1.11.1 Cockpit Voice Recorder. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 1.11.2 Flight Data Recorder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 1.12 Wreckage Recovery and Documentation Information . . . . . . . . . . . . . . . . . . . . . . . . . 27 1.13 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 1.13.1 Toxicological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 1.13.2 First Officer’s Color Vision Deficiency. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 1.13.3 First Officer’s Postaccident Hospitalization Information . . . . . . . . . . . . . . . . . . . . 38 1.14 Fire/Explosion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 1.15 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 1.16 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 1.17 Operational and Management Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 1.17.1 FedEx Flight Crew Training—General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 1.17.2 Postaccident FedEx Actions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 1.18 Additional Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 1.18.1 Hypoxia-Related Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 1.18.2 DOT Operator Fatigue Management Program. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 1.18.3 Crew Familiarity/Attention/Monitoring Information. . . . . . . . . . . . . . . . . . . . . . . . 49 1.18.4 Previously Issued Safety Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

1. Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
2. 1

General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 2.2 The Accident Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 2.3 Fatigue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

Contents iv Aircraft Accident Report 2.3.1 Role of Fatigue—Captain. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 2.3.2 Role of Fatigue—First Officer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 2.3.3 Role of Fatigue—Flight Engineer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 2.3.4 Fatigue Management Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 2.4 Physiological Issues That May Have Affected the First Officer’s Performance . . . . . . 60 2.4.1 The First Officer’s Color Vision Deficiency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 2.4.2 The First Officer’s Breathing Rate. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 2.5 Crew Coordination/Monitoring Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

1. Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
2. 1

Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 3.2 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

1. Recommendations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
2. Appendixes

A: Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 B: Cockpit Voice Recorder Transcript . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 C: Correspondence Regarding the First Officer’s Color Vision. . . . . . . . . . . . . . . . . . . . . . . 104

v Aircraft Accident Report Figures

1. Descent profile of FedEx flight 1478. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2. Descent profile of FedEx flight 1478, with select CVR comments overlaid. . . . . . . . . . . . . 6
3. A map overlay of FedEx flight 1478’s radar track into runway 9 at TLH,

with excerpted CVR comments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

1. The three crewmembers’ estimated sleep schedule during the 72 hours

before the accident. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

1. TLH airport diagram. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
2. PAPI indications from various approach path angles.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
3. A swath of trees damaged by impact with FedEx flight 1478. . . . . . . . . . . . . . . . . . . . . . . 28

vi Aircraft Accident Report Abbreviations AC advisory circular AD airworthiness directive agl above ground level AIM Aeronautical Information Manual ALAR approach and landing accident reduction ARFF aircraft rescue and firefighting ARTCC air route traffic control center ASOS automated surface observation system ATC air traffic control ATCT air traffic control tower ATP airline transport pilot bpm breaths per minute BUF Buffalo Niagara International Airport CFIT controlled flight into terrain CFM company flight manual CFR Code of Federal Regulations CRM crew resource management CTAF common traffic advisory frequency CVR cockpit voice recorder DOT Department of Transportation EGPWS enhanced ground position warning system EPR engine pressure ratio FAA Federal Aviation Administration FALANT Farnsworth Lantern FDR flight data recorder

Abbreviations vii Aircraft Accident Report FL flight level FOM flight operations manual FOTM flight operations training manual fpm feet per minute GAME Guide for Aviation Medical Examiners GFK Grand Forks International Airport GPWS ground proximity warning system Hg mercury IFR instrument flight rules ILS instrument landing system IOE initial operating experience MEM Memphis International Airport msl mean sea level NASA National Aeronautics and Space Administration NATCA National Air Traffic Controllers Association nm nautical mile NPRM notice of proposed rulemaking NWS National Weather Service PAPI precision approach path indicator PIP pseudoisochromatic plate pph pounds per hour S/N serial number SHV Shreveport Regional Airport SODA Statement of Demonstrated Ability TCAS traffic collision avoidance system TLH Tallahassee Regional Airport TRACON terminal radar approach control USAFSAM U.S. Air Force School of Aerospace Medicine VASI visual approach slope indicator

Abbreviations viii Aircraft Accident Report VOR Very High Frequency Omnidirectional Radio Range VSI vertical speed indicators YOW Ottawa MacDonald Cartier International Airport YWG Winnepeg International Airport

ix Aircraft Accident Report Executive Summary On July 26, 2002, about 0537 eastern daylight time, Federal Express flight 1478, a Boeing 727-232F, N497FE, struck trees on short final approach and crashed short of runway 9 at the Tallahassee Regional Airport (TLH), Tallahassee, Florida. The flight was operating under the provisions of 14 Code of Federal Regulations Part 121 as a scheduled cargo flight from Memphis International Airport, in Memphis, Tennessee, to TLH. The captain, first officer, and flight engineer were seriously injured, and the airplane was destroyed by impact and resulting fire. Night visual meteorological conditions prevailed for the flight, which operated on an instrument flight rules flight plan. The National Transportation Safety Board determines that the probable cause of the accident was the captain’s and first officer’s failure to establish and maintain a proper glidepath during the night visual approach to landing. Contributing to the accident was a combination of the captain’s and first officer’s fatigue, the captain’s and first officer’s failure to adhere to company flight procedures, the captain’s and flight engineer’s failure to monitor the approach, and the first officer’s color vision deficiency. The safety issues in this report focus on flight crew performance, flight crew decision-making, pilot fatigue, and Federal Aviation Administration (FAA) certification of pilots with color vision deficiencies. Safety recommendations concerning these issues are addressed to the FAA.

this page intentionally left blank

1 Aircraft Accident Report 1. Factual Information 1.1 History of Flight On July 26, 2002, about 0537 eastern daylight time,1 Federal Express (FedEx) flight 1478, a Boeing 727-232F (727), N497FE, struck trees on short final approach and crashed short of runway 9 at the Tallahassee Regional Airport (TLH), Tallahassee, Florida. The flight was operating under the provisions of 14 Code of Federal Regulations (CFR) Part 121 as a scheduled cargo flight from Memphis International Airport (MEM), in Memphis, Tennessee, to TLH. The captain, first officer, and flight engineer were seriously injured, and the airplane was destroyed by impact and resulting fire. Night visual meteorological conditions prevailed for the flight, which operated on an instrument flight rules (IFR) flight plan. The accident flight crew reported for the accident flight in MEM at least 1 hour before the flight’s scheduled departure time of 0412,2 as required by FedEx. The airplane’s departure from MEM was delayed slightly because of an adjustment to a cargo pallet; the airplane was pushed back about 0424. According to postaccident pilot interviews, cockpit voice recorder (CVR)3 and flight data recorder (FDR) evidence, and air traffic control (ATC) records, the climb and cruise phases of the flight were routine and uneventful. The first officer was the flying pilot, while the captain performed the non-flying pilot duties for the accident flight. According to the CVR transcript, about 0511, the flight engineer received the TLH weather information from the Gainesville Flight Service Station, which indicated: scattered clouds at 100 feet, 18,000 feet, and 25,000 feet; wind from 120º at 5 knots; visibility 9 statute miles; temperature and dew point 22º C (Celsius); and altimeter setting 30.10 inches of mercury (Hg). The flight engineer related this information to the captain and first officer and asked which runway they would use at TLH. About 0512:41, the captain stated that they would land on runway 27 at TLH. The CVR indicated that about 0513:13, a controller at Atlanta Air Route Traffic Control Center (ARTCC) cleared the pilots of flight 1478 to descend to and maintain flight level (FL) 2404 at their discretion. The captain acknowledged the clearance. The flight engineer subsequently contacted FedEx ramp personnel at TLH and advised them that flight 1478 was 25 to 30 minutes from TLH, “lookin’ for a parkin’ spot and the 1 Unless otherwise indicated, all times are eastern daylight time, based on a 24-hour clock. 2 The flight’s scheduled departure time was 0312 in MEM local time (MEM is located in the central daylight time zone). 3 The CVR recorded the last 32 minutes and 12 seconds of cockpit communications before the accident. See appendix B for a complete transcript of the CVR. 4 Flight level (FL) 240 is an altitude of 24,000 feet mean sea level (msl), based on an altimeter setting of 29.92 inches Hg.

Factual Information 2 Aircraft Accident Report power.” TLH ramp personnel advised them to use gate number 2 and to park facing south. The flight engineer then briefed the captain and first officer regarding parking at TLH and, in accordance with company procedures, advised them that FedEx considered TLH a moderate controlled flight into terrain (CFIT) risk.5 About 0515:32, Atlanta ARTCC instructed the pilots of flight 1478 to contact Jacksonville ARTCC and the captain acknowledged the instructions. At 0515:52.3, the CVR recorded the captain, stating, “Jacksonville center uh good morning, FedEx fourteen seventy eight, two nine oh, discretion to two four oh.” The Jacksonville air traffic controller responded, “FedEx 1478, Jax center roger, descend at pilot’s discretion maintain niner thousand, Tallahassee altimeter three zero one zero.” The captain acknowledged the clearance then announced the target airspeeds6 for the approach to the first officer. About 0516:38, the captain questioned the flight engineer about the weather information, stating, “one thousand scattered, ten miles, uhh is zat what it said…there?” About 0516:43 (while the captain was finishing his statement), the first officer began the approach briefing for runway 27 at TLH, stating, in part, “we’ll plan on a visual to runway 27…We’ll back it up with this…ILS[7] runway 27 full procedure…272 is the final approach course inbound.” The first officer stated that the minimum safe altitude was 3,300 feet mean sea level (msl) “all the way around…missed approach will be as published and we’ll talk to ’em and see if we can get something better….runway’s 8,000 [feet long], plan on rollin’ out to the end…got a PAPI[8] on the left-hand side…pilot-controlled lighting,[9] so if you can…click it seven times I’d appreciate it.” About 0518:30, the first officer stated, “all right, start on down,” and the captain responded, “all right.” The captain then radioed Jacksonville ARTCC, stating, “uh, Atlanta FedEx uh fourteen seventy eight, leaving two nine oh for uh, nine thousand.” According to the CVR transcript, about 0519:38, the first officer asked, “you wanna land on nine if we see it?” He added, “we got a PAPI on nine, too.” The captain 5 The Federal Aviation Administration (FAA) defines CFIT as “an event where a mechanically normal functioning airplane is inadvertently flown into the ground, water, or an obstacle” (see http://www/faa.gov/avr/avs/cfit/volume1/titlepg.pdf). FedEx’s Flight Operations Manual (FOM) contains a similar definition. For additional information regarding FedEx’s determination of CFIT risk, see section 1.17.1.1. 6 The captain announced the target airspeeds as follows: “Vref one thirty seven…uhhh bug at uh one forty seven…one fifty two, one sixty two, one ninety two, two oh two.” 7 ILS refers to the instrument landing system. 8 The PAPI, or precision approach path indicator, light system at TLH consists of four boxes of lights that provide a visual indication of an airplane’s position on the glidepath for the associated runway. If an airplane is on glidepath, two boxes should display white lights and two boxes red lights. If an airplane is beneath the glidepath, more red lights are visible to the pilots; if an airplane is above the glidepath, more white lights are visible. For additional information regarding the TLH PAPI lighting system, see section 1.10.2. 9 During hours that TLH air traffic control tower (ATCT) is closed, all runway, taxiway, and approach lighting systems on the airport are pilot-controlled and can be activated by a pilot keying the microphone with the radio tuned to the airport’s common traffic advisory frequency (CTAF). Keying the airplane microphone activates the airport lighting as follows: three times (within 5 seconds) results in low intensity, five time results in medium intensity, and seven times results in high intensity.

Factual Information 3 Aircraft Accident Report responded, “yeah, maybe…be a longer taxi for us, but…way we’re comin’ in probly two seven be about as easy as any of ’em.” The first officer said, “okay.” The pilots initiated the in-range checklist about 0521:57 and completed it about 0522:20. During this time, the CVR recorded a sound similar to the microphone being keyed six times in about 1.3 seconds. The CVR indicated that about 0522:46, Jacksonville ARTCC cleared the pilots of flight 1478 to descend and maintain 3,000 feet msl at their discretion. About 0523:33, the Jacksonville ARTCC controller instructed the pilots to contact him on another frequency. At 0523:49.2, the captain reported on the new frequency, stating, “and Atlanta FedEx fourteen seventy eight with you, one thirty five thirty two.” The Jacksonville ARTCC controller asked if they had TLH weather, and the captain confirmed that they did. About 0524:03, the controller advised them to expect a visual approach into TLH and to report when they had the airport in sight. According to the CVR, about 0524:23, the captain stated, “runway nine…PAPI on the left side…I don’t know, you wanna try for nine?” The first officer responded, “we’re pointed in the right direction, I don’t know, like you said…kinda a long…taxiback.” The captain said, “yeah, that’d be all right.” The first officer further stated, “I always thought you were supposed to land with the prevailing wind…at an uncontrolled…,” and the captain responded, “well, at 5 knots, it really…the only advantage you have, landing to the west you have the…glideslope…which you don’t have to the east.” The captain asked the first officer if he was familiar with TLH, and the first officer replied that he was not. About 0527:47, the flight engineer advised TLH ground personnel that flight 1478 was 5 minutes out. The ramp agent indicated that ground power was available for the airplane and that he would arrange for transportation for them to the layover hotel.10 Consistent with FedEx policy, the flight engineer then asked the captain and first officer if they wanted to perform the approach checklist. About 0528:26, the first officer asked, “we ever decide if we’re goin’ nine or two seven?” The captain responded, “yeah, we can do nine if you want to.” About 0528:30, the first officer stated, “okay, runway nine, visual runway nine PAPI on the left side…approach check.” The flight engineer asked, “briefing?,” and the first officer responded, “complete for runway nine.” The pilots continued the approach checklist and completed it about 0528:57. About 0529:53, the captain asked the first officer if he wanted to tell the ARTCC controller that they had TLH in sight. The first officer responded, “yeah. I don’t see the runway yet, but I got the beacon.” About 0530, the captain told the ARTCC controller that they had the airport in sight. Jacksonville ARTCC then cleared the pilots of flight 1478 for the visual approach into TLH and asked if they were aware that runway 18/36 was 10 The pilots were scheduled to remain in Tallahassee for about 17 hours that day then depart TLH for MEM about 2315.

Factual Information 4 Aircraft Accident Report closed.11 The captain responded, “no sir, but…we’re gonna use runway nine.” Jacksonville ARTCC repeated the visual approach clearance, adding, “report your down time…change to advisory [frequency] approved.” About 0530:32, the CVR recorded sounds similar to a microphone being keyed five times within about 1.3 seconds. About 7 seconds later, the captain radioed “Tallahassee uh FedEx fourteen seventy eight uh extended uh left base leg for runway nine.” The first officer indicated that he thought he saw the runway about 0530:56; he called for “flaps 2” about 0531:10 and “flaps 5” about 12 seconds later. About 0532:34, the first officer stated, “I hope I’m lookin’ in the right spot here.” The captain responded, “see that group of bright lights kinda to the south down there and you see the beacon in the middle of it?…right over there…you’re kinda on about…ten mile left base or so.” The first officer then indicated that he had been “looking at the wrong…flashin’ light.”12 About 0533:05, the first officer repeated, “I was lookin’ at the wrong light,” and the captain responded, “yeah okay, yeah.” The first officer added, “yeah, with the direction I took, we coulda used [runway] 27, eh?,” and the captain responded, “yeah, it dudn’t matter. Yeah, it’s about…ten miles south of the VOR.”13 About 0534:11, the captain stated, “I guess the lights came on, if not I’ll click ‘em again here…when we get a little closer.” About 20 seconds later, the CVR recorded a sound similar to a microphone being keyed five times within about 1.5 seconds, and, at 0534:35, the captain said, “there we go.” The first officer requested “flaps 15” about 0535:24. About 0535:31, the first officer stated, “gear down, before landing check;” about 2 seconds later, the CVR recorded a sound similar to the landing gear handle being operated followed by a sound similar to the nose gear door opening. The CVR indicated that, about 0535:42, the captain advised TLH traffic that flight 1478 was turning onto final for runway 9. The flight engineer began the before landing checklist about 0535:54, stating, “landing gear,” to which the captain responded, “down in three green.” About 0535:59, the flight engineer stated, “autobrakes,” and, about 0536:06, the captain responded, “not installed.” About 0536:06, the first officer asked for “flaps 25,” and the captain acknowledged the request. About 0536:08, the CVR recorded the flight engineer ask, ”autospoilers?” and the captain’s response of “not installed.” About 0536:10, the flight engineer queried “flight and nav[igation] instruments?,” and the captain responded, “cross-checked, no flags.” 11 The National Transportation Safety Board notes that the runway 18/36 closure information was published in the Airport Facility Directory, (on the Jeppesen-type salmon-colored page 10-10A for TLH [which listed local ATC, airport, and radar information]), and in the remarks section of the FedEx flight plan/release for flight 1478. In addition, Notice to Airmen 02-47 was issued on July 19, 2002, for the closure. 12 A FedEx captain who regularly flies the MEM-to-TLH route told Safety Board investigators that a powerplant located a few miles north of TLH has a slow white strobe light that is frequently mistaken for the airport’s rotating beacon. He stated that the powerplant light is in the line of sight for the airport for pilots arriving from the northwest and is often visible before the rotating beacon. He also stated that the green light of the TLH rotating beacon is “very hard to distinguish as green. It is very faint.” 13 VOR refers to the very high frequency omnidirectional radio range navigation aid.

Factual Information 5 Aircraft Accident Report About 0536:20, the first officer said, “sorry ‘bout that…I was linin’ up on that papermill or something.” As the first officer started speaking, (at 0536:20.2), the CVR recorded the ground proximity warning system (GPWS) announce that the airplane passed through 1,000 feet above ground level (agl).14 About 0536:23, the captain said, “that’s all right, no problem.” About 0536:37, the airplane was slightly more than 2.5 nautical miles (nm) from the airport and was transitioning from an angled base-to-final leg to line up with the runway. The Safety Board’s airplane performance study indicated that, about this time, the PAPI would have been displaying one white light and three red lights when viewed from the cockpit. About 0536:40, the PAPI display would have shown four red lights. (Figure 1 shows the airplane’s descent profile in relation to the PAPI light indications, flap extension, the runway, and treetops. Figure 2 shows the same information with select CVR comments overlaid.) About this time, the power on the three engines increased from about 1.05 to 1.24 EPR (engine pressure ratio),15 then, about 0536:41, the power to the engines decreased from 1.24 to 1.17 EPR. About 0536:43, as the airplane approached 500 feet, the captain asked the first officer if he wanted to go to flaps 30, and the first officer responded, “please.” At 0536:47.8, the CVR recorded the GPWS announcement indicating that the airplane was passing through 500 feet agl. About 0536:49, the CVR recorded the captain stating, “stable.” The Safety Board’s airplane performance study indicated that, at this time, the airplane was 1.8 nm west of runway 9, descending through 500 feet agl at a vertical speed of 1,248 feet per minute (fpm),16 with engine power settings of about 1.17 EPR and an airspeed of 152 knots. 14 Evaluation of the accident airplane’s GPWS indicated that the unit provided altitude advisories consistent with its design during the approach to TLH. Additionally, the investigation noted that the airplane’s most rapid rate of descent during the later stages of the approach (more than 1,400 feet per minute [fpm] between 700 and 500 feet) did not meet the warning annunciation threshold for those altitudes; at those altitudes, the GPWS would have generated a “sink rate” warning at descent rates of 2,100 and 1,800 fpm, respectively. 15 Engine pressure ratio (EPR) is a measurement of engine power output as a ratio of the total pressure of the gases in the exhaust pipe divided by the total pressure of the air entering the engine inlet. 16 The Safety Board notes that the captain’s and first officer’s vertical speed indicators (VSIs) were not instantaneous and, therefore, may have displayed vertical speed information that lagged slightly behind the real-time vertical speed derived from the FDR data. According to the VSI manufacturer’s simulation, the pilots’ VSIs would have shown a rate of descent of at least 1,000 fpm when the airplane descended through 500 feet agl.

Factual Information 6 Aircraft Accident Report Figure 1. Descent profile of FedEx flight 1478. Figure 2. Descent profile of FedEx flight 1478, with select CVR comments overlaid.

Factual Information 7 Aircraft Accident Report Also about 0536:49, the CVR recorded the first officer stating, “[I’m] gonna have to stay just a little bit higher…I’m gonna lose the end of the runway.” About 0536:51, the captain responded, “yeah…yeah, okay.” About 0536:52, the flight engineer asked, “flaps?,” and the captain responded, “thirty thirty green light.” About 0536:56, the flight engineer asked, “landing clearance?,” and the captain responded, “clear to land runway…nine.” About 0536:58, the FDR data indicated that the engine power began to increase from 1.17 EPR, reaching 1.20 EPR about 4 seconds later. At 0536:59.7, the captain advised TLH traffic that flight 1478 was on short final for runway 9. About 0537:09, the captain said, “it’s startin’ to disappear in there a little bit, [isn’t] it? Think we’ll be alright, yeah.” The performance study indicated that, about this time, the airplane was 0.9 nm west of runway 9, descending through about 200 feet agl at a vertical speed of 528 fpm and an airspeed of 146 knots; the airplane performance study indicated that the PAPI indication observed from the cockpit would have been four red lights. About 0537:13, the flight engineer announced that the before landing checklist was complete.17 This announcement was the last flight crewmember statement recorded by the CVR. At 0537:14, the GPWS announced that the airplane passed 100 feet agl; FDR and airplane performance information indicated that, at this time, the airplane was 0.7 nm west of runway 9, descending at a vertical speed of 432 fpm and an airspeed of 144 knots and that the engine power had increased to about 1.34 EPR. At 0537:19.9, as the GPWS announced 50 feet agl, the engine power increased to about 1.46 EPR. At 0537:20.3, as the GPWS announced 40 feet agl, the No. 2 and No. 3 engine EPRs began to increase rapidly. At 0537:20.7, the CVR recorded the sound of a crunch, and, about 0537:21, the GPWS announced 30 feet agl. About 0537:22, the CVR recorded another crunch sound, and the No. 1 engine EPR began to increase rapidly. At 0537:22.6, the GPWS announced “bank angle, bank angle.” The CVR transcript indicates that, about 0537:23, the sound of crunching began again and, about 0537:25, a loud squeal began; both sounds continued to the end of the recording at 0537:26.2. (Figure 3 shows the accident airplane’s radar track into TLH overlaid on a map, with excerpted CVR comments.) The airplane collided with trees in a right-wing-low, slightly nose-up attitude during the approach to runway 9 then impacted the ground, coming to rest on a heading of 260º degrees about 1,556 feet west-southwest of the runway. A postimpact fire ensued; however, the three flight crewmembers exited the airplane through the captain’s side sliding cockpit window before the fire reached the cockpit. The accident occurred about 74 minutes before sunrise. 17 Although the CVR did not record any discussion of the last four items on the 727 before landing checklist (fuel panel, hydraulic and brake system, antiskid, and landing lights), FedEx’s 727 Company Flight Manual (CFM) indicates that those items are “to be completed silently.”

Factual Information 8 Aircraft Accident Report During postaccident interviews,18 all three crewmembers described a normal flight until the last seconds of the approach. The captain stated that the airplane was established on final as it descended through about 800 feet. He stated that during the approach, he observed “white pink, going to white red” on the PAPI and that, as the airplane descended, “we started picking up a few little wispy, I want to say clouds or mist, but it didn’t obscure the airport.” The captain stated that his last recollection was of a “white red” PAPI indication, then “we started feeling a little bumping, and the rest of it I don’t recall.” The captain stated that the last thing he remembered about the approach was that “everything visually looked normal, based on the runway and that’s why I was somewhat shocked when I felt the thumping.” The first officer stated the following about the approach: Everything was running exactly the way it was supposed to run. When we got down closer to the field and we had slowed down and the field was in sight….and the wind was still prevailing down runway nine. And that’s when I mentioned…should we go ahead and land on runway nine, since that’s where the wind is. [The captain] said okay, that’s fine. We were kinda lined up that direction anyway. And the speed was well within parameters…Got the nose pointed to the airport, started slowing down, started dirtying up…rolled out on the centerline on the PAPI…I remember specifically adding a touch of power because I recall rolling out on centerline but 2 knots slow and a hair under the bug…that’s the last I can remember…I have no memory of the remainder of the flight. 18 Safety Board investigators interviewed all three crewmembers as soon as possible after the accident. The flight engineer was interviewed in the hospital on July 27, 2002, the day after the accident. The captain was interviewed in the hospital on the next day, July 28. The first officer, whose injuries were more severe than the other crewmembers’, was interviewed in his hometown of Brunswick, Maine, on August 31, 2002.

Factual Information 9 Aircraft Accident Report Figure 3. A map overlay of FedEx flight 1478’s radar track into runway 9 at TLH, with excerpted CVR comments.

Factual Information 10 Aircraft Accident Report The first officer stated that when he first saw the PAPI lights, they indicated white next to red, showing that the airplane was on the glidepath. When investigators asked him to describe the PAPI system, the first officer described two white lights with two red lights next to each other. The first officer said that he would not have considered landing on runway 9 if it did not have the PAPI light guidance. He went on to state, “from the time I rolled out, I saw that I was on glideslope, added that power for the 2 knots, and it never changed. After that, since I have no memory of the remainder of the flight...I don’t know where the rest of the flight went.” When asked about power settings, the first officer told investigators that fuel flow for a normal visual approach would be 3,000 to 3,500 pounds per hour (pph) at 500 feet.19 The flight engineer told investigators that he first saw the airport about the same time the first officer remarked that he had the runway in sight, when the airplane was on a modified left base leg for runway 9. The flight engineer stated that, when he first saw the runway, he observed a white, a pink, and two red lights on the runway’s four-light PAPI system. He further stated that, throughout the approach, he was scanning his instruments and looking outside for other air traffic and that, as they neared the runway, they could see the runway lights “plain as day, including the PAPI.” He stated that the visibility was good during their approach and indicated that he did not observe any of the low, scattered clouds that were reported in the TLH weather observation. According to the flight engineer, the pilots were not rushed during the approach to TLH. The flight engineer stated that, after they completed the before landing checklist, he turned to his instrument panel to scan the instruments.20 He checked the fuel indicators, turned off the right air conditioning pack, and ensured that temperature, hydraulic, and electrical indications were good for landing. He stated that everything looked and felt normal until he started to feel like they were in turbulence. He said that when he felt the “turbulence” and looked out the front windshield, the airplane was in a slight right-wing-low attitude and he realized that they were going to hit something. None of the flight crewmembers indicated that they ever saw all red lights on the PAPI during the approach. 19 According to the FedEx 727 CFM, fuel flows between 3,000 and 3,500 pph correspond to settings of 1.3 to 1.45 EPR. The accident airplane’s FDR data showed that between 0536:20 and 0537:07, the engine power ranged from about 1.1 to about 1.25 EPR; the engine power did not exceed 1.3 EPR until about 10 seconds before impact. 20 According to the FedEx 727 CFM, after the flight engineer completes the before landing checklist, he is to turn his seat “either full forward or first notch to the right of full forward” and be actively involved in the approach for the remainder of the flight. Postaccident fire damage precluded a determination of the flight engineer’s seat position.

Factual Information 11 Aircraft Accident Report 1.2 Injuries to Persons Table 1. Injury chart. 1.3 Damage to Aircraft The airplane was destroyed by impact forces and a postcrash fire. 1.4 Other Damage Trees along the wreckage path were damaged by the impact and postcrash fire. Some farm vehicles and equipment and a fence line were also damaged by the impact. 1.5 Personnel Information The accident flight crew consisted of three reserve FedEx pilots. The accident flight was the first time all three crewmembers had flown together; however, the captain and flight engineer had flown together once previously.21 FedEx operates under 14 CFR Part 121, Subpart S (Flight Time Limitations: Supplemental Operations), which specifies that operators may schedule flight crew members for no more than 8 hours of flight time in a 24-hour period without a rest period within those 8 hours. Pilots must be relieved from duty for at least 24 consecutive hours at least once during any 7 consecutive days. Pilots working in three-person crews can be scheduled for no more than 18 hours of duty in a 24-hour period.22 The three accident flight crewmembers had different flight, duty, and sleep schedules before the accident. Table 2 shows their flight schedules for the 24 hours preceding the accident. Table 3 Injuries Flight Crew Cabin Crew Passengers Other Total Fatal 0 0 0 0 0 Serious 3 0 0 0 3 Minor 0 0 0 0 0 None 0 0 0 0 0 Total 3 0 0 0 3 21 Neither the captain nor the flight engineer had a clear recall of their prior flying experience together. 22 FedEx’s scheduling practices also abide by a union bargaining agreement. This agreement is more restrictive in some respects than 14 CFR 121, Subpart S. For example, the agreement limits scheduled domestic duty periods to between 9 and 13 hours, depending on a duty period’s start time.

Factual Information 12 Aircraft Accident Report shows the cumulative flight and duty times for the three crewmembers at the time of the accident, and figure 4 shows the three crewmembers’ self-reported estimated sleep schedule during the 72 hours before the accident. All times are reported in central daylight time (the time zone in which the crewmembers were based). Sleep start and end times are estimated from the available verbal reports. Table 2. Crew members’ schedule for the 24 hours preceding the accident. Table 3. Flight and duty times since the last rest period for the crew of FedEx flight 1478. Crew member Date Showtime Departure Arrival Block Turn Captain 7/26/02 0212 0324 0447 1:23 First Officer 7/25/02 0300 0356 0645 2:49 12:17 7/25/02 1818 1902 1935 0:33 01:22 7/25/02 2057 2303 2:06 04:21 7/26/02 0324 0447 1:23 Flight Engineer 7/25/02 0236 0358 0553 1:55 00:28 7/25/02 0626 0714 0:48 11:52 7/25/02 1806 2139 2359 2:20 03:25 7/26/02 0324 0447 1:23 Crew Member Flight Time Duty Time Captain 01:23 02:35 First Officer 04:02 10:29 Flight Engineer 03:43 10:41

Factual Information 13 Aircraft Accident Report Figure 4. The three crewmembers’ estimated sleep schedule during the 72 hours before the accident. 1.5.1 The Captain The captain, age 55, was hired by FedEx on April 10, 1989. He held an airline transport pilot (ATP) certificate (issued August 6, 1999) with a multiengine land rating and a flight engineer certificate for turbojet-powered airplanes. The captain’s ATP certificate indicated type ratings in the 727 (issued August 6, 1999), Cessna CE-500, and Canadair CL-600. According to FedEx training records, the captain’s most recent 727 simulator proficiency check was completed on August 13, 2001; his most recent 727 line check was completed on February 7, 2002; his most recent recurrent simulator training was completed on February 15, 2002; and his most recent recurrent ground training was completed on July 22, 2002. The captain’s most recent Federal Aviation Administration (FAA) first-class airman medical certificate was issued on June 17, 2002, and contained the limitation that he “must wear corrective lenses.” The captain estimated that he had flown about 13,000 to 14,000 total flight hours. According to FedEx records, at the time of the accident, the captain had about 2,754 flight hours as a 727 flight crewmember, including about 861 hours as 727 pilot-in-command, 515 hours as 727 second-in-command, and 1,378 hours as 727 flight engineer. FedEx records indicated that the captain’s proficiency checks were satisfactory and that, in accordance with the company training program, he had received training in visual approaches, non-tower operations, fatigue management, and crew resource management (CRM).23 The captain’s training records indicated that he had not seen FedEx’s black 23 According to FedEx’s CRM training staff, all three crewmembers would have seen a presentation on fatigue management during their baseline course for new hires. For additional information regarding FedEx’s training program, see section 1.17.1. July 26 July 25 July 24 July 23 Captain First Officer Second Officer 2400 2400 2400 2400 0600 1200 1800 0600 1200 1800 0600 1200 1800 2400 2400 2400 2400 0600 1200 1800 0600 1200 1800 0600 1200 1800 2400 2400 2400 2400 0600 1200 1800 0600 1200 1800 0600 1200 1800 Sleep Awake Interrupted Sleep Estimated Sleep Schedule Normal Sleep Accident Occured

Factual Information 14 Aircraft Accident Report hole24 or CFIT avoidance training modules, which were presented during recurrent training in 1995 and 1999, because he underwent upgrade—not recurrent—training in those years. Two FedEx first officers who flew with the captain during the week before the accident stated in postaccident interviews that he was a competent pilot who used standard procedures and callouts. One said that the captain had a “standard cockpit style with good CRM skills” and added that he was “upbeat” with a “good sense of humor.” The other first officer stated that he was relatively new with FedEx (fewer than 100 hours in the 727) when he flew a 2-day, four-landing trip with the captain. He stated that the captain decided to make one landing because of foggy conditions and allowed the first officer to fly the other flight segments and landings. The captain stated that his general health was “good,” with no significant changes in the 12 months before the accident. He stated that he did not take prescription medications or smoke and that he drank alcohol only occasionally. Specifically, the captain told investigators that in the days before the accident, he did not drink alcohol or take any prescription medications.25 The captain stated that when he was not working, he usually went to bed between 2200 and 2230 and awoke between 0700 and 0730.26 During postaccident interviews, the captain told investigators that at 0430 on July 23, 2002, FedEx scheduling personnel contacted him by telephone to advise him that he was assigned to fly FedEx flight 1380, from Shreveport Regional Airport (SHV), in Shreveport, Louisiana, to MEM later that day. He arrived at SHV about 1010 on July 23 and checked into a hotel, where he rested before he returned to the airport about 2030 for his assigned flight. When the captain arrived at MEM (on FedEx flight 1380) at 2353, he was released from duty and returned to his home, arriving after midnight on July 24, 2002. The captain stated that he did not sleep well that night. He reported that he stayed awake for a “couple of hours” after he got home to take care of the family dog, which was in deteriorating health. He indicated that he slept on the couch the rest of that night so he could more easily care for the dog during the night and stated that his sleep was accordingly interrupted three times during the night. He stated that his rest period ended about 0730 on July 24 and that he engaged in routine activities throughout the day. He went to bed about 2130 that evening, again sleeping on the downstairs couch and getting up several times during the night to care for the sick dog. He stated that he awoke about 0730 on July 25, 2002, and described his sleep quality as “marginal, not really good.” Between 1800 and 1830 that day, the captain checked company scheduling using his home computer and received notification of the TLH flight assignment. He stated that he slept from about 2100 on July 25 to about 0030 on July 26; he described his sleep 24 The term “black hole” refers to approaches conducted over unlit areas, water, or other featureless terrain. For additional information regarding FedEx’s black hole guidance, see section 1.17.1.1. 25 The captain told investigators that he had taken “a couple of [acetaminophen pills] for headaches” 72 hours before the accident. 26 All times in this section (1.5.1) are local time at the captain’s residence (central daylight time).

Factual Information 15 Aircraft Accident Report during that 3 1/2 hours as “pretty good” and said that he did not feel fatigued when he subsequently arrived at MEM for the accident flight. 1.5.2 The First Officer The first officer, age 44, was hired by FedEx on October 29, 1997. He held an ATP certificate (issued October 27, 1995) with a multiengine land rating and a flight engineer certificate for turbojet-powered airplanes. The first officer’s most recent recurrent 727 line check was completed on October 17, 2001; his most recent 727 simulator training was completed on December 18, 2001; his most recent 727 simulator proficiency check was completed on June 19, 2002; and his most recent recurrent ground training was completed on July 13, 2002. The first officer’s most recent FAA first-class airman medical certificate was issued on October 9, 2001,27 with no restrictions or limitations but with a Statement of Demonstrated Ability (SODA) for “defective color vision.” The medical certificate and SODA were issued on the basis of the first officer’s previous “operational experience.”28 The first officer estimated that he had flown about 7,500 to 8,500 total flight hours.29 According to FedEx records, at the time of the accident, the first officer had about 1,983 flight hours as a 727 flight crewmember, including about 526 hours as a 727 second-in-command and 1,457 hours as a 727 flight engineer. FedEx records indicated that the first officer’s proficiency checks were satisfactory and that, in accordance with the company training program, he had received training in visual approaches, non-tower operations, CRM, fatigue management, and CFIT avoidance. The first officer stated that his general health was “good,” with no significant changes in the 12 months before the accident. He reported that he had called in sick July 17 through 19, 2002, because of a knee injury suffered while playing sports several weeks before.30 He returned to his reserve duty availability on July 20. According to the first officer’s wife, on July 20 and 21, the first officer engaged in routine tasks that included mowing the lawn, cleaning the pool, and walking the dog. The first officer stated that he had not taken any medications, prescription or non-prescription, in the 3 days before the accident. He stated that he smoked about half a pack of cigarettes per day while on trips (less when he was home) and that he drank 27 In accordance with 14 CFR Section 61.23, although the first officer’s first-class medical certificate had expired, it was still valid as a second-class medical certificate. 28 For additional information on the first officer’s color vision deficiency and the SODA issued by the FAA, see section 1.13.2. 29 The first officer was a P3 pilot in the Navy between 1979 and 1995, when he was hired by FedEx. During postaccident interviews, the first officer estimated that his total flight time included about 5,000 hours in the P3 and about 2,500 hours in the 727. 30 A review of company records confirmed that the first officer had taken sick leave as reported. The first officer stated that he spent a lot of time with his left leg immobile during the weeks before the accident because of his knee injury and went to his primary care physician about the injury on July 22, 2002. The physician’s notes from that visit stated, “injured left knee—6 weeks ago…pain behind knee…left knee no swelling or crepitus…referral for orthopedic evaluation.” No orthopedic evaluation was performed before the accident.

Factual Information 16 Aircraft Accident Report alcohol at social events. When he was not working, he stated that he usually went to bed about 2100, fell asleep about 2200, and awoke about 0600. Two captains who flew with the first officer in the days before the accident stated in postaccident interviews that he was personable and professional, with solid flying skills. Neither recalled any deficiencies in his performance as a flight crewmember. The first officer stated that the reserve schedule he worked in July 2002 was difficult because his sleep-wake cycle was frequently changing between day- and night-sleep periods.31 He told investigators that on July 23, 2002, he flew a trip that he considered very difficult—it departed MEM about 0330,32 went to Washington Dulles International Airport in Washington, DC, then to Greater Rochester International Airport in Rochester, New York, and arrived at MEM about 1100. After the trip, he went to an apartment he leased with other FedEx pilots and went to sleep about 1130. The first officer did not recall the exact times involved but stated that he awoke in the evening and went out for dinner, then returned to the apartment and slept through the night. The first officer reported that he awoke again on the morning of July 24 and engaged in routine activities around the apartment during the day. According to a roommate, during a conversation that morning, the first officer complained about the reserve schedule he was flying because it “reversed day and night sleeping on consecutive days.” The first officer stated that he had dinner with his landlord that evening, went to bed about 2100, and slept until early morning on July 25, when he had to get up to report for duty. The first officer arrived at MEM about 0300 on July 25 and departed on FedEx flight 134 about 0356, arriving at Winnepeg International Airport (YWG), in Manitoba, Canada, about 0645. He went to a hotel and slept for about 5 to 6 hours and had dinner before reporting for duty at YWG again about 1818. He described his quality of sleep as “no better or worse than most day sleeps.” The first officer departed YWG on FedEx flight 137 about 1902 and arrived at Grand Forks International Airport (GFK), in Grand Forks, North Dakota, about 1935. Flight 137 departed GFK about 2057 and arrived at MEM about 2303. After flight 137 landed at MEM, the first officer was notified that he was scheduled to work flight 1478 to TLH, which was scheduled to depart MEM about 0312 on July 26 (about 4 hours after flight 137 arrived). The first officer stated that he accepted the flight 1478 trip assignment after he ascertained that it did not violate existing FedEx/pilot union agreements and would not result in his exceeding flight and duty limits. He indicated that he slept for about 1 1/2 hours in a private sleep room in FedEx’s crew rest facilities at MEM before he met the captain to prepare for the accident flight. He stated that, although he described that rest as “good” sleep, he did not recall “feeling 31 The first officer told investigators that he bid the reserve schedule for the month of July to optimize his vacation time that month. He said that it had been a long time since he had flown a reserve schedule and he would rather fly a more regular (predictable) schedule. 32 All times in this section (1.5.2) are local time in Memphis (central daylight time).

Factual Information 17 Aircraft Accident Report alert.” A friend and roommate of the first officer’s told Safety Board investigators that before the accident trip, the first officer “looked tired, like everyone else at 0330.” During postaccident interviews, the accident captain said that the first officer “seemed tired, but maybe it was just his personality; he seemed not as communicative, not as alert. He may have been preoccupied.” In response to a Safety Board investigator’s question during a postaccident interview, the first officer stated that he did not experience shortness of breath, cough, chest pain, or any other significant symptoms during the 24 hours before the accident. He did note some fatigue but did not consider it to be unusual given his schedule. 1.5.3 The Flight Engineer The flight engineer, age 33, was hired by FedEx on September 3, 2001. He held an ATP certificate (issued December 14, 2000) with a multiengine land rating and a flight engineer rating for turbojet-powered airplanes. The flight engineer completed his initial ground training on September 28, 2001; his 727 initial operating experience (IOE) and line check were completed on November 8, 2001; and his most recent 727 simulator proficiency training was completed on April 8, 2002. His most recent FAA first-class airman medical certificate was issued on July 8, 2002, with no restrictions or limitations. The flight engineer estimated that he had flown about 2,600 total flight hours. According to FedEx records, at the time of the accident, the flight engineer had about 346 flight hours as a 727 flight engineer. FedEx records indicated that the flight engineer’s proficiency checks were satisfactory and that, in accordance with the company training program, he had received training in visual approaches, non-tower operations, fatigue management, and CRM. Further, postaccident discussions with the flight engineer and FedEx management personnel indicated that the company was considering the flight engineer for a check airman position. The flight engineer stated that his general health was “good” and that there had been no changes to his health during the 12 months before the accident. He stated that he did not take prescription medications and that he drank alcohol occasionally. The flight engineer stated that when he was not working, he usually went to bed about 2230 and awoke about 0630. The flight engineer stated that on July 23, 2002, he awoke between 0900 and 0930 and spent the day relaxing around the house because he had been experiencing back pain. He reported that he went to bed about 2200. He reported that when he awoke about 0800 on July 24, his back felt better.33 He said he went boating with his children from about 0900 to about 1100, took a nap from about 1300 to about 1550, and engaged in routine activities at home until it was time to travel to his duty station (MEM). He arrived at the airport in Albany, New York, about 2200 to ride on a flight to MEM. He stated that he napped for about 30 minutes during the commute to MEM, arriving at MEM about 2330.34 33 The flight engineer did not report any subsequent back pain before the accident. 34 The times in the remainder of this section (1.5.3) are local time in Memphis (central daylight time).

Factual Information 18 Aircraft Accident Report The flight engineer stated that he slept another 90 minutes in FedEx’s crew rest facility at MEM before reporting for duty at 0248 on July 25. The flight engineer stated that FedEx flight 180 departed MEM about 0358 on July 25 and arrived at Buffalo Niagara International Airport (BUF), in Buffalo, New York, about 0558. The flight then departed BUF about 0626 and arrived at Ottawa MacDonald Cartier International Airport (YOW), Ottawa, Ontario, about 0714. The flight engineer reported that upon arrival at YOW, he checked into a hotel and slept about 6 1/2 hours. He stated that when he awoke, he was notified of his assignment to flight 1478 to TLH on July 26. As a result of his assignment to the accident flight, the flight engineer postponed a job interview for a FedEx 727 line check airman position, which was originally scheduled to occur at MEM the morning of July 26. He stated that he engaged in routine activities at the hotel and returned to YOW about 1806 on July 25 for flight 181. Flight 181 departed YOW about 2139 and arrived at MEM about 2359. The flight engineer stated that after he arrived at MEM around midnight, he had his fingerprints taken to satisfy a new security policy, then relaxed in a recliner chair for 30 to 60 minutes. He stated that he began preparing for flight 1478 about 0135. In postaccident interviews, the captain stated that the flight engineer seemed to be alert during the accident flight. 1.6 Airplane Information The accident airplane, N497FE, a Boeing 727-232F series airplane, was manufactured in September 1974. FedEx purchased the airplane from Delta Airlines in

1. According to FedEx records, the accident airplane had about 37,980 total hours of

operation (23,195 flight cycles)35 at the time of the accident. The accident airplane was equipped with two Pratt & Whitney (P&W) JT8D-15 engines (engines No. 1 and No. 2) and a P&W JT8D-15A engine (engine No. 3).36 According to FedEx’s dispatch documents for the accident flight, the airplane’s estimated landing weight was 159,000 pounds, including about 44,350 pounds of cargo and about 19,000 pounds of fuel. 1.7 Meteorological Information The National Weather Service (NWS) surface analysis chart for 0500 on July 26, 2002, depicted no fronts or other boundaries over the route of flight. The chart indicated that a ridge of high pressure was centered over central Florida. The NWS weather depiction chart for 0600 on July 26, 2002, indicated that, except for a small area of 35 A flight cycle is one complete takeoff and landing sequence. 36 The JT8D-15 and JT8D-15A engines are both rated at 15,500 pounds of thrust.

Factual Information 19 Aircraft Accident Report marginal visual flight rules conditions in north central Florida, visual flight rules conditions existed throughout the state of Florida, including the Tallahassee area. TLH is equipped with an automated surface observation system (ASOS).37 This weather observation system is augmented by NWS-certified weather observers under contract with the FAA. The following conditions were recorded around the time of the accident: TLH weather at 0453, wind from 120° at 5 knots; visibility 9 statute miles; a few clouds at 100 feet;[38] scattered clouds at 18,000 and 25,000 feet; temperature and dew point 22° C (72° Fahrenheit [F]); and altimeter setting 30.10 inches of Hg. Remarks: automated observation system, sea level pressure 1019.2 millibars. TLH weather at 0553, wind calm; visibility 8 statute miles; a few clouds at 100 feet; scattered clouds at 15,000 and 25,000 feet; temperature and dew point 22° C (72° F); and altimeter setting 30.10 inches of Hg. Remarks: automated observation system, sea level pressure 1019.2 millibars. TLH weather at 0653, wind calm; visibility 9 statute miles; a few clouds at 100 feet; scattered clouds at 1,500, 15,000 and 25,000 feet; temperature and dew point 22° C (72° F); and altimeter setting 30.10 inches of Hg. Remarks: automated observation system, sea level pressure 1019.2 millibars, sector visibility from the southwest through northwest quadrants 1/2 mile, cumulonimbus clouds in the distance towards the southeast and southwest, smoke scattered at 1,500 feet, smoke plume over the approach end of runway 9. The weather forecast for TLH that FedEx provided the pilots indicated that between 2300 and 0459, ceilings would be above 2,000 feet, visibility greater than 3 statute miles, and winds less than 10 knots. The FedEx forecasts between 0500 and 0959 indicated, “sky partially obscured, visibility 3 miles in mist, with occasional scattered clouds at 500 feet and visibility 1 mile in mist.” There were no in-flight weather advisories for around the time of the accident. The astronomical data for July 26, 2002, indicated that the sun was more than 10° below the horizon at the time of the accident; civil twilight began at 0626, and sunrise occurred at 0652. At the time of the accident, the moon was located about 31° above the 37 The ASOS continuously measures wind, visibility, precipitation and obstructions to vision, cloud height, sky cover, temperature, dew point, and altimeter setting. 38 The weather observer on duty at TLH when the accident occurred, reported that, when he completed his observation minutes before the accident, he saw some very thin stratus clouds between about 25 feet agl and treetop level (about 60 feet agl) in the wooded area west of the airport near the midpoint of runway 18/36. He stated that these light stratus clouds were north of the accident site. The observer stated that he saw no restriction to visibility near the accident site. (The observer was located on the airport’s south ramp, about 1/4 mile east of the tree line and immediately north of runway 9/27, near the fire station, which is shown on figure 5 in section 1.10.) Although the captain reported that there were “a few little wispy…clouds or mist” as they neared the runway, the three pilots stated that there were no clouds obscuring their view of the runway during their approach.

Factual Information 20 Aircraft Accident Report horizon and was behind and to the right of the accident airplane’s approach course. Records indicate that there was 95 percent illumination from the moon at the time of the accident. 1.8 Aids to Navigation No difficulties with the navigational aids were known or reported. 1.9 Communications No difficulties with communications were known or reported. 1.10 Airport Information TLH is located about 4 miles southwest of downtown Tallahassee, Florida. The official airport elevation is 81 feet. The TLH air traffic control tower (ATCT) operates part time and is closed daily between 2300 and 0600. Control of the airspace that is normally delegated to TLH terminal radar approach control (TRACON) and ATCT reverts to Jacksonville ARTCC when the TLH ATCT is closed. The airport has two perpendicular runways. Runway 18/36 is 6,076 feet long and 150 feet wide and is located along the west side of the field. Runway 9/27 is 8,000 feet long and 150 feet wide and is located along the south side of the field (see figure 5). Runways 36 and 27 have ILS approaches, and runways 9 and 18 have visual approaches. The airport layout plan indicated that the terrain west of the airport was national forest property and was densely wooded. As previously indicated, at the time of the accident, runway 18/36 was closed for construction; Notice to Airmen 02-47 was issued on July 19, 2002, for the closure. The accident airplane was on the visual approach to runway 9. Runway 9 has an elevation of 61.2 feet msl at the approach end and 49.0 feet msl at the departure end, with a maximum elevation of 70.5 feet msl about 2,325 feet from the approach end. There is a 0.4 percent upslope gradient from the approach end of runway 9 to the runway’s maximum elevation (slightly less than the first one-third of the runway).39 39 FAA Advisory Circular (AC) 150/5300-13, titled “Airport Design,” states that “[t]he maximum allowable longitudinal runway gradient at airports with Approach Categories C and D, is plus or minus 1.5 percent; however, the gradient may not exceed 0.8 percent in the first and/or last quarter of the runway length.”

Factual Information 21 Aircraft Accident Report Figure 5. TLH airport diagram.

Factual Information 22 Aircraft Accident Report 1.10.1 Airport/Approach Charts The Jeppesen approach charts for TLH included a precision (that is, ILS) approach chart for runway 27, but no precision approach for runway 9. The chart for runway 9 depicted a nonprecision radar approach for which TLH TRACON (or Jacksonville ARTCC, depending on the time of day) would vector the airplane to a final approach course to runway 9 using airport surveillance radar.40 The first officer’s landing briefings for runways 27 and 9 reflected the information available on those approach charts. FedEx provided its flight crews with two internally generated airport chart pages to augment the published Jeppesen airport and approach charts for TLH. These FedEx pages (10-10 and 10-10A) contained information pertinent to FedEx operations at TLH, including airport-specific precautions, ATCT hours of operation, noise abatement procedures, weather information, emergency contact information/procedures, and runway lighting/traffic advisory information for hours of non-tower operation. The FedEx TLH chart pages also characterized the CFIT risk at TLH as moderate,41 with page 10-10A stating, “Local ATC and radar coverage unavailable at certain times. ILS not installed in all directions, potential nonprecision approach. The airport has no published departure procedure.” 1.10.2 Runway 9 Lighting Runway 9 was equipped with high intensity runway lights, in-pavement runway centerline lights, and runway end identifier lights. A four-box PAPI light system was located on the left side of runway 9 to provide lighted signal glidepath guidance relative to the published 3° glidepath to the runway’s touchdown zone. The runway inspection log for July 25, 2002, indicated that the runway lighting was operational. When the TLH ATCT was open, air traffic controllers controlled the airport/runway lighting from the tower cab. However, when the TLH ATCT was closed, the airport’s lights (with the exception of the rotating beacon) were off unless activated by a pilot keying the airplane microphone with the airplane’s communication radio tuned to the common traffic advisory frequency (CTAF). During the activation process, the airport lighting systems, including runway edge lights, taxiway lights, and the PAPI, activate over a period of a few seconds. Once activated, the airport lights remain on for 15 minutes. The airport lighting activation log indicated that, on the day of the accident, the lights were 40 Although the TLH TRACON was closed, Jacksonville ARTCC could have provided the pilots of flight 1478 with the necessary vectors; however, when the pilots reported that they had TLH in sight, they were cleared for the visual approach. 41 For additional information regarding FedEx’s classification of CFIT risk at airports, see section 1.17.1.1.

Factual Information 23 Aircraft Accident Report activated about 0534:26, and all lights were on by about 0534:31.42 According to CVR and airport lighting activation log evidence, the runway lights were activated on medium intensity. 1.10.2.1 Runway 9 PAPI Lighting System The PAPI lighting system installed on the left side of the approach end of runway 9 was an ADB, ALNACO, Inc. (a subsidiary of Siemens Airfield Solutions) model L-880, style A, and consisted of four identical light boxes mounted along a line perpendicular to the runway centerline about 1,000 feet from the approach end of the runway. Each of the four boxes contained two 200-watt lamps and optical apparatus to split the lamp beams horizontally into red (lower) and white (upper) beams. The lamps in each of the four light boxes were positioned so that each box projected a signal at a prescribed angle above the horizon, relative to a 3° glidepath.43 An on-glidepath signal is represented by the two left-side boxes showing white lights and the two right-side boxes showing red lights. If an airplane is beneath the glidepath, more red lights would be visible to the pilots; if an airplane is above the glidepath, more white lights would be visible. Figure 6 shows PAPI indications from various approach path angles. Figure 6. PAPI indications from various approach path angles. 42 Examination of the computer that controlled the airport’s lighting log indicated that the computer time had not been adjusted for daylight savings time and was also 3 minutes and 16 seconds ahead of the time displayed on a handheld global positioning system receiver. Applying the 56 minute, 44 second difference as a correction factor to the time indicated on the activation log resulted in an airport lighting activation time of about 0534:26; all lights were activated by about 0534:31. 43 According to the manufacturer, a narrow band of pink can normally be seen briefly by a pilot when an airplane transitions between the PAPI unit’s white and red beams during its descent. Runway Environment Display Indication red light white light Too High Too Low Slightly High Slightly Low On Slope

Factual Information 24 Aircraft Accident Report When activated, the TLH PAPI lights are automatically regulated to operate at 100 percent intensity during daylight hours and at 20 percent intensity during nighttime (regardless of the selected intensity of other runway/airport lights), consistent with FAA Advisory Circular (AC) 150/5345-28D. According to the manufacturer, the red light filters in the ADB PAPI system conform to Military Standard C-L5050 for “aviation red” coloring, as outlined in the AC. The filters are designed to retain accurate coloring for the life of the PAPI system. The PAPI system for runway 9 at TLH was installed in 1996. According to electrical technicians at TLH, the runway 9 PAPI system had been checked with a manufacturer-provided and FAA-approved sighting tool “five to six times” since the system was installed, with no improper alignment observed.44 (The FAA does not require certification of an airport’s PAPI lighting system if an FAA-approved aiming device is used to maintain the system.) 1.10.2.2 Postaccident Flight and Ground Evaluations of the Runway 9 PAPI System About 1300, on July 29, 2002, the FAA conducted a flight evaluation of the runway 9 PAPI system. According to the FAA’s flight inspection report, the PAPI’s glideslope angle and obstacle clearance were satisfactory. The flight inspection report stated, “this evaluation was conducted by flying one approach with on-path indications and one approach at an angle consistent with the [fourth of four red boxes] just turning red. On both approaches, the glidepath flown was well clear of the terrain and obstacles in the approach zone.” An additional postaccident flight check of the runway 9 PAPI system was conducted between 0800 and 0900 on August 6, 2002.45 The resultant flight inspection report indicated that the PAPI’s intensity, glideslope angle, angular coverage, and focus and adjustments were satisfactory and stated, “found average PAPI angle at 2.90 degrees and angular coverage satisfactory.”46 Despite the two satisfactory flight inspections, TLH airport personnel classified the PAPI lighting system for runway 9 as out of service as a precaution, and no adjustments to the system were allowed until after the technical inspection and measurement of the PAPI light units. About 1330, on October 10, 2002, the TLH runway 9 PAPI light units were inspected using the aiming tool provided by the manufacturer in accordance with the manufacturer’s instruction manual. The observed 44 No record or log of these inspections was maintained at TLH. 45 This preliminary flight inspection indicated that the PAPI appeared to be operating normally; however, TLH was unable to provide airport survey data at the time. Therefore, the FAA performed a second flight inspection after it obtained the TLH airport survey data necessary to calculate precise PAPI angles for the runway. 46 FAA Order 8200.1, “Flight Inspection Handbook,” allows ± 0.2° variation from the 3° glidepath between flight inspection measurements and ground settings.

Factual Information 25 Aircraft Accident Report settings for the PAPI’s four light units were consistent with the manufacturer’s recommended settings for a standard PAPI installation. 1.10.2.3 Effects of Contamination on PAPI Light Lenses According to a research study that the FAA conducted to assess the attributes of PAPI systems,47 “PAPI units tended to form condensation on the exposed frontal surface of the lenses during high humidity conditions while the system was de-energized. Upon activation, diffusion and mixing of the projected colors created a broad ‘pink’ signal, which could not be easily interpreted.” The FAA also found that condensate on the PAPI lenses began to evaporate as soon as the lamps were energized. (The rate at which evaporation occurred varied based on the amount of condensate, ambient temperature, relative humidity, and intensity of PAPI lamps.)48 The FAA’s report concluded that the transient false signals could be eliminated by: 1) energizing the system continuously; 2) energizing the system at least 30 minutes before in-flight use; and/or 3) installing heaters in close proximity to the lenses.49 During a telephone interview conducted on August 16, 2002, a representative of the PAPI manufacturer stated that the company was aware of an Aerodrome Safety Circular (No. 98-2002) issued by Transport Canada that similarly concluded that ice, dew, or frost on the PAPI front lens surface can affect the projected PAPI signal, producing false slope indications. The Transport Canada circular also recommended that airport operators operate the PAPI continuously or provide an adequate PAPI system “warm up” period before use to prevent a false signal due to PAPI lens contamination. The PAPI manufacturer offers optional heating units that can be installed in the light units; however, according to the representative, “customers do not often request them.” The manufacturer’s representative emphasized that the units produce substantial heat and will “burn off any traces of dew or frost within minutes.” He stated that the manufacturer recommends that the lighting units be activated a few minutes before using the system. On December 12, 2002, the FAA issued CertAlert Number 02-08, “PAPI Operation,” which advised that 14 CFR Part 139-certificated airport operators should “rewire pilot controlled PAPI systems to make them operate continuously in order to preclude environmental contamination of the lenses.” The TLH PAPI lights were subsequently rewired in accordance with the CertAlert. The Safety Board notes that the National Air Traffic Controllers Association (NATCA) submission on this accident stated that there was a “high level of physical particle contamination” on the runway 9 PAPI boxes at TLH. However, investigators who 47 For additional information, see the FAA’s final report on this study, U.S. Department of Transportation, Federal Aviation Administration, Evaluation of Precision Approach Path Indicator (PAPI) DOT/FAA-RD-82/85, Bret Castle: FAA, 1983. 48 The Safety Board notes that the TLH weather observations around the time of the accident indicated matching temperatures and dew points (conditions conducive to the formation of dew and/or fog). However, there were no (official or unofficial) reports of dew or fog in the area at the time of the accident. 49 According to the FAA’s report, the suggested 30-minute warm-up period was not based on any scientific study but, rather, reflected a conservative estimate for reliable PAPI use.

Factual Information 26 Aircraft Accident Report examined the PAPI boxes during the on-scene investigation (including the NATCA representative and other members of the investigative team) noted no such contamination, and the investigation developed no evidence to support this contention. 1.11 Flight Recorders 1.11.1 Cockpit Voice Recorder The CVR installed on the accident airplane was a Fairchild50 model A100, serial number (S/N) 4549, magnetic tape CVR. The exterior dust cover was sooted; however, no mechanical damage was observed and the tape was successfully played back. The CVR recording consisted of four channels of good quality51 audio information: one channel contained audio information recorded by the cockpit area microphone, and the other three channels contained audio information recorded through the radio/intercom audio panels at the captain, first officer, and flight engineer positions. The CVR records incoming and outgoing radio transmissions and “hot” microphone52 signals from the pilots’ headsets through these audio panels. The recording began about 0505:14 and ended at 0537:26.2, after it recorded a series of crunching sounds. A transcript was prepared of the entire 32-minute, 12-second recording. See appendix B for a complete transcript of the CVR recording. 1.11.1.1 CVR Sound Study During the review and transcription of the CVR, investigators noted unusual breathing sounds on the first officer’s CVR channel (as captured by his “hot,” or boom, microphone) during the last 20 minutes of the CVR recording.53 The Safety Board conducted a study to document, characterize, and measure the breathing sounds recorded on the first officer’s channel. The Board’s study and associated research indicated that the first officer’s breathing rate during that 20-minute period (on average, 30 breaths per 50 Fairchild is now known as L3 Communications. 51 The Safety Board uses the following categories to classify the levels of CVR recording quality: excellent, good, fair, poor, and unusable. A good quality recording is one in which most of the crew conversations could be accurately and easily understood. The transcript that was developed may indicate several words or phrases that were not intelligible. Any loss in the transcript can be attributed to minor technical deficiencies or momentary dropouts in the recording system or to a large number of simultaneous cockpit/radio transmissions that obscure each other. 52 A “hot” microphone is always on and is being recorded by the CVR, whether or not a radio transmission is being made. According to the CVR Group Chairman’s Factual Report, it appeared that hot microphones were used by all three crewmembers throughout most of the recording. 53 Although it is somewhat unusual to hear breathing on a CVR recording, it is not unprecedented; Safety Board investigators have noted sounds similar to breaths on CVR transcripts before. For example, see National Transportation Safety Board, USAir Flight 427, Boeing 737-300, N513AU, Uncontrolled Descent and Collision With Terrain, Near Aliquippa, Pennsylvania, September 8, 1994, Aircraft Accident Report NTSB/AAR-99/01 (Washington, DC: NTSB, 1999).

Factual Information 27 Aircraft Accident Report minute [bpm]) was higher than normal (about 12 to 20 bpm, according to some research54) but was within the range of normal breathing for studies involving high stress situations.55 The Safety Board’s CVR sound study also revealed several instances of a pattern in the first officer’s breathing that was characterized by a series of breath sounds with progressively increasing relative loudness (and in at least one case, duration) that were followed by a series of breath sounds with progressively decreasing relative loudness. It was not possible to determine whether this effect was the result of actual changes in depth of breathing or some other phenomenon.56 1.11.2 Flight Data Recorder The FDR was a solid state Universal Flight Data Recorder, part number 980-4120-KXUS, S/N 2343, that recorded 60 parameters of airplane flight information in a digital format using solid-state flash memory. The FDR was recovered in good condition, and more than 27 hours of data were successfully downloaded. The recorded parameters included altitude; airspeed; magnetic heading; control column, control wheel, and rudder pedal position; left aileron, horizontal stabilizer, and right and left elevator and rudder surface positions; trailing- and leading-edge flap and slat positions on both wings; vertical, lateral, and longitudinal acceleration; pitch and roll attitude; and EPR for all three engines. 1.12 Wreckage Recovery and Documentation Information The wreckage path extended over a distance of about 2,094 feet, from the airplane’s first impact with trees about 3,650 feet from the approach end of runway 9 to the site where the main airplane wreckage (fuselage, left wing, and tail section) came to rest, about 1,556 feet west-southwest of the approach end of runway 9. The airplane came to rest oriented on a heading of 260° (about 170° from the easterly inbound course for runway 9). The airplane first impacted trees about 50 feet above the ground. A swath of 54 J.A.Veltman, “A Comparative Study of Psychophysiological Reactions During Simulator and Real Flight,” Int J Aviat Psychol Vol. 12, No. 1 (Jan 2002): 33-48. The maximum breathing rate observed in this study was 21 bpm. Other research data showed the average breathing rate of F-4 pilots during air-to-ground missions was between 17 and 19 bpm. See also, R.L. DeHart, Fundamentals of Aerospace Medicine, 2nd ed. (Baltimore, MD: Williams & Wilkins, 1996). 55 M. Schedlowski and U.Tewes, “Physiological Arousal and Perception of Bodily State During Parachute Jumping,” Psychophysiology The Society for Psychophysiological Research, Inc. Vol. 29, No. 1 (1992): 95-103. 56 Research has shown that variations in depth of breathing similar in timing and shape to those observed in the Safety Board’s sound study were associated with hypoxia. See (a) T.S. Chadha, S. Birch, and M.A. Sackner, “Periodic Breathing Triggered by Hypoxia in Normal Awake Adults. Modification by Naloxone,” Chest Vol. 88, No. 1 (Jul 1985): 16-23. (b) K. Fumimoto, Y. Matsuzawa, K. Hirai, and others, “Irregular Nocturnal Breathing Patterns at High Altitude In Subjects Susceptible to High-Altitude Pulmonary Edema (HAPE): A Preliminary Study,” Aviation, Space, and Environmental Medicine Journal Vol. 60, No. 8 (Aug 1989): 786-91. Also, for additional information on hypoxia, see section 1.18.1.

Factual Information 28 Aircraft Accident Report broken trees continued to the edge of the wooded area (about 1,130 feet from the initial impact), where the trees on the right and left sides of the swath were broken at 7.9 feet and 31.7 feet, respectively. (Figure 7 shows the swath of damaged trees, looking from east to west, with the first ground scars and airplane wreckage in the foreground.) Pieces of the right wing (including the right wing leading-edge flap, trailing-edge flap, wing tip, strobe light, flap jack screws, and slat tracks) were located in the wooded area. Figure 7. A swath of trees damaged by impact with FedEx flight 1478. The first evidence of ground impact was located near the edge of the wooded area, about 170 feet from open terrain. The ground scars continued in the open terrain, increasing in width from about 29 feet near the edge of the trees to about 120 feet near the main wreckage. There was evidence of fire along the wreckage path for about 800 feet leading to the main wreckage, which was destroyed by impact and postimpact fire. The forward fuselage was relatively intact but exhibited impact and fire damage, some of which was severe. The cockpit was severely damaged by fire, with melted and resolidified aluminum draped over the control wheels and pilot seats and the instrument panels destroyed. The lower overhead lighting panel was severely burned and damaged; however, examination revealed that the left and right inboard landing light switches appeared to be in the down, or “on,” position, and the left and right outboard landing light switches appeared to be in the up, or “off,” position. The taxi, navigation, and strobe light switches all appeared to be in the down, or “on,” position.57 The five left-side cockpit 57 According to the amplified before landing checklist contained in FedEx’s 727 CFM, pilots should “use inboard and outboard landing lights, runway turn off lights, and taxi lights for runway illumination during landing. If weather conditions dictate, turning landing lights on may be delayed until [the flying pilot] calls for them.”

Factual Information 29 Aircraft Accident Report windows exhibited fire damage but were intact; the left-side sliding window was open. One of the five right-side cockpit windows was intact but exhibited fire damage; the other four right-side windows were missing. A portion of the nose landing gear was separated from the fuselage and was found about 320 feet northeast of the main wreckage. The top of the fuselage over the cargo area was missing and believed to have been consumed by fire; adjacent fuselage side walls exhibited severe fire damage. The left wing remained attached to the fuselage and exhibited localized impact and fire damage. The right wing had separated and was severely fragmented, with pieces located throughout the wreckage path; most separated pieces of the right wing revealed no evidence of fire. One section of the right wing that exhibited severe fire damage was located near the main wreckage and included portions of the inboard upper and lower wing skins. A large section of the wing rear spar from the center wing tank was also found with fire damage in this area. The left main landing gear was found in the down and locked position and exhibited some soot and fire damage. The right main landing gear was separated from its attachment points and was located next to the right side of the fuselage; it showed evidence of impact and fire damage. The aft fuselage remained attached to the rest of the fuselage but exhibited severe fire and impact damage. The vertical stabilizer, rudder, and rudder trim tab were heavily sooted but remained attached to each other and the fuselage; these surfaces exhibited no evidence of impact damage. The left horizontal stabilizer, elevator, and elevator trim tab remained attached to each other and the vertical stabilizer; they were sooted and exhibited some impact damage. The right horizontal stabilizer, elevator, and elevator trim tab exhibited evidence of severe impact damage, and the outboard sections of these surfaces were separated from the main wreckage and located in the wooded area of the wreckage path. The separated sections of these surfaces showed impact damage but no fire damage, whereas those sections that remained with the aft fuselage exhibited fire and impact damage. The No. 1 engine remained attached to the fuselage, and the No. 2 and No. 3 engines were separated from the fuselage. Examination of the three engines revealed no evidence of preimpact malfunction; all three engines exhibited damage consistent with operation at impact. The impact- and fire-related damage to the airplane precluded the determination of flight control continuity. However, the Safety Board’s examination of the CVR and FDR information, the wreckage, and recovered cargo revealed no evidence of flight control or other system or structure malfunction before the airplane impacted the trees. Further, there was no evidence of preimpact smoke, fire, or fumes. The recovered hazardous materials packaging showed external sooting.

Factual Information 30 Aircraft Accident Report 1.13 Medical and Pathological Information 1.13.1 Toxicological Information Toxicological samples obtained from the captain, first officer, and flight engineer after they were admitted to the hospital emergency room were sent to the FAA’s Toxicology and Accident Research Laboratory in Oklahoma City, Oklahoma, for examination. The blood specimen collected from the captain tested negative for ethanol and a wide range of drugs, including drugs of abuse;58 however, the urine specimen collected from the captain tested positive for morphine (1.306 ug/ml) and acetaminophen (15.57 ug/ml). A review of emergency room hospital records indicated that the captain was administered morphine intravenously about 0640 as part of his postaccident medical treatment and that the urine specimen was collected from the captain about 0714. The blood and urine specimens collected from the first officer and flight engineer tested negative for ethanol and a wide range of drugs, including all drugs of abuse. 1.13.2 First Officer’s Color Vision Deficiency 1.13.2.1 First Officer’s Color Vision Deficiency History According to the first officer’s annual Navy medical reports, the first officer consistently demonstrated 20/20 or better near and distant visual acuity in both eyes without correction during his 16 years of Naval service. The records indicated that color vision testing was performed in conjunction with the pilot’s annual medical examinations by means of the Farnsworth Lantern (FALANT)59 test (the Navy’s primary color vision screen) and that the first officer consistently passed.60 The first officer told investigators that he never had a color vision problem in the Navy. However, during a July 24, 1995, evaluation for an FAA medical certificate,61 the first officer did not pass a color vision screen that was conducted using pseudoisochromatic 58 The drugs tested in the postaccident analysis include (but are not limited to) marijuana, cocaine, opiates, phencyclidine, amphetamines, benzodiazapines, barbiturates, antidepressants, antihistamines, meprobamate, and methaqualone. 59 The FALANT is an FAA-acceptable color vision screening test for FAA pilot certification that is intended to identify (for exclusion) people with significant red-green color vision deficiency who are unable to name aviation (and other) signal lights correctly, while “passing” people with mild red-green vision deficiency. In this test, the applicant is asked to identify the color (red, green, or white) of two lights projected by the FALANT machine. The examinee must identify nine different light pairings. 60 The first officer’s military medical records indicate that he passed the Navy’s color vision test 13 times during his military career—10 times with a documented score of 9/9, 2 times with no documented score, and 1 time with the documented remark “passed-by history.” 61 According to 14 CFR Section 67.103(c), the eye standards for a first-class medical certificate include the “ability to perceive those colors necessary for the safe performance of airman duties.”

Factual Information 31 Aircraft Accident Report plates (PIP).62 The FAA-designated medical examiner who conducted the evaluation contacted the FAA’s Regional Flight Surgeon for advice and was told to issue the first officer’s medical certificate for use with a SODA for the color vision deficiency. In a July 25, 1995, letter to the Regional Flight Surgeon documenting their discussion, the medical examiner stated that the results of the first officer’s color vision screen indicated “a color vision loss on pseudoisochromatic plates, missing numbers 3, 4, 5, and 6. This suggests mild red-green defect. Per your instructions I gave him his certificate….Please notify me about any SODA number that he is issued.” The FAA issued a SODA on August 1, 1995, and, in a same-day letter to the first officer, the Regional Flight Surgeon stated, “based on your operational experience, I have determined that you are eligible for a first-class medical along with [a SODA] for defective color vision.” When the first officer obtained his most recent first-class medical, dated October 9, 2001, he was again issued the certificate with a SODA for the color vision deficiency. As a result of the Safety Board’s postaccident inquiry, on September 5, 2002, the FAA’s New England Regional Flight Surgeon wrote a letter to the FAA’s Recommendation and Quality Assurance Division (AAI-200) further describing the circumstances under which the first officer’s medical certificate and SODA were issued in July/August 1995. The letter stated that the medical examiner subsequently described the first officer’s flight experience and indicated that, although the first officer had not previously failed a color vision test, he had failed the PIP color vision test on the day of his evaluation. After some discussion, the Regional Flight Surgeon advised the medical examiner to issue a medical certificate with a SODA for the color vision deficiency to the first officer. According to the September 2002 letter, a review of FAA computer records indicated that an FAA medical examination of the first officer dated June 20, 1986,63 during which the FALANT color vision screen was administered, resulted in an indication of normal color vision. The letter indicated that, based on the first officer’s previous medical examination results and “operational experience as a Naval aviator…a decision was made to issue a SODA.” During postaccident interviews, the first officer’s wife told investigators that she vaguely remembered hearing about her husband’s color vision deficiency. She stated “I recall this was way back when he was in training for the Navy when this came up. I think it was like a blue/green problem…he was given a waiver for it.” When asked if the first officer’s color vision deficiency ever affected anything in his daily life (for example, did she or her daughters ever have to help him match articles of clothing), the first officer’s 62 PIPs used by the FAA for aeromedical certification are cards with colored spots or patterns that are selected and arranged such that individuals with normal color vision will see a number or figure. The examiner holds the plates about 30 inches in front of the applicant, who then has 3 seconds to identify the figure. There are several FAA-approved versions of the PIP color vision test, ranging from 14 to 38 plates and with different success criteria. For example, in the case of the 14-plate edition of the Ishihara PIP, no more than five errors are allowed on plates 1 through 11. 63 Upon request after this accident, the Safety Board received the first officer’s airman records from the FAA’s Civil Aerospace Medical Institute (the FAA’s national repository for airman medical certification data); these records showed consistent, periodic medical examinations dating from the first officer’s 1995 application for an FAA medical certificate to his most recent preaccident medical examination. Records maintained at the FAA’s Regional Office included evidence of the earlier (1986) medical examination.

Factual Information 32 Aircraft Accident Report wife responded, “no.” Further, the first officer told investigators that he never experienced any difficulty distinguishing red and white on PAPI or VASI (visual approach slope indicator) lights. 1.13.2.2 The FAA’s SODA Issuance and Requirements Title 14 CFR Section 67.401(a) states the following regarding special issuance of a medical certificate: At the discretion of the [FAA’s] Federal Air Surgeon, an authorization for Special Issuance of a Medical Certificate (Authorization), valid for a specified period, may be granted to a person who does not meet the provisions…of this part if the person shows to the satisfaction of the Federal Air Surgeon that the duties authorized by the class of medical certificate applied for can be performed without endangering public safety during the period in which the Authorization would be in force. The Federal Air Surgeon may authorize a special medical flight test, practical test, or medical evaluation for this purpose. Section 67.401(b) further states the following regarding issuance of a SODA: At the discretion of the Federal Air Surgeon, a Statement of Demonstrated Ability (SODA) may be granted, instead of an Authorization, to a person whose disqualifying condition is static or nonprogressive and who has been found capable of performing airman duties without endangering public safety. A SODA does not expire and authorizes a designated aviation medical examiner to issue a medical certificate of a specified class if the examiner finds that the condition described on its face has not adversely changed. According to Section 67.401(c): In granting an Authorization or SODA, the Federal Air Surgeon may consider the person's operational experience and any medical facts that may affect the ability of the person to perform airman duties including— (1) The combined effect on the person of failure to meet more than one requirement of this part; and (2) The prognosis derived from professional consideration of all available information regarding the person. According to the Guide for Aviation Medical Examiners (GAME) in effect in 1995 (when the first officer failed the PIP color vision screening test), “If an applicant fails to meet the color vision standard as interpreted above but is otherwise qualified, the Examiner may issue a medical certificate bearing the limitation: “Not valid for night flying or by color signal control.” The GAME also states the following regarding the process by which a color-vision-deficient applicant may be certificated: An applicant who holds a medical certificate bearing a color vision limitation may request reevaluation or special issuance. This request should be in writing and should be directed to the Aeromedical Certification Division, AAM-300. If the applicant can perform the color vision tasks, the FAA will issue a medical

Factual Information 33 Aircraft Accident Report certificate without limitation with a SODA. Demonstrating the ability to perform color vision tasks appropriate to the certificate applied for may entail a medical flight test or a signal light test. If a signal light test or medical flight test is required, the FAA will authorize the test. The signal light test may be given at any time during flight training. The medical flight test is most often required when an airman with borderline color vision wishes to upgrade a medical certificate.” Chapter 27 of FAA Order 8700.1, “General Aviation Operations Inspector’s Hand- book,” instructs FAA personnel to conduct the practical color signal light test, in part, as follows: 1) Accompany the applicant to an area approximately 1,000 feet from the light operator. a) Instruct the applicant to respond to each light by stating the light color shown within the 5-second interval when the light is displayed. b) Signal the light operator to begin the procedure. c) …record the color displayed and the applicant’s response. d) After a 3-minute interval, repeat the procedure until all three colors are shown. 2) Accompany the applicant to an area approximately 1,500 feet from the light operator and repeat the procedures outlined above. Be sure that all three colors have been displayed before completing the test. 3) Do not give the applicant any indication of the accuracy of his or her readings during the test. If the applicant does not call each color correctly while the light is being shown, the applicant has failed; however, continue until the test is completed. 4) An applicant who fails the signal light test during daylight hours may repeat the test at night. 5) Should the applicant fail the signal light test during daylight hours and at night, the restriction, “Not valid for flight by color signal control,” must be placed on both the replacement medical certificate and the new SODA. Chapter 27 of FAA Order 8700.1 also states that an applicant who fails a color vision screening test must “demonstrate…the ability to read aeronautical charts, including print in various sizes, colors, and typefaces…the ability to read aviation instruments, particularly those with colored limitation marks, especially marker beacon lights, warning lights...the…ability to see colored lights of other aircraft in the vicinity, runway approach lights…all color signal lights normally used in air traffic control.”64 64 According to FAA records, “a light gun signal test was administered to [the first officer] on February 24, 2004, in accordance with FAA Order 8700.1…[The first officer] successfully completed the test.” On the basis of his successful completion of this test, the first officer obtained a medical certificate without reference to color vision deficiency.

Factual Information 34 Aircraft Accident Report FAA database records indicate that the following SODAs were issued in 2002 (the most recent year for which data are available): • 1,576 first-class medical certificates were issued to applicants who failed an initial FAA-acceptable color vision screening test65 and subsequently successfully completed a practical color signal light test; 104 first-class medical certificates were issued to applicants who failed an initial FAA-acceptable color vision screening test and subsequently passed an alternate FAA-acceptable color vision screening test; 13 first-class medical certificates with restrictions were issued to applicants who failed an initial FAA-acceptable color vision screening test and passed a subsequent practical color signal light test; and 24 first-class medical certificates with restrictions were issued to applicants who failed an initial FAA-acceptable color vision screening test and a subsequent practical color signal light test administered in the daytime, then passed a subsequent practical color signal light test administered at night. • 984 second-class medical certificates were issued to applicants who failed an initial FAA-acceptable color vision screening test and subsequently successfully completed a practical color signal light test; 84 second-class medical certificates were issued to applicants who failed an initial FAA-acceptable color vision screening test and subsequently passed an alternate FAA-acceptable color vision screening test; 37 second-class medical certificates with restrictions were issued to applicants who failed an initial FAA-acceptable color vision screening test and a subsequent practical color signal light test; and 36 second-class medical certificates with restrictions were issued to applicants who failed an initial FAA-acceptable color vision screening test and a subsequent practical color signal light test administered in the daytime, then passed a subsequent practical color signal light test administered at night. • 3,851 third-class medical certificates were issued to applicants who failed an initial FAA-acceptable color vision screening test and subsequently successfully completed a practical color signal light test; 194 third-class medical certificates were issued to applicants who failed an initial FAA-acceptable color vision screening test and subsequently passed an alternate FAA-acceptable color vision screening test; 246 third-class medical certificates with restrictions were issued to applicants who failed an initial FAA-acceptable color vision screening test and a subsequent practical color signal light test; and 117 third-class medical certificates with restrictions were issued to applicants who failed an initial FAA-acceptable color vision screening test and a subsequent practical color signal light test administered in the daytime, then passed a subsequent practical color signal light test administered at night. 65 It was not possible to determine how many of the failed FAA-acceptable color vision screening tests were the FALANT test.

Factual Information 35 Aircraft Accident Report 1.13.2.3 Postaccident Color Vision Deficiency Tests/Information At the Safety Board’s request, the first officer completed an extensive postaccident ophthalmic evaluation at the U.S. Air Force School of Aerospace Medicine (USAFSAM) at Brooks City-Base in Texas. In a letter to the Safety Board dated March 28, 2003, the Chiefs of the Visual Electrodiagnostic Laboratory and the Aerospace Ophthalmology Branch at Brooks described the nine color vision tests66 conducted and their results. Subsequently, on September 30, 2003, the Board sent USAFSAM a letter containing follow-up questions. On November 5, 2003, the Board received a response from USAFSAM, which elaborated on the issues related to the first officer’s color vision deficiency.67 The March 28, 2003, letter stated, in part: During CV [color vision] testing, his oxygen saturation was recorded to be between 98-99% by pulse oxymeter….all test results were consistent with a congenital severe deuteranomaly.[68] This was based on the scores, symmetry, and consistency of his performance on a variety of red-green CV tests and ultimately was confirmed by two different anomaloscopes, performed by two independent examiners. [The first officer] did however “pass” the FALANT [test]. When developed, the FALANT was designed to pass about 30 [percent] of CV defectives (mild deficiencies), which were thought to be compatible with existing aviation tasks at the time. However, multiple studies of the FALANT indicate that it can misclassify even the most severe types of red-green CV deficiencies, and “pass” them….In [the first officer’s] case, it also appears that the FALANT did not correctly identify his CV deficiency throughout his entire Navy flying career, nor when administered here at the ACS [Aeromedical Consultation Service]….Thus, we conclude that [the first officer] has a severe congenital deuteranomaly and that this defect was not identified properly by the FALANT. This testing inconsistency with the FALANT has been previously documented in the literature. When a variety of CV tests were evaluated by NATO-RTO[69] and published in RTO Technical Report 16, “Operational Colour Vision in the Modern Aviation Environment” in 2001, the following observations were made. 66 Screening tests included tests commonly used for pilot certification and general color vision deficiency screening, including: PIP-I, PIP-II, PIP-III, FALANT, Farnsworth F2 plate, D-15, FM-100, Nagel anomaloscope and Spectrum Colour Vision Meter anomaloscope. The anomaloscope is a laboratory instrument used to classify color vision deficiencies with greater precision than can be obtained using the basic screening tests. For additional descriptions, see the March 28, 2003, letter in appendix C. 67 The Safety Board’s September 2003 follow-up letter and November 2003 response letter from USAFSAM are in appendix C. 68 A deuteranomaly is a common color vision deficiency, present in about 5 percent of the male population, in which the pigments in the eye that typically respond to the middle range of color wavelengths have a sensitivity shifted to longer wavelengths, resulting in different interpretation of color stimuli from color normal individuals. 69 NATO-RTO is the North Atlantic Treaty Organization—Research and Technology Organization.

Factual Information 36 Aircraft Accident Report “Even though lantern tests have been used for close to one hundred years, their validation and the availability of information on their reliability is almost nonexistent. The evaluation of most lantern tests and the failure rates associated with normals and CV defectives are either conflicting or simply insufficient. Test validation for this class of tests is both complicated and perhaps confusing. Cross validation of one lantern against another is confounded because of the differences in intensity, wavelength, target size, and test distances. “Validation of lantern tests by use of an anomaloscope has very rarely been attempted and cross correlations with plate tests has produced ambiguous results. In most cases, therefore, plate tests precede lantern tests with the notable exception of the U.S. Navy where the Farnsworth lantern was used exclusively during this period of time.” The March 2003 letter from USAFSAM further stated the following: We believe that the type and degree of [the first officer’s] congenital red-green defect could result in difficulties interpreting red-green and white signal lights that combine color and brightness, such as PAPIs and VASIs...it is possible in this case that the red lights of a PAPI could have been identified as ‘yellow’ at lower light levels or ‘white’ when the light was brighter. The USAFSAM letter concluded that the first officer’s “documented proficiency” suggested that he relied on “learned strategies” other than normal color vision to determine the airplane’s position when using the PAPI/VASI during an approach. In the November 2003 letter, the Chief of the USAFSAM Aerospace Ophthalmology Branch stated that the first officer’s color vision discrimination was impaired to an extent that would “limit him to very nearly a gray-blue-yellow world…we believe that he would definitely have had problems discriminating the PAPIs as they were designed because the red lights would not appear to be red at all, but…some other wavelength that would make them more indistinguishable from white.” The letter also stated that “it might be possible for someone with this type of [color vision] deficiency to use brightness differences between the white and red PAPI lights to help differentiate between them.” With respect to the FALANT screening test, the Chief of the USAFSAM Aerospace Ophthalmology Branch stated, “the FALANT was dropped as an official USAF air crew qualifying test in 1993.[70] It simply was not reliable and can misclassify [color vision] defectives. By design, it intentionally was supposed to only pass “mild” red-green [color vision] defectives, however, it can misclassify even moderate to severe [color vision] defectives and allow them to ‘pass’.” 70 According to the November 2003 letter from USAFSAM, the current Air Force color vision screening includes a single red/green PIP test in the field; if this screening test is passed, pilot applicants may advance to Medical Flight Screening at Brooks Air Force Base, where they are subject to four additional color vision tests (the PIP-I, PIP-II, PIP-III, and the F2 plate tests).

Factual Information 37 Aircraft Accident Report The Safety Board notes that, in 1993, the University of Melbourne’s Victorian College of Optometry conducted a study71 to determine the ability of subjects with color vision deficiencies to correctly perceive the colors of simulated PAPI lights for use as an indicator of similar perceptions in pilot applicants. The study indicated that in up to 29 percent of the cases, subjects with color vision deficiencies similar to the first officer’s mistakenly identified a red light signal as a white signal. According to the study, “this is a particularly dangerous error since confusing red with white may lead the pilot to reduce altitude when already too low.” The study concluded that “colour vision defective subjects, with some exceptions, have difficulty distinguishing a simple two colour red-white code when the stimuli simulate the lights used in PAPI” and recommended that “consideration should be given to replacing the Farnsworth lantern by the more modern Holmes Wright Type A lantern which is used to administer the aviation colour vision standard in the [United Kingdom].” Additionally, the Board notes that other research72 has shown that color vision deficiency can degrade the speed, as well as the accuracy, of color-related responses in operational settings. For example, a recent study found that subjects with red-green color vision deficiencies required about 30 percent more time to identify a red traffic signal than subjects with normal color vision. In addition, the study found that subjects with red-green color vision deficiencies misidentified a red signal as “yellow” more often than subjects with normal color vision.73 The Safety Board is aware of instances in which pilots who have met medical certification standards were involved in accidents related to deficient color vision. For example, a U.S. Navy aircraft mishap involved a pilot who passed the FALANT screen but was involved in the loss of an aircraft due to his failure to correctly interpret the color navigation lights of airplanes in the area (leading to the false perception of an impending collision).74 In another case, a general aviation pilot with a medical waiver for red-green color vision deficiency was involved in an accident because he failed to recognize an orange-colored warning barrier indicating a closed runway.75 In addition, the Safety Board has observed color vision deficiency-related issues in other transportation modes, including a February 1996 railroad accident in which the 71 B.L. Cole and J.D. Maddocks, A Simulation of PAPI Signals for Testing the Colour Vision of Applicants for a Pilot’s License, Final Report of an investigation undertaken for the Civil Aviation Authority. Victorian College of Optometry, University of Melbourne, Australia, November 1993. 72 See H.W. Mertens and N.J. Milburn, “Performance of Color-Dependent Air Traffic Control Tasks as a Function of Color Vision Deficiency,” Aviation, Space, and Environmental Medicine Vol. 67, No. 10 (1996): 919-927. 73 See D.A. Atchison, C.A. Pedersen, S.J. Dain, and J.M. Wood, “Traffic Signal Color Recognition is a Problem for Both Protan and Deutan Dolor-Vision Deficients” Human Factors Vol. 45, No. 3 (2003): 495-503. 74 A post-mishap ophthalmological evaluation indicated that the pilot was severely color deficient. See Department of the Navy, Office of the Judge Advocate General, “Investigation into the circumstances surrounding the loss of an F-4J aircraft, which occurred on 5 August 1980 aboard NAS Cubi Point, R.P.” 75 The description for this accident, CHI92LA259, can be found at the Safety Board’s Web site at http://www.ntsb.gov. The report on this accident did not contain additional information regarding the pilot’s color vision screening test that identified the pilot’s deficiency, nor did it address the basis for the SODA/waiver.

Factual Information 38 Aircraft Accident Report Board determined that the train engineer failed “to perceive correctly a red signal aspect because of his diabetic eye disease and resulting color vision deficiency, which he failed to report…during annual medical examinations.”76 As a result of one of the Board’s safety recommendations in this case (R-97-001, which was classified “Closed—Acceptable Action” on July 14, 2000), the color vision testing standards within the rail industry were revised to be consistent with the FAA color vision standards. 1.13.3 First Officer’s Postaccident Hospitalization Information Following the accident, the first officer was treated at a local (Tallahassee) hospital from July 26 to August 8, 2002. The hospital’s records documented significant chest injuries, hypoxemia (decreased blood oxygenation), and right lower lobe lung consolidation throughout the hospitalization. The records also indicated that, when he was admitted to the hospital, the first officer’s breathing rate was 16 bpm (while receiving 10 liters of 100 percent oxygen through a non-rebreather mask and before he received pain medications). After the first officer was discharged from the hospital in Tallahassee on August 8, he traveled to his home in Maine, where he was subsequently hospitalized from August 10 to 23, 2002. This hospital’s records documented an infection surrounding the first officer’s right lung, a small tear in his left hemidiaphragm, and a large right pulmonary embolus and bilateral small pulmonary emboli, which were treated with anticoagulation medications. The Safety Board consulted with the head of the Cardiopulmonary Division of the Duke University Medical Center Department of Radiology regarding the first officer’s injuries and condition, based on documentation obtained from both hospitals. After reviewing the radiographs from the first officer’s first postaccident hospitalization (in Tallahassee), the radiology consultant noted that although “[o]n one image [obtained July 31, 2002] the possibility of central filling defect in one of the right upper lobe vessels is raised…there is insufficient evidence to make a determination…that a pulmonary embolism is present or absent.” After his subsequent review of the documentation from the first officer’s second postaccident hospitalization (in Maine), the radiology consultant stated the following: Having reviewed a pulmonary embolism protocol CT [computed tomography] scan performed on [the first officer] on [August 16, 2002], I believe it is possible that a small filling defect seen in one of the right upper lobe pulmonary arteries on the previous CT scan of [July 31, 2002] may in fact have represented a small pulmonary embolus. This interpretation is made only in retrospect. A pulmonary embolus is usually the result of a blood clot in a deep vein in the leg (known as deep vein thrombosis) that breaks off, travels to the lungs, and blocks one or 76 See National Transportation Safety Board, Near Head-on Collision and Derailment of Two New Jersey Commuter Trains Near Secaucus, New Jersey, February 9, 1996, Railroad Accident Report NTSB/RAR-97/01 (Washington, DC: NTSB, 1997).

Factual Information 39 Aircraft Accident Report more of the arteries in the lungs. Studies indicate that, in most cases, pulmonary emboli result in no symptoms77 and are detected during autopsies in more than half of the people who die during hospitalization.78 Studies of patients with known pulmonary embolism indicate that more than 90 percent exhibit breathing rates greater than 16 bpm, about 88 percent report chest pain, about 84 percent report difficulty breathing,79 and that hypoxemia is observed in about 75 percent.80 According to these studies, the most common predisposing factor for deep vein thrombosis in patients with pulmonary embolism is immobilization resulting from fractured extremities or trauma to a lower extremity. 1.14 Fire/Explosion A fuel-fed fire occurred after impact. 1.15 Survival Aspects The accident was survivable; the three flight crewmembers received serious injuries. According to postaccident interviews, the captain, first officer, and flight engineer exited the airplane through the left-side sliding window in the cockpit. 1.16 Tests and Research No technical tests or research were conducted. 1.17 Operational and Management Information Federal Express Corporation was incorporated in June 1971 and began operations on April 17, 1973, operating 14 corporate-type jet airplanes from the airline’s hub at MEM. After the deregulation of the air cargo industry in 1977, FedEx expanded and began using larger airplanes, including 727s and McDonnell-Douglas DC-10s, for its operations. In recent years, FedEx has added McDonnell-Douglas MD-11s and Airbus A-300s and 77 M.V. Huisman and others, “Unexpected High Prevalence of Silent Pulmonary Embolism in Patients With Deep Venous Thrombosis,” Chest Vol. 95 No. 3 (Mar 1989): 498-502. 78 M.T. Morrell and M.S. Dunnill, “The Post-Mortem Incidence of Pulmonary Embolism in a Hospital Population,” Br J Surg Vol. 55 No. 5 (May 1968): 347-352. 79 For additional information about breathing rate and chest pain in patients with pulmonary embolism, see W.R. Bell, T.L. Simon, and D.L. DeMets, “The Clinical Features of Submassive and Massive Pulmonary Emboli,” American Journal of Medicine Vol. 62 No. 3 (Mar 1977): 355-360. 80 P.D. Stein and others, “Clinical, Laboratory, Roentgenographic, and Electrocardiographic Findings in Patients Acute Pulmonary Embolism and No Pre-existing Cardiac or Pulmonary Disease,” Chest Vol. 100, No. 3 (Sep 1991): 598-603.

Factual Information 40 Aircraft Accident Report A-310s to its fleet. At the time of the accident, FedEx employed 4,256 pilots and operated 128 Boeing 727s. 1.17.1 FedEx Flight Crew Training—General According to FedEx’s Flight Operations Training Manual (FOTM) and postaccident interviews with FedEx training personnel, the FAA had approved single-visit training for annual recurrent training of FedEx pilots. However, as a result of some incidents and the October 17, 1999, FedEx accident in Subic Bay, Philippines,81 the company decided that semiannual training was more effective and elected to return to that schedule for its 727, DC-10, MD-11, and A-310 flight crews. The chief pilot stated that all 727 flight crewmembers received recurrent flight training at 6-month intervals, beginning 6 months after they qualified on a particular airplane. During every 12-month interval after qualification, a FedEx pilot would complete a proficiency training course in the simulator then, 6 months later, a recurrent ground training and a proficiency check in the simulator. According to the FedEx 727 Instructor Guide, annual CRM training was accomplished during the ground training before the proficiency check and would typically focus on one topic of interest (often related to recent aviation issues), such as night visual approaches, depth perception, black hole countermeasures, workload management, fatigue management, conflict management, “hurry-up” syndrome, decision-making in critical situations, flight deck distractions, and monitoring and challenging. The Safety Board reviewed FedEx’s training program/modules and other guidance the company provided its pilots in several potentially relevant subject areas, including: CFIT/black hole guidance, non-tower approaches, night visual approaches, stabilized approach criteria, and fatigue management. 1.17.1.1 FedEx CFIT Avoidance/Black Hole Guidance FedEx’s Flight Operations Manual (FOM) notes that the CFIT accident rate is 3 times greater at nighttime than during daylight hours and that, because many FedEx flights occur at night, a high percentage of FedEx flights would be at risk for a CFIT event. Therefore, FedEx developed a CFIT awareness training module, which it provided to its pilots during initial, upgrade, transition, and recurrent training sessions. This CFIT training identified flight crew factors involved in CFIT accidents, including poor decision-making, deviations from standard operating procedures, crewmember failure to challenge and monitor the performance of other crewmembers, lack of positional awareness, and flight-handling difficulties. FedEx flight crews were encouraged to identify CFIT risks before each approach, conduct thorough approach briefings, monitor each other’s performance, and reduce any hesitation associated with go-around maneuvers. 81 The description for this accident, DCA00RA002, can be found on the Safety Board’s Web site at http://www.ntsb.gov.

Factual Information 41 Aircraft Accident Report FedEx also evaluated the airports used by its airplanes based on factors known to contribute to CFIT accidents (including airport and ATC capabilities, instrument approach availability, surrounding terrain, runway and approach lighting, ATC primary language spoken, and published departure procedures). Airports judged to be high or moderate CFIT risks were identified as such on salmon-colored approach pages, which were then distributed to FedEx flight crewmembers. In addition, FedEx printed the CFIT risk category of destination airports on all flight releases. TLH was identified as a moderate CFIT risk airport because ATC and radar coverage were not always available, it had no published departure procedures, and an ILS was not installed on all runways, which could potentially result in a nonprecision approach. FedEx’s airport CFIT assessments were not runway specific. FedEx also developed a recurrent training module on black hole approach hazards, which explained that visual approaches over water or dark, featureless terrain could be hazardous because of poor and misleading cues for evaluating the airplane’s flightpath and height above the ground.82 Additional risk factors cited in FedEx’s training module included the airport’s location (for example, on the edge of a small city; at a lower elevation than a nearby city; or near city lights on a hillside) and the brightness and type of runway lighting available. The training indicated that, without additional glideslope information, a black hole approach would typically result in a lower-than-usual, or concave, approach. FedEx’s black hole approach training module encouraged pilots to consider the potential for black hole illusions at specific airports, to use all available glideslope information, to perform a thorough approach briefing addressing potential black hole approaches, and to ensure adequate cross-check and monitoring. The training also encouraged pilots to monitor the airplane’s glidepath using altitude and distance from the runway during nonprecision approaches and to monitor sink rate using the vertical speed indicator. The captain and flight engineer had not received FedEx’s CFIT avoidance/black hole training—in the captain’s case, because he underwent upgrade training instead of recurrent training in the years this training was presented and, in the flight engineer’s case, because the company had not offered that training module since he was hired in September 2001. The first officer had received FedEx’s most recent CFIT avoidance/black hole training during recurrent training in 1999. 82 According to chapter 8 of the FAA’s Aeronautical Information Manual (AIM) (8-1-5), dated February 21, 2002, “an absence of ground features, as when landing over…darkened areas, and terrain made featureless…can create the illusion that the aircraft is at a higher altitude than it actually is. The pilot who does not recognize this illusion…overflying terrain which has few lights to provide height cues may make a lower than normal approach.” In addition, the AIM states that upsloping runways at airports (for example, runway 9 at TLH) “can create the illusion that the aircraft is at a higher altitude than it actually is” with similar results. Research indicates that flying over featureless and unlit terrain can adversely affect a flight crew’s ability to maintain adequate clearance from terrain. (Also see (a) C.L. Kraft and D.L. Elworth, “Night Visual Approaches,” Boeing Airliner Magazine (Mar-Apr 1969) and (b) B. Schiff, “Black Hole Approach,” Boeing Airliner Magazine (Jan-Mar 1994.)

Factual Information 42 Aircraft Accident Report 1.17.1.2 FedEx Non-Tower Approach Guidance and Procedures FedEx’s Operations Specifications regarding the company’s operations at airports without an operating control tower states the following: a) The certificate holder is authorized to conduct these operations, provided that the certificate holder determines that: 1) The airport is served by an authorized instrument approach procedure. 2) The airport has an approved source of weather [information]. 3) The airport has a suitable means for the pilot-in-command to acquire timely air traffic advisories and the status of airport services and facilities. 4) The facilities and services necessary to safely conduct IFR operations are available and operational at the time of a particular operation. FedEx’s training curriculum, chapter 6, “Non-operational Control Tower Arriv- als,” states the following: Operations into airports during hours when the control tower is closed are not permitted unless the flight crew possesses briefing information describing non-tower operations for that airport. Briefing information may be supplied as: Jepp[esen chart] insert Photocopy of information placed in trip folder Information relayed from [Global Operations Control] with authority of duty officer The briefing information contains the following: The method for obtaining current weather from an approved source. The Common Traffic Advisory Frequency (CTAF). Ramp personnel are an additional source of advisories during tower off-hours. The three accident flight crewmembers had received FedEx’s non-tower approach training.

Factual Information 43 Aircraft Accident Report 1.17.1.3 FedEx Visual Approach Guidance and Procedures According to the FedEx training program, FedEx pilots receive visual approach training during the advanced simulation training portion of initial new-hire, initial equipment, transition, and upgrade flight training. The three accident flight crewmembers had received FedEx’s visual approach training. FedEx’s January 9, 2004, addendum to its submission states the following regarding nighttime visual approach training: Federal Express trains all its pilots in the simulator on night visual approaches without the use of glideslope information. Crewmembers are expected to demonstrate they can utilize the proper ‘sight picture’ to discern and fly a safe visual approach at night. The first officer had successfully completed this training. The guidance contained in FedEx’s FOTM indicates that visual approaches would be accomplished during the simulator training periods. A review of the FedEx 727 Instructor Guide revealed the following: • The importance of getting the correct sight picture for landing cannot be over-emphasized. • Visual landings…maneuvers and procedures to be accomplished during the…simulator session. • A briefing item concerning non-tower arrival and departure operations…in the…simulator session. • A briefing containing information regarding visual approaches and visual descent points is given to pilots in transition/upgrade training. FedEx’s FOM indicates that during a straight-in visual approach, flight crews should “plan to be established on the extended centerline of the runway in use NO LATER than 4 [nautical miles] from the runway threshold.” Further, on page 7-1-7-2, the FOM states that the airplane should be established on final approach at a position and altitude such that it can be stabilized, with 30° flaps and on target airspeed, by the time it reaches 500 feet agl. The FOM states that at 500 feet agl, the “pilot not flying”83 must determine whether the airplane is stable (in which case, the crew continues the approach) or unstable (in which case, the crew should go-around). The FOM identifies the following common errors in a visual approach: poor airspeed control, poor altitude control, failure to stabilize the aircraft on a proper glidepath, late configuration (for example, excessive airspeed and altitude too close to the runway), and failure to correct to a proper glidepath. 83 According to FedEx’s lead instructor for CRM training, the CRM training department wanted to change the term “pilot not flying” to “pilot monitoring,” with corresponding changes in the company’s philosophy and training because the new term and focus would increase flight crew awareness of actively cross-checking functions/actions within the cockpit. The FAA has addressed this issue in its revised AC 120-71A, and, according to FedEx’s submission on this accident, some airlines have already incorporated the “pilot monitoring” concept.

Factual Information 44 Aircraft Accident Report The FedEx 727 Company Flight Manual (CFM), chapter 7, states the following regarding a stabilized final approach: “a typical stabilized final approach for a 3 degree glideslope, in no wind conditions, will be approximately 1 degree pitch, 700 [foot per minute rate of descent], Vapp (approach airspeed), and 3,000–3,500 pph of fuel flow.”84 According to FedEx check airmen, for the accident airplane and engines under conditions similar to those encountered during the accident approach, this fuel flow would likely correspond to EPR values between 1.30 and 1.45 (this estimate was supported by data supplied by representatives from P&W, the JT8D-15/15A engine manufacturer.) Chapter 7 of the FedEx 727 CFM also lists the callout and monitoring duties for the flying and non-flying pilots during a visual approach. According to this list, the non-flying pilot is to make a call—“stable” or “unstable go-around”—when the airplane descends through 500 feet. The non-flying pilot is also to advise the flying pilot of any deviations in airspeed (more than 5 knots off target airspeed below 1,000 feet), sink rate (no more than 1,000 fpm below 1,000 feet), and glideslope and localizer (if available) during the visual approach. Both flying and non-flying pilots are to announce visual cues as appropriate during a visual approach. 1.17.1.4 FedEx Stabilized Approach Criteria and Procedures According to Chapter 6 of FedEx’s FOM that was effective at the time of the accident, the stabilized approach corridor begins at 500 feet agl for airplanes that are cleared for a visual approach and at 1,000 feet agl for airplanes that are cleared for an instrument approach. The stabilized approach is defined as follows: • The aircraft must have landing gear down and locked; the flaps/slats must be in the final landing configuration. • The engines must be spooled-up[85] and steady at the proper approach setting. • The proper descent angle and rate of descent must be established and maintained. All available landing aids (ILS, VASI, PAPI, etc.) must be used. Non-precision approaches may require a slightly steeper angle until reaching the MDA (minimum descent altitude). • Airspeed must be stable and within the range of target speed (+/- 5 knots of target). Momentary and minor deviations are only tolerated if immediate corrections are made. The FOM emphasized that “the procedures and parameters listed above are not merely targets, THEY ARE MANDATORY CONDITIONS AND LIMITS. ANY DEVIATION OCCURRING AT OR BEYOND THE BEGINNING OF THE STABILIZED APPROACH CORRIDOR REQUIRES A MANDATORY GO-AROUND.” According to FedEx policy, “the decision to execute a go-around is both 84 The fuel flows identified in the FedEx 727 CFM applied to the 727-100 airplane. The FedEx Instructor Guide states that the fuel flows should be increased by 500 pph for the 727-200 airplane; all other parameters/conditions for a stabilized approach are the same. 85 The term “spooled up” would reflect the previously discussed engine power settings typical for a fully configured 727 on a stabilized approach—fuel flows of 3,000 to 3,500 pph, which would correspond to about 1.3 to 1.45 EPR.

Factual Information 45 Aircraft Accident Report prudent and encouraged anytime the outcome of an approach or landing becomes uncertain.” Further, chapter 6 of the FOM states the following, in part: The decision a pilot must make before descending below the minimum altitude for the approach is not a commitment to land. The operational decision to continue an approach using visual means must be based on information the pilot accumulates throughout the approach. Since many variables are involved, the final decision to commit to a landing is the captain’s and is primarily a judgment based on all relevant factors. When queried about FedEx’s criteria for a stabilized approach, the captain of flight 1478 told investigators, “If cleared for instrument approach—it has to be ‘spooled up,’ fully configured, on glidepath, at 1,000 feet [msl]. For a visual approach—‘spooled up,’ fully configured, on glidepath at 500 feet [msl].” He further stated that he believed the accident airplane performance was consistent with the criteria for a stabilized visual approach. 1.17.1.5 FedEx’s Fatigue Management Training and Other Fatigue-Related Information In response to several Safety Board recommendations, on September 8, 1995, the FAA revised AC 120-51D, Appendix 3, to encourage operators to provide pilots with “factual information about the detrimental effects of fatigue and strategies for avoiding and countering its effects” as part of an airline pilot training program,86 although such training is not required by current regulations. Research indicates that during a time period from about midnight to 0600, and especially between 0300 and 0500, there is a higher probability of flight crew errors and accidents because a pilot’s alertness and performance are degraded by fatigue.87 Another common effect observed in fatigue-related accidents is a tendency to continue an approach despite increased cues indicating a need to discontinue the approach.88 86 The inclusion of fatigue as a recommended training topic (within a CRM training curriculum) was made in response to Safety Board recommendations that the FAA require U.S. air carriers to provide fatigue countermeasure information to air crews in initial and recurrent training (Safety Recommendations A-94-5 and A-94-73 were classified “Closed—Acceptable Action” on January 16, 1996). 87 See T. Akerstedt, “Review Article: Shift Work and Disturbed Sleep/Wakefulness,” Sleep Medicine Reviews Vol. 2, No. 2 (1998): 117-128. 88 See (a) National Transportation Safety Board, Runway Overrun During Landing, American Airlines Flight 1420, McDonnell Douglas MD-82, N215AA, Little Rock, Arkansas, June 1, 1999, Aircraft Accident Report NTSB/AAR-01/02 (Washington, DC: NTSB, 2001). (b) National Transportation Safety Board, Controlled Flight Into Terrain, Korean Air Flight 801, Boeing 747-300, HL7468, Nimitz Hill, Guam, August 6, 1997, Aircraft Accident Report NTSB/AAR-00/01 (Washington, DC: NTSB, 2000). (c) National Transportation Safety Board, Uncontrolled Collision With Terrain, American International Airways Flight 808, Douglas DC-8-61, N814CK, U.S. Naval Air Station, Guantanamo Bay, Cuba, August 18, 1993, Aircraft Accident Report NTSB/AAR-94/04 (Washington, DC: NTSB, 1994). Additionally, the Board discussed fatigue in a 1994 safety study. See National Transportation Safety Board, A Review of Flightcrew-Involved, Major Accidents of U.S. Air Carriers, 1978 Through 1990, Safety Study NTSB/SS-94/01 (Washington, DC: NTSB, 1994).

Factual Information 46 Aircraft Accident Report In 1990, FedEx’s CRM instructors developed and implemented a 2-hour course on sleep and fatigue management,89 which was provided to all company pilots as recurrent training. The training addressed causes of fatigue, circadian rhythms, sleep loss, and the physical, social, emotional, and safety-related consequences of fatigue. This 2-hour course was also added to FedEx’s indoctrination course for all new hires. In addition, in 2000, FedEx CRM instructors distributed a fatigue management card to all FedEx pilots to be inserted in their Jeppesen approach binders. Additional company policies supporting the fatigue management training included the availability of sleep/nap rooms in operational areas and a policy allowing pilots to remove themselves from the flight schedule due to fatigue.90 According to a company representative, feedback from pilots about the fatigue training was very positive; the only criticism received was that some pilots wished the training occurred closer to when they actually started flying when it would have had greater operational relevance. In addition, discussions were held within the training department about reintroducing fatigue management as a recurrent topic for line pilots who were not exposed recently to this training. FedEx’s fatigue management training addressed suggested strategies for minimizing and managing fatigue in the home environment and during trips, including taking steps to prevent sleep interruptions, ensuring adequate rest before a trip, making sleep a priority during layovers, sleeping two or more times a day, developing a regular pre-sleep routine, using relaxation techniques, creating a good sleep environment, and maintaining healthy exercise and diet habits. The training also suggested the following strategies for in-flight management of fatigue: interact with other crewmembers, stretch, turn on cockpit lights, maintain a proper cockpit temperature, use caffeine, and/or take a nap (in coordination with other crewmembers). FedEx also encouraged its pilots to keep a sleep journal, study their circadian rhythms, and determine what strategies work best for them. Further, in its fatigue management training and in its formal company policy, FedEx encouraged pilots to “call in fatigued” if they were unable to get adequate rest. The agreement between FedEx and the FedEx pilots’ union stated the following regarding this policy: A pilot who is unable to operate his trip or a portion thereof due to fatigue shall notify [crew scheduling] immediately and shall be placed in sick leave status. A 89 According to FedEx training instructors, the fatigue segment was developed based on National Aeronautics and Space Administration (NASA) models, such as the NASA Ames Fatigue Management Training Module developed by NASA under FAA funding as a result of personal contacts and company participation in a NASA fatigue study. 90 This program is consistent with research literature advocating a comprehensive approach to fatigue management in operational settings, although this program did not incorporate all potential elements of such a comprehensive approach. For example, literature advocates developing technology in areas such as scheduling algorithms and monitoring the effectiveness of interventions. See M.R. Rosekind, P.H. Gander, K.B. Gregory, R.M. Smith, D.L. Miller, R. Oyng, L.L. Webbon, and J.M. Johnson, “Managing Fatigue in Operational Settings 2: An Integrated Approach,” Behavioral Medicine Vol. 21 (1996): 166-170.

Factual Information 47 Aircraft Accident Report fatigued pilot shall be compensated, and his sick leave account(s) shall be debited, for the…missed trip or portion thereof. The pilot shall automatically return from sick leave status at the scheduled conclusion of his trip unless the pilot notifies the Company…to continue his sick leave status. A pilot who is fatigued shall be considered to have an illness or injury. Nothing in this paragraph shall minimize a pilot’s responsibility to ensure that he has adequate rest prior to reporting for duty. During postaccident interviews, the first officer and flight engineer confirmed that they received fatigue management training at FedEx and described some of the strategies learned. The captain did not recall receiving formal fatigue management training but indicated that he had received “flyers” on the subject. The first officer stated, “I’ve flown very tired. I’ve never flown where I felt it was unsafe.” None of the three accident flight crewmembers had turned down a trip because of fatigue. 1.17.2 Postaccident FedEx Actions After this accident, FedEx incorporated several changes in its systems. For example, the company separated its quality assurance function from its training function and initiated a “standards check” on a new captain’s first flight after IOE. Additionally, to ensure that pilots do not select runways for expediency rather than safety, FedEx revised its FOM to provide specific direction regarding the type of approach and landing aids to be used by pilots when the destination airport’s tower is closed. The company’s stabilized approach criteria now requires pilots to ensure that the airplane is stabilized at 1,000 feet agl for both visual and instrument approaches to allow them more time to accomplish checklists and focus on the landing. FedEx also revised its practices to require that only airplanes equipped with operating enhanced GPWS (EGPWS) and traffic collision avoidance systems (TCAS) be dispatched to non-tower and high-CFIT-risk airports. Further, the company stated that it planned to have EGPWS and TCAS installed in all its airplanes by late 2004. The EGPWS provides an aural ground proximity warning based on global positioning system data rather than radio-altitude information used by the GPWS. However, the Safety Board’s evaluation of the EGPWS software available at the time of the accident indicated that it would not have resulted in a warning in this case because the airplane’s flightpath did not penetrate the warning envelope.91 As a result of this accident, the EGPWS manufacturer is developing an upgrade (expected to be approved in 2004) that would have provided the pilots involved in this accident with an aural warning about 19 seconds before the first sounds of impact were recorded by the CVR. 91 The manufacturer’s subsequent review supported the Safety Board’s evaluation.

Factual Information 48 Aircraft Accident Report 1.18 Additional Information 1.18.1 Hypoxia-Related Information Paragraph 8-1-2a of the FAA’s AIM defines hypoxia as “a state of oxygen deficiency in the body sufficient to impair functions of the brain and other organs.” The AIM states that “Although a deterioration in…vision occurs at a cabin altitude as low as 5,000 feet, other significant effects of hypoxia [impaired judgment, memory, alertness, etc.] do not occur in the normal healthy pilot below 12,000 feet.” Research92 also indicates that hypoxia can adversely affect color vision and that individuals with defective color vision can have substantially reduced color discrimination ability at mild levels of hypoxia (as might be expected in pilots operating at typical cabin altitudes). According to the Chief of the USAFSAM Aerospace Ophthalmology Branch, hypoxia could further degrade any residual red-green (white) hue discrimination ability that a severely deuteronomalous pilot might have, and lower levels of illumination would further degrade such a pilot’s ability to discern colors. 1.18.2 DOT Operator Fatigue Management Program The FAA recently participated (with other transportation modal administrations) in a Department of Transportation (DOT) Human Factors Coordinating Committee, which led the DOT’s Operator Fatigue Management Program effort to develop practical tools for use by individuals and industries to better maintain vigilance and alertness on the job. One such tool is a fatigue management reference guide.93 The reference guide was intended to provide basic information to operators in all transportation modes on how to develop an effective fatigue management program using available scientific evidence and best industry practices. For example, the reference guide notes that one of the important components of a fatigue management training program is its ongoing evaluation and refinement. Further, the guide suggests that conducting pilot surveys and monitoring objective safety data to refine existing programs are among the best procedures for such evaluation and refinement. In addition, the DOT program is developing additional 92 See (a) J.T. Ernest and A.E. Krill, “The Effect of Hypoxia on Visual Function. Psychophysical Studies,” Invest Ophthalmol. Vol. 10, No. 5 (May 1971): 323-8. (b) A.J. Vingrys and L.F. Garner, “The Effect of a Moderate Level of Hypoxia on Human Color Vision,” Doc Ophthalmol Vol. 66, No. 2 (Jun 1987): 171-85. (c) C. Bouquet and others, “Color Discrimination Under Chronic Hypoxic Conditions (Simulated Climb “Everest-Comex 97”),” Percept Mot Skills. Vol. 90, No. 1 (Feb 2000): 169-79. 93 U.S. Department of Transportation, (In draft-2003). Commercial Transportation Operator, Fatigue Management Reference. Washington, DC: DOT Research and Special Programs Administration. This work follows, in part, from previous Safety Board recommendations that the DOT develop and disseminate educational material for transportation industry personnel and management regarding shift work; work and rest schedule; and proper regimens of health, diet, and rest (Safety Recommendation I-89-2, which was classified “Closed—Acceptable Action” on May 25, 2001).

Factual Information 49 Aircraft Accident Report products for industry use (which are expected to become available in late 2004), including: • A Fatigue Management Reference Guide: a compendium of current science and practical information on approaches to fatigue management and countermeasure usage; • A Fatigue Model Validation Procedure: a practical and methodologically sound approach for validating output from fatigue modeling software being tailored for transportation application; • Work Schedule Representation and Analysis Software: a software tool to aid managers and schedulers in evaluating and designing ergonomic work schedules to promote on-duty alertness; • Program Evaluation Framework: a cross-modal fatigue management research logic model that provides a blueprint for evaluating current knowledge, information needs, and points of leverage between DOT agencies; and • Business Case Development Tool Suite: a documented methodology and supporting analytical tools to aid company safety managers in building a case for senior management support of fatigue management activities. Recent interviews with DOT personnel working on the fatigue management training program indicate that future efforts should involve setting up a multimodal pilot program to test the tools they are developing. DOT personnel indicated that the Federal Railroad Administration is beginning validation tests on some of these tools in operational settings within the railroad industry. 1.18.3 Crew Familiarity/Attention/Monitoring Information In a 1994 safety study of crew-related air carrier accidents,94 the Safety Board found that 84 percent of the reviewed accidents involved inadequate crew monitoring or challenging. Similarly, research conducted to support the Flight Safety Foundation’s Approach and Landing Accident Reduction (ALAR) efforts revealed that poor monitoring and cross-checking were involved in 63 percent of the reviewed approach and landing accidents.95 A 1998 National Aeronautics and Space Administration (NASA) research project of cockpit interruptions and distractions reviewed 107 Aviation Safety Reporting System reports to identify tasks that crews typically neglected at critical moments while attending to other tasks.96 It found that 69 percent of the neglected tasks involved either 94 NTSB/SS-94/01, 40-41. 95 R. Khatwa and R.L. Helmreich, “Analysis of Critical Factors During Approach and Landing Accidents and Normal Flight,” Killers in Aviation: FSF Task Force Presents Facts About Approach-and-Landing and Controlled-Flight-into-Terrain Accidents. Flight Safety Digest. (November— December 1998, January—February 1999). 96 K. Dismukes, G. Young, and R. Sumwalt, “Cockpit Interruptions and Distractions: Effective Management Requires a Careful Balancing Act,” ASRS Directline (December 1998).

Factual Information 50 Aircraft Accident Report failure to monitor the status or position of the airplane or failure to monitor the actions of the pilot flying or taxiing. The Safety Board notes that recent FAA guidance and industry actions emphasize the importance of careful crew monitoring. For example, in February 2003, the FAA revised AC 120-71A, “Standard Operating Procedures,” to describe the philosophy of and benefits to be derived from a “pilot monitoring” program. AC 120-71A notes that “operators should review existing standard operating procedures…and modify those that can detract from monitoring. AC 120-71A also indicates that several air carrier operators have changed the title of “pilot not flying” to “pilot monitoring” because it is more appropriately descriptive. According to the March 17, 2003, FedEx submission on this accident, the company currently uses the pilot monitoring concept for certain approaches and at least one other air carrier has completely incorporated the pilot monitoring concept into its system. Additionally, in January 2004, the FAA revised AC 120-51E, “Crew Resource Management Training,” to emphasize the critical role of the monitoring pilot. This AC states that the monitoring function is particularly essential during approach and landing when CFIT accidents are most common. The AC suggested that operators redistribute some of the workload items typically accomplished during the approach and landing phase to less demanding phases of flight when possible. According to the AC, this would allow crewmembers to focus more on monitoring airplane and crewmember performance during a critical phase of flight. FedEx’s lead CRM instructor suggested that changing the term “pilot not flying” to “pilot monitoring” would result in increased pilot awareness of the importance of the monitoring function. (Since this accident, FedEx has also developed a new human factors course that focuses on captain leadership and pilot monitoring skills.) Research indicates that a lack of crew familiarity can contribute to a flight crew’s failure to fly and monitor a stabilized approach. For example, in a study of major aviation accidents involving human performance issues, in which a large number of monitoring errors were observed, the Safety Board found that 73 percent of the accidents occurred on the first day that the captain and first officer had flown together; 44 percent occurred on the first flight leg.97 Simulator research supports this, showing that flight crews with recent operating experience together communicate more frequently overall and perform better at solving in-flight emergencies than those that did not (even when the latter crews had completed a long rest period not available to crews with recent operating experience).98 97 These percentages are substantially higher than would be expected by chance and draw attention to the importance of crew familiarity at preventing serious monitoring and other human performance errors. 98 H.C. Foushee, J.K. Lauber, M.M. Baetge, and D.B. Acomb, Crew Factors in Flight Operations: III. The Operational Significance of Exposure to Short-Haul Air Transport Operations. National Aeronautics and Space Administration, NASA Technical Memorandum 88322, August 1986.

Factual Information 51 Aircraft Accident Report Additionally, research shows that conscious attention can be highly selective and that people may not respond to important objects that may be plainly visible.99 For example, a simulator study found that pilots could become so engrossed in performing a landing using a heads-up display that some pilots failed to see that another airplane was blocking the runway.100 Similarly, accident data confirm that an air crew can respond to a visual illusion of airport distance and fail to use accurate PAPI information that is directly visible.101 Fatigue and high workload are both likely to increase selective attention and the likelihood of missing relevant information. 1.18.4 Previously Issued Safety Recommendations 1.18.4.1 CFIT-Related Safety Recommendation As a result of the August 1997 CFIT accident at Nimitz Hill, Guam,102 the Safety Board issued Safety Recommendation A-00-10, which recommended that the FAA do the following: Conduct or sponsor research to determine the most effective use of the monitored approach method and the maximum degree to which it can be safely used and then require air carriers to modify their procedures accordingly. Pending the results of the FAA’s research on use of the monitored approach method, on January 31, 2002, Safety Recommendation A-00-10 was classified, “Open— Acceptable Response.” 1.18.4.2 Fatigue-Related Safety Recommendations Since 1989, the Safety Board has issued more than 70 safety recommendations related to fatigue for all modes of transportation. In addition, human fatigue in transport operations has been included in the Board’s annual list of Most Wanted Transportation Safety Improvements since the list’s inception in September 1990. 99 (a) A. Mack, “Inattentional Blindness,” Current Directions in Psychological Science Vol. 12, No. 5 (2003): 180-184. (b) F.W. Hawkins, Human Factors in Flight (Aldershot, England: Ashgate Publishing Limited, 1997) 116. 100 R.F. Haines, “A Breakdown in Simultaneous Information Processing. In G. Obrecht & L.W. Stark (Eds.),” Presbyopia Research (New York: Plenum Press, 1991) 171-175. 101 See Transportation Safety Board of Canada (1996). Tail Strike on Landing, Canadian Airlines International, Boeing 767-375 C-FOCA, Halifax, Nova Scotia, 08 March 1996, Report A96A0035. 102 See National Transportation Safety Board, Controlled Flight Into Terrain, Korean Air Flight 801, Boeing 747-300, HL7468, Nimitz Hill, Guam, August 6, 1997, Aircraft Accident Report NTSB/AAR-00/01 (Washington, DC: NTSB, 2000).

Factual Information 52 Aircraft Accident Report In Safety Recommendation A-99-45, the Safety Board urged the FAA to: Establish within 2 years scientifically based hours-of-service regulations that set limits on hours of service, provide predictable work and rest schedules, and consider circadian rhythms and human sleep and rest requirements.[103] The FAA issued Notice of Proposed Rulemaking (NPRM) 95-18, “Flight Crewmember Duty Period Limitations, Flight Time Limitations and Rest Requirements,” in December 1995, published a notice of intent in the Federal Register to indicate the agency’s intent to enforce regulations concerning flight time limitations and rest requirements in June 1999, and indicated its intent to issue a supplemental NPRM in spring 2001 (no supplemental NPRM has been issued to date). However, in April 2001, the Safety Board indicated that it was frustrated by the FAA’s lack of progress concerning this safety issue and classified Safety Recommendation A-99-45 “Open—Unacceptable Response.” In October 2001, the Board reiterated Safety Recommendation A-99-45 in its final report on the American Airlines flight 1420 accident at Little Rock, Arkansas.104 103 See National Transportation Safety Board, Evaluation of U.S. Department of Transportation Efforts in the 1990s to Address Operator Fatigue, Safety Report NTSB/SR-99/01 (Washington, DC: NTSB, 2000). 104 National Transportation Safety Board, Runway Overrun During Landing, American Airlines Flight 1420, McDonnell Douglas MD-82, N215AA, Little Rock, Arkansas, June 1, 1999, Aircraft Accident Report NTSB/AAR-01/02 (Washington, DC: NTSB, 2001).

53 Aircraft Accident Report 2. Analysis 2.1 General The captain, first officer, and flight engineer possessed valid airman and medical certificates. The captain, first officer, and flight engineer had received the training and off-duty time prescribed by Federal regulations and company requirements. The accident airplane was properly certificated and maintained and was equipped and dispatched in accordance with applicable regulations and industry practices. There was no evidence of any preexisting powerplant, system, or structural failure. Cargo loading for the accident flight was routine; no cargo loading anomalies were observed, and the airplane was operating within prescribed center of gravity limits. Hazardous materials on board the airplane were not a factor in the accident. The accident airplane and its cargo were not factors in the accident. At the time of the accident, the winds were calm and visibility was unrestricted, with a forecast of a few clouds at or below 100 feet. The pilots reported that no significant meteorological conditions were present that adversely affected their visual approach to runway 9 at TLH; ground observers’ statements corroborated the pilots’ reports. Additionally, the Safety Board’s review of ATC information revealed no evidence of any ATC problems or issues related to the accident. Weather and ATC were not factors in the accident. Postaccident examination of the airport lighting for runway 9, including the PAPI lighting system (the only glidepath information available for runway 9) indicated that the airport lighting was capable of normal operation and had been activated by the pilots almost 3 minutes before the airplane began to impact the trees. During postaccident interviews, all three pilots reported observing red and white lights on the PAPI display, consistent with normal PAPI operation. Although the flight engineer and captain reported seeing a pink PAPI signal on one of the four PAPI lights at some time during the approach, they also reported seeing red and/or white lights (which would have provided appropriate glidepath guidance) at the same time.105 Investigators who examined the PAPI boxes during the on-scene investigation (including the NATCA representative and other members of the investigative team) noted no particle contamination or condensation on the PAPI lights, and the investigation developed no evidence to support the possibility of such contamination. The airport lighting systems, including the PAPI lights, were not a factor in the accident. 105 A pilot might observe a pink PAPI signal as a result of condensation on the PAPI lenses or briefly when the airplane is transiting the narrow zone between the red and white PAPI signals.

Analysis 54 Aircraft Accident Report This analysis will focus on the flight crewmembers’ decisions and performance— as a crew and individually—to consider why none of the three flight crewmembers recognized that the airplane was below the glidepath during about the last 40 seconds of the approach and responded accordingly. 2.2 The Accident Approach Postaccident interviews with the pilots and examination of the CVR and FDR data indicated that the en route portion of the accident flight from MEM to TLH was routine and that the pilots engaged in normal duties and discussions as the airplane neared TLH. CVR evidence indicated that although the flight crew originally planned to land on runway 27, when they were about 10 minutes from touchdown, they decided to land on runway 9 instead. According to the Safety Board’s airplane performance study, when the airplane became established on the final approach course about 2 1/2 miles from the approach end of runway 9, the PAPI lights would have shown a low indication (one white and three red lights). Almost immediately thereafter, the PAPI lights would have shown a very low indication (four red lights), which would have been viewable from the cockpit for the remainder of the flight. As the airplane descended through 500 feet agl at 1,248 fpm, 152 knots, and with engines operating at about 1.17 EPR, the captain announced that the approach was “stable.” The Safety Board notes that, although the airplane’s airspeed was within the target range, the airplane did not meet FedEx’s criteria for a stabilized approach because its rate of descent was greater than FedEx’s recommended 1,000 fpm,106 the engines’ power settings were less than the expected 1.3 to 1.45 EPR, and its glidepath was low as indicated by the PAPI light guidance. According to FedEx procedures at the time of the accident, if a visual approach was not stabilized when the airplane descended through 500 feet agl, the pilots were to perform a go-around. The Safety Board concludes that the accident approach was not stabilized as the airplane descended through 500 feet agl and that the pilots should have detected this and performed a go-around. As the pilots continued the approach, the flight engineer read the before landing checklist query items, with the captain responding, in accordance with FedEx procedures. About 0536:49, the CVR recorded the first officer commenting that he was going to have to stay a little higher or he was “gonna lose the end of the runway.” The airplane’s subsequent descent rate gradually decreased to about 960 fpm; however, the airplane remained significantly below the proper glidepath. FDR data showed that, shortly thereafter, the engine power began to increase further, reaching about 1.34 EPR about 0537:12. During this time, the captain stated that the runway was starting to “disappear…a little” but then said, “think we’ll be alright.” 106 As previously noted, the captain’s and first officer’s VSIs were not instantaneous—that is, the instruments displayed data that lagged behind the airplane’s actual rate of descent, which was derived from the FDR data. However, the manufacturer’s simulations indicated that the pilots’ VSIs would have displayed a rate of descent of at least 1,000 fpm when the airplane descended through 500 feet agl.

Analysis 55 Aircraft Accident Report In postaccident statements, the flight crew and ground observers indicated that there were no obstructions to visibility along the approach path. However, the comments made by the first officer (“gonna lose the end of the runway”) and captain (“disappear…a little”) suggest that they may have encountered a temporary obstruction to visibility (for example, clouds or mist) as they approached runway 9. If such an obstruction existed, it may also have obscured the PAPI lights. Although a temporary obstruction might help explain the flight crew’s failure to recognize the PAPI guidance while that obstruction was present, it does not explain why the three pilots failed to recognize the presence of four red PAPI lights throughout the rest of the approach. Further, according to FedEx procedures (and FAA regulations), if the approach end of the runway became obscured at any time during the visual approach, the pilots should have performed a go-around. The night visual approach to runway 9 at TLH was conducted over a protected national forest area that was devoid of ground lights or other visible references by which the pilots could judge their height above terrain. FedEx’s recurrent training module on black hole approaches, which the first officer received in 1999,107 warned that pilots conducting visual approaches at night over terrain with minimal visible ground features or lighting often perceive the airplane to be higher than its actual altitude. Research has shown that in situations like this, a pilot typically flies a lower-than-normal approach until the error starts to become apparent (usually about 2 to 3 miles from the runway), at which point the pilot takes corrective action. Indeed, on the night of the accident, the first officer did fly a concave approach, with a steeper-than-normal initial descent, which is characteristic of a black hole approach. However, in the case of the accident flight, the first officer did not modify the steepness of the approach path in time, and the airplane collided with trees and terrain. The Safety Board concludes that the approach to runway 9 at TLH (which was flown over unlighted terrain and in night visual conditions) resulted in black hole conditions, which likely contributed to the flight crew’s failure to properly perform the approach. However, the Safety Board also concludes that PAPI lights, such as those installed at runway 9 at TLH, are a recognized countermeasure for use in black hole conditions and should have been, but were not, effectively used to maintain an appropriate glidepath by the first officer (who was the flying pilot) or by the captain and flight engineer (who, under the principles of basic crew coordination, were in a position to receive this information and initiate a corrective response).108 107 FedEx records indicate that the captain and flight engineer had not received this training. In the captain’s case, he missed the black hole recurrent training module because he attended upgrade training instead. The flight engineer had not been with the company long enough to attend recurrent training. 108 The Safety Board also considered the possibility that the 0.4 percent upslope on the first third of runway 9 contributed to the flight crew’s low approach. The geometric appearance of upsloping runways can create the illusion that an airplane’s approach path is higher than desired, and a pilot might compensate by flying a lower-than-normal approach. However, in this case, the upslope was minor and only present for the first third of runway 9, and the remainder of the runway was a gradual downslope. Therefore, it is unlikely that the illusion created by the runway’s slight upslope contributed significantly to the pilots’ failure to maintain the correct glidepath.

Analysis 56 Aircraft Accident Report 2.3 Fatigue Research109 on human alertness has shown that the early morning hours are often associated with degraded alertness and performance; the accident occurred about 0537 local time (0437 in the flight crew’s domicile time zone). However, because FedEx conducted most of its 727 domestic operations overnight, operating at these hours was likely a normal occurrence for the flight crew. Therefore, the Safety Board evaluated each flight crewmember’s performance during the accident flight and their specific activities and sleeping history in the days before the accident for evidence of routine,110 and especially nonroutine, factors conducive to the development of fatigue. 2.3.1 Role of Fatigue—Captain The Safety Board’s examination of the captain’s sleep history revealed evidence of a sleep deficit. The captain was off duty from about midnight on July 24 until the accident flight. However, he described his sleep during the two nights preceding the accident trip as “not really good” or “marginal” because his sleep was interrupted to take care of the family dog. The captain stated that after he learned that he was assigned to the accident trip, he got about 3 1/2 hours of “pretty good” sleep. The CVR recording revealed that the captain made several small errors during the accident flight that suggest he may not have been fully alert. These errors included incorrect readback of the radio frequency, incorrect repetition of weather information, incorrectly addressing Jacksonville Center as Atlanta Center (twice), and repeatedly clicking the microphone button five and six times to activate the airport lighting (rather than the seven times requested by the first officer).111 These errors were not consistent with other pilots’ statements regarding the captain’s performance on previous flights, which described his competence, use of standard FedEx procedures and callouts, good judgment, upbeat nature, and good CRM skills. Further, there was no evidence of previous deficient performance in the captain’s training or operational history. Further, the captain’s decision-making and monitoring during the approach were not characteristic of his past performance. For example, although CVR evidence indicated that the captain initially planned to land on runway 27 because it had an ILS and was more convenient to the FedEx ramp, he agreed to land on runway 9 to accommodate the first officer’s suggestion. When the first officer subsequently began to reconsider his runway selection, the captain said, “yeah, it dudn’t matter.” The captain’s apparent indifference about the landing runway and the ultimate decision to change to a runway that did not 109 See T. Akerstedt, “Review Article: Shift Work and Disturbed Sleep/Wakefulness,” Sleep Medicine Reviews Vol. 2, No. 2 (1998): 117-128. 110 The Safety Board notes that information regarding the flight crewmembers’ activities and sleeping history in the days before the accident was obtained from postaccident pilot and witness statements. 111 Keying the microphone five or six times would result in medium intensity runway lights rather than high intensity runway lights but would not have affected the PAPI brightness/intensity. It is unlikely that this adversely affected the flight crew’s performance of the approach.

Analysis 57 Aircraft Accident Report have a source of precision vertical guidance and provided little advantage over the originally selected runway suggests that the captain’s decision-making may have been degraded. Additionally, although CVR evidence revealed instances in which the captain appeared to be monitoring the first officer’s performance, the captain declared the approach “stable” when the airplane descended through 500 feet, despite the airplane’s excessive descent rate and reduced engine power settings. Most significantly, the captain failed to observe and respond to the four red PAPI lights that were displayed throughout most of the final approach. Any one of these items should have prompted the captain to call for a go-around. Many of the small errors made by the captain and his deficient performance during the approach to TLH were consistent with fatigue. Research and previous accident investigation experience indicate that fatigue can cause pilots to fixate on one aspect of a situation and not respond effectively to warnings from other aspects, such as a stickshaker, GPWS, or visual warnings. Further, one of the common deficiencies observed in fatigue-related accidents is a tendency to continue an approach despite indications that the approach should be discontinued. This fatigue-related performance inertia is evidenced by decision-making and monitoring deficiencies. The Safety Board notes that during the accident approach, there was not much evidence of substantive evaluation or discussion of the consequences of the decision to change the landing runway to runway 9. For an experienced captain to support a decision to change landing runways (when it substantially increased cockpit workload late in the approach and removed a potentially critical source of glideslope guidance) suggests degraded decision-making consistent with the effects of fatigue.112 Therefore, on the basis of the early hour of the accident, the captain’s sleep history, and his performance deficiencies recorded by the CVR, the Safety Board concludes that the captain was likely impaired by fatigue and this impairment contributed to his degraded performance (especially in the areas of crew coordination and monitoring) during the approach to TLH. 2.3.2 Role of Fatigue—First Officer The Safety Board’s review of crew interviews and the first officer’s sleep history revealed that he reported having difficulty adjusting his sleep cycle to the reserve-duty schedule. The first officer told investigators that this was the first reserve schedule he had flown in several years and that it was difficult on his body because the sleep-wake cycle was frequently changing between day and night sleeping schedules. He stated that he normally preferred to bid schedules that allowed either all-day or all-night sleep periods over 1-week blocks. 112 For a similar example of inappropriate landing runway choice caused by fatigue, see National Transportation Safety Board, Uncontrolled Collision With Terrain, American International Airways Flight 808, Douglas DC-8-61, N814CK, U.S. Naval Air Station, Guantanamo Bay, Cuba, August 18, 1993, Aircraft Accident Report NTSB/AAR-94/04 (Washington, DC: NTSB, 1994).

Analysis 58 Aircraft Accident Report On July 23, the first officer flew an early morning trip that began about 0330 and ended about 1100. Upon completion of this trip, he slept several hours during the day and slept again that night. The first officer was off-duty the next day (July 24). He stated that he awoke about 0930 to 1030 and went to sleep about 2100, sleeping for a few hours in preparation for a trip that was scheduled to begin about 0230 on July 25. When he completed the trip about 0830, the first officer got several hours of sleep during the day in the layover hotel. He characterized the quality of sleep as “no better or worse than most day sleeps.” On the evening of July 25, he returned to duty, flew several legs, and arrived at MEM about 2300 expecting to return home. Instead, he learned that he was assigned to fly the accident trip in a few hours. The first officer contacted a duty officer to confirm that the trip assignment did not result in his exceeding flight and duty time limits and agreed to fly the trip.113 The first officer got about 1 1/2 hours of “good” sleep in a company sleep room before starting the accident trip. When asked whether he felt alert, he stated, “I don’t recall feeling alert.” A friend and roommate stated that the first officer “appeared tired” as he waited for the crew bus to take him to MEM for the accident trip. The accident captain stated that he had an impression that the first officer “might be a little tired” and stated that the first officer discussed the rest difficulties of his reserve schedule. During the accident flight, the first officer’s performance was deficient in ways that appear inconsistent with characterizations of his past performance, including his failure to request 30° of flaps until he was prompted to do so by the captain, his failure to “stay a little higher” on the approach (as he noted would be necessary to avoid losing the runway), his failure to maintain appropriate engine EPR settings during the approach, and his failure to respond to PAPI guidance that indicated the airplane was extremely low on the approach. Further, the first officer did not recognize these deficiencies and decide to perform a go-around. The Safety Board notes that there were times during the accident flight that the first officer’s performance was more consistent with characterizations of his past performance; for example, he provided a comprehensive briefing for the initially planned approach to runway 27, and he recognized his failure to correctly identify the airport. Although the first officer’s errors and occasionally deficient performance are consistent with the effects of fatigue, in the case of the failure to maintain an appropriate glidepath, the investigation revealed a potential alternate explanation. Specifically, there was evidence that the first officer’s ability to use PAPI information was limited by a congenital color vision deficiency (see section 2.4.1).114 Therefore, the Safety Board concludes that the first officer’s schedule and his reported difficulty adapting to frequently changing sleep cycles were conducive to the development of fatigue impairment that contributed to his degraded performance during the approach to TLH; however, there were also other factors affecting the first officer’s performance (for example, his color vision deficiency). 113 Although he agreed to take the accident trip, the first officer told investigators that he planned to file a grievance regarding the assignment. 114 In addition, his color vision deficiency may have been exacerbated by hypoxia (see section 2.4.2).

Analysis 59 Aircraft Accident Report 2.3.3 Role of Fatigue—Flight Engineer In the case of the flight engineer, there was little evidence of factors conducive to the development of fatigue in the days before the accident. He was off-duty on July 22 and 23 and reported resting at home with normal overnight sleeping and afternoon naps. On July 24, he reported on-duty at 2200 for a deadhead trip to MEM then departed MEM at 0230 on July 25, arriving at the layover destination about 0830. The flight engineer, who said that he began taking naps as a result of the company fatigue management training class, indicated that he got some rest on the deadhead flight and in a recliner chair at MEM before this trip and that he got “pretty solid” sleep in the layover hotel from 0900 to 1530. He returned to MEM the evening of July 25 and rested in a recliner chair with his eyes closed for 30 minutes to 1 hour before the accident trip. The flight engineer indicated that he felt “pretty rested” for the accident flight. During postaccident interviews, the captain stated that the flight engineer seemed to be alert during the accident flight. During the accident flight, the flight engineer provided the captain and first officer with pertinent weather and airport information and pertinent prompts (such as suggesting performance of the approach and before landing checklists). However, he failed to correct the captain’s inaccurate repetition of the weather information. More seriously, he failed to effectively monitor the airplane’s status during the final moments of descent as required by company procedures. This failure was inconsistent with other pilots’ descriptions of the flight engineer’s performance and his reputation with the company.115 However, it is possible that the flight engineer’s poor monitoring of the late stages of the approach was the result of his workload during the somewhat rushed approach,116 the presumption that the two forward-facing flight crewmembers were adequately monitoring the approach, or some combination of factors. Although the early hour at which the accident occurred suggests the presence of fatigue for all the crewmembers, the investigation indicated that the flight engineer received normal rest until 1 day before the accident trip, supplemented his nightly sleep with good quality sleep and rest at other times before the trip, and appeared to make an adequate adjustment to an overnight flying schedule in preparation for the accident flight. Further, there was no evidence of deficient performance that could be specifically related to fatigue during the accident flight. On the basis of this evidence, the Safety Board concludes that it is possible that the flight engineer was impaired by fatigue at the time of the accident; however, it is also possible that the flight engineer’s poor monitoring of the late stages of the approach was the result of his workload during the somewhat rushed approach, the presumption that the two forward-facing flight crewmembers were adequately monitoring the approach, or some combination of factors. 115 FedEx was evaluating the flight engineer for a check airman position. 116 Although the flight engineer told investigators that he did not feel rushed during the approach, the completion of the checklist just 7 seconds before the CVR recorded the first sounds of impact resulted in less time to focus his attention forward to monitor the final approach.

Analysis 60 Aircraft Accident Report 2.3.4 Fatigue Management Training The flight engineer said that as a result of the company fatigue management training class, he began taking naps to augment his nightly sleep. Both he and the first officer rested in the company sleep/nap areas before the accident trip. FedEx records indicated that the captain received fatigue management training during recurrent training in 1991, but he stated that he did not recall the training. Although the company’s policies allowed for it, the three accident crewmembers indicated that they had never turned down a trip due to fatigue. The Safety Board notes that the FAA recently participated (with other transportation modal administrations) in a DOT Operator Fatigue Management Program effort to develop a fatigue management reference guide. The reference guide was intended to provide basic information to operators in all transportation modes on how to develop an effective fatigue management program using available scientific evidence and best industry practices. In addition, the DOT program is developing additional products for industry use (expected to become available in late 2004), such as software to aid in designing work schedules that promote alertness. Such products can provide useful guidelines and tools for companies that are willing to go beyond current regulations by developing and implementing a fatigue management program (like FedEx). Fatigue in transportation operations has been on the Safety Board’s list of most wanted safety recommendations since the list’s initiation in September 1990. In May 1999, the Board issued a safety report that concluded that, despite acknowledgement that fatigue is a significant factor in transportation accidents, little progress has been made to revise the hours-of-service regulations to incorporate the results of the latest research on fatigue and sleep issues. Thus, the Board issued Safety Recommendation A 99-45 in its report, asking the FAA to “establish within 2 years scientifically based hours-of-service regulations that set limits on hours of service, provide predictable work and rest schedules, and consider circadian rhythms and human sleep and rest requirements.” However, the FAA’s response to this recommendation has not been acceptable, and, in April 2001, Safety Recommendation A-99-45 was classified, “Open—Unacceptable Response.” The Safety Board concludes that the circumstances of this accident, in part, demonstrate the continuing need for fatigue management efforts similar to those being developed by the DOT Operator Fatigue Management Program in the aviation industry. 2.4 Physiological Issues That May Have Affected the First Officer’s Performance 2.4.1 The First Officer’s Color Vision Deficiency At the Safety Board’s request, the first officer completed an extensive postaccident ophthalmic evaluation at USAFSAM, which was intended to determine the extent of the color vision defect noted on his medical certificate and its possible significance during the

Analysis 61 Aircraft Accident Report approach to TLH. During this evaluation, the first officer passed the FALANT color vision screen but failed seven additional red/green color vision tests. The USAFSAM specialists’ report stated that the first officer had a severe congenital deuteranomaly that could result in “difficulties interpreting red-green and white signal lights.” The report also stated the following: We believe that he would definitely have had problems discriminating the PAPIs…because the red lights would appear not to be red at all, but…more indistinguishable from white than red….it would be extremely unlikely that he would be capable of seeing even the color pink on the PAPI…more likely a combination of whites and yellows and perhaps, not even that difference. The USAFSAM conclusions are supported by the results of an Australian study, which showed that individuals with color vision deficiencies similar to the first officer’s mistakenly identified the red light signal as white in up to 29 percent of the cases. The Safety Board notes that this error could be especially dangerous when interpreting a PAPI signal because it might lead a pilot to descend lower when the airplane is already too low. The Australian study recommended that “consideration should be given to replacing the Farnsworth lantern” as a color vision certification test for pilots. The specialists at USAFSAM reported that most individuals with color vision deficiencies develop an ability to “differentiate” between normal colors based on cues other than hue or wavelength, such as differences in shade or brightness. The length of the first officer’s military and civilian aviation career suggests that, in general, he had been able to compensate for his deficient color vision. However, during the approach to runway 9 at TLH, the first officer had to rely more heavily on his color vision because the PAPI lights were the only reliable source of glidepath information in the black hole approach environment leading to runway 9. The first officer’s interpretation of the PAPI lights would have been even more challenging because all four lights were red during most of the final approach. As a result, there would have been no differing levels of brightness for the first officer to perceive across the lights (as might have been apparent if both white and red PAPI lights were visible), nor would there have been a change in brightness to observe (as there might have been when a PAPI light transitioned from white to red during the descent). Either of these would likely have assisted the first officer’s color interpretation. It is possible that the first officer interpreted the uniform PAPI light indications as “white” because that was consistent with available visual indications (for example, the black hole illusion and the slight runway upgrade) that would lead him to perceive that the airplane was higher on the approach than it was. Such an interpretation would be consistent with the first officer’s conduct of earlier portions of the approach, with occasionally excessive rates of descent and lower-than-normal engine power settings. However, just after the airplane descended through 500 feet agl, the first officer stated, “(I’m) gonna have to stay just a little bit higher, (or) I’m gonna lose the end of the runway.” About this time, the FDR data indicated that the airplane’s descent rate began to decrease from about 1,400 to 900, then to 500 fpm. It was not clear exactly why the first officer moderated the descent rate at this time; however, it is possible that he was trying to

Analysis 62 Aircraft Accident Report reconcile a conflict between the 500-foot GPWS callout and a mistaken illusion of the airplane’s elevation above the field. The Safety Board considers it unlikely that the first officer made this moderate reduction in the airplane’s descent rate because he recognized the PAPI indication of four red lights; recognition of four red PAPI lights at such a late stage in the approach should have resulted in a more aggressive response (such as an immediate climb or a go-around). As previously discussed, the Safety Board is aware of other instances in which pilots with valid medical certificates were involved in accidents related to deficient color vision, including a U.S. Navy pilot who had passed the FALANT screen and a general aviation pilot operating with a waiver for color vision deficiency. In addition, the Safety Board has observed color vision deficiency-related issues in other transportation modes. It is apparent that in some situations, accurate color vision may be critical to a degree that is not currently reflected in the application of the aviation medical certification standards,117 specifically in those situations in which color discrimination capabilities are critical to the safe execution of the task and there are no redundant cues to aid the discrimination. Based on the available evidence, the Safety Board concludes that the first officer suffered from a severe color vision deficiency that made it difficult for him to correctly identify the color of the PAPI signal during the below-glidepath, nighttime, visual approach to runway 9 at TLH.118 The Safety Board notes that current aviation medical certification standards for color vision and related screening tests do not emphasize the full complexity of color in modern operational situations, which include not only navigation lights, PAPI/VASI displays and light gun signals, but may also involve color cockpit displays, including weather radar, other flight instruments and gauges, and annunciator panels. Another possible shortcoming of current color vision certification standards and related screening tests is that they may not appropriately evaluate a pilot’s ability to rapidly discriminate among colors. Therefore, the Safety Board concludes that existing aviation medical certification standards for color vision and use of related screening tests may not ensure detection of color vision deficiencies that can be detrimental to safety; it is possible that in some emergency situations, the speed of color recognition may assume an importance that is not currently reflected in the standards. The Safety Board further notes that some color vision screening tests currently in use in the aviation industry are inadequate to confirm that a pilot has the “ability to perceive those colors necessary for the safe performance of airman duties” as required by the certification standards. For example, the FALANT screening test, which is an approved color vision screening method for aeromedical certification, failed to identify 117 FAA medical standards for color vision require that pilots at all levels of certification possess the “ability to perceive those colors necessary for the safe performance of airman duties.” 118 Another instance during the accident flight may provide an additional example of the first officer’s deficient color vision adversely affecting his ability to perform his duties. His initial mistaken identification of a flashing white light as the rotating beacon at TLH reflected his failure to discern the color properties (green and white) of an airport rotating beacon.

Analysis 63 Aircraft Accident Report the first officer’s severe color vision deficiency. In addition, according to the November 5, 2003, USAFSAM letter, other color vision tests (including the PIP) have failed to detect color vision deficiencies in pilot applicants. The letter indicated that the USAF now uses a battery of tests that it believes identifies all color vision deficiencies in applicants. FAA records indicate that there is a substantial pilot population who, like the first officer, have color vision deficiencies but successfully completed the FALANT or other color vision deficiency screening test. For example, during postaccident testing, the first officer successfully completed the FAA’s light gun signal test,119 and as a result, the first officer was issued a first-class medical with no restrictions, limitations, or SODAs. The high success rate of the light gun signal test among individuals who have previously failed another FAA-acceptable color vision screening test (about 95 percent) suggests that this test may not identify all the individuals with severe color deficiencies that could affect their ability to safely operate an aircraft. (The issuance of a color-vision-related SODA to the first officer on the basis of operational experience appears to fall outside current and past available written FAA guidelines regarding appropriate aeromedical disposition of an airman who fails a color vision test.) Further, it is likely that, in some circumstances, these color vision deficiencies may also result in unsafe conditions. Therefore, the Safety Board concludes that one or more of the color vision screening tests currently approved for use in the aviation industry (for example, the FALANT) are not adequate and that these tests should be identified and their use discontinued. The Safety Board believes that the FAA should conduct research to determine the effectiveness of each of the current FAA-approved color vision test protocols (including the color signal light test) at effectively screening out pilot applicants with color vision deficiencies that could impair their ability to perform color-related critical aviation tasks, including (but not limited to) correct interpretation of glideslope information and in-cockpit displays that use color to convey information. The research should take into account the time typically available to perform each task, particularly under emergency conditions, and the potential effect of mild hypoxia (as might occur at typical cabin altitudes) on color vision deficiencies. Further, the Safety Board believes that the FAA should, based on the results of the research requested in the previous recommendation, develop a standard battery of tests to be performed at least once on each applicant for a Class 1 or 2 medical certificate that would prevent applicants with color vision deficiencies that could impair their ability to perform color-related critical aviation tasks from being certificated without limitations. 2.4.2 The First Officer’s Breathing Rate The Safety Board examined the breathing sounds that were recorded by the first officer’s channel of the CVR to determine whether they reflected the presence of an acute medical condition, specifically a pulmonary embolus and resultant hypoxia. This issue is 119 Although operational use of light gun signals in the current aviation environment is very limited, the light gun signal test is still used by the FAA to establish a color-deficient individual's ability to use color operationally.

Analysis 64 Aircraft Accident Report significant because research120 indicates that any mild hypoxia could further degrade a pilot’s color vision (especially in pilots with existing color vision deficiencies) and affect his decision-making abilities. An elevated breathing rate, as evident on the CVR, is one symptom consistent with the diagnosis of this condition (although research shows that people suffering from pulmonary embolus are often asymptomatic); there was also some CVR evidence of breathing patterns consistent with those observed during hypoxia. CT scans taken within 5 days after the accident revealed possible indications of pulmonary embolus, the presence of which was later confirmed. Further, the first officer’s reported knee injury in the weeks before the accident and his subsequent efforts to minimize movement of the injured limb could have been an initiating event for the development of deep vein thrombosis, a precursor to a pulmonary embolism. The rapid breathing rate recorded by the CVR during the last 20 minutes of the accident flight is not sufficient evidence, when considered by itself, of pulmonary embolus and resultant hypoxia. The first officer reported that he experienced no signs of distress, pain, or difficulty breathing (potential symptoms of a pulmonary embolus) before the accident. Further, there was no diagnosis of a pulmonary embolus or other physiological abnormality immediately after the accident. Because there was no definitive evidence to support the presence of a pulmonary embolus at the time of the accident, it was not possible to determine whether the first officer was suffering from a pulmonary embolus and resultant hypoxia at the time of the accident. The Safety Board was not able to determine the cause of the elevated breathing rates recorded on the first officer’s CVR channel. 2.5 Crew Coordination/Monitoring Information Contrary to FedEx standard operating procedures and training, the flight crew did not work together effectively to fly and monitor a stabilized approach into TLH. There was no evidence to suggest that the deficient crew coordination was a characteristic pattern of performance for these three crewmembers (a review of company records and interviews with other pilots generated positive and complimentary descriptions about their abilities). Yet, the captain and flight engineer failed to recognize the solid red PAPI display (although there was no evidence that either had deficient color vision) and take action to correct the low approach. This failure might partially be the result of their accomplishment of tasks that required their attention inside the cockpit, such as those involved in completing the landing checklist. However, it would be normal and expected for both the captain and flight engineer to monitor the runway environment at other times during the final landing sequence, and it is difficult to understand why no one reacted to the visually salient PAPI information. 120 See (a) J.T. Ernest and A.E. Krill, “The Effect of Hypoxia on Visual Function. Psychophysical Studies,” Invest Ophthalmol Vol. 10, No. 5 (May 1971): 323-8. (b) A.J. Vingrys and L.F. Garner, “The Effect of a Moderate Level of Hypoxia on Human Color Vision,” Doc Ophthalmol Vol. 66, No. 2 (Jun 1987): 171-85. (c) C. Bouquet and others, “Color Discrimination Under Chronic Hypoxic Conditions (Simulated Climb “Everest-Comex 97”),” Percept Mot Skills Vol. 90, No. 1 (Feb 2000): 169-79.

Analysis 65 Aircraft Accident Report Research shows that attention can be highly selective and that people may not respond to important objects that may be plainly visible.121 For example, a simulator study found that some pilots became so engrossed in performing a landing using a heads-up display that they failed to see an airplane blocking the end of the runway. Similarly, accident data confirm that an air crew can respond to a visual illusion of airport distance and fail to use accurate PAPI information that is directly visible. Fatigue and high workload are both likely to increase the possibility of missing relevant information. If the captain and flight engineer monitored the runway environment during the final approach and if the PAPI signal was visible without obstruction, inappropriate selective attention could help explain the failure of both crewmembers to respond to the PAPI information. The actions of the captain and first officer added to the complexity of the final approach and the need for careful monitoring by the flight engineer. For example, the captain decided, at the first officer’s suggestion, to change the landing runway, resulting in the performance of a nonprecision approach instead of a precision approach. The first officer was slow to correctly identify the airport, and the airplane was rather close to the airport before it was aligned on final approach. Thus, during the somewhat hurried final approach that ensued, the flight engineer might have served as a significant defense against an accident by carefully monitoring and crosschecking. The Safety Board notes that to accomplish the last item on the before landing checklist (landing lights), the flight engineer would need to look forward to check the landing light switches. According to FedEx procedures, the flight engineer should have remained facing forward, monitoring the approach for the remainder of the flight (in this case, 7 seconds). The flight engineer’s failure to adequately monitor the approach, either because of his workload, reliance on other crewmembers, inattention, or some combination of factors, removed the last defense against the accident. Further, research indicates that a lack of crew familiarity may have contributed to the flight crew’s failure to fly and monitor a stabilized approach.122 For example, in a study of major aviation accidents involving human performance issues, in which a large number of monitoring errors were observed, the Safety Board found that 73 percent of the accidents occurred on the first day that the captain and first officer had flown together; 44 percent occurred on the first flight leg. Simulator research supports this, showing that 121 See (a) A. Mack, “Inattentional Blindness,” Current Directions in Psychological Science Vol. 12, No. 5 (2003): 180-184. (b) F.W. Hawkins, Human Factors in Flight (Aldershot, England: Ashgate Publishing Limited, 1997) 116. (c) R.F. Haines, “A Breakdown in Simultaneous Information Processing. In G. Obrecht & L.W. Stark (Eds.),” Presbyopia Research (New York: Plenum Press, 1991) 171-175. 122 See (a) National Transportation Safety Board, A Review of Flightcrew-involved, Major Accidents of U.S. Air Carriers, 1978 Through 1990, Safety Study NTSB/SS-94/01 (Washington, DC: NTSB, 1994). (b) R. Khatwa and R.L. Helmreich, “Analysis of Critical Factors During Approach and Landing Accidents and Normal Flight,” Killers in Aviation: FSF Task Force Presents Facts About Approach-and-Landing and Controlled-Flight-into-Terrain Accidents. Flight Safety Digest. (November—December 1998, January— February 1999). (c) K. Dismukes, G. Young, and R. Sumwalt, “Cockpit Interruptions and Distractions: Effective Management Requires a Careful Balancing Act,” ASRS Directline (December 1998). (d) H.C. Foushee, J.K. Lauber, M.M. Baetge, and D.B. Acomb, Crew Factors in Flight Operations: III. The Operational Significance of Exposure to Short-Haul Air Transport Operations. National Aeronautics and Space Administration, NASA Technical Memorandum 88322, August 1986.

Analysis 66 Aircraft Accident Report flight crews with recent operating experience together communicate more frequently overall and perform better at solving in-flight emergencies than those that did not (even though, in some cases, crews without recent operating experience together were returning to flight duty after a rest period, which was not the case with crews with recent operating experience together). Therefore, the FedEx accident crew may have had a disadvantage because they were engaged in their first leg as a crew123 and had not yet developed the level of personal working relationship that facilitates effective coordination. Although compliance with FedEx’s standard operating procedures should have helped eliminate flight crew coordination errors, the lack of flight crew familiarity may help explain why such crew coordination and monitoring was deficient during the accident sequence. During postaccident interviews, FedEx’s lead instructor for CRM told investigators that the CRM department had been lobbying the airline to change the term “pilot not flying” to “pilot monitoring” because they wanted non-flying pilots to think more about the importance of their monitoring role. The circumstances of this accident demonstrate the importance of flight crewmembers actively monitoring the performance of other crewmembers, as well as their own performance. According to the ALAR study conducted by the Flight Safety Foundation, inadequate monitoring by flight crewmember(s) was a factor in 63 percent of approach and landing accidents. The Safety Board notes that in February 2003, the FAA revised AC 120-71A, “Standard Operating Procedures,” to describe the philosophy of and benefits to be derived from a “pilot monitoring” program. AC 120-71A also indicates that several air carrier operators have changed the title of “pilot not flying” to “pilot monitoring” because it is more appropriately descriptive. According to the March 17, 2003, FedEx submission on this accident, the company now uses pilot monitoring for certain approaches, and at least one other air carrier has completely incorporated the pilot monitoring concept into its system. The Safety Board concludes that the circumstances of this accident support the recent increase in emphasis on crew monitoring reflected in recent initiatives by the FAA and aviation industry. 123 The captain and flight engineer had been paired once before but neither had a clear recall of the experience.

67 Aircraft Accident Report 3. Conclusions 3.1 Findings 1. The captain, first officer, and flight engineer possessed valid airman and medical certificates. 2. The captain, first officer, and flight engineer had received the training and off-duty time prescribed by Federal regulations and company requirements. 3. The accident airplane and its cargo were not factors in the accident. 4. Weather and air traffic control were not factors in the accident. 5. The airport lighting systems, including the precision approach path indicator lights, were not a factor in the accident. 6. The accident approach was not stabilized as the airplane descended through 500 feet above ground level, and the pilots should have detected this and performed a go-around. 7. The approach to runway 9 at Tallahassee Regional Airport (which was flown over unlighted terrain and in night visual conditions) resulted in black hole conditions, which likely contributed to the flight crew’s failure to properly perform the approach. 8. Precision approach path indicator lights, such as those installed at runway 9 at Tallahassee Regional Airport, are a recognized countermeasure for use in black hole conditions and should have been, but were not, effectively used to maintain an appropriate glidepath by the first officer (who was the flying pilot) or by the captain and flight engineer (who, under the principles of basic crew coordination, were in a position to receive this information and initiate a corrective response). 9. The captain was likely impaired by fatigue and this impairment contributed to his degraded performance (especially in the areas of crew coordination and monitoring) during the approach to Tallahassee Regional Airport.

1. The first officer’s reported difficulty adapting to his schedule and frequently changing

sleep cycles were conducive to the development of fatigue impairment that contributed to his degraded performance during the approach to Tallahassee Regional Airport; however, there were also other factors affecting the first officer’s performance (for example, his color vision deficiency).

Conclusions 68 Aircraft Accident Report

1. It is possible that the flight engineer was impaired by fatigue at the time of the

accident; however, it is also possible that the flight engineer’s poor monitoring of the late stages of the approach was the result of his workload during the somewhat rushed approach, the presumption that the two forward-facing flight crewmembers were adequately monitoring the approach, or some combination of factors.

1. The circumstances of this accident, in part, demonstrate the continuing need for

fatigue management efforts similar to those being developed by the Department of Transportation Operator Fatigue Management Program in the aviation industry.

1. The first officer suffered from a severe color vision deficiency that made it difficult

for him to correctly identify the color of the precision approach path indicator signal during the below-glidepath, nighttime, visual approach to runway 9 at Tallahassee Regional Airport.

1. Existing aviation medical certification standards for color vision and use of related

screening tests may not ensure detection of color vision deficiencies that can be detrimental to safety; it is possible that in some emergency situations, the speed of color recognition may assume an importance that is not currently reflected in the standards.

1. One or more of the color vision screening tests currently approved for use in the

aviation industry (for example, the Farnsworth Lantern screening test) are not adequate; these tests should be identified and their use discontinued.

1. The circumstances of this accident support the recent increase in emphasis on crew

monitoring reflected in recent initiatives by the Federal Aviation Administration and aviation industry. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of the accident was the captain’s and first officer’s failure to establish and maintain a proper glidepath during the night visual approach to landing. Contributing to the accident was a combination of the captain’s and first officer’s fatigue, the captain’s and first officer’s failure to adhere to company flight procedures, the captain’s and flight engineer’s failure to monitor the approach, and the first officer’s color vision deficiency.

69 Aircraft Accident Report 4. Recommendations As a result of the investigation of the FedEx flight 1478 accident, the National Transportation Safety Board makes the following recommendations to the Federal Aviation Administration: Conduct research to determine the effectiveness of each of the current Federal Aviation Administration-approved color vision test protocols (including the color signal light test) at effectively screening out pilot applicants with color vision deficiencies that could impair their ability to perform color-related critical aviation tasks including (but not limited to) correct interpretation of glideslope information and in-cockpit displays that use color to convey information. The research should take into account the time typically available to perform each task, particularly under emergency conditions, and the potential effect of mild hypoxia (as might occur at typical cabin altitudes) on color vision deficiencies. (A-04-46) Based on the results of the research requested in Safety Recommendation A-04-46, develop a standard battery of tests to be performed at least once on each applicant for a Class 1 or 2 medical certificate that would prevent applicants with color vision deficiencies that could impair their ability to perform color-related critical aviation tasks from being certificated without limitations. (A-04-47) BY THE NATIONAL TRANSPORTATION SAFETY BOARD ELLEN ENGLEMAN CONNERS Chairman CAROL J. CARMODY Member MARK V. ROSENKER Vice Chairman JOHN J. GOGLIA Member RICHARD F. HEALING Member Adopted: June 8, 2004

this page intentionally left blank

71 Aircraft Accident Report 5. Appendixes Appendix A Investigation The National Transportation Safety Board was initially notified of this accident on the morning of July 26, 2002. A full go-team was assembled in Washington, D.C., and traveled to the accident scene. The go-team was accompanied by representatives from the Safety Board’s Offices of Government and Public Affairs and Transportation Disaster Assistance. No Board Member traveled to the accident site. The following investigative groups were formed during the course of this investigation: Structures, Systems, Powerplants, Air Traffic Control, Meteorology, Operations, Human Performance, Medical Factors, Airport/Survival Factors, Airplane Performance, Flight Data Recorder, Cockpit Voice Recorder (CVR), and Hazardous Materials. In addition, a CVR Sound Study was conducted. Parties to the investigation were the Federal Aviation Administration, the Boeing Commercial Airplane Group, Federal Express, Air Line Pilots Association, National Air Traffic Controllers Association, Pratt & Whitney, and the Tallahassee Regional Airport.

72 Aircraft Accident Report Appendix B Cockpit Voice Recorder Transcript The following is a transcript of the Fairchild model A100 CVR installed on the accident airplane. Only radio transmissions to and from the accident airplane were transcribed. The CVR transcript reflects the 32 minutes and 12 seconds before power was lost to the CVR. All times are eastern standard time, based on a 24-hour clock.

Appendix B 73 Aircraft Accident Report

Appendix B 74 Aircraft Accident Report

Appendix B 75 Aircraft Accident Report

Appendix B 76 Aircraft Accident Report

Appendix B 77 Aircraft Accident Report

Appendix B 78 Aircraft Accident Report

Appendix B 79 Aircraft Accident Report

Appendix B 80 Aircraft Accident Report

Appendix B 81 Aircraft Accident Report

Appendix B 82 Aircraft Accident Report

Appendix B 83 Aircraft Accident Report

Appendix B 84 Aircraft Accident Report

Appendix B 85 Aircraft Accident Report

Appendix B 86 Aircraft Accident Report

Appendix B 87 Aircraft Accident Report

Appendix B 88 Aircraft Accident Report

Appendix B 89 Aircraft Accident Report

Appendix B 90 Aircraft Accident Report

Appendix B 91 Aircraft Accident Report

Appendix B 92 Aircraft Accident Report

Appendix B 93 Aircraft Accident Report

Appendix B 94 Aircraft Accident Report

Appendix B 95 Aircraft Accident Report

Appendix B 96 Aircraft Accident Report

Appendix B 97 Aircraft Accident Report

Appendix B 98 Aircraft Accident Report

Appendix B 99 Aircraft Accident Report

Appendix B 100 Aircraft Accident Report

Appendix B 101 Aircraft Accident Report

Appendix B 102 Aircraft Accident Report

Appendix B 103 Aircraft Accident Report

104 Aircraft Accident Report Appendix C Correspondence Regarding the First Officer’s Color Vision

Appendix C 105 Aircraft Accident Report

Appendix C 106 Aircraft Accident Report

Appendix C 107 Aircraft Accident Report

Appendix C 108 Aircraft Accident Report

E

P L U R IB US U N U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A F E T Y N

Office of Aviation Safety

National Transportation Safety Board Washington, D.C. 20594

September 17, 2003

Douglas J. Ivan, Col USAF, MC, CFS Chief, Aerospace Ophthalmology Branch Department of the Air Force USAF School of Aerospace Medicine (AFMC) Brooks City-Base Texas

Dear Colonel Ivan:

I am writing in response to the aeromedical evaluation that your branch conducted in support of the NTSB investigation of the FedEx B-727 accident that occurred at Tallahassee, Florida on July 26, 2002. As summarized in your memorandum of March 28, 2003, your laboratory conducted extensive testing on the accident first officer’s color vision and concluded that he suffered from a severe congenital deficiency in red/green color perception.

I am writing on behalf of the investigation to ask several further questions to clarify your findings and seek additional documentation regarding your evaluation of the first officer’s color vision. The questions are:

• In your memorandum, you stated that “clearly, it is possible in this case, that the red

lights of a PAPI could have been identified as ‘yellow’ at lower light levels or ‘white’ when the light was brighter.” Based on the evaluation: a) What is the likelihood the first officer would perceive the color red in a PAPI as white, and be unable to distinguish the red and white colors of the PAPI?

Appendix C 109 Aircraft Accident Report b) What is the likelihood the first officer would see the color red as “yellow?” If so, what would be his perception of the color white and would he be able to distinguish the two colors?

c) What is the likelihood that the first officer would perceive the color red in a PAPI as red, pink, or any color that might be readily distinguished from white?

You indicated that the first officer might “employ learned strategies, other than normal color discrimination, to ‘interpret’ PAPIs.” What sort of learned strategies were you referring to?

Would the first officer have difficulty perceiving the color green in a display such as an airport identifier beacon, and differentiating this color from white and red?

How would the first officer’s ability to discriminate between red and white colors on a PAPI be affected by day versus night viewing conditions?

How would the first officer’s ability to distinguish red and white lights in a PAPI be affected when these signals were viewed under high relative humidity conditions (but not direct obscuration by fog)?

What factors would affect the first officer’s color vision capabilities? Specifically:

a) How would aging affect this type of color vision deficiency? That is, is it likel y that his color perception was better earlier in his career?

b) How would hypoxia affect this type of color vision deficiency? Would his ability to discriminate red and white in a PAPI be affected? Would his ability to discriminate green from white be affected?

c) How would smoking history affect this type of color vision deficiency? The first officer had a ½ pack a day smoking history for his entire adult life. He last smoked about three hours before the accident. Would this smoking history affect his ability to discriminate red and white in a PAPI? Would this smoking history affect his ability to discriminate green from white be affected?

d) What other factors would affect the first officer’s color vision capabilities and how?

The first officer received a perfect score on the Farnsworth Lantern test but failed all other red/green perception tests administered by your laboratory. How was he able to pass the Farnsworth Lantern test?

Can you provide any additional technical references concerning the validity of the Farnsworth Lantern test for color deficiency testing (including references regarding the

Appendix C 110 Aircraft Accident Report ability of pilots who pass the Farnsworth Lantern to reliably distinguish aviation signals and lights)?

Are you aware of any pilots with similar color deficiencies who have had careers in military or civilian aviation? Are you aware of any pilots with similar color deficiencies who have been involved in events/incidents/accidents related to their color vision? What color vision screening methods were used for these pilots?

Is it an accurate summary of your test results to state that the first officer was found to have a congenital color perception deficiency sufficiently severe that he could not reliably distinguish the red and white colors of the PAPI based on color information alone?

In your answers to these questions we would particularly appreciate any additional thoughts or evidence based on your evaluation of the first officer. In addition, any technical references applicable to assessing color vision discrimination capabilities in individuals with this type and severity of color deficiency would be appreciated. Thank you for the very thorough and thoughtful support you have provided so far and for your responses to this material.

Sincerely,

Malcolm Brenner, Ph.D.

National Resource Specialist— Human Performance

Appendix C 111 Aircraft Accident Report

DEPARTMENT OF THE AIR FORCE USAF SCHOOL OF AEROSPACE MEDICINE (AFMC) BROOKS CITY-BASE TEXAS

5 Nov 03

MEMORANDUM FOR NATIONAL TRANSPORTATION SAFETY BOARD

ATTN: MALCOM BRENNER, Ph.D. WASHINGTON, DC 20594

FROM: USAFSAM/FECO

2507 Kennedy Circle

Brooks City-Base Texas 78235-5116

SUBJECT: FedEx B-727 Accident (July26, 2002), Tallahassee, FL; NTSB ID #: DCA 02MA054

The USAFSAM evaluation of First Officer William Frye in Feb 2003 identified him to have a severe deuteranomalous color vision (CV) deficit that most probably represented a congenital defect based on its long standing history, the characteristics of his defect, and the absence of any other identifiable conditions that would be consistent with an acquired etiology. At the request of NTSB, CV testing was done under monitoring by pulse oxymetry, which revealed normal hemoglobin oxygenation levels during testing. If First Officer Frye was alone in his visual interrogation and interpretation of the PAPI system, then it was the only available visible external cue he had to land the aircraft that night. With that in mind, we will now address the specific questions you have posed, in sequence:

• His red-green CV discrimination was significantly impaired as identified on multiple

red-green CV screening tests. Ultimately, he was characterized to be severely deuteranomalous, and nearly dichromatic, on anomaloscopic testing. Thus, compared to normal, his perceptible spectral bandwidth of colors would be quite narrow, likely approaching monochromatism above 540-545nm. This would essentially relegate him very nearly to a gray-blue-yellow world only. In that abnormally color shifted world, such an individual would have extreme difficulty, determining differences between greens and reds and many other colors to include whites based on wavelength or hue. The physiological nature of such a CV deficit is caused by an abnormal shift in the wavelength sensitivity of the green cone system from it’s normal position in the visible spectrum, towards, and nearly overlapping the wavelength sensitivity curve of the red cone system located at the longer wavelength section of the visible spectrum. A total shift would completely overlap the red cone system rendering such an individual dichromatic and a severe enough shift would also effectively render such an individual to be nearly dichromatic and still make red and green lights and most colors virtually Appendix C 112 Aircraft Accident Report indistinguishable. Thus, the ability to appreciate differences in colors as normally generated by appropriate independent and simultaneous stimulation of normally separated red and green cone sensitivity curves would be severely compromised and abnormal. That independent stimulation of separate cone sensitivity curves located in different parts of the visible spectrum is required by the brain to determine appropriate matches that eventually define normal color perception. When the cone sensitivity curves abnormally overlap, wholly or in part, this ability becomes aberrant. The greater the overlap, the greater the problem. For example, conceptually, simultaneous stimulation of a single sensitivity curve by a purish source with a narrow wavelength range, such as a laser, would normally trigger only 1 cone system. However, with overlapping curves, that same light source would now be interpreted by the brain to be stimulating two different cone systems and be centrally processed to represent a color other than a purish red or green, because of the two cone systems now being stimulated (abnormally) at the same time and processed accordingly by the brain. Therefore, a light source or object that would appear to be red or green to a color normal would now appear to be something other than red or green to someone with this type of severe cone sensitivity shift, and more likely be interpreted as yellow. Therefore, because of the severity of his CV deficit, we believe that he would definitely have had problems discriminating the PAPIs normally, and as they were designed, because the red lights would appear not to be red at all, but either yellow, or some other wavelength, that would make them more indistinguishable from white, especially if the light sources were further intensified. Therefore, given the congenital near overlap of his red-green cone sensitivity curves, it would be extremely unlikely that he would be capable of seeing even the color pink on the PAPI, but more likely, a combination of whites and yellows and perhaps, not even that difference.

• Congenital color defectives develop some ability to “differentiate” between normal

colors based on clues other than hue or wavelength, such as by differences in shade or brightness. This is a learned process and is not reliable. Over time, they adjust to their “abnormal” color world and learn to assign typical color names to that perceived difference based on learned experiences. Such adjustments are not foolproof and are vulnerable to failure, especially when exposed to unpredictable and new color challenges without redundancy. Therefore, it might be possible for someone with this type of CV deficiency to use brightness differences between the white and red PAPI lights to help differentiate between them over an entire flying career. However, on the other hand, someone like this may also not have been able to use PAPIs effectively at all over their entire career, especially exclusively. If the "difference" between the white and red lights were somehow perceptible enough, someone could eventually learn how to use this information to analyze such challenges, but more likely, this would have caused such an individual to shy away from sole reliance on PAPIs. Such a strategy would be more effective in a CV defective, if the targets being interrogated, were limited, repeatable, and reproducible, such as in the Farnsworth Lantern (FALANT) or in the PAPI system, where learned strategies could be effectively tested by trial and error and employed. However, new and unexpected color tasks or lighting situations would be much more challenging or even impossible, to an individual with this level of CV defect, especially the first time encountered, than situations that can be uniformally Appendix C 113 Aircraft Accident Report reproduced, retested, and represented over and over. That said, it is possible for an individual with this level of CV defect to quickly learn how to pass some color challenges based on limited selection options and other technical limitations, such as those known to be associated with the FALANT. Once someone learned how to assign a new color name for each particular brightness, or to any differences they might perceive, they could employ this strategy in order to “pass” the FALANT again and again. Remember, CV defectives have been trying to naturally adopt alternate strategies all their lives in order to adapt, function, and survive in their abnormal color world. However, we would expect that the first time someone with a severe red-green CV defect were administered the FALANT, that they would have had trouble truly passing it and would have needed time or additional testing to develop a strategy to “pass”. To “pass” the FALANT, correct responses to the presentations are required. The testee is trying to “pass” the test, therefore, their goal is to give “correct” responses. Being unaware of normal colors and of their inability to truly identify hue based differences during the test, they would nonetheless try to give “correct” responses from their perspective based on how they have learned to differentiate between the choices. Therefore, they are trying to give the right answers without really being able to normally appreciate the differences as was intended by the test. They in fact know no other way and have had a lifetime trying to respond to color differentiation tasks that are obvious to color normals. Technicians are listening for responses and would not easily recognize “problems” beyond “right” or “wrong” responses. In fact, some may unintentionally “help” in the process. With only a known and limited number of colors and choices in FALANT combinations, and some adopted strategies that "differentiates" between the three, it can be conceived that such an individual could have consistently “passed” the FALANT using an alternate strategy, rather than actually being able to truly differentiate between the red, green, and white wavelengths as perceived by a normal trichromat. Paulsen et al.(1966), and others since have reported this. It should also be kept in mind that by design, the FALANT test was never designed to identify only color normals, but to allow some CV defectives to be passed and therefore be indistinguishable from true normals who also pass. However, it should not in theory pass more severe CV deficits, but unfortunately does so.

• An individual with Mr. Frye's type of CV defect is nearly a dichromat. As stated

earlier, this means that the wavelength sensitivity curves of the red and green systems would be nearly overlapped, thus mimi cking a single responding "red-green" cone system and true dichromatism. Consequently, such a red-green dichromat would be relegated to a world of grays, blues and yellows. Someone like him would be expected to have problems truly differentiating between red and green wavelengths, and in fact possibly all wavelengths greater than 545nm. Common errors include confusing whites with reds and greens, e.g., calling white lights red and vice versa. Appendix C 114 Aircraft Accident Report

His ability to see the PAPIs differently during the day or at night might vary depending on the intensity level selected for the PAPIs. Since the perception of the PAPI lights would be a photopic event in either case at these light levels, the same confusion would likely exist day or night, with one exception. Given the scenario he was under, at an unfamiliar airfield, at night, in a black hole with no other visual cues available for him to interrogate other than the PAPIs, published literature by Smith, et al.(1973) in similar CV defectives, including severe deuteranomalous individuals, clearly indicated that hues in the range between 500-600 nm were identified as yellow at reduced illumination levels, but when these wavelengths were intensified, the brighter colored lights were now interpreted as “white”. In addition, low voltage levels of white PAPI lights are known to shift the white lights more towards yellow (Cole and Maddocks). This output driven wavelength shift would make it more difficult, or even impossible, for such CV defectives to distinguish differences between white, red, and yellow.

We do not have enough information available to us to answer this question. There are studies in the literature on atmospheric haze effects, but none that we could find on humidity.

6a. One of the characteristics of congenital CV defects is that they do not change over time unless an additional acquired etiology occurs and thereby overlays an additional component on the already underlying congenital defect. That would only make matters worse. The only age related issue that could possibly impact this case would be from any induced blue light filtration caused by the natural yellowing of the lens that occurs in everyone over time. This is a well-known UV-induced phenomenon that can induce an acquired blue-yellow deficiency by blocking shorter wavelengths, e.g., purples, and blues. We did not demonstrate any obvious cataract in his case, however, even a normal lens is known to have increasing levels of blue and UV filtration as a function of increasing age. Such an acquired blue-yellow CV disturbance would likely not aggravate existing red-green problems, however, could tend to aggravate the ability to distinguish residual differences between yellow and white, as this would be tantamount to wearing yellow lenses. However, he did not demonstrate an objective blue-yellow component at this point in time.

b. Hypoxia can definitely degrade visual function including color vision. This has been well established in the literature for years. The WW2 literature available from Schmidt identified increased pathological color thresholds (red and green both decreased in sensitivity, but in different subjects) with mild hypoxia above 9800 ft. and observed this to be even greater if there was an already existing color deficiency.

The following paragraph with respect to hypoxia and color vision was extracted from the Heino Widdel and David L. Post edited book entitled "Color in Electronic Displays", Defense Research Series, Vol 3, 1992:

Appendix C 115 Aircraft Accident Report

"Several studies have reported that hypoxia results in losses in color sensitivity, although there is disagreement on the specific effects (see Dyer, 1988). When color vision has been tested foveally, the hypoxia generally produced a greater perceptual deficit for blue or green (Frantsen & Iusfin, 1958; Modugno, 1982; Schmidt & Bingel, 1953; Smith, Ernest & Pokorny, 1976; Weitzman, Kinney, & Luria, 1969); when it was tested peripherally, it generally produced a greater deficit for yellow or red (Blum & Fisher, 1942; Ernest & Krill, 1971; Kobrick, 1970; Vollmer, King, Fisher, & Birren, 1946). On the other hand, in testing the effects of hypoxia on the limits of the visual field, Kobrick, Zwick, Witt, and Devine (1984) found that the limits of green sensitivity decreased but not hose of red. Boles-Carenini and Cima (1952) noted that hypoxia worsened already-existing anomalies of the Nagel anomaloscope quotient."

Therefore, hypoxia could be expected to induce or further degrade any residual hue discrimination by raising the color sensitivity thresholds overall and reduce any residual wavelength discrimination across the visible spectrum. All colors become further degraded under lower levels of illumination, especially with hypoxia. These hypoxic effects have generally been studied using the FM100, but we could not find any other studies addressing hypoxia as a function of any other specific CV tests beyond those cited using the FM100 and Nagel anomaloscope.

c. Research has indicated that smoking also affects photopic vision, one aspect of which would be color perception. This can occur from related hypoxic and metabolic effects or from tobacco amblyopia, a type of chronic toxic optic neuropathy, usually seen in heavy smokers. Graefes (Arch Clin Exp Ophthal, 1999, May, pp 377-80) identified color vision changes in individuals who consumed more than 20 cigarettes per day.

d. Other potential factors that could affect anyone’s color vision would include the nature, transmission characteristics, and color of any intervening optical interfaces, medications, drugs, and/or diseases that might also be present. These all would reduce brightness, change the spectral characteristics entering the eye or receptor sensitivities, and further degrade cone function. Our evaluation however did not reveal any known indication of any medications or diseases that would further impact his color perception in any way. A typical Boeing 727 windscreen would not normally be associated with any selective waveband filtration that would have further degraded the visual scene external to the cockpit in any significant way. However, specific FedEx modifications would need to be ruled out.

• We believe that the First Officer was able to “pass” the Farnsworth Lantern using

naturally learned strategies as previously discussed. His learned experience may have involved some early, unrecorded test failures and perhaps, some technician “assistance” along the way. This could have been as benign as allowing someone like him some additional opportunities to change a response or even retake the test. On the other hand, the FALANT is known to “pass” severe CV defectives, however that occurs. Appendix C 116 Aircraft Accident Report Regardless, the FALANT was the only color vision test that he could “pass” at USAFSAM. All other test scores were consistent with a severe red-green deficit. The D15 was borderline. While this may appear disconcerting, it is not surprising and is consistent with known problems with the FALANT.

• A database literature search would provide you with a complete bibliography with

respect to the FALANT. In addition to references you already have, I would draw your attention to germane articles recently published in Aviation, Space, and Environmental Medicine in the last few years as a good start, as well as a few others linked below: (a) Birch and Dain, ASEM, Vol 70, No. 1, 1999. (b) Dain and Houson, ASEM, Vol 59, No. 4, 1988. (c) Laxar, Military Medicine, Sept, 1967, pp 726-731. (d) Cole BL and Maddocks, JD, “Colour Vision and PAPI”, Colour Deficiencies XII, 1995, pp 501-510. (e) Cole and Vingrys, Documenta Ophthalmologica, 55, 1983, pp 157-175.

The simulated PAPI Study by Cole and Maddocks (d) in particular identified unexpected problems with all deutans, both deuteranopes and deuteranomalous, that led them to conclude that proper recognition of PAPI systems by color defectives is problematic and a risk in aviation.

Because of testing inaccuracies and other flaws of FALANT testing applicable to modern aviation, it was dropped as an official USAF aircrew qualifying test in 1993. It simply was not reliable and misidentified significant CV defectives. (See below).

• Prior to 1993, and throughout the entire history of the use of the FALANT in the Navy

and USAF, passing the test meant that you met applicable CV standards at the time and did not require any further CV testing. Therefore, since many color defectives can “pass” the FALANT, the true CV status of an individual who passes it, cannot be determined on the basis of passing that test alone. Procedurally, for decades, the USAF used a red-green PIP-I screener first, and then, only if you failed that test, were you administered the FALANT. If you failed the FALANT, you were disqualified. If you passed the FALANT, you were qualified and no further definitive quantitative analysis was required. PIP testing became the only standard used by the USAF between 1993 and 1995, when a transition to the present methodology was adopted. Currently the USAF uses a four-test battery of PIP plate tests to evaluate pilot applicants during Medical Flight Screening (MFS) for both congenital and acquired red-green and blue-yellow CV deficiencies. To qualify for MFS, an applicant must first pass an Initial Flying Class I exam including the traditional single red/green screening PIP test exam done in the field. The additional four test CV battery is then administered to all pilot candidates during MFS at USAFSAM. It comprises the PIP I, PIP II, PIP III, and the F2 plate tests. Failure of any one of those four PIP plate tests results in additional color vision (CV) testing to determine the exact nature and degree of any existing CV defect and a complete ophthalmological evaluation to rule out

Appendix C 117 Aircraft Accident Report acquired pathology. The final CV determinant test is the gold standard anomaloscope. However, many additional CV tests (FM100, FALANT, APT-5, D15, etc.) are also performed to monitor their effectiveness and correlation with the screening test battery and the anomaloscope, however, their results do not impact on the final waiver recommendation, only the anomaloscope results count at this point. This CV screening methodology is consistent with the recommendation of NATO’s Working Group 24 that was published in RTO-TR-016 in 2001. Because of many problems related to lantern tests, WG-24 did not recommend using any lanterns for CV screening and assessment for modern aircrew. Previous published studies of the FALANT have revealed that it “passes” between 25-40% of all color defectives while in theory it was designed to only pass mild deficiencies. That proven unreliability was the fundamental reason why the USAF dropped it as a CV qualifying test in 1993. Repeated analysis of the FALANT results in CV defectives at USAFSAM indicate that the FALANT does not distinguish or predict the magnitude of the CV deficiency and passes mild, moderate and severe anomalous trichromats. It is usually failed by dichromats. More specifically, in the most recently analyzed data submitted for presentation for AsMA 2004, the FALANT passed 60% of subjects identified to have severe deuteranomaly on the anomaloscope.

Given intended and unintended flaws associated with the FALANT, it therefore remains unknown how severe a color defective might be if they “passed” the FALANT. There is some data however on this in the literature to incl ude the additional experience here at USAFSAM with large numbers of applicants. Therefore, it is possible that aircrew with similar defects managed to escape accurate identification of their true CV performance because of "passing" the FALANT. It has been subsequently shown that some can have significant CV deficits.

An apparent paradox exists in that, because of the absence of any disastrous accidents, aviators may appear, and is often argued, to have performed “successfully” throughout their career. This perception is likely due to a myriad of circumstances, but would represent a spectrum to include not being appropriately challenged, or even being just plain lucky! Being “successful” therefore can be misleading in some cases, as we believe it appears in this case. That “success” may vanish if their CV deficiency gets challenged in a way that their handicap fails them. We are aware of another Navy aircraft mishap that can be attributed to a very similar scenario involving a CV defective, as severe as this case, who also apparently “passed’ the FALANT many times over his career. Following a series of color vision misperceptions during a flight that resulted in the loss of the aircraft, that mishap pilot was later identified to also be severely red-green CV defective and quite similar to the type of the CV defect in this case. During the post accident investigation, he admitted that he had gotten “help” and used alternate strategies to “game” the FALANT in order to “pass” it. Technicians “helped” in assorted ways. Anomaloscope testing in his case also revealed a severe red-green deuteranomalous CV deficiency.

Appendix C 118 Aircraft Accident Report

1. In summary, we believe that this case appears to be consistent with a true failure in CV

testing methodology involving the FALANT’s inability to properly identify a severe red-green CV defective who found himself in a scenario when the PAPI system was the, main and possibly only, clue available to help him successfully land the aircraft at an unfamiliar airfield, despite his past history of apparent “success”. The failure to properly identify his CV deficit is consistent with one of the potential problems associated with reliance on the FALANT, and is further consistent with other research in CV defectives using colored lights similar to the PAPIs. In this setting, we believe he would not have been able to properly interpret the PAPI system as designed because of his severe congenital red-green color vision disturbance.

JOHN T. YATES, Ph.D.

Chief, Visual Electrodiagnostic Laboratory

DOUGLAS J. IVAN, Col, USAF, MC, CFS

Chief, Aerospace Ophthalmology Branch

FD07287 ｜ 2004_美国_AAR0403.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2004 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

In-Flight Engine Failure and Subsequent Ditching Air Sunshine, Inc., Flight 527 Cessna 402C, N314AB About 7.35 Nautical Miles West-Northwest of Treasure Cay Airport, Great Abaco Island, Bahamas July 13, 2003 Aircraft Accident Report NTSB/AAR-04/03 PB2004-910403 Notation 7671A National Transportation Safety Board Washington, D.C.

this page intentionally left blank

Aircraft Accident Report In-Flight Engine Failure and Subsequent Ditching Air Sunshine, Inc., Flight 527 Cessna 402C, N314AB About 7.35 Nautical Miles West-Northwest of Treasure Cay Airport, Great Abaco Island, Bahamas July 13, 2003 NTSB/AAR-04/03 PB2004-910403 National Transportation Safety Board Notation 7671A 490 L’Enfant Plaza, S.W. Adopted October 13, 2004 Washington, D.C. 20594 E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N

National Transportation Safety Board. 2005. In-Flight Engine Failure and Subsequent Ditching, Air Sunshine, Inc., Flight 527, Cessna 402C, N314AB, About 7.35 Nautical Miles West-Northwest of Treasure Cay Airport, Great Abaco Island, Bahamas, July 13, 2003. Aircraft Accident Report NTSB/AAR-04/03. Washington, DC. Abstract: This report explains the accident involving Air Sunshine, Inc., flight 527, a Cessna 402C, which experienced an in-flight engine failure and was subsequently ditched about 7.35 nautical miles west-northwest of Treasure Cay Airport, Great Abaco Island, Bahamas. The safety issues discussed in this report include maintenance record-keeping and practices, pilot proficiency, Federal Aviation Adminstration (FAA) oversight, and emergency briefings. A safety recommendation concerning emergency briefings is addressed to the FAA. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2004-910403 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Aircraft Accident Report Contents Figures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii

1. Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
2. 1

History of Flight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.2 Injuries to Persons. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.3 Damage to Airplane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.4 Other Damage. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.5 Personnel Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.5.1 The Pilot. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.5.1.1 Flight Check History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 1.5.2 The Director of Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1.5.3 The Assistant Mechanic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.6 Airplane Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.6.1 Engines and Propellers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.6.1.1 Air Sunshine’s Approved Aircraft Inspection Program. . . . . . . . . . . . . . . . . . . . 10 1.6.1.2 Differential Compression Checks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1.6.1.2.1 June 12 to 14, 2003, Differential Compression Checks . . . . . . . . . . . . . . . . 12 1.6.1.3 Time Between Overhauls. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 1.7 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1.8 Aids to Navigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1.9 Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1.10 Airport Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1.11 Flight Recorders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 1.12 Wreckage and Impact Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 1.12.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 1.12.2 Engines and Propellers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 1.13 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 1.14 Fire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 1.15 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 1.15.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 1.15.2 Emergency Briefings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 1.15.3 Personal Flotation Devices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 1.15.4 Search and Rescue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 1.16 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 1.16.1 Cessna Airplane Performance Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 1.16.2 Airplane Performance Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 1.16.3 Metallurgical Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 1.16.3.1 Right Engine Cylinder Assemblies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 1.16.3.2 Right Engine Pistons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 1.16.3.3 Right Engine Crankcase. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Contents iv Aircraft Accident Report 1.16.3.4 Right Engine No. 2 Cylinder Hold-Down Studs and Through Bolts . . . . . . . . . 27 1.16.3.5 Cylinder Hold-Down Nuts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 1.17 Organizational and Management Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 1.17.1 Air Sunshine. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 1.17.1.1 Air Sunshine’s In-Flight Engine Failure Procedures. . . . . . . . . . . . . . . . . . . . . . 30 1.17.1.2 Ditching Procedures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 1.17.1.3 Company Record-Keeping. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 1.17.1.3.1 Maintenance Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 1.17.1.3.2 Aircraft Flight Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 1.17.2 Federal Aviation Administration Oversight. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 1.17.2.1 General. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 1.17.2.2 San Juan Flight Standards District Office Preaccident Oversight of Air Sunshine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 1.17.2.3 Fort Lauderdale Flight Standards District Office Postaccident Oversight of Air Sunshine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 1.17.2.4 San Juan Flight Standards District Office Postaccident Oversight of Air Sunshine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 1.17.2.5 Additional Postaccident Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 1.18 Additional Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 1.18.1 Previous Ditching Accidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

1. Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
2. 1

General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 2.2 Accident Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 2.3 Airplane Performance After the Right Engine Failure . . . . . . . . . . . . . . . . . . . . . . . . . . 38 2.4 Right Engine Failure Sequence. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 2.5 Cause of the Loosened No. 2 Cylinder Hold-down Nuts . . . . . . . . . . . . . . . . . . . . . . . . 40 2.6 Air Sunshine Maintenance Record-Keeping and Practices . . . . . . . . . . . . . . . . . . . . . . 41 2.7 Pilot Proficiency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 2.8 Pilot Failure to Use Shoulder Harness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 2.9 Emergency Briefings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

1. Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
2. 1

Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 3.2 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

1. Recommendation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
2. Appendix

A: Investigation and Public Hearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

v Aircraft Accident Report Figures

1. Interior configuration of the accident airplane.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2. Cylinder differential compression check form.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3. Exterior of the upper outboard engine cowling. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
4. The condition in which the right engine No. 2 cylinder

retention system components were found. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

vi Aircraft Accident Report Abbreviations A&P airframe and powerplant AAIP Approved Aircraft Inspection Program ARTCC air route traffic control center ATP airline transport pilot CFI certified flight instructor CFR Code of Federal Regulations CG center of gravity CVR cockpit voice recorder F Fahrenheit FAA Federal Aviation Administration FDR flight data recorder FLL Fort Lauderdale/Hollywood International Airport fpm feet per minute FSDO Flight Standards District Office Hg mercury KIAS knots indicated airspeed METAR meteorological aerodrome report MYAT Treasure Cay Airport MYGF Grand Bahamas International Airport PFD personal flotation device PIC pilot-in-command PMI principal maintenance inspector psi pounds per square inch PTRS Program Tracking and Recording System SB service bulletin SJU Luis Munoz Marin International Airport SRQ Sarasota/Bradenton International Airport TBO time between overhaul TCM Teledyne Continental Motors TSO Technical Standard Order

vii Aircraft Accident Report Executive Summary On July 13, 2003, about 1530 eastern daylight time, Air Sunshine, Inc. (doing business as Tropical Aviation Services, Inc.), flight 527, a Cessna 402C, N314AB, was ditched in the Atlantic Ocean about 7.35 nautical miles west-northwest of Treasure Cay Airport (MYAT), Treasure Cay, Great Abaco Island, Bahamas, following the in-flight failure of the right engine. Four of the nine passengers sustained no injuries, three passengers and the pilot sustained minor injuries, and one adult and one child passenger died after they evacuated the airplane. The airplane sustained substantial damage. The airplane was being operated under the provisions of 14 Code of Federal Regulations Part 135 as a scheduled international passenger commuter flight from Fort Lauderdale/Hollywood International Airport, Fort Lauderdale, Florida, to MYAT. Visual meteorological conditions prevailed for the flight, which operated on a visual flight rules flight plan. The National Transportation Safety Board determines that the probable cause of this accident was the in-flight failure of the right engine and the pilot’s failure to adequately manage the airplane’s performance after the engine failed. The right engine failure resulted from inadequate maintenance that was performed by Air Sunshine’s maintenance personnel during undocumented maintenance. Contributing to the passenger fatalities was the pilot’s failure to provide an emergency briefing after the right engine failed. The safety issues discussed in this report include maintenance record-keeping and practices, pilot proficiency, Federal Aviation Administration (FAA) oversight, and emergency briefings. A safety recommendation concerning emergency briefings is addressed to the FAA.

this page intentionally left blank

1 Aircraft Accident Report 1. Factual Information 1.1 History of Flight On July 13, 2003, about 1530 eastern daylight time,1 Air Sunshine, Inc. (doing business as Tropical Aviation Services, Inc.),2 flight 527, a Cessna 402C, N314AB, was ditched in the Atlantic Ocean about 7.35 nautical miles west-northwest of Treasure Cay Airport (MYAT), Treasure Cay, Great Abaco Island, Bahamas, after the in-flight failure of the right engine. Two of the nine passengers3 sustained no injuries, five passengers and the pilot sustained minor injuries, and one adult and one child passenger died after they evacuated the airplane.4 The airplane sustained substantial damage. The airplane was being operated under the provisions of 14 Code of Federal Regulations (CFR) Part 135 as a scheduled international passenger commuter flight from FLL to MYAT.5 Visual meteorological conditions prevailed for the flight, which operated on a visual flight rules flight plan. The accident pilot was scheduled to fly the accident airplane on a 2-day trip sequence, which began about 0900 on July 12, 2003. The pilot flew five flights, each of which lasted about 1 hour, on the first day of the trip sequence. The last flight was from FLL to Sarasota/Bradenton International Airport (SRQ), Sarasota, Florida, and it arrived at SRQ about 1930. All of the first day’s flights were uneventful, and the pilot reported no engine- or airframe-related discrepancies for any of the flights. On July 13, 2003, the pilot arrived at SRQ about 0830 for the second day of the trip sequence. The pilot was scheduled to conduct five flights, each of which was to last about 1 hour. The first flight departed SRQ about 0930 and arrived at FLL about 1030. The second flight departed FLL about 1100 and arrived at MYAT about 1200. The third 1 Unless otherwise indicated, all times in this report are eastern daylight time. The airplane was not equipped with a cockpit voice recorder (CVR) and was not required to be so equipped. Therefore, all times referenced in this report are approximations, except for the takeoff time, which was determined by reference to transcripts of voice recordings obtained from the Fort Lauderdale/Hollywood International Airport (FLL) air traffic control tower and the Miami Automated International Flight Service Station. 2 Air Sunshine and Tropical Aviation Services are two separate companies owned and operated by the same people. 3 Four of the nine passengers were children; one of the children was under 2 years of age and was seated on an adult passenger’s lap during the flight. 4 The search for, and rescue of, the surviving airplane occupants (and recovery of the bodies of the two other airplane occupants) is discussed in section 1.15.4. 5 Under the provisions of Annex 13 to the Convention on International Civil Aviation, the investigation of an airplane crash is the responsibility of the state of occurrence (the state or territory in which an accident or incident occurs, which in this case was the Bahamas). However, the state of occurrence may delegate all or part of an investigation to another state by mutual arrangement or consent. At the request of the Bahamian Government, the National Transportation Safety Board assumed full responsibility for the investigation. The Bahamian Government designated an accredited representative to the investigation.

Factual Information 2 Aircraft Accident Report flight departed MYAT about 1215 and arrived at FLL about 1330. All of the flights were reported to be uneventful. The pilot stated that, before departing on the fourth flight of the day, from FLL to MYAT, he conducted a preflight inspection of the airplane, which included checking the oil quantity. The accident flight was cleared for takeoff at 1427:11 and was estimated to last about 1 hour 10 minutes. During postaccident interviews, passengers stated that, before starting the engines, the pilot briefed6 them on the location of the personal flotation devices (PFD),7 the exits, and the safety briefing cards8 and on the need to keep their lapbelts fastened during the flight. One of the passengers who accompanied a child noted that the pilot’s briefing did not include how to handle children during an emergency and added that the briefing was “short and rushed.” The pilot and adult passengers stated that the cruise portion of the flight was uneventful, and the pilot stated that the engine instruments showed no indications of a mechanical problem. The pilot indicated that the flight’s cruise altitude was about 7,500 feet and that the cruise speed was about 160 knots indicated airspeed (KIAS).9 The pilot stated that, during the descent into MYAT, he maintained the same power setting that he used during cruise flight, which was about 2,300 rpm and 27 inches of mercury (Hg) manifold pressure. The pilot stated that, about 20 to 25 miles from MYAT (about 45 to 50 minutes into the flight), while descending to about 3,500 feet, he heard a bang and saw oil coming out of the right engine cowling.10 The adult passenger in the copilot’s seat (the seat to the right of the pilot seat) reported seeing a “stream of oil” coming from the right engine and stated that he notified the pilot of his observation. Several of the other adult passengers reported seeing white smoke coming from the right engine. These passengers stated that the smoke was followed 6 Title 14 CFR 135.117(a) requires pilots to brief passengers orally before departure. Section 135.117(a) states that the predeparture briefing should include, in part, information on the use of safety belts, the location of and instructions for opening the passenger entry door and emergency exits, and the location of survival equipment. 7 The airplane was equipped with 10 PFDs that were sealed in plastic pouches. Eight of the PFDs were stowed under the forward edge of each passenger seat. The PFDs for the pilot and copilot positions were stowed outboard of each pilot seat. For more information, see section 1.15.3. 8 The safety briefing cards were contained in the stowage pockets located on the back of each seat. 9 The airplane was not equipped with a flight data recorder (FDR) and was not required to be so equipped. Data from the Nassau Air Route Surveillance Radar (about 125 miles south of the accident site) did not indicate any targets in the Bahamas airspace consistent with the reported route and altitude of flight 527. Other aircraft were observed at an altitude of about 6,600 feet and above near Grand Bahamas Island and at an altitude of about 5,100 feet and above near the ditching site. All flight altitudes and speeds referenced in the report are based on the pilot’s recollections. 10 From June 12 to 14, 2003, Air Sunshine’s Director of Maintenance and an assistant mechanic performed differential compression checks on the accident airplane’s right engine cylinders during the airplane’s last recorded engine maintenance. For more information about these checks, see section 1.6.1.2.1.

Factual Information 3 Aircraft Accident Report by a stream of oil and then the sound of a loud bang. They reported seeing parts falling from the engine after they heard the loud bang. The pilot stated that, after he heard the bang, he reduced power to the right engine. The pilot indicated that, at the time of the event, the airplane’s airspeed was about 135 to 140 KIAS. He added that the airspeed for a normal descent should be about 140 knots. The pilot stated that he then saw that the engine magnetos had penetrated through the engine cowling and that the magnetos were hanging from wires. He added that he did not see any other damage. He stated that he noticed that the right engine oil pressure indication was decreasing rapidly. He added that the fuel selector was “in the green” (that is, each engine was being provided fuel from its respective main fuel tank). He stated that he attempted to feather11 the right propeller and shut down the engine12 but that the propeller continued “wind-milling” (turning) slowly. The passenger in the copilot seat and the adult passenger in the seat behind the copilot’s seat also reported that the pilot tried to feather the right propeller but that it continued to turn after the engine failed.13 The pilot stated that, after he attempted to shut down the right engine, he applied full power to the left engine and tried to fly the airplane but that he could not maintain altitude. He stated that he slowed the airplane to “blue line” (single-engine best climb rate) airspeed, which is about 105 KIAS, and that, at that point, the airplane was at a descent rate of about 200 to 300 feet per minute (fpm). The pilot stated that he contacted Air Sunshine’s station manager at MYAT after trying to shut down the engine. The station manager stated that the pilot told him that the right engine had failed and that he was at an altitude of about 3,000 feet. The manager added that the pilot asked him to contact the company’s Director of Operations at FLL, which the manager did. Air Sunshine’s Director of Operations told the manager to ask the pilot if the propeller on the failed engine was feathered, and the pilot responded that it was. The Director of Operations then asked the manager to get the airplane’s distance from the airport, altitude, and descent rate; the pilot responded that he was about 15 miles from the airport14 at an altitude of about 2,000 feet with a descent rate of about 200 fpm. The Director of Operations instructed the manager to tell the pilot to “keep the good engine at full power, bank to the good engine and to just stay calm and fly the plane.” The pilot told the manager that he had already “done all of those things.” 11 Feathering means to rotate the propeller blades so that the blades are parallel to the line of flight to reduce drag and prevent further damage to an engine that has been shut down. 12 The pilot stated that he did not follow Air Sunshine’s procedures for an in-flight engine failure because he knew which engine had failed; therefore, he chose to immediately shut down the right engine. He added that he did not follow the engine failure checklist because he was “too busy flying the airplane.” For more information about Air Sunshine’s in-flight engine failure procedures, see section 1.17.1.1. 13 The pilot and both passengers reported that the right propeller continued turning until the airplane contacted the water. 14 The airplane was equipped with a global positioning system, which the pilot used to determine the airplane’s distance from the airport.

Factual Information 4 Aircraft Accident Report The station manager stated that he then alerted local agencies about the emergency and instructed another Air Sunshine pilot, who had just taken off from Marsh Harbor, Bahamas, for FLL, to divert that flight toward flight 527 and follow the airplane until it reached the airport. The Air Sunshine pilot transmitted a distress call for flight 527, which the pilot of a nearby flight (Gulf flight 9267) heard and relayed to the Federal Aviation Administration (FAA) Air Route Traffic Control Center (ARTCC), Miami, Florida. The pilot stated that, after talking to the station manager, he slowed the airplane to about 95 KIAS to try to maintain altitude. The pilot stated that, once he descended from about 1,500 to 1,000 feet, he realized the airplane could not make it to the airport and that he would have to ditch the airplane. The pilot stated that he ditched the airplane parallel to the waves with the flaps retracted. He added that, at the time of the ditching, the winds were about 15 knots, and the outside air temperature was about 80° to 90° Fahrenheit (F). The passenger in the copilot seat stated that the pilot did a good job ditching the airplane. He stated that he noticed a placard on the instrument panel with instructions for ditching, which stated that the airspeed should be kept in the “blue zone,” and that the airspeed was within this zone during the ditching. Adult passengers described the contact with the water as “very hard.” They stated that the airplane landed “flat” and that it did not dive into the water. During postaccident interviews, the passengers stated that the pilot did not instruct them to retrieve their PFDs or to assume a brace position before contact with the water. The passengers stated that the only time the pilot addressed them after the right engine failed and before the airplane contacted the water was to tell them to “calm down.” The airplane was located at 26° 45.547' north latitude and 77° 31.642' west longitude. The accident occurred during daylight hours. 1.2 Injuries to Persons Injuries Flight Crew Cabin Crew Passengers Other Total Fatal 0 0 2 0 2 Serious 0 0 0 0 0 Minor 1 0 5 0 6 None 0 0 2 0 2 Total 1 0 9 0 10

Factual Information 5 Aircraft Accident Report 1.3 Damage to Airplane The airplane sustained substantial damage. 1.4 Other Damage No other damage was reported. 1.5 Personnel Information 1.5.1 The Pilot The pilot, age 46, was hired by Air Sunshine in September 1995. He held an airline transport pilot (ATP) certificate, which was issued March 7, 1998, with a multiengine land rating. Additionally, he held a commercial pilot certificate with a single-engine land rating and a certified flight instructor (CFI) certificate with single-engine, multiengine, and instrument ratings. The pilot held an FAA first-class medical certificate, dated June 9, 2003, with no limitations. According to the pilot, he began flight training at Aviation Training, Hayward, California. The pilot reported that, before he began working for Air Sunshine, he worked as a first officer on Embraer 110 airplanes for Payam Aviation Services, Tehran, Iran, for 2 years. The pilot began working for Air Sunshine in September 1995, performing clerical work for about 6 months before starting the company’s flight training. He served as first officer on the company’s Embraer 110 for about 1 1/2 years, during which time he earned his ATP certificate. In 1998, he upgraded to captain on the Cessna 402. He resigned from Air Sunshine on September 29, 2002. From September 30 to November 11, 2002, the pilot received flight training at Arrow Air, Inc., in Miami.15 The pilot left Arrow Air because he could not complete the training.16 On November 23, 2002, the pilot was rehired by Air Sunshine. Air Sunshine records indicated that the accident pilot had accumulated a total flying time of about 8,000 hours, about 5,500 hours of which were as pilot-in-command (PIC) and about 5,000 hours of which were in Cessna 402 airplanes. He had flown about 251, 69, 13, and 6 hours in the last 90, 30, and 7 days, and 24 hours, respectively. The pilot’s last PIC line check occurred on July 9, 2002; his last PIC proficiency check occurred on January 14, 2003; and his last recurrent ground training occurred on June 14,

1. A search of FAA records found no evidence of enforcement actions.

15 Arrow Air is a 14 CFR Part 121 supplemental all-cargo air carrier. During the time that the pilot was in training, the company operated McDonnell Douglas DC-8 and Lockheed L-1011 airplanes. 16 A review of Arrow Air’s simulator training records for the pilot revealed that he had received a large number of “unsatisfactory” grades. Further, the records indicated that the pilot needed to improve his scanning and checklist skills, including response and organization.

Factual Information 6 Aircraft Accident Report FAA records revealed that the pilot had been involved in an incident on June 12, 1999, in which the nose landing gear collapsed during landing at FLL. The pilot and passengers were not injured, and the airplane sustained minor damage. The records also revealed that the pilot was involved in an accident on March 16, 2000, in which a tire failed during takeoff from FLL.17 The pilot aborted the takeoff but was unable to keep the airplane on the runway. The pilot and passengers were not injured, and the airplane received substantial damage. Further, a review of the FAA’s Program Tracking and Reporting System (PTRS) records revealed that, on September 13, 2000, the pilot failed a ramp check because his airplane was found to have numerous discrepancies and his passenger briefing was found to be inadequate. As previously stated, the pilot was scheduled for a 2-day trip sequence on July 12 and 13, 2003. Between 0900 and 1700 on July 12th, the pilot flew five flights and accumulated about 5 hours of flight time. All of the flights were conducted in the accident airplane. The pilot stated that, after the last flight (FLL to SRQ), he ate, watched some television, and went to bed between about 2230 and 2300. The pilot stated that he awoke about 0730 on July 13th and arrived at SRQ about 0830 to report for the second day of the trip sequence, which consisted of five scheduled flights starting about 0930. Each flight was expected to last about 1 hour. The pilot completed three of the scheduled flights before the accident flight occurred. 1.5.1.1 Flight Check History Between April 1983 and February 1998, the pilot received the following notices of disapproval from the FAA: • In April and May 1983, the pilot received notices of disapproval because he failed the entire flight test portion of the flight checks18 he was receiving for his private pilot certificate. On June 22, 1983, the pilot was rechecked successfully, and he received his private pilot certificate. • On October 30, 1985, the pilot received a notice of disapproval because he failed the “holding” and the “recovery from an unusual attitudes” portions of the flight check he was receiving for his instrument rating. On November 8, 1985, the pilot was rechecked successfully, and he received his instrument rating. • In December 1987 and February 1988, the pilot received notices of disapproval because he failed the entire flight test portion of the flight checks he was receiving for his CFI certificate. On March 17, 1988, the pilot was rechecked successfully, and he received his CFI certificate. 17 A description of this accident, MIA00LA109, can be found on the Safety Board’s Web site at http://www.ntsb.gov. 18 If a pilot receives a notice of disapproval for a flight check, the pilot can be required to be rechecked on the complete flight check or on designated portions of the flight check.

Factual Information 7 Aircraft Accident Report • In July 1988 and May 1989, the pilot received notices of disapproval because he failed the entire flight test portion of the flight checks he was receiving for his CFI instrument rating. In August 1989, he received another notice of disapproval because he failed the “holding” portion of the flight check and did not complete three other portions of the check. On December 8, 1989, the pilot was rechecked successfully, and he received his CFI instrument rating. • In February 1998, the pilot received a notice of disapproval because he failed the “nondirectional beacon approach” portion of the flight check he was receiving for his ATP certificate. On March 7, 1998, the pilot was rechecked successfully, and he received his ATP certificate. 1.5.2 The Director of Maintenance Air Sunshine’s Director of Maintenance was hired by the company in March 1997 as a mechanic; seven months later, he was promoted to Director of Maintenance. On October 28, 1989, the Director of Maintenance applied for his airframe and powerplant (A&P) certificate based on work experience19 he obtained while working as an assistant mechanic from March 1985 to the date of the application. On October 24, 1990, the director took the oral and practical examinations required by 14 CFR 65.79.20 He passed all of the oral examinations; however, he failed the following portions of the practical exam: Section I, General – Airframe and Powerplant, subsections (A) weight and balance and (B) completion of FAA Form 337; and Section IV, Powerplant Theory and Maintenance, subsection (A) troubleshooting of turbine engines. The director received additional training in these areas and retook the practical exam on October 30, 1990, at which time he received his A&P certificate. A search of FAA records found no evidence of enforcement actions. The Director of Maintenance reported that, from March 1985 to August 1990, he worked as an assistant mechanic on Cessna 402 airplanes at Airways International, a 14 CFR Part 135 on-demand charter operator in Miami. From January 1988 to March 1989, he also worked part-time as an assistant mechanic on McDonnell Douglas DC-10 and Lockheed L-1011 airplanes at Eastern Airlines in Miami. From mid-1990 to mid-1996, he worked as a mechanic at Airways International. From August 1996 to March 1997, he worked as a mechanic on Cessna 402, 210, and 206; Piper Cherokee; Britten-Norman Islander; and Beechcraft 55 and 58 airplanes at Flightline of America, Pembroke Pines, Florida. 19 According to 14 CFR 65.77, “Experience Requirements,” “each applicant [for a mechanic certificate or rating]…must present either an appropriate graduation certificate or certificate of completion from a certificated aviation maintenance technician school or documentary evidence of…at least 30 months of practical experience concurrently performing the duties appropriate to both the airframe and powerplant ratings.” 20 According to 14 CFR 65.79, “Skill Requirements,” “each applicant [for a mechanic certificate or rating]…must pass an oral and a practical test on the rating he seeks. The tests cover the applicant’s basic skill in performing practical projects on the subjects covered by the written test for that rating. An applicant for a powerplant rating must show his ability to make satisfactory minor repairs to, and minor alterations of, propellers.”

Factual Information 8 Aircraft Accident Report 1.5.3 The Assistant Mechanic Air Sunshine’s assistant mechanic was hired by the company on June 6, 2000, to work in San Juan, Puerto Rico. In March 2003, he transferred to the company’s facility at FLL. The assistant mechanic did not have an A&P certificate. On March 31, 2003, the Director of Maintenance signed off a Certificate of Training for the assistant mechanic, indicating that he had completed 30 hours of basic indoctrination training. On April 30, 2003, the director signed off a Certificate of Training for the assistant mechanic, indicating that he had completed 60 hours of aircraft subjects training. On June 30, 2003, the director signed off a Certificate of Training for the assistant mechanic, indicating that he had completed 200 hours of on-the-job training for the “entire aircraft, airframe, engine, propeller, accessories, etc.” 1.6 Airplane Information The accident airplane, serial number 402C0413, was manufactured by Cessna Aircraft Company on November 24, 1980. The airplane was operated by several airlines21 before being sold to Tropical International Airlines, Inc.,22 on August 29, 1997. From mid-1997 to late 2000, the airplane was kept at the company’s maintenance facility at FLL. Air Sunshine’s President stated that, during this time, extensive maintenance was being performed on the airplane, including left and right engines and propellers replacement, sheet metal repair, corrosion treatment, and landing gear repair, to make it airworthy. Tropical International Airlines leased the airplane to Air Sunshine on November 1, 2000.23 The airplane was inspected in accordance with Air Sunshine’s FAA Approved Aircraft Inspection Program (AAIP) on November 20, 2000, and found to be airworthy.24 The airplane was added to the company’s operations specifications on December 6, 2000. The airplane was configured with a pilot seat (left side), a copilot seat (right side), and eight passenger seats. (See figure 1.) The airplane was equipped with a window escape hatch adjacent to the pilot seat (1A); an emergency escape hatch adjacent to seats 2B and 3B; and a two-section outward opening airstair door (main cabin door) adjacent to seats 4A and 5A, the lower portion of which was equipped with stairs. The pilot and copilot seats were equipped with lapbelts and single-strap shoulder harnesses, and the passenger seats were equipped with lapbelts. 21 On March 1, 1992, the airplane was involved in a nose landing gear collapse while being operated by Airways International. For more information about this accident, MIA92IA090, see the Safety Board’s Web site at http://www.ntsb.gov. 22 Tropical International Airlines was owned and operated by the same people who own and operate Air Sunshine. 23 The lease agreement stated that Air Sunshine would be responsible for all expenses, including maintenance. 24 For more information about Air Sunshine’s AAIP, see section 1.6.1.1

Factual Information 9 Aircraft Accident Report According to the load manifest form for the accident flight, the airplane’s takeoff weight was about 6,644 pounds, including 890 pounds of passenger weight,25 350 pounds of baggage weight, and 800 pounds of fuel weight. The airplane’s takeoff center of gravity (CG) was 154.61 inches aft of the reference datum. After the airplane was retrieved from the water,26 the baggage was removed from the airplane, dried, and weighed. The baggage weighed 440.85 pounds, 90 pounds more than the amount that was entered on the load manifest form. After applying the additional 90 pounds, the weight and CG were still within acceptable limits.27 1.6.1 Engines and Propellers The airplane was equipped with two Teledyne Continental Motors (TCM) TSIO-520-VB reciprocating engines. These engines are turbo-charged and fuel-injected with six horizontally opposed air-cooled cylinders. The engines are rated for 325 horsepower at a power setting of 2,700 rpm with 39 inches Hg manifold pressure up to an altitude of 12,000 feet. Figure 1. Interior configuration of the accident airplane. 25 Actual passenger weights were used to calculate the total passenger weight. 26 The airplane was retrieved from the water on August 3, 2003. The retrieval was delayed because of choppy waters. 27 According to the Cessna 402C Pilot Operating Handbook, the airplane’s maximum gross takeoff weight is 7,210 pounds, and the maximum gross landing weight is 6,850 pounds. The maximum forward CG for flight 527 was 151.2 inches aft of the reference datum, and the maximum aft CG for the flight was 160.7 inches.

Factual Information 10 Aircraft Accident Report The engine cylinders incorporate an overhead inclined valve design. The cylinders have updraft intake inlets and downdraft exhaust outlets mounted to the underside of the cylinder heads. Each of the six cylinders is attached to the engine case by a series of threaded studs, through bolts, and nuts. Six 7/16-inch, 20 threads-per-inch studs are threaded into the case half for exclusive use at each cylinder location and are held down by 6-point nuts. Additional studs are positioned between the cylinders and are shared by adjacent cylinders. Two 1/2-inch through bolts, which are located at the engine crankshaft main bearing positions, are either shared by opposed cylinders or the opposite crankcase half and are held down by 12-point nuts. The right engine, serial number 529092, and the left engine, serial number 811069-R, were manufactured by TCM on February 1, 1991, and January 1, 1997, respectively. Airmark Overhaul, Inc., in Fort Lauderdale28 overhauled the right and left engines on December 14 and December 21, 1999, respectively.29 At the time of overhaul, the right and left engines had times since new of 3,582.6 flight hours and 2,400.0 flight hours, respectively. The right and left engines were installed on the accident airplane on October 10 and 7, 2000, respectively. The last routine engine maintenance, which included changing the oil, inspecting the oil filter, looking for leaks, and performing a ground run-up, was conducted on July 8, 2003, and the time since overhaul for both engines at that time was 2,246.5 flight hours. At the time of the accident, both engines had a time since overhaul of 2,270.6 flight hours.30 The airplane was equipped with two McCauley Propeller Systems 3AF32C505-C three-bladed, dual-acting, constant-speed propellers. The blades are counterweighted to help move them toward higher blade angles (that is, toward feather) during operation. A feather spring inside the propeller moves the blades to the high-pitch (feather) stops. A centrifugal start-lock system, which uses spring-loaded pins that engage the piston as the propeller speed drops below approximately 600 rpm, prevents the blades from traveling all the way to feather during normal engine shutdowns, which reduces the load on the engine during subsequent engine starts. 1.6.1.1 Air Sunshine’s Approved Aircraft Inspection Program As a 14 CFR Part 135 operator, Air Sunshine had the option to operate either under the manufacturers’ maintenance inspection programs or to develop and receive FAA approval for its own maintenance inspection program. From 1982 to 1992, Air Sunshine operated under the manufacturers’ (Cessna, TCM, and McCauley Propeller) maintenance inspection programs. In early 1992, under the oversight of the Fort Lauderdale Flight Standards District Office (FSDO), Air Sunshine developed and received approval for its own inspection 28 Airmark Overhaul is an FAA-approved maintenance vendor for Air Sunshine. 29 Maintenance records were not available from the dates of manufacture of the right and left engines to the dates of the overhauls. 30 For information about TCM’s recommended overhaul limit and Air Sunshine’s overhaul interval, see section 1.6.1.3.

Factual Information 11 Aircraft Accident Report program. The company’s initial AAIP was a 3-phase, 60-hour inspection program. A different phase was performed every 60 hours of operation along with a routine servicing check, which included an engine oil change, a ground run-up, and a visual inspection of the airframe. Phases 1 through 3 comprised one full cycle, and an airplane had to complete one full cycle (that is, the entire aircraft had to have been inspected) every 180 hours of operation. On November 4, 2002, Air Sunshine submitted revision No. 10, which proposed to change the company’s AAIP to a 6-phase, 60-hour inspection program, to the FAA for approval. On January 9, 2003, the FAA approved the change,31 and the 6-phase, 60-hour inspection program was in effect at the time of the accident. Each of the six phase inspections focused on one major airplane section. Phase 1 covered the powerplants, including a focused engine inspection and a differential compression check of the engine cylinders; phase 2 covered the wings; phase 3 covered the cabin; phase 4 covered the landing gear; phase 5 covered the fuselage; and phase 6 covered the empennage. Phases 1 through 6 comprised one full cycle, and an airplane had to complete one full cycle every 360 hours of operation. The last phase 1 inspection was performed at FLL from June 12 to 14, 2003. During this inspection, each engine was determined to have a time since overhaul of 2,187 flight hours. 1.6.1.2 Differential Compression Checks TCM Service Bulletin (SB) 03-3 states that differential compression checks are conducted to identify leaks in the engine cylinders and the sources of any leaks that were found and that leaks can be caused by abnormal or excessive wear inside the engine cylinders or their components, problems with the valves or valve seats, and cracks in the cylinders. The SB also states that compression checks should be conducted “at each 100 hour interval, annual inspection or when cylinder problems are suspected.”32 According to SB 03-3, before conducting the differential compression check, the acceptable pressure leakage limit for the equipment being used and the atmospheric conditions at the time that the check is conducted need to be established. SB 03-3 contains the following instructions on how to perform differential compression checks on all of its engines: • remove the most accessible spark plug from each of the six cylinders on each engine; • turn the engine crankshaft by hand in the direction of rotation until the piston is coming up on top dead center at the end of the compression stroke; 31 In early 1998, Air Sunshine requested that its operating certificate be transferred from the FAA’s Fort Lauderdale FSDO to its San Juan FSDO. The FAA granted the request, and the transfer took place on June 2,

1. The company’s operating certificate was under the jurisdiction of the San Juan FSDO when the

company applied and was approved to change its AAIP. For more information about FAA oversight of Air Sunshine, see section 1.17.2. 32 For information about the postaccident change to the differential compression check interval and other changes to Air Sunshine’s AAIP, see section 1.17.2.5.

Factual Information 12 Aircraft Accident Report • install a cylinder adapter in the spark plug hole and connect a differential pressure tester to the cylinder adapter and slowly open the cylinder pressure valve and pressurize the cylinder to 20 pounds per square inch (psi); • continue to rotate the engine in the direction of rotation, against the pressure, until the piston reaches top dead center (that is, with the piston at the end of the compression stroke and the beginning of the power stroke); • open the cylinder pressure valve completely; • move the propeller slightly back and forth with a rocking motion while directing regulated pressure of 80 psi into the cylinder and adjust regulator as necessary to maintain a pressure gauge reading of 80 psi; and • record the pressure indication on the cylinder pressure gauge. The difference between the pressure directed into the cylinder (80 psi) and the cylinder pressure shown on the regulator pressure gauge is the amount of leakage through the cylinder. Any cylinder pressure level greater than that established as the acceptable pressure leakage limit indicates an acceptable operating condition for a reciprocating engine. The SB recommends that, if the cylinder pressure levels are less than the acceptable pressure leakage limit, cylinder borescope inspections should be conducted. 1.6.1.2.1 June 12 to 14, 2003, Differential Compression Checks As noted previously, the last differential compression checks performed on the accident airplane’s engines occurred from June 12 to 14, 2003, as part of the airplane’s last phase 1 inspection. According to the Director of Maintenance, he performed the checks on the left engine while the assistant mechanic watched and then recorded the readings in the inspection record. The cylinder differential compression check form33 in Air Sunshine’s Maintenance Manual contains the following: “CAUTION - It is recommended that someone hold the propeller during this check to prevent possible rotation.” (See figure 2.) The Director of Maintenance stated that, after completing the checks on the left engine, he asked the assistant mechanic if he felt capable of performing the checks on the right engine without supervision. The director stated that the assistant replied that he could perform the checks; as a result, the director left the assistant to perform the checks by himself without supervision. According to the director, he asked the assistant mechanic to record the compression check readings for the right engine on a sheet of paper so that he could review them before making the entries in the cylinder differential compression check form in the inspection records; however, the assistant mechanic recorded the readings directly in the inspection record. Figure 2 also shows the compression check readings (in psi) recorded in the inspection record by the assistant mechanic for both engines. Accounting for the check equipment used at the time that the checks were performed, the Safety Board determined that the acceptable pressure leakage limit was 54 psi. 33 The cylinder differential compression check form is part of the company’s AAIP phase 1 inspection package.

Factual Information 13 Aircraft Accident Report Note: According to the assistant mechanic and the Director of Maintenance, the number recorded for right engine cylinder No. 3 was “55.” (Safety Board investigators who reviewed the document noted that the number could be either “55” or “25.”) The assistant mechanic’s signature and A&P certificate number have been redacted. Figure 2. Cylinder differential compression check form.

Factual Information 14 Aircraft Accident Report During postaccident interviews, the assistant mechanic stated that he had never performed a differential compression check before conducting the checks on the accident airplane’s right engine. The assistant stated that his normal duties included changing oil, tires, cables, and spark plugs and cleaning the airplane. When a Safety Board investigator asked the assistant how to perform the compression check, he stated only that the spark plugs had to be removed from the cylinders and that the piston had to be at top dead center on its compression stroke. The Director of Maintenance stated that, as he was reviewing and signing off on the day’s maintenance work, he noticed that two of the readings obtained from the compression checks of the right engine (0 psi for the No. 2 cylinder and 20 psi for the No. 4 cylinder)34 were “highly questionable.” The director stated that he asked the assistant mechanic if he had been careful to get the piston at top dead center on its compression stroke on each cylinder when he performed the check. The director indicated that, although the assistant stated that he had been careful to get the piston into its required position, he appeared uncertain when asked specifically about the two questionable cylinder readings. The director told the assistant mechanic that the compression checks on the right engine cylinders would have to be repeated. According to the Director of Maintenance, after he repeated the checks on the right engine, all of the cylinder’s compression readings were in the 70-psi range, including the two cylinders with low readings from the first compression checks. The director stated that, when he did the rechecks, he was careful to get the piston at top dead center on its compression stroke and hold the propeller while adding the pressure. He added that, if the compression level readings had remained low, he would have grounded the airplane. The director stated that he had the assistant mechanic observe the checks and record the readings on a sheet of paper. The assistant mechanic stated that he gave the sheet of paper to the director but that he did not see what the director did with the paper. The director stated that he recorded the corrected readings on a new cylinder differential compression check form; however, company personnel did not locate the corrected form. The director stated that he did not conduct cylinder borescope inspections on cylinder Nos. 2 and 4 because the repeated compression checks yielded readings that were within acceptable limits. The Director of Maintenance stated that the company had removed and replaced an engine cylinder assembly about five or six times in the last 3 years. The director stated that, before applying torque to the cylinder studs, maintenance personnel coated the studs with an aluminum-copper-graphite, lithium-based antiseize compound manufactured by Permatex. TCM SB 96-7B specifies that clean 50-weight aviation-grade engine oil should be applied to the studs and through bolts before applying torque. Permatex does not recommend using antiseize compound in high-vibratory environments because such use could contribute to the loss of torque. 34 The Director of Maintenance stated that he would consider any reading below 58 psi to be too low and that low readings would require that the cylinder be rechecked. The director did not mention that the reading recorded for cylinder No. 3 was too low, even though he stated that it was “55.”

Factual Information 15 Aircraft Accident Report 1.6.1.3 Time Between Overhauls TCM Service Information Letter 98-9A recommends that TSIO-520-VB engines have a time between overhaul (TBO) of 1,600 hours. Air Sunshine began operating its airplanes equipped with TSIO-520-VB engines in accordance with this recommendation. After Air Sunshine’s inspection program received FAA approval in early 1992,35 the company applied to the Fort Lauderdale FSDO for a 200-hour extension of its TBO per the procedures outlined in FAA Order 8300.10, Airworthiness Inspector’s Handbook.36 The FAA principal maintenance inspector (PMI) for Air Sunshine granted its request and allowed the company to increase its TBO by 200 hours. From late 1992 to late 1995, Air Sunshine applied for four additional TBO extensions (of 200 hours, 200 hours, 100 hours, and 100 hours) for a total TBO extension of 800 hours. The FAA granted approval for all of the requested extensions, which resulted in a TBO of 2,400 hours. According to FAA Order 8300.10, approval of TBO extensions is granted based on “satisfactory service experience and/or a teardown examination of at least one exhibit engine.” Neither the FAA nor Air Sunshine had retained the paperwork that related to the five requests for, and approvals of, the extensions of the company’s TBO for longer than the 2 years required by the FAA. However, Air Sunshine provided the Safety Board with four teardown reports prepared by Airmark Overhaul (which were submitted as support for the first four TBO extension requests) and one report prepared by TCM (which was submitted as support for the last request). These reports were dated July 16, 1992; November 17, 1992; March 20, 1994; January 20, 1995; and October 9, 1995. All of the teardowns conducted by Airmark and TCM were of TCM-rebuilt engines. After Air Sunshine received approval for the last 100-hour TBO extension, the company petitioned the Fort Lauderdale FSDO to change the company’s operations specifications to reflect the 2,400-hour TBO, and the Fort Lauderdale FSDO granted the request under the condition that the company’s airplane engines be rebuilt by TCM. In late August/early September 1999, after Air Sunshine transferred its operations certificate to the San Juan FSDO, the company petitioned the San Juan FSDO to remove from the company’s operations specifications the requirement that TCM rebuilt engines must be used. In a letter dated September 9, 1999, the FAA PMI for Air Sunshine stated that he would grant the company’s request provided it (1) monitored the performance of newly overhauled engines and reported any abnormal conditions to the San Juan FSDO,37 (2) used 35 Air Sunshine was required to have its own AAIP to receive FAA approval for TBO extensions. 36 FAA Order 8300.10 indicates that TBO extensions for reciprocating engines can be granted in increments of up to 200 hours. 37 A review of Air Sunshine and FAA records revealed that the company made no reports to the FAA between the date of this letter and the date of the accident in which the company reported any abnormal conditions of its overhauled engines.

Factual Information 16 Aircraft Accident Report the approved overhaul facilities listed in its Maintenance Manual vendor list,38 and (3) established standards for parts to be used during the overhaul process. The PMI added that, if the engines did not perform satisfactorily, the company’s operations specifications would be amended back to the original TBO of 1,600 flight hours.39 1.7 Meteorological Information The closest airport to the location of the airplane wreckage was Grand Bahamas International Airport (MYGF), Freeport, Bahamas, which was about 63.9 nautical miles from where the airplane was located. MYGF does not have an automated weather system. Weather observations are made by an on-site weather observer and are recorded in coordinated universal time. Eastern daylight time is 4 hours behind coordinated universal time. The 1900 meteorological aerodrome report (METAR) (1500 local time, which was about 30 minutes before the ditching) indicated that winds were 160° at 8 knots, visibility was 10 nautical miles, clouds were broken at 2,000 feet, the temperature was 88.5° F, the dew point was 74.1° F, and the altimeter setting was 30.09 inches of Hg. The 2000 METAR (1600 local time, which was about 30 minutes after the ditching) indicated that winds were 140° at 10 knots, visibility was 10 nautical miles, a few clouds were at 1,500 feet and were scattered at 2,000 feet, the temperature was 88.5° F, the dew point was 74.1° F, and the altimeter setting was 30.08 inches of Hg. 1.8 Aids to Navigation The distance measuring equipment on the MYAT VOR40 had been inoperative for several years. 1.9 Communications No communication problems were reported. 1.10 Airport Information MYAT was the destination airport for flight 527. The airplane was ditched about 7.35 nautical miles west-northwest of the airport. 38 After its operations specifications were amended, Air Sunshine started using Airmark Overhaul, a company on the FAA-approved vendor list, to overhaul its engines. 39 For information about postaccident changes to Air Sunshine’s operations specifications, see section 1.17.2.5. 40 VOR stands for very high frequency omnidirectional range.

Factual Information 17 Aircraft Accident Report 1.11 Flight Recorders The accident airplane was not equipped with either a CVR or an FDR and was not required to be so equipped. 1.12 Wreckage and Impact Information 1.12.1 General The airplane was submerged in water for about 3 weeks after the accident. Underwater photographs taken before the airplane was recovered from the water showed that the window escape hatch adjacent to the pilot seat (1A) was open. The emergency escape hatch adjacent to seats 2B and 3B was found closed. The top and bottom portions of the main cabin door adjacent to seats 4A and 5A were found open. Impact damage was noted on the lower fuselage skin from the wing main spar forward, and damage was noted on the nose cone. The landing gear was found retracted. All of the airplane’s major components,41 except for the left aileron and the outboard section of the right elevator and balance weight, were recovered attached to the airplane. The separated sections were not recovered. The rudder trim tab actuator was found positioned between 5° and 10° trailing edge tab right; the elevator trim tab actuator was found positioned at 15° trailing edge tab down. The left flap was found extended about 15°, and the cowl flap was nearly closed. The right flap was found extended about 15°, and the cowl flap was open. An oil sheen was noted on the exterior surface of the right engine upper cowling, from the louvers aft to the trailing edge of the wing; on the interior surface of the upper cowling; and on the upper and lower exterior surfaces of the horizontal stabilizer. The left fuel selector valve handle in the cockpit was found positioned to the left main fuel tank; the right fuel selector valve handle was missing; therefore, its position could not be determined. The emergency crossfeed/shutoff valve handle was found positioned to the crossfeed position. The left and right auxiliary fuel pump switches were found in the off position. The left and right cowl flap controls were found out (closed) and in (open), respectively. Both the flap selector and flap position indicator were found at about 15° flaps extended,42 and the landing gear selector handle was found in the retracted position. The elevator trim indicator was found positioned to full nose up. The aileron trim indicator was found positioned slight left wing down. The rudder trim indicator was found positioned nose left. 41 A major component is necessary for an airplane to sustain flight. 42 During postaccident interviews, the pilot stated that he did not extend the flaps during the flight. The pilot stated that he would normally extend the flaps when he was about 3 miles from an airport. When he was asked how the flaps became extended to 15°, the pilot replied that after the ditching, some of the passengers crawled over him and that one of them might have hit the switch that extended the flaps. He stated that the flaps were extended electrically and that he had left the power on after the ditching.

Factual Information 18 Aircraft Accident Report All seats were found attached to the floor and were undamaged. All lapbelts were present and were found to operate normally. The seatback stowage pockets for seats 2A and 2B did not contain safety briefing cards;43 all of the other stowage pockets contained briefing cards. Six packaged PFDs were found in the airplane. One PFD was found forward of the pilot seat, and one PFD was found forward of the copilot seat. The remaining four PFDs were found in their stowage areas (under seats 2A, 2B, 3A, and 5A). The PFDs were brought to the Safety Board’s headquarters in Washington, D.C., and were examined on August 28, 2003. The sealed plastic pouches were opened, and the PFDs were inflated by pulling the inflation rings. All of the PFDs were undamaged and were found to operate normally. Inspection records found inside the plastic pouches containing the PFDs indicated that they had been inspected within the past 5 years, in accordance with Federal regulations. 1.12.2 Engines and Propellers The left engine was attached to the airframe, and the propeller was attached to the engine. The outboard lower engine cowling had separated and was not located. The left engine was removed and examined, under Safety Board supervision, at TCM’s facility. All six cylinders and their valves were intact. No evidence of preexisting damage was found. The left propeller was removed and examined, under Safety Board supervision, at McCauley Propellers’ facility. The left propeller hub was intact and undamaged, and all three blades were installed in the hub. Examination of the left propeller revealed no evidence of preimpact damage. The feather-stop mechanism was attached and undamaged, and the start-lock mechanism44 was intact and undamaged. The right engine was attached to the airframe in its normal position, and the propeller was attached to the engine. Damage was noted on the leading edge skin from the engine outboard to the wing tip; the leading edge skin from the engine nacelle inboard of the wing root was crushed up and aft. The lower inboard engine cowling was separated and was not recovered; the lower outboard engine cowling was in place. The right engine No. 2 (inboard aft) cylinder was found separated from the engine crankcase, exposing a portion of the crankshaft, and held onto the engine by the exhaust pipe tubing and by an electrical cable that was secured to the cylinder assembly by an adel clamp. The two magnetos were found protruding through the upper outboard engine cowling but remained attached to the engine by ignition leads. (See figure 3.) Two 6-point flanged nuts, one 12-point flanged nut with a fractured threaded piece, and a nonfractured connecting rod were recovered from the engine compartment area. Piston ring pieces were found in the partially separated No. 2 cylinder assembly. 43 The stowage pockets on these seatbacks held the briefing cards for use by the passengers in seats 3A and 3B. For more information about the airplane’s interior configuration, see section 1.6. 44 As noted previously, the start-lock mechanism is a system designed to prevent the propeller from traveling all the way to feather during normal engine shutdowns.

Factual Information 19 Aircraft Accident Report The right engine was removed and examined, under Safety Board supervision, at TCM’s facility. After engine disassembly at TCM, some of the right engine components were brought to the Safety Board’s Materials Laboratory in Washington, D.C., for further examination. For additional information about the metallurgical inspections of the right engine components, see section 1.16.3. The right propeller was removed and examined, under Safety Board supervision, at McCauley Propeller’s facility. The right propeller hub was intact and undamaged, and all three blades were intact and installed in the hub and appeared to be in the feathered position. The blade angles were measured as follows: blade No. 1 was 82.2°, blade No. 2 was 82.4°, and blade No. 3 was 82.3°. The feather angle for this propeller is 82.2° (+/-0.3°). All of the blade counterweights were present and in place. The propeller piston was undamaged, and the centrifugal weights and springs were in place. The piston rod and feathering spring were intact, in place, and undamaged. The feather-stop and start-lock mechanisms were intact and undamaged. Figure 3. Exterior of the upper outboard engine cowling.

Factual Information 20 Aircraft Accident Report 1.13 Medical and Pathological Information Fluid specimens obtained from the pilot were sent to the Royal Bahamas Police Force’s Forensic Science Laboratory for toxicological analysis. The fluid specimens tested negative for alcohol and drugs.45 According to the Rand Memorial Hospital (Freeport, Grand Bahamas) autopsy report, the cause of death for the deceased 4-year-old child was “drowning secondary to plane crash.” According to the Princess Margaret Hospital (Freeport, Grand Bahamas) pathology report, the deceased adult passenger had injuries “consistent with the history of plane crash accident.” Further, the report stated that the deceased adult passenger had a cerebral contusion and rib fractures. The report also stated that a “section of both lungs showed edema and congestion.” 1.14 Fire No evidence of an in-flight fire was found, and the accident did not result in a postcrash fire. 1.15 Survival Aspects 1.15.1 General The pilot reported that he was not wearing his shoulder harness when the airplane contacted the water and that he hit his head on the instrument panel during the ditching.46 During postaccident interviews, one passenger stated that the pilot “did not appear to have much clarity and was not particularly coherent” after the ditching. Another passenger stated that he “took charge of the situation because the pilot was incoherent in the water.” The passenger also stated that the pilot “did not look like he could swim” and that he had to give the pilot his PFD. The passenger in the copilot seat reported a bump on his head and a cut on his leg. The passenger stated that he was not wearing his shoulder harness during the ditching because the pilot had not informed him before the flight departed that his seat was so equipped. The passengers in seats 2A and 2B reported bruises on their hips from the lapbelts. The passenger in seat 3B reported a contusion on her forehead. After the airplane contacted the water, the pilot opened the pilot-side window hatch. The pilot, four adult passengers (from the copilot seat and seats 2A, 2B, and 3B), 45 The drugs tested in the postaccident analysis included benzoylecgonine, barbiturates, benzodiazapines, and opiates. 46 Title 14 CFR 91.105(b) requires that required flight crewmembers of a U.S.-registered civil aircraft keep their shoulder harnesses fastened while at their assigned duty stations during takeoff and landing.

Factual Information 21 Aircraft Accident Report and one child (who had been sitting on the passenger in seat 3B’s lap) evacuated the airplane through the pilot-side window escape hatch. One adult and three children (from seats 4A, 4B, 5A, and 5B) evacuated the airplane through the main cabin door. 1.15.2 Emergency Briefings Air Sunshine’s FAA-approved General Operations Manual, Section 4, “Emergency Procedures,” contains the following guidance to pilots on briefing passengers before a ditching: • review the emergency ditching evacuation procedures with the passengers; • instruct passengers to don life vests at that time, without inflating them in the airplane; • review the operation of the inflation ring and the manual/oral blow-up tubes; and • instruct passengers to inflate their life vests once they are outside of the aircraft. As noted previously, passengers reported that the pilot did not tell them to retrieve and don their PFDs before the airplane contacted the water. They stated that the only time he addressed the passengers after the right engine failed and before the airplane contacted the water was to tell them to “calm down.” As the result of a postaccident focused inspection of Air Sunshine (conducted from July 22 to August 29, 2003), the FAA instructed the company to amend its emergency ditching procedures.47 The amended procedures contain the following guidance to pilots on briefing passengers before a ditching: • instruct all passengers to don life vests as soon as any emergency occurs during overwater operation; • instruct passengers to familiarize themselves with emergency evacuation procedures, including special evacuation procedures for those passengers who are assisting others, such as children and handicapped individuals; • review ditching procedures before ditching, including instructing passengers to partially inflate their life vests through the use of the blow-up tubes; and • instruct passengers that, only once they have gotten outside the airplane, they should fully inflate their life vests by pulling the inflation ring. 1.15.3 Personal Flotation Devices Title 14 CFR Part 135 requires specific emergency equipment, including approved life preservers and rafts, a survival kit, and an emergency locator transmitter, to be 47 For more information about the FAA’s postaccident focused inspection of Air Sunshine, see section 1.17.2.4.

Factual Information 22 Aircraft Accident Report installed on airplanes that conduct extended overwater operations (that is, operate flights over water at a horizontal distance greater than 50 nautical miles from the nearest shoreline). Because Air Sunshine flight 527 did not qualify as an extended overwater flight, the airplane was not required to be equipped with such emergency equipment. However, 14 CFR 91.205 requires that aircraft operated for hire over water and beyond power-off gliding distance to shore be equipped with approved flotation gear that is readily available to each occupant.48 The airplane was equipped with 10 PFDs.49 According to the markings on the PFDs, they met the requirements of FAA Technical Standard Order (TSO) C-13e, which defines minimum performance standards for PFDs. The markings on the PFDs indicated that they were approved for use by adults and children and that children should have their PFDs put on them by adults per crew instruction. The PFDs on the airplane were vests with two separate symmetrically arranged chambers and a retention strap. The PFD is donned when a user inserts its head through a hole in the PFD and fastens the retention strap around its waist. A PFD is inflated when the user pulls an inflation ring that discharges carbon dioxide cartridges into the two chambers. The user can also inflate a PFD by blowing into a tube that is located on each chamber. A correctly donned and inflated PFD that meets the requirements of TSO C-13e should provide the user with 35 pounds of buoyancy, automatically correctly position the user in the water within 5 seconds, and hold the user’s nose and mouth “clear of the waterline.” Only 4 of the 10 PFDs installed on the airplane were retrieved and used by the passengers.50 The passenger in seat 3B, who was holding a child on her lap, retrieved the PFD from under her seat. The passenger in seat 5A retrieved three PFDs and put them on the three children accompanying her before the airplane contacted the water. According to the passenger in the copilot seat, he could not retrieve his PFD because it was wedged between the seat and the wall of the airplane. The passenger in seat 2A and another passenger who tried to help her stated that they could not retrieve the PFD for seat 2A “because the Velcro that closed the container [the fabric pouch] would not separate.” These two passengers stated that they exited the airplane without the PFD when the water reached knee level. The passengers who were not able to retrieve their PFDs did not try to retrieve them until the airplane contacted the water. Once the airplane occupants were in the water, airplanes circling the area at the time of the accident dropped several PFDs. The passengers retrieved some of these PFDs and distributed them. The adult female passenger (in seat 5A) and the child accompanying 48 This requirement applied to flight 527. 49 According to the President of Air Sunshine, after Tropical International Airlines purchased the airplane in 1997, that company installed the PFDs on the airplane, which were stowed in fabric pouches that the company had made. 50 As noted in section 1.12.1, the six PFDs that were still in the airplane were found undamaged and were capable of normal operation.

Factual Information 23 Aircraft Accident Report her who died after the evacuation were not wearing a PFD when they were recovered from the water. The passenger in seat 1B reported that he took the PFD off of the child who died after the evacuation. This passenger stated that, when he took the PFD from the child, it was not inflated and that one of the inflation chambers had a hole in it. The passenger stated that he provided the PFD to another passenger and that the undamaged chamber inflated normally.51 Another passenger stated that the other two children’s PFDs were also not inflated and that he inflated one chamber on each of their vests. No information indicates whether the other passengers donned their PFDs correctly. However, during postaccident interviews, none of the passengers appeared to be familiar with the proper donning and inflating procedures (for example, none of the passengers reported fastening the retention straps around their waists). Passengers reported that the airplane sank within several minutes after contacting the water. Passengers stated that they tried to stay together in the water; however, two groups were eventually formed, and, because of the waves, the two groups drifted apart. Passengers reported that two of the children traveling with the female passenger in seat 5A were extremely frightened when they entered the water and that they were frantic to the point that they were “dangerous” to nearby passengers who were treading water. Passengers also reported that the female passenger in seat 5A who was not wearing a PFD was seen floating face down shortly after entering the water. The passengers were in the water for about 1 1/2 hours before being rescued, as detailed in section 1.15.4. 1.15.4 Search and Rescue At 1533, the Air Sunshine pilot who had just taken off from Marsh Harbor transmitted a distress call. (That airplane’s altitude was too low to allow the pilot to contact the Miami ARTCC directly.) The pilot of Gulf flight 9267 heard the distress call and relayed the message to the Miami ARTCC. At 1540, the Miami ARTCC notified MYGF that Air Sunshine flight 527 was in the water. MYGF personnel responded that the airport did not have any helicopters and that, therefore, it could not assist with the search and rescue. At 1541, the Miami ARTCC notified the U.S. Coast Guard at Opa-Locka, Florida, that the flight 527 airplane was in the water. After receiving the notification, the U.S. Coast Guard launched from Air Station Miami one HH-65 (an Aerospaciale Dolphin helicopter), which departed about 1551 and arrived on scene about 1702, and one Falcon jet, which departed about 1606 and arrived on scene about 1636. In addition, the Coast Guard launched one HH-60J (a Sikorsky Jayhawk helicopter) from Andros Island, Bahamas, which departed about 1605 and arrived on scene about 1702.52 Two life rafts were dropped from the Falcon after it arrived on scene. One of 51 The deceased child’s PFD was not recovered; therefore, the condition of her PFD could not be determined. 52 According to the Coast Guard, about 1605, the winds at the crash site were about 11 knots, and the waves were about 4 feet high. The Coast Guard did not estimate wave height for the time of its arrival on scene.

Factual Information 24 Aircraft Accident Report the rafts landed near one of the groups of passengers53 and was used by two adult passengers; the other raft did not land near any of the passengers. A rescue diver from the HH-65 recovered the pilot, one child passenger, and two adult passengers, all of whom were hoisted into the helicopter and then flown to MYGF. According to the rescue diver from HH-60J, he found two children wearing PFDs, and each of the children was holding an arm of an adult female who was floating face down in the water and “appeared to be deceased.” The diver recovered the two children, removed one of the children’s PFDs, and placed the PFD on the deceased female.54 The rescue diver then recovered two additional adult passengers who were hanging onto one of the life rafts dropped from the Falcon. All of these passengers and the rescue divers from both helicopters were hoisted into HH-60J. At the request of a Royal Bahamian police officer, a private fishing boat went to the accident site about the same time as the helicopters arrived. Two men on the boat retrieved the bodies of two passengers. The flight crew of HH-60J stated that they saw occupants on the boat performing CPR on the two passengers. HH-60J dropped a rescue diver who determined that one of the passengers was a child. The rescue diver hoisted the child onto the helicopter and performed CPR on the child until landing at MYGF. The boat carried the deceased female passenger to MYGF. After arriving at the MYGF, all of the passengers that had been hoisted into HH-60J were transported to Rand Memorial Hospital. 1.16 Tests and Research 1.16.1 Cessna Airplane Performance Data The Cessna 402C Aircraft Information Manual, Section 5, “Performance,” contains a performance chart for estimating the airplane’s climb rate with one inoperative engine. Conditions for the use of the chart include the following: operative engine power at maximum (2,700 rpm and 39 inches Hg manifold pressure), fuel flow in the white arc on the fuel flow gauge,55 landing gear retracted, flaps at 0°, inoperative propeller feathered, wing bank 5° toward operative engine with about 1/2-ball56 slip indicated on the turn-and-bank indicator, and inoperative engine cowl flaps closed. Safety Board investigators used the information from Cessna’s performance chart and accounted for the 53 According to the commander of HH-60J, when the helicopter arrived on scene, the passengers were clustered in three groups, about 110 yards away from each other. 54 The rescue diver stated that he placed one of the children’s PFDs on the deceased female so that she would be easier to locate after the survivors were retrieved from the water. 55 According to Cessna’s Aircraft Information Manual, white arc is used for “(Takeoff and Engine Inoperative Power-Sea Level to 12,000 feet) 200.0 Pounds per hour (16.8 psi) to 210.0 Pounds per hour (18.0 psi).” 56 During coordinated, straight-and-level flight, the ball is centered between the turn-and-bank indicator’s reference lines. In the event of an engine failure, the pilot banks 5° toward the operative engine to ensure that about a 1/2-ball slip is indicated on the turn-and-bank indicator to create the most efficient bank angle, which creates minimum drag.

Factual Information 25 Aircraft Accident Report weight of the airplane (between 6,444 and 6,534 pounds),57 the outside air temperature (90° F), the winds (about 15 knots),58 and the altitude (3,500 feet) at the time that the right engine failed in estimating that the airplane would have had a climb rate of about 200 fpm if nothing had occurred to negatively affect the airplane’s performance. Cessna provided the following climb rate penalty data:59 flaps at 15° (the configuration at which the accident airplane was found) at 103, 100, and 95 knots yields penalties of -165, -155, and -145 fpm, respectively; a windmilling propeller (pilot and passenger statements indicated that the right engine propeller was windmilling, not feathered, after the right engine failed) yields a penalty of -400 fpm; cowl flap of inoperative engine open (the postaccident configuration in which the airplane’s right engine cowl flap was found) yields a penalty of -9 fpm; and protruding magnetos (the right engine magnetos penetrated the engine cowling in flight) yields a penalty of -4 fpm. 1.16.2 Airplane Performance Study The Safety Board conducted an airplane performance study to establish the effects that the pilot’s actions, airplane damage, and windmilling propeller had on the airplane’s performance after the right engine failed. Because the airplane did not have an FDR or a CVR and no radar data relating to the accident flight were available, the study used statements from the pilot, passengers, and Air Sunshine’s station manager to determine the sequence of the pilot’s actions throughout the flight. With the use of the data provided by Cessna and a range of average indicated airspeeds between 115 and 95 knots,60 the airplane performance study determined that the airplane’s descent rate was between about 560 and 212 fpm during its descent from 3,500 to 2,000 feet. The airplane traveled between about 5 and 10 nautical miles during this portion of the flight. With the use of a range of average indicated airspeeds between 105 and 90 knots, the study determined that the airplane’s descent rate was between about 429 and 360 fpm during its descent from 2,000 feet to the point of contact with the water. The airplane traveled about 7.6 nautical miles during this portion of the flight. At the time of the right engine failure, the airplane was about 20 to 25 miles from MYAT. The study determined that the airplane was airborne for at least 7 minutes after the right engine failed and before it contacted the water. At 90 knots, and with the engine damage, the airplane 57 The difference in weight would have caused less that a 40 fpm difference in the climb rate. 58 Airport weather data were obtained from Miami International Airport and MYGF. The data showed that the estimates provided by the pilot (the winds were about 15 knots, and the outside air temperature was 80° to 90° F) at the time of the ditching were accurate. 59 Cessna could not quantify the penalties for the following variables that also could have decreased the climb rate: operation of the airplane at greater or less than the recommended wing bank of 5° toward operative engine; operation of the airplane at greater or less than the recommended 1/2-ball slip on the turn-and-bank indicator; and operation of the airplane on a nonsteady descent (for example, decreasing pitch angle to increase speed and then reducing pitch to arrest descent rate). 60 According to the pilot, the blue radial on the accident airplane’s airspeed indicator, which shows the single-engine best climb rate, was pointing to about 105 knots.

Factual Information 26 Aircraft Accident Report could have tolerated a descent rate of an average of about 200 fpm and been able to maintain flight and reach MYAT. 1.16.3 Metallurgical Inspections 1.16.3.1 Right Engine Cylinder Assemblies The right engine No. 2 cylinder assembly was separated from the engine crankcase. The other five cylinder assemblies were intact and attached to the engine crankcase. The Nos. 1, 3, 4, 5, and 6 cylinder bores were covered with corrosive material and sand and salt residue, consistent with salt water immersion. No discernible damage to the cylinder assemblies or to the valves was noted. All of the valves and valve springs were intact and undamaged. The valve faces and springs were coated with sand, salt, and oil, and the faces were oxidized. The No. 2 cylinder assembly was generally intact with no apparent damage to the valves or cylinder head. The cylinder bore was covered by a layer of corrosive material; no large-scale marking, scoring, or gouging was found under the corrosion. The No. 2 cylinder skirt area (the inboard portion of the cylinder that projects into the engine crankcase when assembled) was damaged and deformed in multiple places. The damage displaced various portions of the inboard edge of the cylinder skirt both toward and away from the cylinder centerline. The spacing between the deformed areas was about equal to the distance between the No. 2 cylinder hold-down studs and through bolts. The cylinder base flange was also damaged with the two upper aft mounting holes (at the intact stud locations) distorted adjacent to the inboard (case side) surface. Five of the engine cylinder assemblies (Nos. 1 through 5) had markings on the heads and base flanges, identifying them as FAA Parts Manufacturing Approval components. The letters “EC” were steel-stamped into the cylinder head, indicating that the cylinders were manufactured by Engine Components, Inc (ECI). One of the valve rocker bosses on each of these cylinders was also marked with steel-stamped numbers 29689-1 through -5. The first five numbers corresponded to the work order number for the last engine overhaul performed by Airmark Overhaul, and the last number corresponded to the position of the cylinder (1 through 5). The cylinders were installed in their respective positions on the engine crankcase. The markings on the No. 6 cylinder were not consistent with those on an ECI-manufactured cylinder. The letters “DET” and “E” and the number “99” were steel-stamped into the cylinder head. One of the valve rocker bosses was marked with the steel-stamped number “33258-3,”61 and another of the rocker bosses was vibro-etched with the number “7-99.” 61 This work order number corresponded to a propeller strike inspection that was conducted on another one of the company’s engines, serial number 816113-R. For more information about this engine, see section 1.17.1.3.1.

Factual Information 27 Aircraft Accident Report 1.16.3.2 Right Engine Pistons The Nos. 1, 3, 4, 5, and 6 pistons from the right engine were intact. The No. 2 piston was found fractured into two large pieces and many small pieces. Only about 35 percent of the No. 2 piston was recovered. Magnified optical examinations of the fractures on the No. 2 piston found features consistent with overstress separations; no indications of preexisting cracking were found. On the largest piece, the piston was circumferentially fractured along the lower oil control ring and vertically in the plane of the piston pin but offset to one side. Deformation on the outer edge of the piston skirt adjacent to the fracture at the oil control ring groove was consistent with partial canting of the piston in the cylinder after the fracture occurred. 1.16.3.3 Right Engine Crankcase The left half of the right engine crankcase was fractured and damaged in line with the No. 2 cylinder connecting rod, which was consistent with continued rotation of the engine and flailing of the connecting rod after the complete separation of the cylinder. The right half of the engine crankcase was also damaged in line with the No. 2 cylinder connecting rod. The main portion of the connecting rod was heavily distorted in the rod bearing and piston pin areas. The piston pin area had many impact marks, and the pin hole and bushing were flattened. The connecting rod bolt pieces were also distorted and fractured through the shank. Optical examinations revealed fracture features consistent with overstress separations. A portion of the crankcase, which contained the two upper center studs of the No. 2 cylinder, was missing. The engine crankcase surfaces that contact the cylinder skirt and base flange of the No. 2 cylinder contained several different impact marks and contact features. Small, raised ridges were present on the forward side of the mounting face corresponding to the installed edges of the No. 2 cylinder base flange. Additionally, the bore portion of the crankcase that mates with the No. 2 cylinder skirt contained several sharp circumferential dents, scrapes, and other contact marks that are consistent with progressive outboard movement of the cylinder skirt. The cylinder skirt edge marks continued onto the lower portion of the mounting surface where a series of concentric dents, which matched the machined contour and overall radius of the innermost edge of the cylinder skirt, were found. Light fretting damage was noted in some areas of the contact surface with the cylinder base flange. 1.16.3.4 Right Engine No. 2 Cylinder Hold-Down Studs and Through Bolts Of the eight hold-down studs and two through bolts that retain the No. 2 cylinder to the engine crankcase, three of the studs were found intact in the crankcase without nuts, four of the studs and the two through bolts were found fractured, and one of the studs was not found. The intact studs found in the crankcase without nuts had minimal thread damage. The outboard portions of one of the fractured hold-down studs and one of the fractured through bolts were recovered. The stud piece was found without a nut attached,

Factual Information 28 Aircraft Accident Report and the through bolt piece was found with a nut attached. The outboard portions of the other three fractured studs were not recovered. The other fractured through bolt, which is where the nut would normally be, was not recovered. Figure 4 shows the condition in which the right engine No. 2 cylinder retention system components were found. Note: The cylinder base flange is outlined in blue, and the mounting surface is outlined in red. Optical and scanning electron microscopic examinations of four of the hold-down stud and two of the through bolt fractures found features that were consistent with high-stress and low-cycle fatigue propagation. For all of the studs and through bolts with fatigue cracking, initiation was from multiple locations in a thread root along one side of the fastener. The fatigue propagated in a high-stress manner with parallel fissures and striations until ductile overstress occurred at about 50 percent of the fastener’s cross-section. Some spots of corrosive material were visible at random areas across the fractures; however, little or no oxidation or corrosion was apparent in the fracture origin areas. A comparison of height measurements of the No. 2 cylinder studs’ features with features on other cylinder studs in the engine crankcase revealed that the studs had been installed to similar depths. Figure 4. The condition in which the right engine No. 2 cylinder retention system components were found. Through Bolt Fatigue, Nut in Place Stud Intact, Case Threads Stripped, No Nut Through Bolt Fatigue, Outboard Piece Not Recovered Stud Fatigue, Outboard Piece Not Recovered Stud Fatigue, Outboard Piece Not Recovered Stud Fatigue, Outboard Piece Not Recovered Stud Intact, No Nut Stud Intact, Bent, No Nut Stud Intact, Missing from Case Stud Fatigue, Outboard Piece Recovered, No Nut

Factual Information 29 Aircraft Accident Report 1.16.3.5 Cylinder Hold-Down Nuts The cylinder hold-down nuts from the Nos. 1, 3, 4, 5, and 6 right engine cylinders were recovered on their respective hold-down studs and through bolts; three of the hold-down nuts were found in the engine compartment. Thirty 7/16-inch-diameter, 6-point, flanged cylinder hold-down nuts were examined. Two of these hold-down nuts were found in the engine compartment after recovery of the airplane, and 28 of these hold-down nuts were removed from the right engine cylinders during engine teardown. Initial optical examinations found two different styles of nuts. Seven of the nuts had concave transition from the wrench flats to the enlarged washer flange. These nuts were consistent with an exemplar cylinder hold-down nut provided by Superior Air Parts with standard 7/16-20 UNF-3B thread form.62 Twenty-three of the nuts had a convex transition from the wrench flats to the enlarged washer flange and were embossed with two opposed sets of parallel lines. These nuts were consistent with TCM flanged nuts with the optional, nonstandard Spiralock thread form.63 According to TCM, the company has exclusively procured cylinder hold-down nuts with the Spiralock thread form since about 1990. One of the nuts found loose in the engine compartment was a Superior-style hold-down nut, and the other nut was a TCM-style nut with the Spiralock thread form. According to Airmark Overhaul’s Quality Assurance Manager, the company uses OEM-specified hold-down nuts or nuts provided by Superior Air Parts. The manager stated that, since he began working at Airmark in April 1984, if the company was overhauling an engine and 36 6-point cylinder hold-down nuts were needed and 24 with a TCM part number and 12 with a Superior Air part number were in stock, both types of nuts would be used to complete the overhaul rather than hold up production. He stated that this procedure was “accepted in industry.” 1.17 Organizational and Management Information 1.17.1 Air Sunshine Air Sunshine, Inc., was formed in June 1982 and began conducting Part 135 on-demand charter flights on September 2, 1982, and Part 135 scheduled commuter flights in 1983. The company provides commuter and charter services in South Florida and the Caribbean. The company has offices and a permanent maintenance facility in Fort Lauderdale. The company has a ticket counter and two rooms at Luis Munoz Marin International Airport (SJU), San Juan, Puerto Rico, but no permanent maintenance facility there. Air Sunshine’s President stated that the company keeps its maintenance records in the two rooms it has at SJU. 62 Standard 7/16-20 internal threads have a 7/16-inch major diameter and 20 threads per running inch of UN fine 60° threads with a class 3 fit. 63 Spiralock internal threads are proprietary and were developed by Spiralock Corporation, a subsidiary of Detroit Tool Industries Company. The internal threads of the Spiralock nut engage the external threads at the crests of the stud threads.

Factual Information 30 Aircraft Accident Report At the time of the accident, the company employed 12 pilots, 10 of whom were captains and 2 of whom were first officers. According to Air Sunshine’s President, the company typically employed three A&P-certified mechanics and one or two assistant mechanics in San Juan and four A&P-certified mechanics and three assistant mechanics in Fort Lauderdale. The company operated three to four flights daily out of FLL and about six to eight flights daily out of SJU with a fleet of seven Cessna 402C airplanes and one Embraer 110 airplane. The Director of Maintenance stated that company maintenance was conducted in both Fort Lauderdale and San Juan. According to the director, if an airplane is in Fort Lauderdale when an inspection becomes due, the inspection is conducted there. He stated that, because most of the flights conducted on its Cessna 402 airplanes originated in San Juan, most of the inspections of these airplanes were conducted there.64 Air Sunshine’s President stated that extensive maintenance and sheet metal work were conducted in Fort Lauderdale because the company owned a hangar at FLL. He stated that inspections conducted in San Juan were typically conducted on the ramp and that, if an airplane needed to be “placed on jacks,” the company would obtain hangar space at SJU. Since March 26, 1987, Air Sunshine has experienced four incidents and six accidents, including the flight 527 accident. Three of the accidents, including the accident flight, resulted in fatalities. On January 23, 1992, a Cessna 402C crashed near Clewiston, Florida, and two people were killed. On February 8, 1987, a Cessna 402C crashed into the Atlantic Ocean while on final approach to Cyril E. King Airport, Charlotte Amalie, Virgin Islands, and two people were killed. Both accidents were determined to be caused by pilot error; no mechanical malfunctions were reported with either airplane. 1.17.1.1 Air Sunshine’s In-Flight Engine Failure Procedures In-flight engine failure procedures were taught during company training and were contained in Air Sunshine’s Training Manual. The manual states that, if an engine were to fail in flight, the pilot should comply with memory items and follow the prescribed checklist. Air Sunshine’s Training Manual, section 3, revision 6, dated May 10, 1990, contains the following in-flight engine failure procedures:

1. Inoperative Engine – DETERMINE.
2. Operative Engine – ADJUST as required.

Before Securing [shutting down] Inoperative Engine:

1. Fuel Flow – CHECK. If deficient, position auxiliary fuel pump to ON.
2. Fuel Selectors – MAIN TANKS (Feel For Detent).
3. Fuel Quantity – CHECK.

64 Air Sunshine’s General Manager reported to Safety Board investigators that the company conducted 45 inspections of its Cessna 402 airplanes in Fort Lauderdale and 17 inspections of its Cessna 402 airplanes in San Juan between January 1 and July 13, 2003.

Factual Information 31 Aircraft Accident Report

1. Oil Pressure and Oil Temperature – CHECK.
2. Magneto Switches – CHECK ON.
3. Mixture – ADJUST. Lean until manifold pressure begins to increase, then

enrich as power increases. Air Sunshine’s Training Manual states that, if the engine does not start after performing the first eight steps of the in-flight engine failure procedures, the pilot was to perform the following procedures:65

1. Inoperative Engine – SECURE [shut down].

a. Throttle – CLOSE. b. Mixture – IDLE CUT-OFF. c. Propeller – FEATHER. d. Fuel Selector – OFF (Feel For Detent). e. Auxiliary Fuel Pump – OFF. f. Magneto Switches – OFF… i. Cowl Flap – CLOSE…

1. Trim Tabs – ADJUST 5° bank toward operative engine with approximately

1/2 ball slip indicated on the turn and bank indicator. Air Sunshine’s Training Manual also stated that, if an engine failure were to occur, the single-engine best climb rate should be maintained regardless of whether the altitude could be maintained because that speed guaranteed the best climb rate or the least altitude loss with an inoperative engine. Cessna’s 402C Aircraft Information Manual, Section 3, “Emergency Procedures,” states the following: The one engine inoperative best rate-of-climb speed becomes important when there are no obstacles ahead on takeoff, or when it is difficult to maintain or gain altitude in single-engine emergencies. The one engine inoperative best rate-of-climb speed is 104 KIAS with wing flaps and landing gear up. This speed is indicated by a blue radial on the airspeed indicator. During postaccident interviews, the accident pilot stated that he was trained by Air Sunshine that, in the event of an in-flight engine failure, a pilot should push “all the engine levers forward (throttle, mixture, and propeller levers).” As noted previously, the pilot stated that his first action after he heard the bang and saw oil coming out of the right engine cowling was to shut down the failed engine. The pilot stated that he did not follow the company’s in-flight engine failure procedures because he knew which engine had failed. The pilot added that he did not follow the in-flight engine failure checklist because he was “too busy flying the airplane.” The passenger in the copilot seat stated that the pilot pushed the throttle, mixture, and propeller levers of the operative engine forward immediately after he tried to shut down the failed engine. 65 These procedures were also contained in Cessna’s 402C Aircraft Information Manual.

Factual Information 32 Aircraft Accident Report Air Sunshine’s Director of Operations, who is also a check captain and conducts company training, stated that he trained pilots to perform the following procedures if an in-flight engine failure occurred: (1) mixture [lever] – full forward, (2) propeller [lever] – full forward, (3) throttles [lever] – full forward, (4) flaps – up [retracted], (5) gear – up [retracted], (6) fuel selector – on main tanks, (7) auxiliary pump – on, (8) identify the failed engine, (9) verify the failed engine, (10) feather the propeller, and (11) call for the [engine failure] checklist. 1.17.1.2 Ditching Procedures Air Sunshine’s Training Manual, section 3, contained the following ditching procedures: Landing Gear – UP. Approach – HEADWIND if high winds. PARALLEL to SWELLS if light wind and heavy swells. Wing Flaps – DOWN 45°. Power – AS REQUIRED (300 Feet Per Minute Descent). Airspeed – 95 KIAS minimum. Attitude – DESCENT ATTITUDE through touchdown. The pilot stated, during postaccident interviews, that he did not extend the flaps before ditching. 1.17.1.3 Company Record-Keeping 1.17.1.3.1 Maintenance Records As noted previously, although Air Sunshine’s Director of Maintenance told Safety Board investigators that he and the assistant mechanic had repeated the compression checks after initially getting unacceptably low readings (below 54 psi) for two of the right engine cylinders (Nos. 2 and 4) during the airplane’s last scheduled engine maintenance in June 2003, no documentation of the repeated checks was found. Further, no records were found indicating that any inspections or corrective maintenance had been performed on the right engine cylinders after getting the low compression check readings. As previously mentioned, TCM SB 03-3 recommends that, if cylinder pressure levels are lower than the limit established by the acceptable pressure leakage check (in this case, 54 psi), a cylinder borescope inspection is to be conducted. In addition, no records were found indicating that any of the right engine cylinders had been removed since the engine was last overhauled (December 14, 1999). A review of Air Sunshine’s maintenance records revealed that the number stamped on the No. 6 cylinder from the right engine did not match the number recorded in the maintenance records; however, the maintenance records for the right engine did not

Factual Information 33 Aircraft Accident Report indicate that the No. 6 cylinder had ever been removed or replaced. Air Sunshine’s General Manager stated that, according to company records, the cylinder installed in the No. 6 position on the accident airplane was a cylinder previously installed in the No. 3 position on another one of the company’s engines, serial number 816113-R, which was installed on N220RS. The General Manager stated that, from January to July 2001, engine serial number 816113-R was not installed on N220RS and that, during that time, the engine “was basically sitting in [the company’s] parts room.” He added that the No. 3 cylinder from engine serial number 816113-R must have been installed on the accident engine at some point during that time. However, the maintenance records for N220RS did not indicate that the No. 3 cylinder had ever been removed or replaced from engine serial number 816113-R. Further, a review of Air Sunshine’s maintenance records revealed no reports to the FAA that any of the company’s engines were running unsatisfactorily from the date that its operations specifications were amended (September 9, 1999) to the date of the accident.66 1.17.1.3.2 Aircraft Flight Logs A Safety Board review of the accident airplane’s flight logs from the first flight conducted on December 23, 2002, to the last flight conducted on July 12, 2003, revealed that the airplane had been operated a total of 543.8 hours on 559 flights. During this time, pilots reported three maintenance-related discrepancies. A review of the flight logs also revealed that the first flight to be conducted after the last phase 1 check (June 14, 2003) occurred on June 16, 2003. From the June 16th flight to the first flight conducted on the day of the accident, the airplane had been operated a total of 79.7 hours on 83 flights. During this time, no pilot-reported maintenance-related discrepancies were recorded. 1.17.2 Federal Aviation Administration Oversight 1.17.2.1 General Air Sunshine was initially certificated in 1982 by the Miami FSDO. The company’s operations certificate was transferred to the Fort Lauderdale FSDO in 1986. As noted previously, in early 1998, Air Sunshine asked the FAA to transfer its operations certificate to the San Juan FSDO. The FAA granted the request, and the certificate was transferred to the San Juan FSDO on June 2, 1998. According to the PMI for Air Sunshine, airplanes that are based at FLL are maintained there, and airplanes that are based at SJU are maintained there. The PMI, who is based in San Juan, reported that he scheduled three to four trips a year to FLL as part of his work program. 66 As noted previously, the PMI stated that he would grant Air Sunshine’s request to amend its operations specifications provided that the company monitored the performance of newly overhauled engines and reported any abnormal conditions to the San Juan FSDO.

Factual Information 34 Aircraft Accident Report 1.17.2.2 San Juan Flight Standards District Office Preaccident Oversight of Air Sunshine According to the FAA’s planned oversight program for Air Sunshine, the PMI planned on conducting the following inspections for fiscal year 2003 (from October 1, 2002, to September 30, 2003): two required and two additional facility inspections at FLL, two required and two additional ramp inspections of the Embraer 110 at FLL, two required and two additional ramp inspections of the Cessna 402s at FLL, one required and one additional spot check of the Cessna 402s at FLL, one required aircraft (Embraer 110) records inspection and one additional aircraft records inspection at FLL, and one required maintenance records inspection and one additional maintenance records inspection at SJU. A review of FAA records indicated that, from October 1, 2002, to July 8, 2003, the PMI conducted 10 ramp inspections, 2 spot inspections, and 1 aircraft records inspection. The review of FAA records also indicated that the PMI conducted an inspection of Air Sunshine’s Fort Lauderdale facility from March 25 to 27, 2003. In an April 1, 2003, letter to the company, the PMI stated that he found five Maintenance Manual-related discrepancies during the inspection. The PMI also reported that he conducted an inspection of Air Sunshine’s San Juan facility from July 8 to 10, 2003. In a July 15, 2003, letter to the company, the PMI stated that he found three Maintenance Manual- and three aircraft records-related discrepancies. None of the aircraft records-related discrepancies involved the accident airplane. 1.17.2.3 Fort Lauderdale Flight Standards District Office Postaccident Oversight of Air Sunshine Although the Fort Lauderdale FSDO has no maintenance oversight responsibilities for Air Sunshine, according to an aviation safety inspector from Fort Lauderdale, after the accident, the Fort Lauderdale FSDO Manager contacted the San Juan FSDO Manager to advise him that the Fort Lauderdale FSDO wanted to conduct additional surveillance of Air Sunshine. A review of FAA records indicated that, from July 14 to September 30, 2003, personnel from the Fort Lauderdale FSDO conducted 2 facility inspections, which found scales that were out of calibration and cargo that was not secured; 21 ramp inspections, which found numerous maintenance-related discrepancies with Air Sunshine’s Cessna 402C airplanes; and 5 spot inspections, which found numerous maintenance-related discrepancies. 1.17.2.4 San Juan Flight Standards District Office Postaccident Oversight of Air Sunshine According to the FAA, after the accident, the San Juan FSDO increased surveillance of Air Sunshine in all areas. The FAA stated that, from July 14, 2003, to February 25, 2004, the San Juan FSDO conducted 45 inspections of the company. From July 22 to August 29, 2003, the San Juan FSDO conducted a focused inspection of Air Sunshine. During this inspection, the FAA determined that the company’s record-keeping system was inadequate, its maintenance program was deficient, its passenger briefing card and overwater safety briefing needed to be revised, its pilot training needed to be revised, and its engine compression check interval was too high.

Factual Information 35 Aircraft Accident Report The FAA stated that, as a result of these inspections, the following actions were taken: • The FAA filed an Enforcement Investigative Report regarding the deficiencies found in Air Sunshine’s record-keeping system. The FAA stated that subsequent records inspections revealed that the deficiencies were corrected. • The FAA sent a letter to Air Sunshine, addressing all of the maintenance discrepancies. The FAA stated that all of the corrective actions were documented in its PTRS. • The FAA sent a letter to Air Sunshine, requiring the company to revise its General Operations Manual, section 3 (relating to the passenger briefing card and the overwater safety briefing). On October 1, 2003, the FAA accepted revision No. 31, which amended the overwater safety briefing. On July 6, 2004, the FAA accepted revision No. 32, which amended the passenger briefing card. • The FAA sent a letter to Air Sunshine, requesting that the company revise its FAA-approved Pilot Training Manual. On February 12, 2004, the FAA accepted revision No. 15, which corrected outdated information and training-hour requirements and conformed to the new format of FAA Order 8400.10, Air Transportation Operations Inspector’s Handbook. • On November 18, 2003, Air Sunshine submitted and the FAA approved revision No. 11 to Air Sunshine’s AAIP, which lowered the compression check interval from 360 to 120 hours. 1.17.2.5 Additional Postaccident Actions On February 26, 2004, Air Sunshine’s PMI sent the company a letter regarding its AAIP. The PMI stated that, effective immediately, the company’s Operations Specification Part D-101 would be amended to specify that only TCM could rebuild the company’s TCM TSIO-520-VB engines. The PMI further stated that, pending mitigating actions on the part of Air Sunshine, he was proposing to reduce the TBO from 2,400 flight hours to the manufacturer-recommended TBO of 1,600 flight hours, effective March 12,

1. The PMI asked Air Sunshine to provide in writing, by March 4, 2004, a detailed

plan for any actions that the company planned on taking in response to the PMI’s letter. In a letter to the FAA dated March 3, 2004, Air Sunshine’s General Manager responded that the company did not agree with the FAA that TCM rebuilt engines were superior to engines that were overhauled by Airmark Overhaul. He added that Airmark was a TCM distributor and that Airmark used TCM guidelines and “brand new millennium cylinders.”67 He further stated that “throughout the years we have found quality control and attention to details of Airmark highly superior to the mass production errors inherent of large factories like TCM.” The manager asked the PMI to reconsider its decision to require Air Sunshine to use only TCM rebuilt engines. The General Manager stated that the company would revise its AAIP to include a cylinder inspection every 1,600 flight hours, which would include replacement of valves, 67 “Millennium” cylinders are Superior Air Parts cylinders. Five of the six cylinders from the right engine were ECI cylinders.

Factual Information 36 Aircraft Accident Report rings, and gaskets. The manager also stated that the cylinder inspection would include, if necessary, replacement of valve seats, guides, and pistons. He added that the company would revise its compression check interval and place additional constraints, such as replacing of cylinders if the compression levels fell below the limit established in accordance with TCM SB 03-3. The manager stated that the company had already revised its AAIP to require three compression checks during a 360-flight-hour inspection cycle (compression checks would be conducted once every 120 flight hours). At the time of the accident, one compression check was required during a complete inspection cycle (compression checks were conducted once every 360 hours). The General Manager stated that Air Sunshine was also willing to conduct cylinder inspections on the four engines in its fleet that had more than 1,600 flight hours and that the company had already ordered one new TCM engine to replace an engine that had about 2,200 flight hours. The manager also stated that the company had followed all of the guidelines to obtain the TBO extension to 2,400 flight hours, including preparing five engine teardown reports, and that the company had operated for 11 years and for more than 100,000 flight hours under the extended TBO. 1.18 Additional Information 1.18.1 Previous Ditching Accidents On January 1, 2002, a Piper PA-31 operated by Air Taxi, Inc., as a Part 135 nonscheduled commuter flight was ditched in the Atlantic Ocean after fuel exhaustion. Three passengers and the pilot sustained serious injuries, and one passenger died. According to the surviving passengers, the pilot did not conduct a preflight briefing or an emergency briefing before the ditching. Four of the PFDs on board the airplane were retrieved after the airplane was in the water.68 On August 20, 2000, a Piper PA-31 operated by Big Island Air as a Part 135 commuter flight was ditched in the Pacific Ocean after a loss of engine power. All of the passengers retrieved their PFDs before the ditching. The passengers reported that, shortly after the engine problem occurred, the pilot instructed them to retrieve and don their PFDs and assume a crash position. One passenger retrieved, donned, and partially inflated her PFD, but she was not able to evacuate the airplane and, as a result, died. 68 A description of this accident, MIA04FA48, can be found on the Safety Board’s Web site at http://www.ntsb.gov.

37 Aircraft Accident Report 2. Analysis 2.1 General The pilot was properly certificated and qualified under Federal regulations. No evidence indicated any preexisting medical or physical condition that might have adversely affected the pilot’s performance during the accident flight. The airplane was properly certificated and equipped in accordance with Federal regulations. The airplane was equipped with FAA-approved flotation gear, as required by Federal regulations. The airplane was loaded in accordance with FAA-approved company weight and balance procedures. The weight and balance of the airplane were within prescribed limits during all phases of the flight. Given the distance from shore at which the ditching occurred and the availability of emergency response equipment, the search and rescue efforts were timely and appropriate. The accident was survivable.69 The inoperative distance measuring equipment on the MYAT VOR was not a factor in this accident. This analysis discusses the accident sequence, including the airplane’s performance after the right engine failed and the cause of this failure. This analysis also discusses Air Sunshine-related maintenance issues, pilot proficiency, and the need for emergency briefings. 2.2 Accident Sequence The accident flight departed FLL about 1427. The takeoff and cruise portions of the flight were uneventful. The pilot reported that the flight’s cruise altitude was about 7,500 feet and that the cruise speed was about 160 KIAS. The pilot reported that, while descending through an altitude of about 3,500 feet at an airspeed of about 135 to 140 KIAS and a distance of about 20 to 25 miles from MYAT, he heard a bang and saw oil coming out of the right engine cowling. Several of the passengers reported seeing white smoke coming from the engine followed by a stream of oil and then hearing a loud bang. The passengers reported seeing parts falling from the 69 Although the accident was survivable, two passengers died after evacuating the airplane. Section 2.9 discusses the pilot’s failure to conduct an emergency briefing after the right engine failed and this failure’s effect on the outcome of the accident.

Analysis 38 Aircraft Accident Report engine after they heard the loud bang. The pilot reported that, after attempting to shut down the right engine, he applied full power to the left engine and slowed to about 95 KIAS, but he could not maintain altitude. He stated that, once the airplane descended through an altitude of about 1,500 to 1,000 feet, he realized that the airplane could not make it to the airport and, therefore, he decided to ditch the airplane. The on-site examination of the airplane after it was recovered from the water revealed that both of the right engine magnetos had penetrated through the engine cowling and that they were hanging onto the engine by their harnesses. After opening the engine cowling, the No. 2 cylinder was found separated from the engine crankcase at the cylinder flange. Therefore, the Safety Board concludes that the airplane’s right engine failed while the airplane was descending through an altitude of about 3,500 feet. 2.3 Airplane Performance After the Right Engine Failure Air Sunshine’s Training Manual states that, if a failed engine does not start after performing steps 1 through 8 of the in-flight engine failure procedures (see section 1.17.1.1), the pilot should close the throttle, cut off mixture, and feather the propeller on the inoperative engine; move the fuel selector, auxiliary fuel pump, and magneto switches for the inoperative engine to off; and close the cowl flaps. The left fuel selector valve in the cockpit was found positioned to the left main fuel tank; the position of the right fuel selector valve was not determined. The right cowl flap was found open. Further, Air Sunshine’s Training Manual states that, before ditching, the pilot should extend the wing flaps to 45°. The pilot stated that he did not extend the flaps before ditching; however, the Safety Board notes that the airplane was found with the left and right flaps extended to 15°.70 Several factors existed that adversely affected the airplane’s performance, including the windmilling propeller (-400 fpm penalty), the protruding magnetos (-4 fpm penalty), and the open right engine cowl flap (-9 fpm penalty). In addition, flaps that are extended to 15° could cause a -145 to -165 fpm penalty. However, Safety Board investigators could not determine when the flaps were extended; therefore, it is unknown when the penalty for flaps at 15° started. Several other factors could also have degraded the airplane’s performance, including not flying at the recommended airspeeds, operating with a bank angle and sideslip not in accordance with Cessna’s recommended in-flight engine failure configuration, and not maintaining a steady descent. However, Cessna could not quantify the penalties for these variables. The Safety Board calculated that, at an airspeed of 90 knots and with the engine damage, the airplane could have tolerated a descent rate of about 250 fpm and have been able to maintain flight and reach land. The pilot stated that, during the ditching, the descent rate was between about 200 and 300 fpm. Board calculations showed that the airplane’s descent rate was between 560 and 212 fpm during its descent from 3,500 feet to 2,000 feet and was between 429 and 360 fpm during its descent from 2,000 feet to contact with the water. 70 The pilot stated that one of the passengers might have hit the electrically controlled switch that extends the flaps while they were evacuating the airplane.

Analysis 39 Aircraft Accident Report On the basis of this evidence, the Safety Board concludes that several factors contributed to the degradation of the airplane’s performance and its inability to maintain flight and reach land, including the windmilling propeller, the protruding magnetos, the open right engine cowl flap, and the possibility that the flaps were extended to 15° at some point during the descent. The Safety Board further concludes that, during the descent from 3,500 to 2,000 feet, the airplane’s descent rate was between about 560 and 212 fpm, and that, during the descent from 2,000 feet to contact with the water, its descent rate was between 429 and 360 fpm. The Safety Board also concludes that, if the average descent rate had been about 200 fpm or less, the airplane would have been able to maintain flight and reach MYAT. The pilot stated that, when he tried to feather the right propeller, it continued to turn until the airplane contacted the water. Two passengers stated that the propeller continued turning until the airplane contacted the water. However, when the propeller was removed and examined, the blade angles were measured to be within the specified range for feather (82.2° +/-0.3°). Further, the propeller’s start-lock mechanism showed no evidence of damage, such as witness marks, which would have been expected if the propeller had been on the start locks at the time that it contacted the water. Therefore, the Safety Board concludes that the right propeller was in the fully feathered position, but Board investigators could not determine at what point the propeller became fully feathered. 2.4 Right Engine Failure Sequence Previous Safety Board investigations of engine cylinder separations have shown that cylinder stud failures generally occurred as a progressive sequence of fatigue fractures. Typically, the initial fracture has been caused by high-cycle, low-stress fatigue (indicating preexisting cracking that was not created during the engine cylinder separation) and has penetrated nearly the entire fastener section. Subsequent fractures have shown decreasing amounts of fatigue followed by overstress and fracture features that were increasingly indicative of high-stress propagation. However, the accident airplane right engine No. 2 cylinder stud fractures showed no evidence of a progressive sequence of fatigue, indicating that a sudden onset of higher loads occurred. Although combustion instabilities, such as detonation or preignition, can cause the rapid increase of the loads on the studs, no evidence of such an event was found. A partial piston or ring failure can also increase the loads on the studs; however, metallurgical evidence indicated that the No. 2 cylinder piston fractures were caused by sudden overstress. Optical examinations of the fractured studs and through bolts confirmed that they failed as a result of high-stress fatigue. Small, raised ridges observed on the forward side of the right engine No. 2 cylinder mounting face indicated that the cylinder was rocking on the engine crankcase, pivoting around the through bolt on the forward side of the base flange. For this motion to occur, some of the cylinder studs opposite of this location had to become fractured or the nuts opposite of this location had to become loose. Two of the studs from this area were found intact but without the nuts.

Analysis 40 Aircraft Accident Report In addition, two intact cylinder hold-down nuts were found in the engine compartment area. Typically, cylinder hold-down nuts become separated from the cylinder hold-down studs if the threads on the nuts or studs are stripped (pulled out) or if the nuts become loose and unthreaded by vibration. The threads on the two cylinder hold-down nuts found in the engine compartment area were intact; the damage to the threads of the nonfractured studs in the engine crankcase was minimal. Therefore, the hold-down nuts on the two unfractured studs must have become loose and backed off of the studs. The Safety Board is unaware of any previous instances of cylinder separations in which the hold-down nuts completely backed off of multiple studs. The loss of the cylinder hold-down nuts on the two unfractured studs would have caused the loads to be transferred to the remaining studs and through bolts. The increased load would have been sufficient to initiate and propagate high-stress fatigue fractures in four of the remaining studs and both through bolts; the loads on the remaining stud would have been sufficient to strip its case threads. The presence of fractures of the four broken studs, the fractures of the two broken through bolts, and the stripped case threads at another stud location indicated that the nuts were present on these studs and through bolts for a significant portion of the failure sequence. Several sharp circumferential dents, scrapes, and other contact marks on the bore portion of the case that mates with the No. 2 cylinder skirt show that the failure of the No. 2 cylinder retention system caused the progressive outboard movement of the cylinder. At some point, the piston fragmented and, the connecting rod, wrist pin, and piston fragments separated from the engine. On the basis of the metallurgical evidence, the Safety Board concludes that two or more of the right engine No. 2 cylinder hold-down nuts became loose and backed off of the studs, which resulted in the remaining studs and through bolts fracturing in high-stress fatigue, allowing the cylinder to separate from the engine. 2.5 Cause of the Loosened No. 2 Cylinder Hold-down Nuts The probability that two or more cylinder hold-down nuts would simultaneously loosen is very low. Therefore, an outside influence, such as the application of insufficient torque to the nuts during maintenance, likely occurred. The Safety Board reviewed Air Sunshine’s maintenance records to determine when insufficient torque might have been applied to the nuts. Between the time of the last compression checks (June 12 to 14, 2003) and the accident, the engine accumulated 83 flight hours. No records were found indicating that any other maintenance was performed on the accident engine at the time of and after the last compression check. Although it is possible that insufficient torque was applied to the cylinder hold-down nuts during undocumented maintenance at the time of the last known

Analysis 41 Aircraft Accident Report maintenance event,71 it is also possible that insufficient torque was applied during undocumented maintenance subsequent to the last known event. However, if a mechanic does not apply enough torque to a nut during maintenance, the nut typically becomes loose soon afterward. Therefore, the Safety Board concludes that the simultaneous loosening of two or more of the right engine No. 2 cylinder hold-down nuts resulted from the application of insufficient torque, which was applied by Air Sunshine maintenance personnel during undocumented maintenance. 2.6 Air Sunshine Maintenance Record-Keeping and Practices The Safety Board’s review of Air Sunshine’s maintenance records revealed several discrepancies. The review revealed that the number stamped on the No. 6 cylinder from the accident airplane’s right engine did not match the number recorded in the maintenance records. The maintenance records for the right engine did not indicate that the No. 6 cylinder had ever been removed or replaced. Further, although the company’s General Manager reported that the No. 6 cylinder was originally the No. 3 cylinder from another one of the company’s engines, the maintenance records for the other engine did not indicate that its No. 3 cylinder had ever been removed or replaced. Air Sunshine’s records showed no evidence that the company had reported any problems with its engine to the FAA72 despite evidence found during this investigation that indicated that at least two cylinders were removed and replaced on two separate engines. In 1998, Air Sunshine applied to change its AAIP from a 3-phase, 60-hour inspection program to a 6-phase, 60-hour inspection program. The FAA approved the change, which was in effect at the time of the accident. As a result of this change, engine differential compression checks were conducted once every 360 hours instead of every 180 hours. Subsequent to the accident, Air Sunshine changed its AAIP to require that three compression checks be conducted during a 360-hour inspection cycle (once every 120 hours), and the FAA approved this change. Although the company’s modified AAIP increased the number of compression checks in a 360-hour cycle, the compression check interval is still well beyond the 100-hour interval recommended in SB 03-3. In addition, during the last differential compression checks performed on the airplane’s engines (from June 12 to 14, 2003), the assistant mechanic recorded readings of 0 psi for the right engine No. 2 cylinder and 20 psi for the No. 4 cylinder. Further, Safety Board investigators who reviewed the engine differential compression check form on which the assistant mechanic recorded the readings noted that the number recorded for the 71 Typically, torque only needs to be applied to cylinder hold-down nuts after cylinder installations. Cylinders are not removed and reinstalled during compression checks; therefore, insufficient torque would not have been applied during the June 2003 compression checks. 72 As noted previously, in a September 9, 1999, letter to Air Sunshine, the PMI stated that he would grant the company’s request to amend its operations specifications to reflect the 2,400-flight-hour TBO if the company monitored the performance of newly overhauled engines and reported any abnormal conditions to the San Juan FSDO.

Analysis 42 Aircraft Accident Report No. 3 cylinder could have been either 55 or 25. The Director of Maintenance told Safety Board investigators that, because the readings were low, he repeated the checks on all of the right engine cylinders. He stated that all of the readings were in the 70-psi range. However, Board investigators could not find any documentation indicating that the checks had been repeated. The differential compression checks on the right engine were performed by an assistant mechanic without supervision or assistance, even though he did not have an A&P certificate. During postaccident interviews, the assistant mechanic stated that he had never conducted a compression check before conducting the checks on the accident airplane’s right engine. When a Safety Board investigator asked the assistant how to perform the test, he did not appear to be familiar with the entire test. Further, Air Sunshine’s Maintenance Manual contained a caution, stating that two people should conduct the compression checks. The Safety Board notes that, for the compression checks to be conducted safely and properly, the two people who conduct the checks should have adequate training and experience. However, Air Sunshine’s Director of Maintenance allowed a non-A&P certified assistant mechanic, who had never previously performed engine compression checks, to perform the checks by himself without supervision. Further, a review of the assistant mechanic’s training records indicated that he did not complete on-the-job training for the entire airplane until 14 to 16 days after he performed the compression checks. The assistant mechanic should not have been working unsupervised during on-the-job training, which indicated that the company’s on-the-job maintenance training was not adequate. Last, during postaccident interviews, the Director of Maintenance stated that, when company maintenance personnel remove and replace an engine cylinder assembly, they coat the cylinder hold-down studs with an aluminum-copper-graphite, lithium-based antiseize compound manufactured by Permatex before applying torque to the studs. The use of the Permatex compound is not in accordance with TCM SB 96-7B. Permatex does not recommend using antiseize compound in high-vibration environments because it could contribute to the loss of torque. Although the threads of the right engine studs and through bolts showed no evidence of this compound, the Safety Board is concerned that Air Sunshine indicated that it was using an antiseize compound on its engines. The Safety Board concludes that, at the time of the accident, Air Sunshine’s maintenance record-keeping and practices were not adequate. Subsequent to the accident, the FAA conducted a focused inspection of Air Sunshine (from July 22 to August 29, 2003). During these inspections, the FAA determined that the company’s maintenance program was deficient. The FAA stated that it had sent a letter to Air Sunshine in which all of the maintenance discrepancies were addressed and that all of the company’s corrective actions in response to these discrepancies had been documented in the FAA’s PTRS. Therefore, the Safety Board concludes that the FAA’s oversight of Air Sunshine was in accordance with standard guidelines, but was insufficient to detect inadequate maintenance record-keeping and practices at the company.

Analysis 43 Aircraft Accident Report 2.7 Pilot Proficiency A review of Arrow Air’s simulator training records for the pilot revealed that he had received a large number of “unsatisfactory” grades and that he needed to improve his scanning and checklist skills, including response and organization.73 Further, on September 13, 2000, the pilot failed a ramp check because an FAA inspector found that the airplane had numerous discrepancies and that his passenger briefing was inadequate. Airplane performance calculations show that the windmilling propeller and the protruding magnetos alone were not sufficient to cause the airplane to descend as rapidly as it did. Other factors that were most likely caused or controlled by the pilot, including not flying at the recommended airspeeds and flap settings, operating with a bank angle and sideslip that were not in accordance with Cessna’s recommended in-flight engine failure configuration, and not maintaining a steady descent, could have degraded the accident airplane’s performance. If the pilot had been more proficient, he might have been able to decrease the descent rate enough to maintain flight and reach land. A review of FAA records revealed that, from April 1983 to February 1998, the pilot failed nine flight checks. The pilot failed two flight checks that he was receiving for his private pilot certificate, one flight check that he was receiving for his instrument pilot rating, one flight check that he was receiving for his ATP certificate, two flight checks that he was receiving for his CFI certificate, and three flight checks that he was receiving for his CFI instrument rating. Therefore, the Safety Board concludes that the pilot had a history of below-average flight proficiency, including numerous failed flight tests, before the accident flight, which contributed to his inability to maintain maximum flight performance and reach land after the right engine failed. 2.8 Pilot Failure to Use Shoulder Harness Federal regulations require flight crewmembers of U.S.-registered civil aircraft to keep their shoulder harnesses fastened during takeoff and landing, including during a ditching. During postaccident interviews, the pilot stated that he did not have his shoulder harness fastened during the ditching. He added that, because his harness was not fastened, he hit his head on the instrument panel when the airplane hit the water, which made him dizzy. Two passengers indicated that the pilot was incoherent when he was in the water. One of the passengers also stated that the pilot “did not look like he could swim” and that he had to give the pilot his PFD. Therefore, the Safety Board concludes that the pilot was not wearing his shoulder harness during the ditching, and, because he was not wearing his harness, he sustained a head injury that reduced his ability to assist passengers after the ditching. 73 The pilot did not complete Arrow Air’s pilot training program.

Analysis 44 Aircraft Accident Report 2.9 Emergency Briefings Air Sunshine’s FAA-approved General Operations Manual stated that, before a ditching, the pilot should review the emergency ditching evacuation procedures with the passengers and instruct them to don their PFDs without inflating them in the airplane. The manual added that the pilot should also review with the passengers how to operate the PFDs. Because these instructions were also contained in the company’s operations specifications, the instructions were required to be performed by the pilot. In a 1985 safety study titled, Air Carrier Overwater Emergency Equipment and Procedures,74 the Safety Board concluded that “the ability of flight and cabin crewmembers to assist passengers effectively during ditchings and following inadvertent water impacts may be the single most important factor in the survival outcome.” As noted previously, passengers reported that, after the right engine failed, the pilot did not tell them to retrieve or don their PFDs before the airplane contacted the water. The passengers stated that the only time the pilot addressed them after the right engine failed and before the airplane contacted the water was to tell them to “calm down.” According to the Safety Board’s airplane performance study, the airplane was airborne for at least 7 minutes after the right engine failed and before it contacted the water. Even though the pilot did not instruct the passengers to retrieve their PFDs, the passenger in seat 3B, who was holding a child on her lap, retrieved the PFD from under her seat, and the passenger in seat 5A retrieved three PFDs and put them on the children accompanying her. None of the other passengers or the pilot attempted to retrieve their PFDs before the airplane contacted the water. After the airplane was in the water, several of these passengers tried to retrieve their PFDs, but none was successful. If the pilot had instructed the adult passengers to retrieve and don their PFDs and had reviewed how to operate the PFDs shortly after the right engine failed, all of the passengers would have had adequate time to retrieve and don their PFDs before the airplane contacted the water. The Safety Board is aware that, subsequent to the accident, Air Sunshine amended its emergency ditching procedures by adding the instruction that all occupants should don PFDs as soon as any emergency occurs during overwater operations. The Safety Board concludes that, after determining that he was going to ditch the airplane, the pilot failed to conduct an emergency briefing, which was required by the emergency ditching procedures contained in Air Sunshine’s General Operations Manual, and that this failure contributed to passenger fatalities. The Safety Board further concludes that the passengers would have had sufficient time to retrieve and don their PFDs if the pilot had instructed them to do so shortly after the right engine failed. 74 For more information, see National Transportation Safety Board, Air Carrier Overwater Emergency Equipment and Procedures, Safety Study NTSB/SS-85/02 (Washington, DC: NTSB, 1985).

Analysis 45 Aircraft Accident Report On January 1, 2002, a Piper PA-31 operated by Air Taxi, Inc., was ditched in the Atlantic Ocean after fuel exhaustion. Three passengers and the pilot sustained serious injuries, and one passenger died. According to the surviving passengers, the pilot did not conduct a preflight briefing or an emergency briefing before the ditching. None of the PFDs on board the airplane were retrieved until the airplane was in the water. In contrast, on August 20, 2000, a Piper PA-31 operated by Big Island Air was ditched in the Pacific Ocean after a loss of engine power. All of the passengers retrieved their PFDs before the ditching. The passengers reported that, shortly after the engine problem occurred, the pilot instructed them to retrieve and don their PFDs and assume a crash position. As indicated by this event, if passengers aboard flights that operate over water are adequately briefed and have time to prepare during an emergency, deaths may be prevented. The Safety Board concludes that having pilots provide adequate emergency briefings to passengers is an important survival factor. Therefore, the Safety Board believes that the FAA should issue a flight standards information bulletin to principal operations inspectors of all Part 135 single-pilot operators that carry passengers and operate over water, which familiarizes them with the circumstances of the Air Sunshine flight 527 accident and emphasizes the need for pilots to provide timely emergency briefings. The bulletin should state that these briefings should include, at a minimum, information about the location and operation of the on-board emergency equipment and exits.

46 Aircraft Accident Report 3. Conclusions 3.1 Findings 1. The pilot was properly certificated and qualified under Federal regulations. No evidence indicated any preexisting medical or physical condition that might have adversely affected the pilot’s performance during the accident flight. 2. The airplane was properly certificated and equipped in accordance with Federal regulations. The airplane was equipped with Federal Aviation Administration-approved flotation gear, as required by Federal regulations. 3. The accident airplane was loaded in accordance with Federal Aviation Administration-approved company weight and balance procedures. The weight and balance of the airplane were within prescribed limits during all phases of the flight. 4. Given the distance from shore at which the ditching occurred and the availability of emergency response equipment, the search and rescue efforts were timely and appropriate. The accident was survivable. 5. The inoperative distance measuring equipment on the Treasure Cay Airport very high frequency omnidirectional range was not a factor in this accident. 6. The airplane’s right engine failed while the airplane was descending through an altitude of about 3,500 feet. 7. Several factors contributed to the degradation of the airplane’s performance and its inability to maintain flight and reach land, including the windmilling propeller, the protruding magnetos, the open right engine cowl flap, and the possibility that the flaps were extended to 15° at some point during the descent. 8. During the descent from 3,500 to 2,000 feet, the airplane’s descent rate was between about 560 and 212 feet per minute (fpm), and, during the descent from 2,000 feet to contact with the water, its descent rate was between 429 and 360 fpm. 9. If the average descent rate had been about 200 feet per minute or less, the airplane would have been able to maintain flight and reach Treasure Cay Airport.

1. The right propeller was in the fully feathered position, but Safety Board investigators

could not determine at what point the propeller became fully feathered.

1. Two or more of the right engine No. 2 cylinder hold-down nuts became loose and

backed off of the studs, which resulted in the remaining studs and through bolts fracturing in high-stress fatigue, allowing the cylinder to separate from the engine.

Conclusions 47 Aircraft Accident Report

1. The simultaneous loosening of two or more of the right engine No. 2 cylinder

hold-down nuts resulted from the application of insufficient torque, which was applied by Air Sunshine maintenance personnel during undocumented maintenance.

1. At the time of the accident, Air Sunshine’s maintenance record-keeping and practices

were not adequate.

1. The Federal Aviation Administration’s oversight of Air Sunshine was in accordance

with standard guidelines, but was insufficient to detect inadequate maintenance record-keeping and practices at the company.

1. The pilot had a history of below-average flight proficiency, including numerous failed

flight tests, before the accident flight, which contributed to his inability to maintain maximum flight performance and reach land after the right engine failed.

1. The pilot was not wearing his shoulder harness during the ditching, and because he

was not wearing his harness, he sustained a head injury that reduced his ability to assist passengers after the ditching.

1. After determining that he was going to ditch the airplane, the pilot failed to conduct

an emergency briefing, which was required by the emergency ditching procedures contained in Air Sunshine’s General Operations Manual, and this failure contributed to passenger fatalities.

1. The passengers would have had sufficient time to retrieve and don their personal

flotation devices if the pilot had instructed them to do so shortly after the right engine failed.

1. Having pilots provide adequate emergency briefings to passengers is an important

survival factor. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the in-flight failure of the right engine and the pilot’s failure to adequately manage the airplane’s performance after the engine failed. The right engine failure resulted from inadequate maintenance that was performed by Air Sunshine’s maintenance personnel during undocumented maintenance. Contributing to the passenger fatalities was the pilot’s failure to provide an emergency briefing after the right engine failed.

48 Aircraft Accident Report 4. Recommendation As a result of its investigation of the July 13, 2003, Air Sunshine flight 527 accident, the National Transportation Safety Board makes the following recommendation to the Federal Aviation Administration: Issue a flight standards information bulletin to principal operations inspectors of all Part 135 single-pilot operators that carry passengers and operate over water, which familiarizes them with the circumstances of the Air Sunshine flight 527 accident and emphasizes the need for pilots to provide timely emergency briefings. The bulletin should state that these briefings should include, at a minimum, information about the location and operation of the on-board emergency equipment and exits. (A-04-55) BY THE NATIONAL TRANSPORTATION SAFETY BOARD ELLEN ENGLEMAN CONNERS Chairman CAROL J. CARMODY Member MARK V. ROSENKER Vice Chairman RICHARD F. HEALING Member DEBORAH A. P. HERSMAN Member Adopted: October 13, 2004

49 Aircraft Accident Report 5. Appendix Appendix A Investigation and Public Hearing Investigation The National Transportation Safety Board learned about the accident about 1545 on July 13, 2003. A go-team was not assembled, and the Safety Board did not immediately respond to the scene of the accident. An Air Safety Investigator from the Board’s Southeast Regional Field Office departed Miami on July 31, 2003, to observe the recovery of the airplane, which occurred on August 3, 2003, about 1120. Investigators from Cessna Aircraft Company and the Federal Aviation Administration (FAA) were also present during the recovery. Parties to the investigation were the FAA, Teledyne Continental Motors, McCauley Propeller Systems, and Cessna Aircraft Company. The Bahamian Government designated an accredited representative to assist in the investigation. Public Hearing No public hearing was held for this accident.

this page intentionally left blank

FD07288 ｜ 2004_美国_AAR0404.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2004 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

In-Flight Separation of Vertical Stabilizer American Airlines Flight 587 Airbus Industrie A300-605R, N14053 Belle Harbor, New York November 12, 2001 Aircraft Accident Report NTSB/AAR-04/04 PB2004-910404 Notation 7439B National Transportation Safety Board Washington, D.C.

this page intentionally left blank

Aircraft Accident Report In-Flight Separation of Vertical Stabilizer American Airlines Flight 587 Airbus Industrie A300-605R, N14053 Belle Harbor, New York November 12, 2001 NTSB/AAR-04/04 PB2004-910404 National Transportation Safety Board Notation 7439B 490 L’Enfant Plaza, S.W. Adopted October 26, 2004 Washington, D.C. 20594 E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N

National Transportation Safety Board. 2004. In-Flight Separation of Vertical Stabilizer, American Airlines Flight 587, Airbus Industrie A300-605R, N14053, Belle Harbor, New York, November 12, 2001. Aircraft Accident Report NTSB/AAR-04/04. Washington, DC. Abstract: This report explains the accident involving American Airlines flight 587, an Airbus Industrie A300-605R, N14053, which crashed into a residential area of Belle Harbor, New York, following the in-flight separation of the airplane’s vertical stabilizer and rudder. The safety issues discussed in this report focus on characteristics of the A300-600 rudder control system design, A300-600 rudder pedal inputs at high airspeeds, aircraft-pilot coupling, flight operations at or below an airplane’s design maneuvering speed, and upset recovery training programs. Safety recommendations concerning these issues are addressed to the Federal Aviation Administration and the Direction Général de l’Aviation Civile. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2004-910404 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Aircraft Accident Report Contents Figures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

1. Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
2. 1

History of Flight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.2 Injuries to Persons. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.3 Damage to Airplane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.4 Other Damage. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.5 Personnel Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.5.1 The Captain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.5.1.1 Pilot Interviews Regarding the Captain. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.5.2 The First Officer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1.5.2.1 Pilot Interviews Regarding the First Officer . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 1.6 Airplane Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 1.6.1 Vertical Stabilizer and Rudder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 1.6.2 Rudder Control System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 1.6.2.1 Public Hearing Testimony on the A300-600 Rudder Control System . . . . . . . . 23 1.6.2.2 Airbus Changes to the A300-600 Rudder Control System Design . . . . . . . . . . . 24 1.6.2.3 A300-600 Rudder Control System Design Compared With Other Airplanes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 1.6.3 Powerplants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 1.6.4 Airplane Certification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 1.6.4.1 Loads Certification for the Vertical Stabilizer. . . . . . . . . . . . . . . . . . . . . . . . . . . 31 1.6.4.1.1 Federal Aviation Regulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 1.6.4.1.2 Public Hearing Testimony on Section 25.351. . . . . . . . . . . . . . . . . . . . . . . . 33 1.6.4.1.3 Complementary Conditions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 1.6.4.2 Design Loads for the Vertical Stabilizer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 1.6.4.3 Vertical Stabilizer Certification Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 1.6.4.3.1 Validity of the Full-Scale Vertical Stabilizer Certification Test. . . . . . . . . . 39 1.6.4.3.2 Validity of the Attachment Fitting Certification Tests . . . . . . . . . . . . . . . . . 40 1.6.4.4 Yaw Axis Certification Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 1.6.4.5 Design Maneuvering Speed Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 1.6.5 Maintenance Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 1.7 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 1.8 Aids to Navigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 1.9 Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 1.10 Airport Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 1.10.1 Air Traffic Control Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 1.11 Flight Recorders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 1.11.1 Cockpit Voice Recorder. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 1.11.2 Flight Data Recorder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

iv Aircraft Accident Report 1.12 Wreckage and Impact Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 1.12.1 General Wreckage Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 1.12.2 Vertical Stabilizer and Rudder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 1.12.3 Rudder Control System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 1.12.4 Powerplants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 1.13 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 1.14 Fire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 1.15 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 1.16 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 1.16.1 Video Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 1.16.2 Airplane Performance Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 1.16.2.1 Wake Vortex Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 1.16.2.2 Flight 587 Simulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 1.16.2.3 Loads on the Vertical Stabilizer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 1.16.3 Examinations of the Flight 587 Vertical Stabilizer and Rudder . . . . . . . . . . . . . . . 61 1.16.3.1 Nondestructive Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 1.16.3.2 Materials Testing and Microstructural Examination . . . . . . . . . . . . . . . . . . . . . . 63 1.16.3.3 Fractographic Examination of the Main Attachment Lugs . . . . . . . . . . . . . . . . 64 1.16.4 Structural Analyses and Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 1.16.4.1 Finite Element Analysis and Progressive Failure Analysis. . . . . . . . . . . . . . . . . 66 1.16.4.2 Postaccident Lug Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 1.16.4.3 Summary of Structural Analyses and Tests. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 1.16.5 Systems Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 1.16.5.1 Rudder Servo Controls and Linkages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 1.16.5.2 Artificial Feel and Trim Unit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 1.16.5.3 Rudder Control System Ground Tests. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 1.16.5.4 Yaw Autopilot and Yaw Damper Actuators . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 1.16.5.5 Flight Control Linkages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 1.16.6 Human Performance Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 1.16.6.1 Vertical Motion Simulator Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 1.16.6.2 Control Force and Control Surface Displacement Ground Tests . . . . . . . . . . . . 74 1.16.7 Temperature Tab Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 1.16.8 Cockpit Voice Recorder Sound Spectrum Study . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 1.16.9 Speech Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 1.17 Organizational and Management Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 1.17.1 Flight Crew Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 1.17.1.1 Selected Event Training. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 1.17.1.2 Advanced Aircraft Maneuvering Program. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 1.17.1.2.1 Development of the Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 1.17.1.2.2 Ground School Training Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 1.17.1.2.3 Simulator Training Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 1.17.1.2.4 Training Materials. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 1.17.1.2.5 Comments on the Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 1.17.1.2.6 Training Simulator Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 1.17.1.2.7 Comparison of Rudder Pedal Responses in the A300-600 Airplane and the American Airlines A310/300 Training Simulator . . . . . . . . . . . . . . 91 1.17.1.3 Postaccident A300 Pilot Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 1.17.2 Flight and Operations Manuals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 1.17.2.1 Use of Rudder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 1.17.2.1.1 Manufacturer’s Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Contents

v Aircraft Accident Report 1.17.2.2 Unusual Attitude Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 1.17.2.2.1 Manufacturer’s Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 1.17.2.2.2 Airplane Upset Recovery Training Aid. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 1.17.2.3 Design Maneuvering Speed. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 1.17.2.3.1 Manufacturer’s Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 1.17.3 Federal Aviation Administration Oversight. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 1.17.3.1 National Simulator Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 1.18 Additional Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 1.18.1 Flight 587 Witness Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 1.18.2 Airbus Vertical Stabilizers That Reached High Loads . . . . . . . . . . . . . . . . . . . . . 103 1.18.2.1 1997 American Airlines Flight 903 Accident . . . . . . . . . . . . . . . . . . . . . . . . . . 106 1.18.2.1.1 Flight 903 Postaccident Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 1.18.2.2 1991 Interflug Incident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 1.18.2.3 2002 American Airlines Incident. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 1.18.3 Federal Aviation Administration Airworthiness Directives. . . . . . . . . . . . . . . . . . 110 1.18.3.1 Airworthiness Directive 2001-23-51 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 1.18.3.2 Airworthiness Directive 2002-06-09 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 1.18.4 Previous Safety Recommendations Related to the Circumstances of the Flight 587 Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 1.18.4.1 Safety Recommendations A-02-01 and -02. . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 1.18.4.1.1 American Airlines Flight Operations Technical Informational Bulletin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 1.18.4.1.2 Airbus Flight Crew Operating Manual Bulletin . . . . . . . . . . . . . . . . . . . . . 114 1.18.4.1.3 Boeing Flight Operations Technical Bulletin . . . . . . . . . . . . . . . . . . . . . . . 115 1.18.4.2 Safety Recommendations A-03-41 Through -44. . . . . . . . . . . . . . . . . . . . . . . . 116 1.18.5 Previous Safety Recommendations Related to the Circumstances of the Flight 903 Accident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 1.18.6 Previous Safety Recommendations Related to Upset Recovery Training. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 1.18.6.1 Safety Recommendation A-96-120 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 1.18.6.2 Other Upset Recovery Training Safety Recommendations. . . . . . . . . . . . . . . . 121 1.18.7 Previous Safety Board Actions Regarding Data Filtering . . . . . . . . . . . . . . . . . . . 123 1.18.7.1 Safety Recommendations A-94-120 and -121. . . . . . . . . . . . . . . . . . . . . . . . . . 123 1.18.7.2 Postaccident Correspondence on Data Filtering . . . . . . . . . . . . . . . . . . . . . . . . 126 1.18.7.3 Safety Recommendation A-03-50 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 1.18.7.3.1 Public Meeting on Safety Recommendation A-03-50 . . . . . . . . . . . . . . . . 129 1.18.8 Aircraft-Pilot Coupling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 1.18.8.1 Aircraft-Pilot Coupling Testing Maneuvers . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 1.18.9 Reports of Rudder Use in Upset Recovery Efforts . . . . . . . . . . . . . . . . . . . . . . . . 131 1.18.10 Airbus Technical Note . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132

1. Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
2. 1

General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 2.2 Separation of the Vertical Stabilizer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 2.3 Analysis of the First Officer’s Rudder Pedal Inputs. . . . . . . . . . . . . . . . . . . . . . . . . . . 137 2.3.1 First Officer’s Reactions to Wake Turbulence Encounters . . . . . . . . . . . . . . . . . . 137 2.3.2 Training Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 2.3.2.1 Lack of Pilot Exposure Regarding Airplane Response to Large Rudder Pedal Inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 2.3.2.2 American Airlines Advanced Aircraft Maneuvering Program . . . . . . . . . . . . . 140 Contents

vi Aircraft Accident Report 2.3.2.2.1 Ground School Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 2.3.2.2.2 Simulator Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 2.3.2.3 Lack of Pilot Training on Restricted A300-600 Rudder Pedal Travel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 2.3.3 Characteristics of the A300-600 Rudder Control System Design . . . . . . . . . . . . . 144 2.4 Analysis of the Accident Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 2.4.1 Initial Rudder Pedal Input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 2.4.1.1 First Officer’s Reactions to Wake Turbulence Encounters . . . . . . . . . . . . . . . 147 2.4.1.2 Training Factors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 2.4.1.3 A300-600 Rudder Control System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 2.4.2 Subsequent Rudder Pedal Inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 2.4.2.1 Role of Training. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 2.4.2.2 Airplane Response to Initial Input as Triggering Event for an Adverse Aircraft-Pilot Coupling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 2.4.2.3 Characteristics of the A300-600 Rudder Control System Design That May Be Conducive to Sustained Alternating Inputs . . . . . . . . . . . . . . . . . . . . . . 151 2.4.3 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 2.5 Prevention of High Loads Resulting From Pilot Rudder Pedal Inputs. . . . . . . . . . . . . 153 2.5.1 Rudder Pedal Inputs at High Airspeeds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 2.5.2 Alternating Full Control Inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 2.5.3 Pilot Guidance on Design Maneuvering Speed . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 2.6 Upset Recovery Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156

1. Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
2. 1

Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 3.2 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

1. Recommendations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
2. 1

New Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161 4.2 Previously Issued Recommendations Resulting From This Accident Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 4.3 Previously Issued Recommendations Classified in This Report . . . . . . . . . . . . . . . . . 164

1. Appendixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167

A: Investigation and Public Hearing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 B: Cockpit Voice Recorder Transcript . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168 C: Differences Between American Airlines Flights 903 and 587. . . . . . . . . . . . . . . . . . 197 Contents

vii Aircraft Accident Report Figures

1. Control Wheel and Rudder Pedal Movements During the Second Wake Encounter. . . . . . . 6
2. American Airlines Flight 587 and Japan Air Lines Flight 47 Flightpaths . . . . . . . . . . . . . . . 7
3. Flight 587’s Flightpath and Key Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
4. Vertical Stabilizer-to-Aft Fuselage Attachment Points . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
5. Main Attachment Lug . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
6. Rudder Control System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
7. Rudder Travel Limiter System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
8. A300-600 and A300B2/B4 Rudder Pedal Sensitivities . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
9. Shear, Bending, and Torsion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
10. Net Torsion Versus Net Bending . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
11. Vertical Stabilizer After Recovery From Jamaica Bay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
12. Right Rear Main Attachment Fitting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
13. Bending Moment About the Root Chord in the Vertical Stabilizer Axis System . . . . . . . . . 58
14. Bending Moment Load Range at the Time of Vertical Stabilizer Separation . . . . . . . . . . . 60
15. Estimated Aerodynamic Loads in Relation to the Torsion Versus

Bending Correlated Shear Force Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

1. Comparison of Lug Forces at the Time of Fracture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
2. Load on the Flight 587 Right Rear Main Attachment Lug and a Depiction

of the Cleavage-Tension Failure Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

1. Rudder Pedal Motion With Normal and High Pilot Pedal Force in the A300-600

Airplane and the American Airlines A310/300 Training Simulator . . . . . . . . . . . . . . . . . . . 91

viii Aircraft Accident Report Abbreviations AAMP advanced aircraft maneuvering program AC advisory circular AD airworthiness directive AFM airplane flight manual AFS auto flight system agl above ground level AOA angle of attack APC aircraft-pilot coupling APM aircrew program manager APU auxiliary power unit ASOS automated surface observing system ASR-9 airport surveillance radar-9 ASRS aviation safety reporting system ATC air traffic control ATCT air traffic control tower ATIS automatic terminal information service ATP airline transport pilot C Celsius CC complementary conditions CFD computational fluid dynamics CFIT controlled flight into terrain CFR Code of Federal Regulations CFRP carbon fiber reinforced plastics cg center of gravity CMO certificate management office CT computed tomography

Abbreviations ix Aircraft Accident Report CVR cockpit voice recorder DGAC Direction Général de l’Aviation Civile EICAS engine instrument crew alert system FAA Federal Aviation Administration FARs Federal Aviation Regulations FBI Federal Bureau of Investigation FCOM flight crew operating manual FDAU flight data acquisition unit FDR flight data recorder FEA finite element analysis GFRP glass fiber reinforced plastic HBAT handbook bulletin for air transportation Hg mercury Hz Hertz JFK John F. Kennedy International Airport KCAS knots calibrated airspeed kN kiloNewton MAC mean aerodynamic chord METAR meteorological aerodrome report MIA Miami International Airport MPD maintenance planning document MRB maintenance review board msl mean sea level N Newton NASA National Aeronautics and Space Administration nm nautical mile Nm Newton times meter(s) NPRM notice of proposed rulemaking NRC National Research Council

Abbreviations x Aircraft Accident Report NSP National Simulator Program NWS National Weather Service PFA progressive failure analyses POI principal operations inspector S/N serial number SDAC system data analog converter SDR service difficulty reports SEM scanning electron microscopy SPECI special weather observation TAF terminal aerodome forecasts TRACON terminal radar approach control TWA Trans World Airlines UTC coordinated universal time VA design maneuvering speed VB design gust speed VC design cruise speed VD design dive speed VMC minimum control speed VMS vertical motion simulator VSR reference stall speed VSR1 reference stall speed in a specific configuraton

xi Aircraft Accident Report Executive Summary On November 12, 2001, about 0916:15 eastern standard time, American Airlines flight 587, an Airbus Industrie A300-605R, N14053, crashed into a residential area of Belle Harbor, New York, shortly after takeoff from John F. Kennedy International Airport, Jamaica, New York. Flight 587 was a regularly scheduled passenger flight to Las Americas International Airport, Santo Domingo, Dominican Republic, with 2 flight crewmembers, 7 flight attendants, and 251 passengers aboard the airplane. The airplane’s vertical stabilizer and rudder separated in flight and were found in Jamaica Bay, about 1 mile north of the main wreckage site. The airplane’s engines subsequently separated in flight and were found several blocks north and east of the main wreckage site. All 260 people aboard the airplane and 5 people on the ground were killed, and the airplane was destroyed by impact forces and a postcrash fire. Flight 587 was operating under the provisions of 14 Code of Federal Regulations Part 121 on an instrument flight rules flight plan. Visual meteorological conditions prevailed at the time of the accident. The National Transportation Safety Board determines that the probable cause of this accident was the in-flight separation of the vertical stabilizer as a result of the loads beyond ultimate design that were created by the first officer’s unnecessary and excessive rudder pedal inputs. Contributing to these rudder pedal inputs were characteristics of the Airbus A300-600 rudder system design and elements of the American Airlines Advanced Aircraft Maneuvering Program. The safety issues discussed in this report focus on characteristics of the A300-600 rudder control system design, A300-600 rudder pedal inputs at high airspeeds, aircraft-pilot coupling, flight operations at or below an airplane’s design maneuvering speed, and upset recovery training programs. Safety recommendations concerning these issues are addressed to the Federal Aviation Administration and the Direction Général de l’Aviation Civile.

this page intentionally left blank

1 Aircraft Accident Report 1. Factual Information 1.1 History of Flight On November 12, 2001, about 0916:15 eastern standard time,1 American Airlines flight 587, an Airbus Industrie A300-605R,2 N14053, crashed into a residential area of Belle Harbor, New York, shortly after takeoff from John F. Kennedy International Airport (JFK), Jamaica, New York. Flight 587 was a regularly scheduled passenger flight to Las Americas International Airport, Santo Domingo, Dominican Republic, with 2 flight crewmembers, 7 flight attendants, and 251 passengers3 aboard the airplane. The airplane’s vertical stabilizer and rudder separated in flight and were found in Jamaica Bay, about 1 mile north of the main wreckage site.4 The airplane’s engines subsequently separated in flight and were found several blocks north and east of the main wreckage site.5 All 260 people aboard the airplane and 5 people on the ground were killed, and the airplane was destroyed by impact forces and a postcrash fire. Flight 587 was operating under the provisions of 14 Code of Federal Regulations (CFR) Part 121 on an instrument flight rules flight plan. Visual meteorological conditions prevailed at the time of the accident. The accident airplane arrived at JFK about 2231 on the night before the accident. The airplane had been flown from San Jose, Costa Rica, to JFK with an intermediate stop in Miami International Airport, Miami, Florida. During postaccident interviews, the pilots of the flight leg from MIA to JFK indicated that the flight was smooth and uneventful. Flight 587 was the first leg of a 1-day roundtrip sequence for the flight crew. American Airlines records indicated that the captain checked in for the flight about 0614 and that the first officer checked in about 0630. The gate agent working the flight arrived at the departure gate about 0645. She stated that the flight attendants were already aboard the airplane at that time and that the captain and the first officer arrived at the gate about 0700. 1 Unless otherwise indicated, all times in this report are eastern standard time based on a 24-hour clock. 2 The A300-605R is one of several variants of the A300-600 series airplane. The “5” refers to the type of engine installed on the airplane (see section 1.6.3 for information), and the “R” refers to the airplane’s ability to carry fuel in the horizontal stabilizer. 3 Of the 251 passengers, 5 were lap children under 2 years of age. 4 The vertical stabilizer is attached to the airplane’s aft fuselage. The vertical stabilizer provides supporting structure for the rudder, which is an aerodynamic control surface that is used to make the airplane yaw, or rotate, about its vertical axis. An airplane cannot be flown without its vertical stabilizer. 5 Section 1.12 provides additional information about the wreckage area.

Factual Information 2 Aircraft Accident Report About 0710, the airplane fueling process began.6 The airplane fueler indicated that, during the fueling process, he saw one of the pilots perform an exterior inspection of the airplane. He finished the fueling process about 0745 and stated that he saw nothing unusual regarding the airplane. Statements provided to the Port Authority of New York and New Jersey Police Department by American Airlines maintenance and avionics personnel indicated that, sometime between 0730 and 0800, the captain reported that the number 2 pitch trim and yaw damper system would not engage. Two avionics technicians were sent to the airplane to investigate the problem. They performed an auto flight system (AFS) check, which indicated a fault with the number 2 flight augmentation computer. The circuit breaker was then reset, another AFS check was performed, and no fault was detected. In addition, an autoland system check was performed, and that test also did not detect a fault. The avionics technicians estimated that they were in the cockpit for 5 to 7 minutes. The cockpit voice recorder (CVR) recording began about 0845:35. The CVR indicated that, about 0859:58, the airplane was cleared to push back from the gate. About 0901:33, the ground controller provided the flight crew with taxi instructions to runway 31L, and the first officer acknowledged these instructions. About 0902:05, the captain told the first officer, “your leg, you check the rudders.” (The first officer was the flying pilot, and the captain was the nonflying pilot.) Data from the flight data recorder (FDR) showed that, about 0902:07, the rudder pedal check began. The FDR data also showed that a maximum right rudder pedal deflection of about 3.7 inches was recorded about 0902:11 and that a maximum left rudder pedal deflection of 3.6 inches was recorded about 0902:19. About 0902:23, the first officer responded, “rudders check.” The FDR data showed that the rudder pedals returned to their neutral position about 0902:25. About 0906:53, the ground controller provided the pilots of Japan Air Lines flight 47, a Boeing 747-400, with taxi instructions to runway 31L. About 0908:01, the ground controller instructed the Japan Air Lines pilots to contact the local (tower) controller. About 0908:58, the ground controller instructed the flight 587 pilots to follow the Japan Air Lines airplane and to contact the local controller. The first officer acknowledged this instruction. About 0911:08, the local controller cleared the Japan Air Lines airplane for takeoff. About 0911:36, the local controller cautioned the flight 587 pilots about wake turbulence and instructed the pilots to taxi into position and hold for runway 31L. The first officer acknowledged the instruction. About 0913:05, the local controller instructed the Japan Air Lines pilots to fly the bridge climb7 and to contact the departure controller at the New York Terminal Radar Approach Control (TRACON). About 0913:21, the flight 587 captain said to the first officer, “you have the airplane.”8 6 The Port Authority of New York and New Jersey collected samples of fuel from the fuel truck that serviced the accident airplane and from the two tanks that supplied fuel to the truck. The fuel samples were sent to a New Jersey laboratory for analysis and were determined to conform to specifications. 7 The bridge climb is one of several standard instrument departure routes from JFK. 8 According to FDR data, the autopilot was not engaged at any time during the accident flight.

Factual Information 3 Aircraft Accident Report About 0913:28, the local controller cleared flight 587 for takeoff, and the captain acknowledged the clearance. About 0913:35, the first officer asked the captain, “you happy with that [separation] distance?”9 About 3 seconds later, the captain replied, “we’ll be all right once we get rollin’. He’s supposed to be five miles by the time we’re airborne, that’s the idea.” About 0913:46, the first officer said, “so you’re happy.” The National Transportation Safety Board’s airplane performance study for this accident10 determined that flight 587 started its takeoff roll about 0913:51 and lifted off about 0914:29, which was about 1 minute 40 seconds after the Japan Air Lines airplane.11 About 0914:43, the local controller instructed the flight 587 pilots to turn left, fly the bridge climb, and contact the New York TRACON departure controller. About 5 seconds later, the captain acknowledged this instruction. Radar data indicated that the airplane climbed to 500 feet above mean sea level (msl) and then entered a climbing left turn to a heading of 220º. About 0915:00, the captain made initial contact with the departure controller, informing him that the airplane was at 1,300 feet msl and climbing to 5,000 feet msl. About 0915:05, the departure controller instructed flight 587 to climb to and maintain 13,000 feet msl, and the captain acknowledged this instruction about 5 seconds later. About 0915:29, the CVR recorded the captain’s statement “clean machine,” indicating that the gear, flaps, and slats had all been retracted. About 0915:35, flight 587 was climbing through 1,700 feet msl with its wings approximately level. About 1 second later, the departure controller instructed flight 587 to turn left and proceed direct to the WAVEY navigation intersection (located about 30 miles southeast of JFK). About 0915:41, the captain acknowledged the instruction. The controller did not receive any further transmissions from flight 587. FDR data indicated that, about 0915:36, the airplane experienced a 0.04 G drop in longitudinal load factor, a 0.07 G shift to the left in lateral load factor, and about a 0.3 G drop in normal (vertical) load factor.12 The airplane performance study found that these excursions were consistent with a wake turbulence encounter. Between 0915:36 and 0915:41, the FDR recorded movement of the control column, control wheel, and rudder pedals. Specifically, the control column moved from approximately 0º (neutral) to 2º nose up, 2º nose down, and back to 0º; the control wheel moved a total of seven times, with peaks at 18º right, 30º left, 37º right, 34º left, 5º left, 21º left, and 23º right, before moving to between 5º and 6º left;13 and the rudder pedals moved from about 0.1 inch left (the starting point for the pedals) to about 0.1 inch right and 0.2 inch left before moving to 9 Federal Aviation Administration (FAA) Order 7110.65, “Air Traffic Control Handbook,” paragraphs 3-9-6, “Same Runway Separation,” and 5-5-4, “Minima,” indicate that the separation for a heavy airplane behind another heavy airplane is 2 minutes or 4 nautical miles (nm), respectively. 10 See section 1.16.2 for detailed information from the airplane performance study. 11 Japan Air Lines flight 47 and American Airlines flight 587 were separated at all times by at least 4.3 nm horizontally and 3,800 feet vertically. 12 G is a unit of measurement that is equivalent to the acceleration caused by the earth’s gravity (32.174 feet/second2). 13 The control wheel can be moved to a maximum of 78º either left or right.

Factual Information 4 Aircraft Accident Report 0.1 inch left. The airplane performance study indicated that, during this time, the rudder moved from 0º (neutral) to about 2º left, about 0.6º right, and back to 0º.14 During the wake turbulence encounter, the airplane’s pitch angle increased from 9º to 11.5º, decreased to about 10º, and increased again to 11º. The airplane’s bank angle moved from 0º (wings level) to 17º left wing down, which was consistent with the turn to the WAVEY navigation intersection. At 0915:44.7, the captain stated, “little wake turbulence, huh?” to which the first officer replied, at 0915:45.6, “yeah.” At 0915:48.2, the first officer indicated that he wanted the airspeed set to 250 knots, which was the maximum speed for flight below 10,000 feet msl. At that point, the airplane was at an altitude of about 2,300 feet msl. FDR data indicated that, about 0915:51, the load factors began excursions that were similar to those that occurred about 0915:36: the longitudinal load factor dropped from 0.20 to 0.14 G, the lateral load factor shifted 0.05 G to the left, and the normal load factor dropped from 1.0 to 0.6 G. The airplane performance study found that these excursions were also consistent with a wake turbulence encounter. According to the FDR, the airplane’s bank angle moved from 23º to 25º left wing down at 0915:51.5, the control wheel moved to 64º right at 0915:51.5, and the rudder pedals moved to 1.7 inches right at 0915:51.9. At 0915:51.8, 0915:52.3, and 0915:52.9, the CVR recorded the sound of a thump, a click, and two thumps, respectively. At 0915:54.2, the first officer stated, in a strained voice, “max power.”15 At that point, the airplane was traveling at 240 knots. About 0915:55, the captain asked, “you all right?” to which the first officer replied, “yeah, I’m fine.” One second later, the captain stated, “hang onto it. Hang onto it.” The CVR recorded the sound of a snap at 0915:56.6, the first officer’s statement “let’s go for power please” at 0915:57.5, and the sound of a loud thump at 0915:57.7. According to the airplane performance study, the vertical stabilizer’s right rear main attachment fitting fractured at 0915:58.4,16 and the vertical stabilizer separated from the airplane immediately afterward. At 0915:58.5, the CVR recorded the sound of a loud bang.17 At that time, the airplane was traveling at an airspeed of about 251 knots. 14 These rudder movements are within the authority of the yaw damper, which can move the rudder without a pilot or autopilot input. (Section 1.6.2 provides information about the A300-600’s rudder control system, including the yaw damper.) Between 0915:41 and 0915:48, the rudder oscillated twice between 0º and 1º left and then moved to 0.5º left until 09:15:51. These rudder movements are also within the authority of the yaw damper. 15 The FDR indicated that the captain did not subsequently change the airplane’s power setting. 16 For information about the vertical stabilizer’s attachment fittings, see section 1.6.1. For information about the fracture of the right rear main attachment fitting, see sections 1.16.2.3 and 1.16.4. 17 It took 0.14 second for the sound of the vertical stabilizer separation to travel from the back of the airplane to the front to be recorded on the CVR.

Factual Information 5 Aircraft Accident Report According to the FDR, the rudder pedals moved from 1.7 inches right to 1.7 inches left, 1.7 inches right, 2.0 inches right, 2.4 inches left, and 1.3 inches right between 0915:52 and 0915:58.5.18 Also, the FDR showed that the control wheel moved 64º to the right at 0915:51.5, 78º (full) to the left at 0915:53.5, 64º to the right at 0915:55.5, and 78º to the left at 0915:56.5.19 Figure 1 shows these cockpit control movements. The airplane performance study estimated that, at 0915:53.2, the rudder was deflected 11º to the left,20 and the sideslip angle at the airplane’s center of gravity (cg) was about 4º to the left (after peaking temporarily at 5º to the left).21 At 0915:56.8, the rudder was deflected 10.2º to the left, and the sideslip angle was about 7º to the left. At 0915:58.4 (the time that the right rear main attachment fitting fractured), the rudder was deflected between 10º and 11º to the right, the sideslip angle was between 11º and 12º to the right,22 and the airplane experienced a 0.2 G shift to the right in lateral load factor. The CVR recorded, at 0916:00.0, a sound similar to a grunt and, 1 second later, the first officer’s statement, “holy [expletive].” At 0916:04.4, the CVR recorded a sound similar to a stall warning repetitive chime, which lasted for 1.9 seconds. At 0916:07.5, the first officer stated, “what the hell are we into…we’re stuck in it.” At 0916:12.8, the captain stated, “get out of it, get out of it.” The CVR recording ended 2 seconds later. The airplane was located at 40º 34' 37.59" north latitude and 73º 51' 01.31" west longitude. The accident occurred during the hours of daylight. Figures 2 and 3 show flight 587’s radar track based on JFK Airport Surveillance Radar-9 (ASR-9) information. Figure 2 shows flight 587’s flightpath, from takeoff to impact, in relation to the flightpath for Japan Air Lines flight 47, and figure 3 shows flight 587’s flightpath overlaid on a topographical map, along with key events. 18 After 0915:58.5, the rudder pedals moved briefly to 0.7 inch right and then to 3.9 inches right, where they remained for the remainder of the FDR recording. (The FDR stopped recording 13.6 seconds before impact.) 19 The directional movements of the control wheel between 0915:51.5 and 0915:58.5 mostly paralleled those of the rudder pedals. The only control wheel movements with directions that did not parallel those of the rudder pedals occurred between 0915:53.5 and 0915:56.0, when the pedals moved to 1.7 inches right and then 2.0 inches right; the control wheel showed a right-to-left movement between 0915:53.5 and 0915:54.5 and a left-to-right movement between 0915:54.5 and 0915:55.5. Also, between 0915:51 and 0915:53.5, the rudder pedal movements lagged behind the control wheel movements by about 0.2 second; after 0915:55.5, the pedal movements lagged behind the wheel movements by 0.5 second. 20 The rudder angle data detected by the rudder position sensor at the vertical stabilizer were filtered before they were recorded on the FDR. As a result, the rudder angles during the second set of load factor excursions had to be reconstructed using the recorded FDR data, the characteristics of the filter (as determined from a test performed during this investigation), and constraints imposed by the rudder control system and the recorded motion of the airplane. See section 1.11.2 for information about the data filter and section 1.16.2 for information about the reconstruction of rudder angles. 21 Sideslip is the angle between the longitudinal stability axis of the airplane and the direction of motion that produces an airspeed component along the airplane’s lateral axis; simply stated, sideslip is a measure of the “sideways” motion of the airplane through the air. The sideslip angle was not recorded on the FDR but was calculated using FDR parameters, including heading, roll, and pitch angles and longitudinal, lateral, and normal load factors. See section 1.16.2 for more information. 22 Afterward, the sideslip angle continued to increase and reached 31º at the end of the FDR recording.

Factual Information 6 Aircraft Accident Report Figure 1. Control Wheel and Rudder Pedal Movements During the Second Wake Encounter

Factual Information 7 Aircraft Accident Report Figure 2. American Airlines Flight 587 and Japan Air Lines Flight 47 Flightpaths

Factual Information 8 Aircraft Accident Report Note: The toll booth video and the white streak that appears on it are explained in section 1.16.1 of this report. Figure 3. Flight 587’s Flightpath and Key Events

Factual Information 9 Aircraft Accident Report 1.2 Injuries to Persons Table 1. Injury chart Note: Five fatalities occurred on the ground. 1.3 Damage to Airplane The airplane was destroyed by impact forces and a postcrash fire. 1.4 Other Damage In the immediate vicinity of the impact area, four homes were destroyed, three homes received substantial damage, and three homes received minor damage. In addition, the in-flight separation of the engines resulted in property damage where the engines came to rest. A gas station received minor damage as a result of the impact of the left engine, and a home and a boat (parked in the driveway) received severe damage as a result of the impact of the right engine. 1.5 Personnel Information 1.5.1 The Captain The captain, age 42, was hired by American Airlines in July 1985. He held an airline transport pilot (ATP) certificate and a Federal Aviation Administration (FAA) first-class medical certificate dated June 5, 2001, with no limitations. The captain received a type rating on the A30023 in September 1988 while serving as a first officer24 and Injuries Flight Crew Cabin Crew Passengers Other Total Fatal 2 7 251 5 265 Serious 0 0 0 0 0 Minor 0 0 0 0 0 None 0 0

0

0 Total 2 7 251 5 265 23 The A300 is designated as the A310 on pilot certificates. 24 Title 14 CFR Section 121.543, “Flight crewmembers at controls,” (b) (3) (i), states, in part, that a second-in-command can act as a pilot-in-command during the en route portion of the flight if the pilot holds an ATP certificate and an appropriate type rating, is currently qualified as pilot-in-command or second-in-command, and is qualified as pilot-in-command of that aircraft during the en route cruise portion of the flight.

Factual Information 10 Aircraft Accident Report received a type rating on the Boeing 727 in December 1991. He completed initial operating experience as an A300 captain in August 1998. According to American Airlines records, the captain joined the U.S. Air Force Reserves in June 1982. He flew T-37, T-38, and C-141 airplanes while on duty and received an honorable discharge in 1992. He had accumulated 1,922 hours total flying time in military and general aviation before his employment with American Airlines. American Airlines records also indicated that the captain had accumulated 8,050 hours total flying time,25 including 3,448 hours as pilot-in-command and 1,723 hours as an A300 pilot-in-command. He had flown approximately 146 and 52 hours in the 90 and 30 days, respectively, before the accident. The captain’s last recurrent training occurred from June 18 to 22, 2001; his last recurrent proficiency check was on June 21, 2001; and his last pilot-in-command line check occurred on July 31, 2001. FAA records indicated no accident or incident history or enforcement action, and a search of the National Driver Register database indicated no record of driver’s license suspension or revocation. According to American Airlines records, the captain had a scheduled day off on November 8, 2001. He flew a trip that started on the morning of November 9 and ended on the night of November 10. The captain had a day off on November 11. According to his wife, the captain’s activities on November 11 included going to church in the morning and watching television and attending a Cub Scouts committee meeting in the afternoon. He went to sleep about 2200. On November 12, the captain awoke about 0416 and left his residence about 0500 to check in for the flight. The captain’s wife said that he was in good health and that he exercised regularly. She indicated that he consumed alcohol occasionally but abstained from alcohol within the required period before reporting for duty. The captain’s wife also stated that he did not smoke, use tobacco products, or suffer from any sleep disorders. In addition, she indicated that no changes had occurred in the captain’s eating or sleeping habits, off-duty activities, or financial situation in the year before the accident. American Airlines records indicated that the captain and the first officer had flown together on 36 flight segments before the accident. The captain’s wife stated that he and the first officer “got along well.” 1.5.1.1 Pilot Interviews Regarding the Captain The first officer who flew with the captain on November 9 and 10, 2001, described the captain’s management style as “ideal.” The first officer stated that the captain would let him fly the airplane but would not hesitate to make suggestions or offer an opinion. Another first officer who flew recently with the captain stated that he was “confident, 25 This figure includes time as a captain and a first officer. The captain received a flight engineer certificate in August 1985, but American Airlines’ records did not reflect the captain’s flight times as a flight engineer.

Factual Information 11 Aircraft Accident Report respected, and able to get a point across in a nice way.” A first officer who indicated that he had often flown with the captain on the 727 stated that the captain was an “extremely good pilot” who was “very relaxed and competent.” This first officer also stated that he “couldn’t imagine him [the captain] panicking.” 1.5.2 The First Officer The first officer, age 34, was hired by American Airlines in March 1991. He held an ATP certificate and an FAA first-class medical certificate dated October 18, 2001, with a limitation that required him to wear correcting lenses while exercising the privileges of the certificate. The first officer received a type rating on the A300 in November 1998. According to American Airlines records, the first officer had flown Shorts 360, Beechcraft 99, and DeHavilland DHC-6 airplanes in commuter and regional operations under 14 CFR Parts 121 and 135. He had accumulated 3,220 hours total flying time in commercial and general aviation before his employment with American Airlines. American Airlines records also indicated that the first officer had accumulated 4,403 hours total flying time,26 including 1,835 hours as an A300 second-in-command. He had flown approximately 135 and 52 hours in the 90 and 30 days before the accident. The first officer’s second-in-command qualification line check occurred on December 12, 1998; his last recurrent training occurred from December 17 to 21, 2000, and on January 5, 2001; and his last recurrent proficiency check was on December 23, 2000.27 FAA records indicated no accident or incident history or enforcement action, and a search of the National Driver Register database indicated no record of driver’s license suspension or revocation. American Airlines records indicated that the first officer flew 1-day trip sequences on November 8 and 9 and was off duty on November 9 at 2209. He then had a 48-hour crew rest period on November 10 and 11. According to his father, the first officer’s activities on November 11 included helping a friend prepare her sailboat for the winter and then going out to lunch, having friends over to his home for dinner, and speaking by telephone with his parents about 2230. A friend of the first officer’s (an American Airlines flight attendant), who spoke with him by telephone earlier in the evening of November 11, indicated that he planned to go to bed between 2200 and 2300. The friend also indicated that the first officer was excited about his trip the next day because he liked the captain and enjoyed working with him. The first officer’s father indicated that his son’s alarm clock had been set for 0530 on the morning of the flight. 26 The first officer received a flight engineer certificate in April 1990, but American Airlines’ records did not reflect the first officer’s flight times as a flight engineer. 27 The first officer completed the ground school portion of the training on January 5, 2001, because the classroom presentation for human factors had been canceled (for unknown reasons) during the December 17 through 21, 2000, time period. Also, the first officer’s proficiency check was not accomplished until December 23, 2000, because of mechanical problems with the simulator during the December 17 through 21, 2000, time period.

Factual Information 12 Aircraft Accident Report The first officer’s father indicated that his son was in good health and was “very health conscious” and that no recent changes had occurred in his son’s health. The first officer’s father also stated that his son consumed alcohol occasionally and never used illicit drugs or tobacco products. The first officer’s friend indicated that he enjoyed his flying schedule because he liked getting up early for trips and returning home the same day. 1.5.2.1 Pilot Interviews Regarding the First Officer An American Airlines captain who flew several times with the first officer on the 727 (when they were a junior captain and junior first officer, respectively) told Safety Board investigators that, during one flight sometime in 1997,28 the first officer had been “very aggressive” on the rudder pedals after a wake turbulence encounter. Specifically, the captain indicated that, when the airplane was at an altitude of between 1,000 and 1,500 feet, the first officer “stroked the rudder pedals 1-2-3, about that fast.” The captain thought that the airplane had lost an engine and was thus focused on the engine instruments. The captain stated that he then asked the first officer what he was doing and that the first officer replied that he was “leveling the wings due to wake turbulence.” The captain, who had his feet on the rudder pedals, thought that the first officer had pushed the rudder to its full stops. The captain did not recall what type of airplane the 727 was following. He thought that the wake turbulence encounter required only aileron29 inputs to level the wings but did not think that the first officer had made any such inputs during the encounter. The captain recalled being startled by the first officer’s rudder inputs and indicated that they did not level the wings but created left and right yawing moments and heavy side loads30 on the airplane. He further indicated that the first officer did not need to be so aggressive because the 727 was “a very stable airplane.” According to the captain, he and the first officer discussed this event later in the flight. The captain pointed out to the first officer that his use of the rudder pedals was “quite aggressive,” but the first officer insisted that the American Airlines Advanced Aircraft Maneuvering Program (AAMP)31 directed him to use the rudder pedals in that manner. The captain disagreed with the first officer and told him that the AAMP directed that the rudder was to be used at lower airspeeds. The captain told the first officer to review the AAMP when he returned home and to be less aggressive on the rudder pedals when they flew together. The captain indicated that, during a wake turbulence encounter 28 American Airlines records indicated that the flight occurred during a 3-day trip sequence from August 31 to September 2, 1997. 29 An aileron is an aerodynamic control surface that is attached to the trailing edges of each wing. The ailerons, when commanded, rotate up or down in opposite directions. 30 Sideload is an effect of lateral acceleration that is typically the result of sideslip or yaw acceleration. 31 According to American Airlines, AAMP is “advanced training for experienced aviators involving upsets in aircraft attitude.” AAMP consists of ground school and simulator flight training. At the time of the 1997 flight, the first officer had attended AAMP ground school but had not yet attended AAMP simulator training. For more information about AAMP, see section 1.17.1.2.

Factual Information 13 Aircraft Accident Report on a subsequent flight, the first officer modified his wake turbulence maneuver; specifically, the first officer used the rudder during the encounter but did not push the rudder to its full stop. The captain added that the first officer was still “very quick” on the rudder. The captain stated that he did not document or report this event at the time that it occurred. The captain further stated that he remembered the event with such clarity because he had never seen any pilot other than the first officer perform this maneuver. The flight engineer who flew with the captain and the first officer during the 1997 trip sequence recalled that the captain and the first officer had a discussion regarding piloting skills but added that he was not part of that conversation. The flight engineer indicated that he did not recall anything remarkable (such as a yawing event associated with wake turbulence) that would have provoked the discussion. The flight engineer also indicated that the first officer did not discuss the incident with him but that the captain made a “passing comment” to him about the incident after the flight. The flight engineer did remember a different event involving the first officer that he thought also occurred sometime in 1997. Specifically, the flight engineer and the first officer (the flying pilot) were on final approach (about 7 miles from the runway) in instrument meteorological conditions to LaGuardia International Airport, New York, when a Boeing 737 ahead of their 727 performed a go-around. The 727 encountered the wake from the 737. The flight engineer thought that the airplane rolled as a result of the wake encounter but that the bank angle did not exceed 30º. The flight engineer stated that the first officer made a “fast” decision to go around because of the wake. The first officer called for maximum power without “discussion or hesitation.” The flight engineer explained that the airplane’s tail went down as the nose of the airplane pitched up. The flight engineer stated that the go-around felt “weird” but that the first officer “flew the airplane to do what was necessary to keep the airplane under control.” The flight engineer also stated that the event happened when the airplane was at an altitude of between 3,000 and 5,000 feet above ground level (agl) and that the airplane was not in immediate danger of ground contact. In addition, the flight engineer stated that the event was one of the more memorable ones of his career. The captain indicated that the first officer’s aggressive response to wake turbulence was out of character. Specifically, the captain described the first officer’s overall flying skills as “excellent” and did not recall aggressive movements or abnormal rudder inputs during other trips with him. Also, the flight engineer stated that the first officer flew airplanes “smoothly and accurately.” In addition, the Safety Board interviewed other pilots who provided similar information about the first officer’s flying abilities. For example, one captain who flew with the first officer on the 727 stated that he was an “excellent” pilot who was “well above the norm.” This captain also stated that he never had to question the first officer’s flying ability and that he never saw the first officer fly the airplane aggressively.

Factual Information 14 Aircraft Accident Report 1.6 Airplane Information Airbus Industrie,32 the manufacturer of the A300-600 airplane, is headquartered in Toulouse, France. The airplane is type-certificated for operation in the United States under 14 CFR 21.29 and a bilateral airworthiness agreement between the U.S. and French governments. (See section 1.6.4 for A300-600 certification information.) The development of the A300 airplane began in May 1969, and the first flight of an A300 occurred in October 1972. The A300B2 and A300B4 models entered service in May 1974 and June 1975, respectively. The development of the A300-600 series airplane (a derivative of the A300B2/B4) began in December 1980, the first flight of an A300-600 occurred in July 1983, and the airplane was certificated in March 1984. Before the accident, 242 A300-600 series airplanes were in service worldwide. The accident airplane’s official designation was A300B4-605R. A review of the American Airlines air carrier certificate, which included the standards, terms, conditions, and limitations contained in the FAA-approved operations specifications, revealed no discrepancies regarding the company’s operation of the A300B4-605R airplane. A review of the FAA’s type certificate data sheet for the A300B4-605 airplane, which prescribes the conditions and limitations under which the airplane meets airworthiness requirements, revealed no discrepancies. The accident airplane, N14053, serial number (S/N) 420, was delivered new to American Airlines on July 12, 1988.33 At the time of the accident, the airplane had accumulated 37,550 flight hours and 14,934 cycles.34 All applicable FAA airworthiness directives (AD) were accomplished on the airplane. The airplane’s weight and balance on the day of the accident were calculated according to the American Airlines takeoff performance system and the procedures in the Airbus A300-600 Flight Crew Operating Manual (FCOM). Both computations determined that the airplane’s weight and balance were within limitations. The airplane departed JFK with a takeoff weight of 349,370 pounds, which was below the maximum takeoff weight limitation of 353,500 pounds, and the corresponding cg was 29.1 percent mean aerodynamic chord (MAC). The airplane had a forward limit of 20.3 percent MAC and an aft limit of 34.3 percent MAC. 32 Airbus Industrie is a consortium of aerospace companies located in countries throughout Europe, including France, Germany, Great Britain, and Spain. A300-600 parts are manufactured in Airbus facilities throughout Europe, but the final assembly of the A300-600 occurs at company headquarters in Toulouse. 33 In a final commitment letter dated July 12, 1988, Airbus indicated that “delamination and bonding failure have been found in the aircraft fin central fittings.” (The terms “fin” and “vertical stabilizer” are synonymous.) A repair was performed that reinforced the defect area with additional fabric layers attached by rivets. The final commitment letter also stated, “further to the several actions and repairs accomplished, there are no further aircraft limitations.” 34 An airplane cycle is one complete takeoff and landing sequence.

Factual Information 15 Aircraft Accident Report 1.6.1 Vertical Stabilizer and Rudder The A300-600 vertical stabilizer and rudder were constructed with composite materials, that is, mixtures that contain two or more distinct materials that are unified into one combined material. The composite materials used in the vertical stabilizer and the rudder consisted primarily of long fibers of carbon or glass held together by an epoxy polymer. These materials are identified as carbon fiber reinforced plastics (CFRP) or glass fiber reinforced plastics (GFRP). The materials are manufactured as plies (or sheets) of fibers that are premixed with an uncured, flexible epoxy. The plies in the sheets are either oriented in one direction or are woven with fibers oriented at right angles. The plies are shaped and stacked in a mold and are then cured under heat and pressure to form a solid structure. The stiffness and strength of a structure made of composite materials depend on the number of plies and the orientation of the fibers in the plies. The vertical stabilizer consists of a torque box, a leading edge and tip, and a trailing edge. The torque box is the main structural component. It is made from a CFRP material and has a front, center, and rear spar; left and right skin panels; 18 ribs (including top and bottom closure ribs);35 and 24 stringers on each skin panel. The leading edge and tip are curved panels made from a GFRP material with a honeycomb core and are mechanically fastened to (but removable from) the torque box. The trailing edge panels are made from a GFRP material with a honeycomb core and are mechanically fastened to (but removable from) the trailing edge support structure, which is made of a light alloy framework that is mechanically fastened to the torque box. The vertical stabilizer is attached to the aft fuselage by three pairs of main attachment fittings and three pairs of transverse load fittings, as shown in figure 4. All of the fittings are made from a CFRP material. The main attachment fitting pairs, which are up to 1.6 to 2.5 inches thick, are located at the bottom of the front, center, and rear spars and are integrated in the skin panels. The transverse load fittings pairs, which are up to 0.5 inch thick, are integrated in the front, center, and rear spars. Each main attachment fitting (left forward, left center, left rear, right forward, right center, right rear) has its own assembly that consists of inboard and outboard fitting halves that are bonded to the skin panels during the curing process. The fitting assemblies and skin panels have lug portions,36 which extend below rib 1. Figure 5 shows a main attachment lug in detail. 35 The ribs are numbered sequentially from bottom to top; thus, rib number 1 is the bottom closure rib, and rib number 18 is the top closure rib. 36 The part of a fitting through which a pin passes to fasten mating parts is the lughole, and the area that immediately surrounds the lughole is the lug portion of the fitting.

Factual Information 16 Aircraft Accident Report Source: Airbus Note: Letter A in the left corner shows the location of a main attachment lug (which is shown in detail in figure 5). Figure 4. Vertical Stabilizer-to-Aft Fuselage Attachment Points A Main attachment fitting Transverse load fittings Main attachment fitting Transverse load fittings Transverse load fittings Main attachment fitting Main attachment fitting Main attachment fitting Main attachment fitting

Factual Information 17 Aircraft Accident Report Source: Airbus Figure 5. Main Attachment Lug The rudder is attached to the aft portion of the vertical stabilizer and is used for controlling engine-out situations and aligning the airplane with the runway during crosswind landings. The rudder consists of the rudder torque box and rudder leading edge and tip. These parts are made from a CFRP and GFRP material over a honeycomb core. The rudder torque box, which is assembled from the left and right skin panels and the spar web, is the main structural component and has a front spar and top and bottom closure ribs. The rudder leading edge and tip are mechanically fastened to (but removable from) the rudder torque box. Three mechanically controlled hydraulic actuators, referred to as servo controls, operate the rudder. Information about the rudder control system is discussed in section 1.6.2. The rudder is attached to the vertical stabilizer rear spar by seven hinge arm assemblies. These assemblies consist of a hinge arm, a hinge attachment fitting on the vertical stabilizer skin panels and rear spar, and a hinge attachment fitting on the rudder Lughole Lug Bushing Pin Clevis

Factual Information 18 Aircraft Accident Report skin panels and rudder front spar. Hinge arm numbers 1, 5, 6, and 7 are made from aluminum alloy, and hinge arm numbers 2, 3, and 4 are made from tubular steel. Each hinge arm has three self-aligning bearings that allow the rudder to rotate about the hinge line (that is, the axis about which the rudder rotates).37 The vertical stabilizer hinge attachment fittings are made from a CFRP material, and the rudder hinge attachment fittings are made from aluminum. The three rudder servo controls are part of hinge arm assembly numbers 2, 3, and 4 (one per assembly) and are attached with fittings to the vertical stabilizer rear spar and the rudder front spar. The rudder is also attached to the vertical stabilizer rear spar by a support strut assembly, which maintains vertical alignment of the rudder. This assembly consists of a support strut and a support strut attachment fitting on the vertical stabilizer skin panels and rear spar. The support strut and its attachment fitting are made of an aluminum alloy. The support strut assembly is installed above and attached to hinge arm assembly number 4. 1.6.2 Rudder Control System The rudder control system includes (1) the rudder pedals, the rudder trim actuator, the yaw damper actuator, and the yaw autopilot actuator, which command the rudder to move; (2) pushrods, bellcranks, a tension regulator, and cables (also referred to as linkages), which transmit rudder commands; (3) three servo controls (upper, middle, and lower), which operate the rudder; (4) a rudder travel limiter system, which provides a variable stop that limits rudder pedal travel with increasing airspeeds; and (5) a differential unit, which is a mechanical device that sends the rudder servo controls a command that is the sum of a pilot or an autopilot input and a yaw damper input. The maximum rudder deflection is 30º either left or right, the maximum rate of rudder movement (with no loads) is 60º ±5º per second, and the maximum rudder pedal displacement is 4 inches.38 The rudder control system is shown in figure 6. Each pilot position has a pair of rudder pedals (left and right).39 The rudder pedals are connected through pushrods and bellcranks to a cable tension regulator under the cockpit. The cable tension regulator maintains constant cable tension and transmits rod motion to two cables that run the length of the fuselage to a rudder control quadrant located aft of the pressure bulkhead and below the vertical stabilizer. The rudder control quadrant converts cable motion to bellcrank and rod movements that travel along the rear spar of the vertical stabilizer to the rudder servo controls. The rudder pedals have a 22-pound breakout force,40 that is, the rudder pedal does not begin to move until 22 pounds of pedal force has been applied. 37 The rudder hinge line lies on the 70 percent chord of the vertical stabilizer and rudder assembly and is swept back 30º. 38 The rudder deflection limits and the rudder pedal limits decrease with increasing airspeed, as discussed later in this section. 39 A pushrod provides a rigid connection between the pedals at one pilot position and the pedals at the other pilot position. As a result, rudder motion can only occur if one pilot solely operates the pedals or if both pilots move their pedals in the same direction. 40 The purpose of the breakout force is to prevent any inadvertent rudder pedal input.

Factual Information 19 Aircraft Accident Report Source: Airbus Figure 6. Rudder Control System The rudder trim actuator implements rudder trim by adjusting the length of the artificial feel and trim unit through an internal jackscrew. The artificial feel and trim unit, which is connected through a bellcrank to the rudder control quadrant, also provides rudder pedal feel and centering forces. The artificial feel and trim unit provides force feedback to the pilot during a pedal input and a one-to-one correspondence between pedal position and pedal force. The springs in the artificial feel and trim unit provide rudder pedal force feel loads that are proportional to the rudder pedal input. The artificial feel and trim unit brings the rudder pedals and rudder deflection back to zero (assuming no trim is commanded) when all forces are released from the rudder pedals. If trim is commanded, the artificial feel and trim unit brings the pedals and rudder back to the trim position. The yaw damper actuator is an electrohydraulic mechanism that operates the yaw damper system.41 The yaw damper actuator has two cylinders, each of which is controlled by a flight augmentation computer. The two yaw damper cylinders have a common output axis that is connected to two output levers that lead to the differential unit. One of the yaw damper cylinders is referred to as the driving cylinder, and the other yaw damper cylinder 41 The three functions of the yaw damper system are Dutch roll damping (that is, overcoming the yawing and rolling oscillations that are inherent in swept-wing airplanes), turn coordination, and engine failure compensation. Dutch roll damping is active throughout the flight envelope. Turn coordination is not active if the autopilot is engaged. Engine failure compensation is active only if the autopilot is engaged. Servo control Variable stop transducer unit Variable stop actuator Yaw autopilot actuator Variable stop lever Stop Yaw damper actuator Artificial feel and trim unit Trim actuator Differential unit Pushrods and bellcranks First officer's pedals Captain's pedals Cables and pulleys Tension regulator

Factual Information 20 Aircraft Accident Report is referred to as the driven cylinder. The yaw damper system commands small rudder position changes to minimize the effects of yaw rate. For example, if the airplane were yawing to the left, small right rudder deflections, as commanded by the yaw damper, would tend to slow the yaw rate and minimize the yaw angle that would develop. Yaw damper commands are limited by software in the flight augmentation computers to a maximum of 39º of rudder per second. The maximum allowable displacement of the rudder by the yaw damper for airspeeds up to 165 knots is 10º, and the maximum allowable displacement for airspeeds greater than 165 knots is determined by the formula 10 x (165/knots indicated airspeed)². The maximum displacement of the rudder by the yaw damper at an airspeed of 250 knots (the approximate airspeed of the flight 587 airplane at the time of the accident) is 4.4º. The yaw damper and the rudder pedals are not linked, so yaw damper inputs do not result in pedal motion (because such inputs can be transmitted independent of the main bellcrank). Rudder position is determined by the sum of the rudder pedal input and the yaw damper command. However, a rudder pedal input can negate the effect of the yaw damper. Specifically, the rudder position can be held at its limit (shown in table 2 later in this section) by a continuous push of the pedal, regardless of the yaw damper command. For example, if the pedal commanded a rudder position at the limit, a yaw damper command could allow the rudder position to decrease from that limit, but pushing the pedal farther forward would cause the rudder position to again achieve the limit. Conversely, if a yaw damper command resulted in a rudder position that was greater than the limit, the system would push the pedal aft while the rudder position remained at the limit. In either case, the rudder would remain at the limit while the yaw damper commanded a left or right input and the pedals moved in the opposite direction. The yaw autopilot actuator, which produces yaw autopilot commands,42 is a single unit that houses two electrohydraulic actuators, each of which is controlled by a flight control computer. The yaw autopilot actuator has an output lever that is connected through a torque limiter to the main bellcrank. The torque limiter allows a pilot to override an autopilot output as long as the pilot applies about 143 pounds more than the rudder pedal feel forces. Yaw autopilot commands are limited by software in the flight control computers to a maximum of 34º of rudder per second. The yaw autopilot actuator and the rudder pedals are rigidly linked, so a yaw autopilot input (through the main bellcrank) results in pedal motion. The rudder travel limiter system reduces the maximum allowable rudder deflection as airspeed increases. Specifically, the system reduces the maximum rudder deflections from ±30º at speeds at and below 165 knots to ±3.5º at speeds of 395 knots and above, as shown in table 2. Rudder pedal and yaw damper commands are restricted to the limits imposed by the rudder travel limiter system. 42 The yaw autopilot is active only if the slats are extended and the autopilot is engaged.

Factual Information 21 Aircraft Accident Report Table 2. Rudder Limits at Various Airspeeds The rudder travel limiter system is controlled by two feel and limitations computers. Each feel and limitations computer receives indicated airspeed data from two air data systems and uses the data from the system with the higher values to determine the appropriate rudder limit.43 Feel and limitations computer number 1 is normally the active computer, and feel and limitations computer number 2 is normally the backup computer. Both feel and limitations computers are powered by a.c. electricity, but computer number 1 receives a.c. electrical power from the airplane’s emergency bus. Each feel and limitations computer operates one of the motors of the variable stop actuator. Figure 7 shows the rudder travel limiter system along with the maximum rudder deflections shown in table 2. The variable stop actuator motors are rigidly connected and are powered by a.c. electricity. The motors drive a jackscrew through a reduction gear and torque limiter to adjust the position of a variable stop lever, which limits the travel of the bellcrank that is located above the differential unit. Two transducers (one for each feel and limitations computer) indicate the position of the variable stop actuator. The transducers are connected to the variable stop lever by a pushrod. In the event that a.c. electrical power is lost, the feel and limitations computers would drive the variable stop actuator to provide full authority (that is, 30º either side of neutral) to the rudder control system. Airspeed (knots) Rudder limit (degrees) 0 to 165 30 220 14.5 250 9.3 270 7 310 5 350 4 395 and above 3.5 43 If one of the air data systems were to fail, then both feel and limitations computers would use indicated airspeed data from the operating air data system.

Factual Information 22 Aircraft Accident Report Source: Airbus Figure 7. Rudder Travel Limiter System The variable stop limits the rudder pedal travel as airspeed increases over 165 knots. As the pedal travel limit is reduced, the pedal force required to reach the new travel limit is also reduced. Table 3 shows the pedal force and pedal travel required to achieve the maximum deflection of the A300-600 rudder at a low airspeed (135 knots Rudder travel limiter Feel and limitations computer 1 Feel and limitations computer 2 Variable stop transducer unit To rudder Variable stop lever From pedals Variable stop actuator Actuator motor Actuator motor 0 100 200 300 400 500 Rudder limit (degrees) 35 20 15 10 5 0 30 25 Indicated airspeed (knots)

Factual Information 23 Aircraft Accident Report calibrated airspeed [KCAS]) and at the approximate airspeed that the flight 587 airplane was traveling at the time of the accident (250 KCAS). Table 3. Rudder Pedal Force Required for Full Rudder Deflection a This amount of pedal travel may change slightly because of the response of the yaw damper. 1.6.2.1 Public Hearing Testimony on the A300-600 Rudder Control System At the public hearing for this accident,44 the vice president of Airbus’ flight control and hydraulic department stated that the rudder was not normally used during cruise flight to control roll.45 The vice president of training for Airbus North America customer services stated that the ailerons and spoilers were used to control roll.46 This Airbus vice president also stated that the rudder was used to control yaw and sideslip and that the rudder “is not a primary flight control to induce roll under any circumstances unless normal roll control is not functional.” He further stated that, if pilots were to experience a roll for any reason, “they will intuitively try and counter the roll with their normal roll control. If they exhaust their normal roll control, they will then go to rudder to try and induce a roll.” He added that it would be “a long path to get down to that level of degradation to where a pilot would be exposed to using rudder.” Regarding the rudder travel limiter system, American Airlines’ A300 fleet standards manager47 stated that, before the flight 587 accident, he thought that pilots knew “quite a bit” about the rudder limiter system but that, after the accident, it became apparent that pilots, as well as the aviation industry as a whole, “didn’t know much about rudder Airspeed (KCAS) Pedal force (pounds) Pedal travel (inches) Full rudder deflection (degrees) 135 65 4 30 250 32 1.2a 9.3 44 The Safety Board held a public hearing for this accident from October 29 to November 1, 2002, in Washington, D.C. (see appendix A). The Board may hold a public hearing as part of its investigation into an accident to supplement the factual record of the investigation. The Board calls technical experts as witnesses to testify, and Board investigative staff and designated representatives from the parties to the investigation ask questions to obtain additional factual information. The hearing is not intended to analyze factual information for cause. 45 Roll is the rotation of an airplane about its longitudinal axis. 46 A spoiler is a device located on a wing’s upper surface that, when commanded, provides increased drag and decreased lift. The A300-600 has one aileron and five spoilers on each wing. 47 The A300 fleet standards manager has been in that position since July 2002. At the time of the accident, he was the Fokker F.100 and A300 fleet training manager.

Factual Information 24 Aircraft Accident Report limiter systems and in fact possibly had wrong perceptions.” The A300 fleet standards manager also stated the following: Most pilots think that a limiter on some system will protect…the pilot from exceeding whatever parameter that limiter is limiting. And in this case…and it’s not unique to Airbus aircraft…the pilots think that the rudder limiter will protect the aircraft structurally, and if it can’t…they think…that there would be a limitation or a warning or caution or a note that would indicate…that the rudder limiter couldn’t protect [the aircraft] structurally. Regarding the rudder pedals, the A300 fleet standards manager stated that, before the flight 587 accident, American Airlines did not teach its pilots during training that rudder pedal movement would become restricted as airspeed increased. The fleet standards manager also stated that he did not know that the rudder pedal movement would become restricted because the pedals are not normally pushed to the stop in flight. In addition, the fleet standards manager stated that, before the flight 587 accident, he did not think that any pilot would have thought that full rudder could be gained from about 1 1/4 inch of pedal movement and 10 pounds of pressure (above the breakout force) at an airspeed of 250 knots. 1.6.2.2 Airbus Changes to the A300-600 Rudder Control System Design In designing the A300-600 rudder control system, Airbus made two changes to the rudder control system that was used on the airplane’s predecessors, the A300B2 and A300B4. First, Airbus decreased the forces required to depress the rudder pedals on the A300-600. At the public hearing, the vice president of Airbus’ flight control and hydraulic department stated that pilots suggested that roll control (aileron) forces be reduced to allow for more precise piloting. As a result, Airbus decided to reduce control wheel forces by about 30 percent and to reduce rudder pedal forces to maintain consistency with control wheel forces. According to an Airbus flight control systems engineer, the reduced pedal force was achieved because (1) the springs in the A300-600 artificial feel and trim unit were different than those in the A300B2/B4 artificial feel and trim unit; (2) the A300-600’s design included a variable stop actuator, whereas the A300B2/B4’s design included a variable lever arm; and (3) the ratio between the pedals and the artificial feel and trim unit in the A300-600 was different than that in the A300B2/B4. Second, Airbus changed the rudder travel limiter system on the A300-600 from a variable ratio design,48 which was used on the A300B2/B4, to a variable stop design. Airbus indicated that the variable stop design was chosen for the A300-600 over the variable ratio design because it was less complex and had less severe failure modes. The two changes to the A300-600’s rudder control system resulted in a substantial increase in the airplane’s response to a given amount of force above the pedal breakout 48 The variable ratio design allows a constant range of pedal travel but reduces the amount of commanded control surface movement at higher airspeeds through an internal limiter.

Factual Information 25 Aircraft Accident Report force at higher airspeeds. The magnitude of the airplane’s response to forces applied on the controls is a measure of the sensitivity of those controls. A more sensitive control requires less pilot force on, and less displacement of, the control to obtain a given airplane response than a less sensitive control. The sensitivity of the controls has an important influence on the handling qualities of the airplane, and a pilot’s feel for the airplane is largely a matter of familiarity with the sensitivity of the controls. The sensitivity of an airplane’s pitch axis control (that is, the control column) is carefully engineered during design and is affected by certification requirements, such as the speed stability requirement contained in 14 CFR 25.173(c), which regulates the “stick force per knot” gradient required to deviate from the trim airspeed using the column. Military specifications for fighter and transport aircraft (MIL-STD-1797A, appendix A) further regulate the sensitivity of the pitch axis through specifications for “stick force per G” characteristics, which measure the amount of column force required to hold the airplane in a steady pull-up or a steady level turn at a given normal load factor. As a result of these requirements, the sensitivity of the pitch controls do not change substantially as airspeed increases. No Federal Aviation Regulations (FAR) or military specifications are analogous to the pitch control sensitivity requirements governing the sensitivity of the pedal controls, except for the requirement in 14 CFR 25.177 that the angle of sideslip must be “substantially proportional” to the rudder angle (see section 1.6.4.4). As a result, the sensitivity of the pedals can be either relatively constant with airspeed (as it is for variable ratio systems), or it can increase significantly with airspeed (as it does for variable stop systems). There is also no industry standard measure of rudder pedal sensitivity that is analogous to the stick-force-per-knot or stick-force-per-G measures of sensitivity in the pitch axis. Developing such an analogous measure for pedal sensitivity is difficult because the airplane response to a pedal input can quickly become very complicated, involving motion about all three axes of the airplane as the sideslip angle resulting from the initial yawing motion produces a roll, and the roll is followed by a drop in pitch and an increase in airspeed. However, if a pedal input were initiated from steady, level flight, the initial response of the airplane would be a yaw acceleration in the direction of the pedal input. This yaw acceleration would produce a lateral acceleration at the cockpit, and the more sensitive the pedals, the larger the lateral acceleration will be for a given input. Thus, a measure of pedal sensitivity that is similar to the stick-force-per-G measure of pitch sensitivity is the amount of initial lateral acceleration produced in the cockpit per pound of pedal force above the breakout force. The sensitivity of the rudder pedals, measured in this way, is proportional to the square of the airplane’s airspeed, the amount of rudder deflection per pedal deflection, and the amount of pedal deflection per pedal force. With either variable ratio or variable stop rudder control systems, the amount of pedal deflection per pedal force remains constant. For airplanes with variable ratio systems, as airspeed increases, the amount of rudder deflection per pedal deflection decreases, which offsets the effect of increasing airspeed and keeps the pedal sensitivity relatively constant. For airplanes with variable stop

Factual Information 26 Aircraft Accident Report systems (such as the A300-600), the rudder deflection per pedal deflection remains constant, so the sensitivity of the pedals increases with the square of the airspeed. These characteristics are illustrated in figure 8, which compares the A300-600 and A300B2/B4 rudder pedal sensitivities as a function of airspeed and shows that the A300-600 is twice as responsive to a pedal displacement at 250 knots KCAS than at 165 KCAS. Figure 8. A300-600 and A300B2/B4 Rudder Pedal Sensitivities 1.6.2.3 A300-600 Rudder Control System Design Compared With Other Airplanes The Safety Board compared the rudder control system design characteristics of the A300-600 with the A300B2/B4, other Airbus airplanes, and Boeing- and McDonnell Douglas-designed airplanes, as shown in table 4. Also, the Board used four metrics to quantify aspects of pedal sensitivity at 250 knots for the same airplane models, as shown in table 5. These four metrics were (1) the ratio of maximum force to breakout force, (2) the degrees of rudder commanded per pound of force above the breakout force, (3) the

Factual Information 27 Aircraft Accident Report pedal displacement as a percent of total displacement at low airspeed, and (4) the work involved in pushing the pedal to maximum. For the second metric (degrees of rudder commanded per pound of force above the breakout force), a higher value suggests a more sensitive rudder pedal design; for the other three metrics, a lower value suggests a more sensitive pedal design. Table 4. A300-600 Rudder Control System Design Characteristics Compared With Those of Other Airplanes 135 knots 250 knots Airplane Breakout force (pounds) Pedal force (pounds) Pedal travel (inches) Rudder deflection (degrees) Pedal force (pounds) Pedal travel (inches) Rudder deflection (degrees) Airbus-designed airplanes A300B2/B4 22.0 125.0 4.0 30.0 125.0 4.0 9.3 A310 22.0 65.0 4.0 30.0 32.0 1.2 9.3 A300-600 22.0 65.0 4.0 30.0 32.0 1.2 9.3 A320 21.3 80.0 4.0 30.0 36.0 1.1 8.3 A330-300 32.0 80.5 4.0 30.0 45.0 1.2 9.5 A340-300 32.0 80.5 4.0 30.0 45.0 1.2 9.5 Boeing-designed airplanes 707 a 70.0 2.3 24.0 100.0 1.3 9.0 727 17.0 80.0 3.0 18.0 50.0 1.3 7.0 737 15.0 70.0 2.8 18.0 50.0 1.0 4.0 747 19.0 80.0 4.0 30.0 80.0 4.0 12.0 757 16.0 80.0 4.0 26.0 80.0 4.0 6.0 767 17.0 80.0 3.6 26.0 80.0 3.6 8.0 777 18.0 60.0 2.9 27.0 60.0 2.9 9.0 McDonnell Douglas-designed airplanes DC-8 a 85.0 3.6 32.0 65.0 1.5 13.0 DC-9 16.0 75.0 2.6 22.0 60.0 1.1 8.0 MD-80 15.0 75.0 2.6 22.0 60.0 1.1 8.0 MD-90 20.0 75.0 3.3 29.0 65.0 1.6 13.0 DC-10 10.0 80.0 3.8 23.0 65.0 2.0 14.0

Factual Information 28 Aircraft Accident Report a These data were not supplied to the Safety Board. Table 5. Metrics Used to Compare Rudder Pedal Sensitivity at 250 Knots 135 knots 250 knots Airplane Breakout force (pounds) Pedal force (pounds) Pedal travel (inches) Rudder deflection (degrees) Pedal force (pounds) Pedal travel (inches) Rudder deflection (degrees) McDonnell Douglas-designed airplanes MD-11 10.0 80.0 3.8 23.0 65.0 2.2 15.0 717 20.0 75.0 3.3 29.0 65.0 1.6 13.0 Metric of rudder pedal sensitivity Airplane System Ratio of maximum force to breakout forcea Rudder commanded (degrees) per pound of force above the breakout force Pedal displacement as a percent of total displacement Work involved (pound inches) in pushing the pedal to maximum Airbus-designed airplanes A300B2/B4 Variable ratio 4.68 0.09 100 294 A310 Variable stop 1.45 0.93 30 32 A300-600 Variable stop 1.45 0.93 30 32 A320 Variable stop 1.69 0.56 28 32 A330 Variable stop 1.41 0.73 31 48 A340 Variable stop 1.41 0.73 31 48 Boeing-designed airplanes 707 Force limitb c c 57 c 727 Force limit 2.94 0.21 43 44 737 Force limit 3.33 0.11 36 33 747 Variable ratio 4.21 0.20 100 198 757 Variable ratio 5.00 0.09 100 192 767 Variable ratio 4.71 0.13 100 175 777 Variable ratio 3.33 0.21 100 113

Factual Information 29 Aircraft Accident Report Note: These metrics are not provided for the 135-knot airspeed (which was shown in table 4) because rudder control characteristics at that airspeed are relatively similar among all transport-category airplanes. a This number was achieved by dividing the maximum pedal force by the breakout force. b In the force limit design (also referred to as a blowdown limited design), the pedal displacement reduces with airspeed, but the hydraulic power available to move the rudder is limited and cannot overcome high vertical stabilizer aerodynamic loads, even with a pilot-commanded rudder input. Because this design adds an extra safety feature to prevent high vertical stabilizer loads, the pedal sensitivity measures may not be directly comparable with the other two rudder pedal designs. c Because the Safety Board did not receive breakout force data for these airplanes, the Board was unable to make these computations. 1.6.3 Powerplants The accident airplane was equipped with two General Electric CF6-80C2A5 engines. The left (number 1) engine, S/N 695-211, was installed on the accident airplane on August 13, 2001, and had accumulated 31,112 hours and 12,282 cycles since new, 2,887 hours and 1,072 cycles since overhaul, and 694 hours and 264 cycles since installation. The right (number 2) engine, S/N 690-280, was installed on the accident airplane on July 30, 1998, and had accumulated 25,131 hours and 13,216 cycles since new, 11,658 hours and 5,421 cycles since overhaul, and 2,618 hours and 1,229 cycles since installation. The engine condition monitoring data from October 31 to November 11, 2001, for both engines showed no abnormal shifts in N1 and N2 rpm,49 exhaust gas temperature, fuel flow, vibration, oil temperature, and oil pressure. The engine takeoff performance data for the accident flight and for the nine previous flights showed that neither engine exceeded any of the operating limits for N1 and N2 rpm, exhaust gas temperature, fuel Metric of rudder pedal sensitivity Airplane System Ratio of maximum force to breakout forcea Rudder commanded (degrees) per pound of force above the breakout force Pedal displacement as a percent of total displacement Work involved (pound inches) in pushing the pedal to maximum McDonnell Douglas-designed airplanes DC-8 Force limit c c 42 c DC-9 Variable stop 3.75 0.18 42 42 MD-80 Variable stop 4.00 0.18 42 41 MD-90 Variable stop 3.25 0.29 48 68 DC-10 Force limit 6.50 0.26 53 75 MD-11 Force limit 6.50 0.27 58 83 717 Variable stop 3.25 0.29 48 68 49 N1 is the low pressure rotor speed; N2 is the high pressure rotor speed.

Factual Information 30 Aircraft Accident Report flow, N1 and N2 vibration, oil temperature, and oil pressure. Also, the engine performance data for the flight that preceded flight 587 in the accident airplane indicated that the takeoff was at maximum engine power.50 The accident airplane was also equipped with an AlliedSignal (Honeywell) GTCP331-250H auxiliary power unit (APU), S/N P-1077. The APU is mounted in the aft fuselage and consists of three main components: the power section, the load compressor, and the accessory gearbox. The power section has a two-stage centrifugal compressor driven by a three-stage axial flow turbine that is governed by a fuel control unit and an electronic control box. The load compressor has a single-stage centrifugal compressor that is directly driven by the power section and provides bleed air to the airplane’s pneumatic system. The accessory gearbox is directly driven by the power section and carries the fuel control unit, a.c. generator, cooling air fan, and starter motor. The accident APU was installed in the accident airplane on September 20, 2001, and had accumulated 19,723 hours and 12,104 cycles since new and 426 hours and 215 cycles since installation. 1.6.4 Airplane Certification As previously stated, the A300-600 is type certificated for operation in the United States under 14 CFR 21.29 and a bilateral airworthiness agreement between the U.S. and French governments. According to the FAA, a bilateral agreement is reached after a foreign authority establishes a demonstrated level of competency and the ability to interpret and comply with U.S. airworthiness regulations. To achieve this agreement, the foreign authority first submits an application and information on the airplane to the FAA, which then determines whether the airplane has any unique features or unusual characteristics. Afterward, the FAA determines the extent that it wants to participate in the foreign certification. For airplanes that are a model change from an airplane that has already been evaluated and has a satisfactory service history, and for which the foreign certification authority is believed to be capable of evaluating the airplane according to U.S. regulations, the FAA accepts the foreign certification authority’s findings of compliance. At the public hearing, an FAA airframe engineer stated that the FAA did not make findings of compliance for the A300-600 because it was a derivative of the A310 airplane but that the FAA made findings of compliance for several areas on the A310.51 For example, the FAA made findings of compliance on the design and strength of the A310 vertical stabilizer, which is structurally identical to the A300-600 vertical stabilizer. The FAA also worked closely with Airbus and European airworthiness agencies to establish certification and test programs for the A310 vertical stabilizer. 50 Depending on airplane weight, runway length, and weather conditions, an airplane may take off with less than maximum engine power. The use of reduced engine power for takeoff decreases the deterioration of an engine, thus permitting it to remain in service longer. An airplane must make a maximum engine power takeoff within a specified number of days to demonstrate that its engines are capable of attaining maximum engine power. 51 A310 development began in July 1978, and the A310’s first test flight was in April 1982.

Factual Information 31 Aircraft Accident Report The loads certification for the A300-600 vertical stabilizer is discussed in section 1.6.4.1. The design loads for the vertical stabilizer are discussed in section 1.6.4.2. For information on the structures certification basis of the vertical stabilizer, see the public docket for this accident. 1.6.4.1 Loads Certification for the Vertical Stabilizer 1.6.4.1.1 Federal Aviation Regulations Airbus airplanes are designed and certificated according to the requirements of 14 CFR Part 25, “Airworthiness Standards: Transport-Category Airplanes.” The loads and structures certification basis for the A300-600 vertical stabilizer were Subpart C, “Structure,” and Subpart D, “Design and Construction,” Amendments 1 through 44, in Part 25.52 Section 25.301, “Loads,” was at amendment level 23 (enacted in May 1970) at the time that the A300-600 was certificated (March 1984). However, Airbus asked (and the European certification authorities agreed) to apply the original 1965 version of this regulation, which was in effect at the time of the original A300B2 type certificate application date. The FAA accepted the regulation’s original 1965 language as part of the A300-600’s certification basis; thus, Airbus was not required to comply with amendment level 23 for the regulation. The original 1965 Section 25.301 language stated the following: (a) Strength requirements are specified in terms of limit loads (the maximum loads to be expected in service) and ultimate loads (limit loads multiplied by prescribed factors of safety).[53] Unless otherwise provided, prescribed loads are limit loads. (b) Unless otherwise provided, the specified air, ground, and water loads must be placed in equilibrium with inertia forces, considering each item of mass in the airplane. These loads must be distributed to conservatively approximate or closely represent actual conditions. (c) If deflections under load would significantly change the distribution of external or internal loads, this redistribution must be taken into account. Amendment 23 added the following sentence to Section 25.301(b): “Methods used to determine load intensities and distribution must be validated by flight load 52 The applicable FARs appear in an Airbus document titled A310, A300-600, A300-600R airworthiness requirements (AI/V-C 600/78, Issue 9, November 1994), which can be found in the public docket for this accident. 53 In public hearing testimony, the FAA airframe engineer stated that an airplane was expected to experience limit load once in its lifetime and that an airplane was never expected to experience ultimate load.

Factual Information 32 Aircraft Accident Report measurement unless the methods used for determining those loading conditions are shown to be reliable.” Section 25.303, “Factor of safety,” was at amendment level 44 (enacted in December 1978) at the time that the A300-600 was certificated. This section stated the following: Unless otherwise specified, a factor of safety of 1.5 must be applied to the prescribed limit load which are considered external loads on the structure. When a loading condition is prescribed in terms of ultimate loads, a factor of safety need not be applied unless otherwise specified. Section 25.305, “Strength and deformation,” was at amendment level 23 at the time that the A300-600 was certificated. However, Airbus asked (and the European certification authorities agreed) to apply the original 1965 version of this regulation, which stated the following: (a) The structure must be able to support limit loads without detrimental permanent deformation. At any load up to limit loads, the deformation may not interfere with safe operation. (b) The structure must be able to support ultimate loads without failure for at least 3 seconds. However, when proof of strength is shown by dynamic tests simulating actual load conditions, the 3-second limit does not apply. Static tests conducted to ultimate load must include the ultimate deflections and ultimate deformation induced by the loading. When analytical methods are used to show compliance with the ultimate load strength requirements, it must be shown that— (1) The effects of deformation are not significant; (2) The deformations involved are fully accounted for in the analysis; or (3) The methods and assumptions used are sufficient to cover the effects of these deformations. (c) Where structural flexibility is such that any rate of load application likely to occur in the operating conditions might produce transient stresses appreciably higher than those corresponding to static loads, the effects of this rate of application must be considered. Amendment 23 added Section 25.305(d), which stated, “the dynamic response of the airplane to vertical and lateral continuous turbulence must be taken into account.” Section 25.351, “Yawing Conditions,” was at amendment level 44 at the time that the A300-600 was certificated. This section stated the following: The airplane must be designed for loads resulting from the conditions specified in paragraphs (a) and (b) of this section. Unbalanced aerodynamic moments about

Factual Information 33 Aircraft Accident Report the center of gravity must be reacted in a rational or conservative manner considering the principal masses furnishing the reacting inertia forces: (a) Maneuvering. At speeds from VMC [minimum control speed] to VA [design maneuvering speed], the following maneuvers must be considered. In computing the tail loads,[54] the yawing velocity may be assumed to be zero: (1) With the airplane in unaccelerated flight at zero yaw, it is assumed that the rudder control is suddenly displaced to the maximum deflection, as limited by the control stops, or by a 300 lb. rudder pedal force, whichever is less. (2) With the rudder deflected as specified in subparagraph (1) of this paragraph, it is assumed that the airplane yaws to the resulting sideslip angle. (3) With the airplane yawed to the static sideslip angle corresponding to the rudder deflection specified in subparagraph (1) of this paragraph, it is assumed that the rudder is returned to neutral. (b) Lateral gusts. The airplane is assumed to encounter derived gusts normal to the plane of symmetry while in unaccelerated flight. The derived gusts and airplane speeds corresponding to conditions B’ through J’ (in § 25.333(c)) (as determined by §§ 25.341 and 25.345 (a)(2) or 25.345 (c)(2)) must be investigated. The shape of the gust must be as specified in § 25.341. In the absence of a rational investigation of the airplane’s response to a gust, the gust loading on the vertical tail surface must be computed [according to a specific equation].[55] Section 25.351(a) does not require a return of the rudder from the overswing sideslip angle to neutral or a full rudder movement in one direction followed by a movement in the opposite direction. At the public hearing on this accident, an Airbus senior specialist in composites testified that the design of the A300-600 vertical stabilizer met or exceeded all U.S. certification standards. He also stated that the certification of the composite structure has been validated by more than 40 million flight hours by Airbus airplanes. 1.6.4.1.2 Public Hearing Testimony on Section 25.351 The FAA’s chief scientific and technical advisor for loads and aeroelasticity explained that Section 25.351(a) defines a single maneuver that encompasses a few points that are of special interest to loads. The maneuver is performed at wings level and is not coupled with roll, although some sideways motion of the airplane will occur. He stated that the maneuver is performed as follows: A pilot makes and holds a rapid, sudden, full 54 The terms “vertical tail” and “vertical stabilizer” are synonymous. 55 For details on the FAR sections and the specific equation for computing the gust loading on the vertical stabilizer surface, see Airbus’ document, A310, A300-600, A300-600R airworthiness requirements, in the public docket for this accident.

Factual Information 34 Aircraft Accident Report rudder control input up to a maximum of 300 pounds at any speed between VMC and VA.56 The airplane yaws sideways; the rolling motion is held by the ailerons, and, as the rudder is held, the sideslip builds dynamically to a peak value before settling down to a final steady-state value. Afterward, the pilot suddenly returns the rudder to neutral. The peak sideslip value, referred to as the overswing sideslip value, is typically about 1.5 to 1.6 times the steady-state value. The loads and dynamics manager at Airbus stated that Airbus analyzed the yawing maneuver in accordance with Section 25.351(a). He indicated that, at overswing sideslip, the loads on the vertical stabilizer induced by the rudder are opposite from those induced by the sideslip. He also indicated that, when the rudder is returned from steady sideslip to neutral, the loads on the vertical stabilizer are only those induced by sideslip. The FAA’s chief scientific and technical advisor for loads and aeroelasticity stated that, if the rudder were returned to its neutral position at the point of overswing sideslip, the aerodynamic loading on the vertical stabilizer would increase. The local domain manager for loads and aeroelasticity at Airbus indicated that a return of the rudder from the overswing sideslip angle to neutral or a full rudder movement in one direction followed by a movement in the opposite direction would result in external loads that were “a little bit higher” than those that were developed using the current regulation. The FAA airframe engineer stated that, since the 1953 implementation of Civil Aeronautics Regulation 4B (the predecessor to the FAR that described the maneuvering conditions for the design of the vertical stabilizer), no historical evidence would lead the FAA to believe that the design loads envelope for the vertical stabilizer was inadequate. The airframe engineer stated that a maneuver with alternating rudder inputs was an extreme maneuver and that, if the maneuver were performed, loads would build that would exceed the current requirements. He further stated that, if two sets of alternating rudder inputs were performed, a series of dynamic maneuvers would start that could be benign or “could lead the airplane into a severe dynamic situation where, at the proper frequency, this continued application of this surface would allow the motion of the airplane to build up to the point where the sideslip would become excessive and overload the airplane.” According to the FAA’s chief scientific and technical advisor for loads and aeroelasticity, the gust event in FAR 25.351(b) is not an instantaneous condition. He stated that the airplane traverses a gust and that the gust intensity builds initially from zero to a maximum in the time it takes the airplane to travel a distance equal to 12.5 mean geometric chord lengths of the wing. Afterward, the gust velocity decreases back to zero as the airplane again travels a distance equal to 12.5 mean geometric chord lengths of the wing. The equation in Section 25.351(b) provides a means for estimating the peak load occurring during this event. The peak gust loads are examined at VC, the design cruising speed (the nominal case); VB, the design speed for maximum gust intensity (a lower speed 56 Even though Section 25.351(a) states that yaw maneuvers must be analyzed for all speeds between VMC and VA, an additional requirement (discussed in section 1.6.4.1.3), states that yaw maneuvers must be analyzed for all speeds up to VD, the design diving speed.

Factual Information 35 Aircraft Accident Report than VC, but a higher gust velocity is assumed); and VD, the design diving speed (a speed that is outside the normal operating envelope, but a reduced gust velocity is assumed). 1.6.4.1.3 Complementary Conditions The French and the German civil aviation authorities—the Direction Général de l’Aviation Civile (DGAC) and the Luftfahrt-Bundesamt (commonly referred to as the LBA), respectively—established complementary conditions (CC) to be addressed during airplane design and certification. These conditions are requirements in addition to those in the FARs. CC5-1, “Design Manoeuvre Condition, A—General,” requires the following in addition to Section 25.331(a): The manufacturer will carry out a rational analysis of the specified manoeuvres taking into account the effects of flexibility. Under no circumstances is it necessary for the speed of deflection of the control surfaces to exceed the maximum speed permitted by the servo controls, with control surfaces under appropriate aerodynamic load. CC5-1, “Design Manoeuvre Condition, C—Yaw Manoeuvre,” requires the following in addition to Section 25.351(a): The deflection of the control surfaces should correspond to the smallest angle corresponding to Maximum travel compatible with the stops Maximum power of the servo controls Maximum pilot effort of 300 lbs Yaw manoeuvres must be analysed for all speeds between VMC and VD CC6, “Design Gust Condition,” requires the following in addition to Section 25.341(a): “the values for gust speeds…also apply for the recommended speed in turbulent air shown in the flight manual.” Also, CC6 requires the following in addition to Section 25.341(c) and 25.351: the following method [for calculating the gust loading on the vertical stabilizer surfaces] may be applied at the request of the certification authorities: taking into account the aeroelastic and dynamic effects of flexibility, the most unfavourable response of the flexible aircraft will be calculated for an isolated gust.[57] 57 The equation for making this calculation is included in the public docket for this accident.

Factual Information 36 Aircraft Accident Report Last, CC6 requires the following in addition to Section 25.305: “a study of the behaviour of the aircraft in continuous turbulence should be made.” At the time of the A300-600 certification, the European airworthiness authorities, especially the British Civil Aviation Authority, asked for a “tuning” of the discrete gust event described in Section 25.351(b), that is, a variation of gust length, with a fully flexible airplane (which deforms dynamically). At the public hearing for this accident, the FAA’s chief scientific and technical advisor for loads and aeroelasticity testified that, even though CC6 was not in effect at the time that the A300-600 was certificated, Airbus elected to use a “discrete tuned gust model” to show compliance with the conditions described in CC6. Airbus’ discrete tuned gust model was based on the discrete gust model described in Section 25.351(b), which had a fixed gust gradient of 12.5 times the mean geometrical chord. According to the FAA’s chief scientific and technical advisor for loads and aeroelasticity, the discrete tuned gust model employed a calculation procedure that determined the actual loads at all times during the gust event, from which the peak load could be extracted. Such a model was necessary to fully account for the aeroelasticity and the dynamic effect of flexibility. The gust to be considered had the same profile as that defined in Section 25.351(b), but, instead of being limited to a fixed gust gradient of 12.5 times the mean geometrical chord, it was allowed to vary within a specified range. For A300-600 series airplanes, the gust gradient varied between 7 and 18 times the mean geometric chord using the same gust velocities prescribed in Section 25.341. The FAA’s chief scientific and technical advisor for loads and aeroelasticity and the FAA airframe engineer testified that CC5-1 and CC6 exceeded the FAA requirements in place at the time that the A300-600 was certificated. 1.6.4.2 Design Loads for the Vertical Stabilizer Airbus established vertical stabilizer loads for specific conditions, as defined by the applicable airworthiness requirements in 14 CFR Part 25. These conditions were the yawing maneuver that results from rudder displacement conditions; an engine failure (the loss of thrust) and the associated pilot corrective action; potential systems failures, in particular, flight control systems; and atmospheric anomalies (for example, a lateral gust). Airbus performed a loads assessment of the A300-600 using a theoretical model that involved aerodynamic, mass, structural stiffness, engine, and systems data. The model was validated by data generated during ground and flight tests. With the use of this model, airplane movements resulting from yawing maneuvers, gusts, and engine failures were simulated, and the associated internal forces induced by the external aerodynamic and mass inertial loadings (the net external loading) on the vertical stabilizer were calculated. These internal forces are transmitted to the fuselage through the six main attachment fittings and the six transverse load fittings. The internal forces within each lug are characterized by the local stress (force per unit area of material), which can be compared directly with measured material strength values.

Factual Information 37 Aircraft Accident Report The external aerodynamic and mass inertial loadings on the vertical stabilizer can also be quantified as a net shear (a side load), a net bending (a moment about the longitudinal axis), and a net torsion (a moment about the vertical axis), as shown in figure 9. The correlated shear force diagram, which is used to define the limit and the ultimate load design envelopes, consists of one diagram plotting net shear versus net torsion and, as shown in figure 10, one diagram plotting net torsion versus net bending.58 Figure 9. Shear, Bending, and Torsion Figure 10. Net Torsion Versus Net Bending 58 Any design condition can be located as a point on the correlated shear force diagram. Shear Bending Torsion -550,000 0 550,000 -2,000,000 2,000,000 Root bending moment (Nm) Maneuver loading Maneuver loading Gust loading Full-scale test fracture loads Limit load design envelope Ultimate load design envelope Torsion moment (Nm)

Factual Information 38 Aircraft Accident Report During the design and certification process, Airbus considered all of the critical loading conditions that formed the vertical stabilizer’s design load envelope. The lateral gust condition produced the largest bending moment at the root (the location where the vertical stabilizer attaches to the aft fuselage) compared with the other critical loading conditions and produced the critical margins of safety59 for the rear main attachment fittings; as a result, the rear main attachment fittings were designed by the lateral gust condition. The gust condition also produced the critical margins of safety for portions of the skin panels and several internal ribs. (Other parts of the vertical stabilizer had their lowest margins of safety produced by different conditions.) Airbus conducted a full-scale structural test during certification to demonstrate that the vertical stabilizer could withstand limit and ultimate loads and to validate the analysis tools and methodology that were used in designing the vertical stabilizer. Section 1.6.4.3 provides details about this test. 1.6.4.3 Vertical Stabilizer Certification Tests In 1986, Airbus performed a full-scale static structural test of the entire A310-300 vertical stabilizer. (As stated previously, the A310 vertical stabilizer is structurally identical to that of the A300-600, but the A310-300 vertical stabilizer has higher design loads.) The test was performed with the vertical stabilizer attached to a laboratory fixture and not an airplane fuselage. The aerodynamic loading for the lateral gust and yaw maneuver conditions was simulated by applying loads to the left side of the vertical stabilizer and to the fuselage clevises. The tests were conducted in hot and wet conditions to capture environmental effects that could degrade the performance of composite materials.60 Airbus certification documents showed that, for the lateral gust and yaw maneuver conditions, the A310-300 vertical stabilizer withstood loads up to limit load without permanent deformation and loads up to ultimate load for 3 seconds. The documents also showed that the vertical stabilizer was loaded to about two times the design limit load for the lateral gust condition, as shown in table 6, before the left rear main attachment lug 59 Airbus used the stresses calculated for limit and ultimate loads, along with measured material strength values, to compute the margins of safety for the vertical stabilizer structure. 60 The test structure was conditioned in an environmental chamber (which controlled heat and humidity) for 3 weeks until the structure reached an average temperature of about 70º C and increased in weight by about 1.2 percent as a result of moisture absorption.

Factual Information 39 Aircraft Accident Report fractured. The loads in table 6 are presented in Newtons61 for consistency with the certification documents. Table 6. A300-600 Design Limit Loads for the A300-600 and A310-300 and the 1986 Full-Scale Certification Test Loads The full-scale test revealed that the left rear main attachment lug fractured because of a tensile static overload. The test further revealed that the lug fractured with a resultant lug force of about 905 kN, which is about twice the resultant lug forces at limit load for the A300-600 and A310-300 lateral gust conditions (454 and 466 kN, respectively, when calculated using hot and wet conditions).62 In 1985, Airbus performed static tests on two right rear main attachment fittings at room temperature ambient conditions (20º C). The first fitting was tested for strength in compression and tension,63 and the second fitting was tested for strength in tension. The first fitting experienced a compression failure of the skin and stringers away from the lug at a load of 1,003 kN. The second fitting experienced a cleavage-tension failure64 at the lughole at a load of 1,036 kN. Both tests were conducted using in-plane loads only and did not account for the lateral component of load at the lug. The exclusion of this loading component caused a reduction in the local lug bending moment and the transverse shear; thus, the lug fractured at a larger resultant force than that experienced during the full-scale test. 1.6.4.3.1 Validity of the Full-Scale Vertical Stabilizer Certification Test The Safety Board asked the National Aeronautics and Space Administration’s (NASA) Langley Research Center in Hampton, Virginia (NASA-Langley), to review and 61 A Newton is a unit of force that is equal to 0.2248 pounds. In this report, loads are presented as Newtons (N) and kiloNewtons (kN). One kN equals 1,000 N. Bending and torsion moments are presented in this report in Newton-meters, or Newtons times meters (Nm). Load type A300-600 design limit loads A310-300 design limit loads A310-300 full-scale certification test loads Shear (in N) -215,800 -223,390 -424,440 Bending moment in Nm) 861,650 883,300 1,677,700 Torsion (in Nm) 152,680 161,000 340,720 62 The resultant lug forces are 475 kN for the A300-600 and 487 kN for the A310-300 when calculated using room temperature ambient conditions (20° C). 63 Compression refers to loading in which two ends are pushed in directions toward each other, and tension refers to loading in which two ends are pulled in directions away from each other. 64 According to the ASM Handbook, volume 21, “Composites,” a cleavage-tension failure is one of several failure modes for mechanically fastened composite joints. This failure mode typically initiates by a translaminar fracture (that is, a fracture that occurs across composite layers, or plies) in a plane parallel to the load direction between the fastener hole and the end of the piece (lug). Susceptibility to cleavage-tension failures over other failure modes generally increases as the fastener is located closer to the end of the specimen.

Factual Information 40 Aircraft Accident Report assess Airbus’ 1986 full-scale vertical stabilizer certification test. One concern with the full-scale test was that, because the vertical stabilizer was tested off the airplane, the loads applied at the main attachment fittings might not have represented the condition with the vertical stabilizer attached to the airplane. During the Airbus certification test, the loads applied to the fittings were prescribed exactly from Airbus’ global finite element analysis (FEA) of the vertical stabilizer, rudder, and aft fuselage. As a result, the validity of the vertical stabilizer loading during the full-scale certification test depended on the validity of the global FEA. Under the direction of Safety Board investigators, NASA-Langley conducted test and analysis correlations and stiffness sensitivity studies on the fuselage and vertical stabilizer to determine the validity of Airbus’ global FEA. NASA-Langley’s work confirmed that the applied forces in Airbus’ full-scale test represented the condition with the vertical stabilizer attached to the airplane. The insensitivity of attachment lug forces to stiffness variations demonstrated that the attachment lug forces were primarily the result of the aerodynamic load distribution and the overall geometry of the structure rather than the local stiffness representation of the attachment lug itself. 1.6.4.3.2 Validity of the Attachment Fitting Certification Tests The Safety Board requested that NASA-Langley conduct a detailed strength analysis of the vertical stabilizer main attachment fittings to determine whether Airbus’ 1985 certification tests on two right rear main attachment fittings were valid. Under the direction of Board investigators, NASA-Langley performed FEA and progressive failure analyses (PFA) to assess Airbus’ certification tests. According to NASA-Langley, the lug allowable strength (force) applied by Airbus during design and certification was expressed in terms of a resultant force and did not explicitly represent the effect of local bending moments on the strength of the fittings. The local lug bending moment of concern was the moment about the airplane’s longitudinal axis. NASA-Langley conducted a detailed strength analysis that showed that the bending moment at the rear lug influenced the failure strength of the lug. NASA-Langley found that Airbus’ allowable strength for the fittings was based on a “building block” test sequence65 that ultimately incorporated local bending moment effects. This bending moment was primarily the result of (1) the eccentricity in the skin-panel-to-lug transition region of the vertical stabilizer structure coupled with large in-plane loads in the vertical stabilizer skin and (2) the lateral loads on the lug. Thus, the bending moment at the lug was directly related to the forces on the lug. During the full-scale test, the loads introduced into the fittings resulted in forces and moments that were representative of those that would be experienced by the airplane during flight. The full-scale test generated a representative local bending moment in response to the applied forces to the fittings; thus, the right rear main attachment lug 65 The building block test sequence involved coupons first followed by subcomponent tests and then full-scale tests.

Factual Information 41 Aircraft Accident Report fractured at a lower resultant force than that experienced during the tests on the fittings. According to NASA-Langley, when Airbus reduced the allowable attachment fitting strength, the effect of a representative bending moment on the fitting strength was captured, even though the magnitude of the bending moment was not computed or measured. 1.6.4.4 Yaw Axis Certification Requirements Section 25.143, “Controllability and Maneuverability—General,” paragraph (b), states that it must be possible for the airplane to make a smooth transition from one flight condition to another without exceptional piloting skill, alertness, or strength and without danger of exceeding the airplane limit load factor under any probable operating conditions, including the sudden failure of the critical engine. Paragraph (c) includes a table that prescribes the maximum control forces permitted during the testing required by this section. The table indicates that, for short-term application of yaw control, 150 pounds of force can be applied to the rudder pedals and that, for long-term application of yaw control, 20 pounds of force can be applied to the rudder pedals. Paragraph (f) describes qualitative limits on pitch force sensitivity to prevent overstress and overcontrol,66 but no such paragraph exists for roll or yaw force sensitivity.67 Section 25.147, “Directional and Lateral Control,” paragraph (a), states that it must be possible for the airplane, with its wings level, to yaw into the operative engine and, at 1.3 VSR1 (the reference stall speed in a specific configuration), to safely make a reasonably sudden change in heading of up to 15° in the direction of the critical inoperative engine. Section 25.149, “Minimum Control Speed,” paragraph (b), states that, when the critical engine is suddenly made inoperative, it must be possible to maintain control of the airplane with that engine still inoperative and to maintain straight flight with a bank angle of no more than 5°. Paragraph (d) states that the rudder forces required to maintain control at VMC cannot exceed 150 pounds. Section 25.177, “Static Directional and Lateral Stability, paragraph (c), states that, in straight, steady sideslips, aileron and rudder control movements and forces must be 66 Paragraph (f) states the following: “When maneuvering at a constant airspeed or Mach number (up to VFC/MFC [the maximum speed for stability characteristics]), the stick forces and the gradient of the stick force versus maneuvering load factor must lie within satisfactory limits. The stick forces must not be so great as to make excessive demands on the pilot’s strength when maneuvering the airplane, and must not be so low that the airplane can easily be overstressed inadvertently. Changes of gradient that occur with changes of load factor must not cause undue difficulty in maintaining control of the airplane, and local gradients must not be so low as to result in a danger of overcontrolling.” 67 Section 25.177 (discussed later in this section) places qualitative requirements on the proportionality between the rudder control movements and forces and the sideslip angle in steady sideslips, which affects the sensitivity of the rudder control system.

Factual Information 42 Aircraft Accident Report substantially proportional to the angle of sideslip and that the factor of proportionality must lie between limits found necessary for safe operation.68 Section 25.181, “Dynamic Stability, paragraph (b), states that any combined lateral/directional oscillations (that is, Dutch roll) occurring between 1.13 VSR (the reference stall speed) and the maximum allowable speed appropriate to the configuration of the airplane must be positively damped with the controls free and must be controllable with normal use of the primary controls and without exceptional pilot skill. 1.6.4.5 Design Maneuvering Speed Information VA is an important airspeed related to load factors. Section 25.1583, “Operating Limitations,” requires that transport-category airplane pilots be provided with information on the airplane’s VA airspeed. Section 25.1583 also requires that the pilots receive “a statement that full application of rudder and aileron controls, as well as maneuvers that involve angles of attack near the stall, should be confined to speeds below this value.” FAA Advisory Circular (AC) 61-23C, “Pilot’s Handbook of Aeronautical Knowledge,” states that “any combination of flight control usage, including full deflection of the controls, or gust loads created by turbulence should not create an excessive air load if the airplane is operated below [design] maneuvering speed.” In a postaccident interview, American Airlines’ managing director of flight operations technical stated that the rudder should be able to be fully displaced and stay within its structural limit as long as the rudder travel limiter were working properly and the airplane were traveling below VA. Also, he thought that the rudder travel limiter would protect the airplane with a full deflection of the rudder followed by a deflection in the opposite direction as long as the airplane was traveling below VA. He further stated that most of the company pilots believed that, if the pilot made right, left, and right rudder inputs, the airplane would be protected as long as it was traveling below VA. At the public hearing, American Airlines’ A300 fleet standards manager stated that, before the flight 587 accident, he thought that the rudder could be exercised to its full authority in alternating sideslips on airplanes that were traveling below VA. He also thought that the rudder travel limiter would preclude any risk of damaging the airplane. 68 At the public hearing, an FAA flight test pilot stated that the FAA’s steady heading sideslip tests were accomplished in “a very slow, methodical way.” He further stated that, during the tests, pilots applied force to the rudder pedals “very carefully and slowly” to generate sideslip.

Factual Information 43 Aircraft Accident Report 1.6.5 Maintenance Records American Airlines developed its maintenance program for its fleet of A300-600 airplanes using the FAA’s A300-600 Maintenance Review Board (MRB) report69 and Airbus’ A300-600 Maintenance Planning Document (MPD).70 The required maintenance tasks for the A300-600 were included in American’s engineering specification maintenance document, and the specific work to be accomplished was found within American’s Maintenance Check Manual work cards or the applicable engineering specification orders. American’s engineering specification maintenance intervals for A300-600 airplanes included “periodic service;” “A,” “B,” and “C” checks (the C checks were divided into “1C,” “2C,” “3C,” “4C,” “5C,” “6C,” and “8C” checks); and “main base visit” checks. Periodic service checks are to be accomplished at a maximum of 2 flying days from the last periodic service or higher check. A and B checks are to be accomplished every 65 and 500 flight hours, respectively.71 All but one of the C checks are performed every 15 months.72 The main base visit check is to be accomplished at a maximum of every 30 months. The accident airplane’s last periodic service check occurred on November 11, 2001; the last A check occurred on November 9, 2001; and the last B check was performed on October 3, 2001. (All of these checks were performed at JFK.) The last C and main base visit checks occurred on December 9, 1999, at American Airlines’ Maintenance and Engineering Center in Tulsa, Oklahoma. As part of the last main base visit check, a detailed visual inspection of the vertical stabilizer attachment was performed. (American Airlines conducts this inspection once every 5 years—every other Main Base Visit—in accordance with the requirements of the A300-600 MRB report.) 69 The FAA’s A300-600 MRB report, dated March 2000, outlined the initial minimum maintenance and inspection requirements to be used in developing an approved continuous airworthiness total maintenance program for A300-600 airplanes. The requirements in the report were developed using the task-oriented Maintenance Steering Group 3 risk analysis methodology, dated September 1993. (The Maintenance Steering Group 2 risk analysis methodology, dated March 1988, was in effect between the time that the accident airplane entered American’s fleet and the time that the Maintenance Steering Group 3 risk analysis methodology was issued.) The MRB report was based on an airplane utilization of between 2,500 and 5,000 hours and 2,500 flight cycles in 15 months. The report indicated that the basic check intervals were 400 flight hours for an “A” check and 15 months for a “C” check. The maintenance tasks and intervals with which to perform these tasks were defined in the “Systems and Powerplant Program,” the “Structures Program,” and the “Zonal Inspection Program.” 70 Airbus’ A300-600 MPD provided scheduled maintenance recommendations and information to assist operators in establishing their own maintenance program. The MPD included task numbers, task description/preparation data/access requirements, and maintenance intervals/thresholds. The MPD assumed that the 2,500-flight hour C check would be accomplished about every 12 to 15 months. The version of the MPD that was current at the time of the accident was dated April 30, 2001. 71 The MRB weekly check became the American Airlines A check. The MRB A check became the American Airlines B check. 72 The 1C, 2C, 3C, 4C, 5C, 6C, and 8C checks are to be accomplished every 15, 30, 45, 60, 75, 90, and 120 months, respectively.

Factual Information 44 Aircraft Accident Report The airplane maintenance logbook for N14053 was recovered after the accident. The last entry for November 11, 2001, indicated, “no items.” The only entry for November 12, 2001, was an informational note to the crew that the first flight security check had been completed at 0130. No minimum equipment list (deferred maintenance) items were found in the logbook. Also, American’s field maintenance reliability report (a computerized report that indicates the maintenance status of an airplane and includes data fields not found on logbook discrepancy forms) for N14053 between January 1 and November 12, 2001, did not note any minimum equipment list items. The aircraft damage log for N14053 (a computerized program that contains a record of external damage to the airplane structure that was not permanently repaired at the time the damage was noted) was reviewed for events between February 22, 1991, and August 17, 2001 (the date of the last entry). No damage involving the vertical stabilizer was recorded. According to the FAA’s incident data system, the accident airplane was involved in a turbulence incident on November 28, 1994. Specifically, American Airlines flight 1218 was en route from Bridgetown, Barbados, to San Juan, Puerto Rico, when the airplane encountered severe clear air turbulence while in normal cruise flight. After the turbulence encounter, the airplane landed at San Juan without further incident. Of the 221 people aboard the airplane, 47 were injured. After the incident, American Airlines performed a special inspection of the airplane because of the excessive turbulence that the flight encountered. Records on the completed inspection were not available (the records were required to be retained only for 1 year), but the work cards that were used during this special inspection were available. The work cards indicated that the vertical stabilizer torque box was to be inspected externally for distortion, cracks, pulled or torn fasteners, or damaged paint work. If damage was found, the work cards instructed that the attachment fittings and front and rear spar webs be inspected for distortion, cracks, pulled or torn fasteners, or damaged paint work and that, on the rear spar, the hydraulic lines, mechanical linkages, electrical looms, and their mounts be inspected for distortion, cracks, rupture, and fluid leakage. FAA accident and incident data indicated that American Airlines’ Airbus airplanes were involved in 16 maintenance-related events from January 1, 1996, to November 29,

1. None of these events involved N14053.

FAA service difficulty reports (SDR) between January 1995 and November 2001 were reviewed for A300 maintenance-related “vibration” involving the airplane’s flight controls, fuselage, stabilizers, and wings; “flutter;” “group control flight system;” and “group empennage structure.” Regarding the A300 vibration category, 19 SDRs were submitted. Regarding the A300 flutter category, one SDR was submitted. Regarding the group control flight system category, 54 SDRs were submitted. Regarding the “group empennage structure” category, 12 SDRs were submitted. All of the SDRs were cleared by maintenance actions; no maintenance trends were found.

Factual Information 45 Aircraft Accident Report In addition, 62 SDRs were submitted for N14053 from January 1, 1995, to the accident date. No significant findings related to the circumstances of the flight 587 accident were identified. 1.7 Meteorological Information Weather observations at JFK are made by an automated surface observing system (ASOS), which is maintained by the National Weather Service (NWS). The ASOS records continuous information on wind speed and direction, cloud cover, temperature, precipitation, and visibility.73 The ASOS transmits an official meteorological aerodrome report (known as a METAR) each hour and a special weather observation (known as a SPECI) as conditions warrant; such conditions include a wind shift, change in visibility, and change in ceiling (cloud cover or height). ASOS observations at JFK are augmented and edited by certified weather observers under contract with the FAA. Weather observations are transmitted in coordinated universal time (UTC). (Eastern standard time is 5 hours behind UTC time.) The 1351Z METAR74 (0851 local time) on the day of the accident indicated the following: winds 310º at 11 knots, visibility 10 miles, few clouds at 4,300 feet, temperature 6º C (about 42º F), dew point -6º C, and altimeter setting 30.44 inches of mercury (Hg). At 1425 (0925 local time), a SPECI was issued because of the accident (which had occurred about 9 minutes earlier). The SPECI indicated the following: winds 270º at 8 knots, visibility 10 miles, few clouds at 4,800 feet, temperature 6º C, dew point -6º C, altimeter setting 30.44 inches of Hg, aircraft mishap,75 smoke plume south. Automatic terminal information service (ATIS) information is based on ASOS observations. ATIS information Delta, which the flight crew was using,76 was based on the 1251Z METAR (0751 local time). ATIS information Echo, which was in effect at the time that the airplane departed JFK,77 was based on the 1351Z METAR. American Airlines’ flight release for flight 587 contained, among other items, METARs for JFK, Santo Domingo, and the alternate airport (San Juan) and terminal aerodrome forecasts78 (TAF) for the three airports. American Airlines Weather Services provided the following TAF information for JFK, which was valid from 1300Z to 2300Z 73 Cloud cover is expressed in feet agl. Visibility is expressed in statute miles. 74 The “Z” designation that follows the time in a weather observation stands for Zulu, which indicates UTC time. 75 This remark was only transmitted locally. 76 About 0901:24, the first officer contacted the ground controller and informed him that he had received ATIS information Delta, which stated the wind was 330º at 11 knots, visibility was 10 miles, a few clouds were at 3,400 feet, temperature was 4º C, dew point was -6º C, and altimeter was 30.42 inches of Hg. 77 The CVR and air traffic control (ATC) transcripts do not indicate that the flight crew had received ATIS information Echo. 78 TAFs are prepared by the NWS and are normally issued every 6 hours with amendments issued as conditions warrant.

Factual Information 46 Aircraft Accident Report (0800 to 1800 local time) on the day of the accident: winds 310º at 12 knots, gusting to 22 knots; visibility greater than 6 miles; few clouds at 5,000 feet; temporary clouds scattered at 5,000 feet. 1.8 Aids to Navigation No problems with any navigational aids were reported. 1.9 Communications No communications problems were reported between the pilots and any of the air traffic controllers who handled the flight. 1.10 Airport Information JFK is located 1/2 mile southeast of the city of New York limits and has an elevation of 13 feet msl. The airport has four runways: runway 13L/31R is 10,000 feet long and 150 feet wide; runway 13R/31L (the accident airplane departed from runway 31L) is 14,572 feet long and 150 feet wide; runway 4L/22R is 11,351 feet long and 150 feet wide; and runway 4R/22L is 8,400 feet long and 150 feet wide. Runway 31L has an elevation of 12 feet msl. The Port Authority of New York and New Jersey Police Department stated that, after the crash of flight 587 had been confirmed, a Port Authority employee conducted a visual inspection of the full length of runway 31L and the taxiways used by the accident airplane. No debris was found on the runway or the taxiways. 1.10.1 Air Traffic Control Information ATC radar coverage for the JFK area is provided by an ASR-9 radar located on the airport. The ASR-9 is a short-range (60 nm) radar that provides position and track information to controllers at the New York TRACON and the JFK air traffic control tower (ATCT) for aircraft operating within terminal airspace. ASR-9 antennas rotate about 13 times per minute, resulting in a radar return about every 4.6 seconds. Flight 587 was handled by three air traffic controllers on the day of the accident: a ground controller and a local controller at the JFK ATCT and a departure controller at the New York TRACON. A controller-in-charge was also present at the JFK ATCT at the time of the accident.79 79 The controller-in-charge was performing duties in the absence of the tower supervisor. He was not monitoring any particular controller position and did not see flight 587 during taxi, takeoff, or departure.

Factual Information 47 Aircraft Accident Report The ground controller first became aware of flight 587 when the flight crew called for taxi clearance. He instructed the flight crew to taxi out of the ramp area to a taxiway for sequencing into the departure queue. When the airplane arrived at the taxiway, the ground controller instructed the flight crew to follow the Japan Air Lines 747 into the queue, and the crew followed this instruction.80 The departure controller indicated that he had “a good look” at the accident airplane during its taxi and did not notice anything unusual. The local controller first became aware of flight 587 when she cleared the airplane to taxi into position and hold on the runway. She then issued a wake turbulence advisory because the Japan Air Lines 747 was a heavy jet. The local controller also indicated that she added extra radar separation between the Japan Air Lines 747 and the flight 587 airplane because 747s are often “slow climbers.” Once the separation was established, the local controller issued the current wind and cleared flight 587 for takeoff. She watched the airplane during its takeoff roll and did not see anything unusual. The last time the local controller saw the accident airplane was when it made the left turn needed to follow the bridge climb. She then instructed the flight crew to contact departure control. The local controller first became aware of the accident when she heard an unidentified pilot stating, over radio frequency, that an airplane was crashing south of the airport. She reported that she said this information out loud and that everyone in the tower turned to look for the accident. The local controller reported that she then saw a black plume of smoke. The controller-in-charge first became aware of the accident from the local controller and an outside telephone call. The controller-in-charge then called the New York TRACON to see if it had lost an airplane. The flight data controller at the TRACON answered the telephone and indicated that flight 587 was missing. When the controller-in-charge went to get the flight strip for flight 587, he noticed a large plume of smoke outside. The controller-in-charge stated that he notified the Port Authority Police Department of the accident and that the tower supervisor had returned almost immediately to the ATCT after the accident occurred. The departure controller first became aware of flight 587 when the flight crew reported on frequency. At that point, the airplane was climbing through 1,300 feet msl. The departure controller’s radar identified the airplane, and he issued an instruction for the airplane to climb to 13,000 feet msl. The departure controller subsequently issued an instruction for the airplane to turn left and proceed direct to the WAVEY intersection. Soon afterward, he noticed that the airplane’s radar target had disappeared and that its data block was no longer showing airspeed or altitude. One of the pilots of American Airlines flight 686, which departed JFK after American Airlines flight 587, reported seeing fire and smoke south of Long Island, New York. When the JFK ATCT called to see if the TRACON had lost any airplanes, the departure controller informed the TRACON’s flight data controller that flight 587 was lost. 80 The departure controller indicated that the sequencing of flights in the queue was decided by airplane type and departure fix. He estimated that between 8 and 10 airplanes were waiting in the queue to take off.

Factual Information 48 Aircraft Accident Report The departure controller stated that nothing was unusual on the day of the accident about the spacing between airplanes coming from JFK to the TRACON. The departure controller thought that the Japan Air Lines 747 was about 7 miles ahead of flight 587 and that the 747’s flight track was normal. The departure controller also stated that he had not received any turbulence reports from other airplanes in the area. 1.11 Flight Recorders 1.11.1 Cockpit Voice Recorder The accident airplane was equipped with a Fairchild model A-100A CVR (S/N unknown). According to Airbus documents, the CVR was operating off the emergency bus, which allowed the CVR to continue recording after the engines separated from the airplane. The exterior of the CVR showed evidence of significant structural damage. The front panel, including the underwater locator beacon, was missing. The outer metal enclosure was heavily covered with soot and was dented, and it had to be cut to gain access to the tape reel. The exterior of the crash case was not damaged. The tape did not show evidence of heat damage, but several inner windings were crinkled.81 The CVR was sent to the Safety Board’s audio laboratory in Washington, D.C., for readout and evaluation. The CVR data started at 0845:35 and continued uninterrupted until 0916:14.8. The recording consisted of four channels of audio information, three of which were excellent quality and one of which was poor quality.82 The three channels that contained the excellent quality information were the cockpit area microphone, the captain’s audio panel, and the first officer’s audio panel. The fourth channel contained a high-frequency squeal and was mostly unreadable.83 A transcript was prepared of the entire 30-minute 39-second recording (see appendix B). 1.11.2 Flight Data Recorder The accident airplane was equipped with a Fairchild model FA2100 FDR, S/N 1186, that was manufactured by L-3 Communications. The FDR used solid-state flash memory, stored in a crash-survivable memory unit, as the recording medium. The FDR was sent to the Safety Board’s laboratory for readout and evaluation. 81 This portion of the recording contained the oldest data, which recorded the events before flight 587 left the gate. 82 The Safety Board rates the quality of CVR recordings according to a five-category scale: excellent, good, fair, poor, and unusable. See appendix B for a description of these ratings. 83 The fourth channel is used to record a third crewmember’s audio information if the CVR is installed into a three-crewmember airplane. The fourth channel is usually not used on a two-crewmember airplane.

Factual Information 49 Aircraft Accident Report The FDR showed extensive fire and impact damage. The memory module inside the memory unit did not show any damage, but the memory cable needed to be replaced before the data could be read out. The FDR contained more than 81 hours of recorded data, and American Airlines provided conversion formulas for the data.84 The FDR recorded about 1 minute 33 seconds of flight data for the accident airplane, beginning at 0914:28.45 (the time that the right main landing gear squat switch changed from ground to air) and ending at 0916:01.23 (before airplane impact). The analog signals from the rudder position, aileron right position, aileron left position, elevator position, and horizontal stabilizer position were processed through the airplane’s system data analog converter (SDAC)85 computer before they were sent to the flight data acquisition unit (FDAU)86 as a digital signal. The SDAC computer applied a filter to the data,87 and the FDR recorded the filtered digital value. (Uncertainties in the FDR data associated with data filtering are discussed in section 1.16.2.) An SDAC bench test was conducted on February 4 and 5, 2002, at Airbus’ facility in Toulouse. One purpose of the test was to define the filtering function and the associated processing delay of the SDAC. The Safety Board and Airbus independently analyzed the results of the test and concluded that the SDAC applied a first-order lag filter with a 0.434-second time constant. Another purpose of the test was to input data into the SDAC and compare the SDAC output data to the calculated filtered output data. The input data were Airbus’ first estimation of the accident airplane’s flight control surface movements. The calculated filtered output data were computed by applying a filter to the input data. These results supported the conclusion that the SDAC filter was a first-order lag filter with a 0.434-second time constant. 84 During the initial readout of the FDR, the conversion equation for the rudder pedal parameter was found to be incorrect. Thus, the FDR data had to be examined to obtain reference data to establish the proper equation for the rudder pedal position parameter. In addition, revised equations for the control wheel and control column positions were established based on the FDR data. (The airplane was not initially configured with the rudder pedal position, control wheel position, and control column position parameters because they were not mandatory when the airplane was manufactured.) American Airlines added flight control input sensors and the associated hardware to the airplane to comply with 14 CFR 121.344, which required that, no later than August 20, 2001, all transport-category airplanes be equipped with FDRs that record control input positions. 85 In some Airbus documents, the SDAC is also referred to as the system data acquisition concentrator. 86 The FDAU converts and conditions Aeronautical Radio, Inc. (better known as ARINC), data into a serial data stream, which the FDR records in a digital format. 87 See sections 1.18.7.1 and 1.18.7.3 for information regarding the Safety Board’s recommendations to the FAA regarding the filtering of flight control position data.

Factual Information 50 Aircraft Accident Report 1.12 Wreckage and Impact Information 1.12.1 General Wreckage Description The main wreckage area was located about 4 miles southwest of runway 31 at the intersection of Newport Avenue and Beach 131st Street. The main wreckage was confined to an area of about 500 by 300 feet and was oriented on a magnetic heading of about 040º. The vertical stabilizer and the rudder separated from the airplane in flight and were recovered from Jamaica Bay, which was about 3/4 mile north of the main wreckage area. Figure 11 shows the vertical stabilizer after it was recovered from Jamaica Bay. The left and right engines also separated from the airplane in flight. The left engine was recovered at 441 Beach 129th Street, which was about 800 feet north-northeast from the main wreckage area. The right engine was recovered at 414 Beach 128th Street, which was about 800 feet northeast of the main wreckage area. The largest piece of airplane structure recovered on land away from the main wreckage area and the engines was the left wing tip, which was recovered at the intersection of Beach 125th Street and Cronston Avenue. Smaller pieces of airplane debris were found from Beach 116th Street to the accident site (between Jamaica Bay and the Atlantic Ocean) and in Jamaica Bay. All major sections of the airplane were accounted for in the wreckage. Most of the airframe and its associated systems showed severe impact and fire damage. Figure 11. Vertical Stabilizer After Recovery From Jamaica Bay

Factual Information 51 Aircraft Accident Report 1.12.2 Vertical Stabilizer and Rudder The vertical stabilizer was mostly intact. The left and right skin panels did not exhibit any significant damage, but the six main attachment fittings and the three pairs of transverse load fittings were fractured. The right rear main attachment fitting fractured at the lughole (see figure 12). The right center main attachment fitting remained attached to the aft fuselage but separated from the vertical stabilizer when it fractured just above ribs 1 and 4 and the skin/stringer interface. The right forward main attachment fitting fractured at the lughole. The left rear main attachment fitting assembly (that is, the inboard and outboard fitting assembly halves and the lug portion of the skin laminate) fractured from the vertical stabilizer but remained attached to the aft fuselage. The left center main attachment fitting separated from the vertical stabilizer at the fastener line along the rib 1 attach angle. The left forward main attachment fitting fractured at the lughole, but the lower part of the fitting remained attached to the aft fuselage. 88 Figure 12. Right Rear Main Attachment Fitting The transverse load fittings at the rear and center spars fractured at the location where the spars and aft fuselage interfaced. The transverse load fittings at the front spar fractured from the vertical stabilizer along with part of the front spar web, which remained attached to the forward main attachment and transverse load fittings. 88 For information on the damage to the main attachment fittings, see section 1.16.3.3.

Factual Information 52 Aircraft Accident Report The entire rudder separated from the vertical stabilizer, except for portions of the rudder spar structure that remained attached to hinge arm assembly numbers 2, 3, 4, 5, and

1. The rudder had numerous fractures and broke into a section including and above hinge

arm assembly number 7, a section between hinge arm assembly numbers 4 and 7, and many pieces below hinge arm assembly number 4. For additional information on the damage to the vertical stabilizer and rudder, see Materials Laboratory Factual Report number 02-077 in the public docket for this accident. For information on tests performed on the vertical stabilizer and rudder, see section 1.16.3. 1.12.3 Rudder Control System The three rudder servo controls remained attached to the vertical stabilizer. The fittings that attached the servo controls to the rudder fractured at the rudder attachment locations, and the bulk of the fittings and small pieces of rudder structure remained attached to the servo controls. The rudder frame assembly89 components detached from the empennage. The artificial feel and trim unit, rudder trim actuator, yaw damper actuator, yaw autopilot actuator, and variable stop actuator were located; all had suffered heat damage. Most of the linkages (that is, pushrods and bellcranks), the rudder control quadrant, and the rudder travel limiter were fractured and melted. No rudder control system components forward of the rudder frame assembly were identified in the wreckage. For information on tests performed on rudder control system components, see section 1.16.5. 1.12.4 Powerplants Neither the left engine nor the right engine had any indications of an uncontainment, case rupture, in-flight fire, preimpact malfunction, or bird strike. The thrust reversers were found in the stowed position. Between November 28 and December 4, 2001, the engines were disassembled and examined at American Airlines’ Maintenance and Engineering Center in Tulsa. The examination revealed that the high pressure compressor and turbine rotors’ blades were bent opposite of the direction of rotation and that the fan and low pressure turbine rotors’ blades were bent or broken only where they were crushed by the engines’ case. The APU was found in the airplane’s aft fuselage, which was recovered at the corner of Beach 131st Street and Newport Avenue. The APU had broken loose from its supports and was found slightly forward of its normal position. The APU showed no indications of an uncontainment, case rupture, or in-flight fire. 89 The rudder frame assembly houses the rudder control quadrant, artificial feel and trim unit, rudder trim actuator, yaw damper actuator, yaw autopilot actuator, main bellcrank, differential unit, variable stop actuator, and variable stop lever.

Factual Information 53 Aircraft Accident Report On December 13, 2001, the APU was disassembled and examined at Honeywell’s engine teardown facility in Phoenix, Arizona. The APU showed no evidence of any rotational damage to the compressor impellers and turbine rotors. The APU also showed no evidence of an in-flight fire, case rupture, uncontainment, or hot air leak across a case flange. 1.13 Medical and Pathological Information Tissue specimens from the captain and the first officer were sent to the FAA’s Civil Aerospace Medical Institute in Oklahoma City, Oklahoma, for toxicological analysis. The captain’s specimens tested negative for major drugs of abuse and for prescription and over-the-counter medications but tested positive for ethanol.90 The first officer’s specimens tested negative for major drugs of abuse and ethanol but tested positive for ephedrine and pseudoephedrine.91 1.14 Fire A postcrash fire developed after airplane impact. The parts of the vertical stabilizer and rudder that separated in flight showed no evidence of fire damage. 1.15 Survival Aspects The accident was not survivable for any of the airplane occupants. 1.16 Tests and Research 1.16.1 Video Study Two security cameras from the Metropolitan Triborough Bridge and Tunnel Authority of New York captured a portion of the accident flight. These cameras, which shared a common time base, were located in two lanes (1 and 5) at the Gil Hodges Marine Parkway Bridge toll plaza. The video from the camera in lane 1 showed the airplane as a small black dot moving from left to right across the sky. The dot then became obscured by a building. At that point, the video from the camera in lane 5 showed a small black dot emerging from behind another obstruction (part of a toll booth). The dot continued initially to move left to right but then started to descend. During the descent, a white 90 Ethanol in specimens can be the result of the postmortem production of ethanol. 91 These substances are present in many over-the-counter medications used to treat upper respiratory symptoms. The first officer had reported, on his FAA medical certificate application, a history of mild seasonal allergies. The substances were also found in nutritional supplements marketed for various purposes. These substances do not usually result in impairment.

Factual Information 54 Aircraft Accident Report “streak” was briefly seen trailing behind the dot before it became obscured by the building.92 About 40 seconds later, black smoke was seen rising in the background.93 Detailed examination of the video in the Safety Board’s laboratory revealed no images of an object or objects falling off the airplane. The Safety Board conducted a video study to accomplish three objectives. First, the study was to compare the elapsed time information from the video recordings with that of the radar/CVR/FDR data. Second, the study was to determine the time and location of the white streak. Third, the study was to calculate the position of the airplane after the loss of FDR and radar data. The study estimated that the first indication of the white streak occurred when the alignment of the airplane was directly above column 3 of the building seen in the video from lane 5. On the basis of the elapsed time between the last recorded radar return and the end of the CVR recording, the white streak was calculated to have begun at 0916:06.14, or about 4.3 seconds after the last recorded radar return. In addition, the study determined the airplane’s position at several points after the loss of FDR and radar data. The airplane’s altitudes were calculated using data from the site survey, still images from the video recordings, and an architectural drawing of the building in the cameras’ view. The alignment of the airplane was over the roof midpoint (lane 1) at 0916:02.26 and at an altitude of 2,398 feet msl.94 The airplane’s alignment was over column 3 (lane 5) at 0916:06.14 (the same time as the white streak appeared) and at an altitude of 2,428 msl. The airplane’s alignment was over column 4 (lane 5) at 0916:09.38 and at an altitude of 2,012 feet msl. The airplane’s alignment was over the roofline at column 5 (lane 5) at 0916:12.08 (the end of the period that the airplane is visible in the video) and at an altitude of 1,470 feet msl. 1.16.2 Airplane Performance Study The Safety Board conducted an airplane performance study to describe the motion of the accident airplane, identify the causes of the motion, and calculate the resulting aerodynamic loads on the vertical stabilizer. The data used to determine the airplane’s motion and the resulting loads included ATC radar, CVR, and FDR data; wreckage location and condition; ground scars, markings, and damage to surface structures; weather information; and outputs from computer programs and simulations. 92 The video recorded by the camera in lane 1 included the midpoint of the building’s roof. The video recorded by the camera in lane 5 included columns 3 through 7 of the building. 93 The Safety Board received another videotape that captured the accident flight. The video was reportedly taken by a construction crew working near runway 4R at JFK on the day of the accident. The video showed the departures of both Japan Air Lines flight 47 and American Airlines flight 587. The video depicted the accident airplane as it taxied into position for takeoff, began its takeoff roll, lifted off the runway, and began a left turn. The video then panned away from the airplane, and the camera was turned off for a short time. The next image on the video was smoke rising from the ground in the distance. (This video was not part of the video study.) 94 All altitudes derived from the video study are estimated to be accurate within 65 feet.

Factual Information 55 Aircraft Accident Report The computational tools used in the airplane performance study included an engineering flight simulation of the A300-600 to compute the airplane’s dynamic response to control inputs and a computational fluid dynamics (CFD) code to compute the aerodynamic loads over both rigid and flexible models of the vertical stabilizer. The Safety Board developed its A300-600 engineering simulation using data from Airbus’ A300-600 engineering simulator. The CFD computations were performed by Airbus at the direction of, and in cooperation with, Board investigators. Many performance parameters required to define the motion of the airplane were recorded directly by the FDR. Other parameters required to define the airplane motion were not recorded by the FDR and had to be derived from the available FDR parameters and/or supplemented with information obtained from simulator studies and other computations. The performance parameters of most interest to this investigation were those required to determine the aerodynamic loads on the vertical stabilizer; the most significant of these parameters included the dynamic pressure of the air flowing past the airplane, the sideslip angle, and the rudder angle. None of these parameters were recorded directly on the FDR. Even though the FDR did not directly record rudder angle data, the FDR did record a filtered rudder signal that could be used to check whether an estimate of rudder position, obtained by other means, was viable. The dynamic pressure and sideslip angle could be computed from other FDR parameters.95 However, because of uncertainties in the FDR data—including data latencies (that is, delays), data filtering, and sampling rate effects— the rudder and sideslip angles at the time that the vertical stabilizer separated from the airplane were determined within a narrow range—10° to 11° for the rudder angle and 10° to 12.5° for the sideslip angle. 1.16.2.1 Wake Vortex Investigation As part of the airplane performance study, the Safety Board requested that NASA-Langley conduct a wake vortex investigation. Specifically, the Board asked NASA-Langley to investigate whether flight 587 could have encountered the wake vortexes of Japan Air Lines flight 47. Such an encounter could explain the two sets of load factor excursions—the first occurring about 0915:35 at an altitude of 1,750 feet agl and the second occurring about 0915:51 at an altitude of 2,430 feet agl—that were recorded on flight 587’s FDR. NASA-Langley used flightpath and wind information for American Airlines flight 587 and Japan Air Lines flight 47 provided by the Safety Board, as well as atmospheric data for the day of the accident, as inputs to four wake prediction models.96 In a report on its investigation,97 NASA-Langley stated the following: A wake vortex 95 These calculations are outlined in “Aircraft Performance Group Chairman’s Aircraft Performance Study” in the public docket for this accident. 96 These models are described, and their individual results are presented, in appendix B of “Aircraft Performance Group Chairman’s Aircraft Performance Study.” 97 National Aeronautics and Space Administration, AA 587 Wake Vortex Investigation, Modeling and Analysis by NASA Langley Research Center (Hampton, VA: NASA, 2002).

Factual Information 56 Aircraft Accident Report from Japan Air Lines flight 47 was likely transported into the flightpath of flight 587. The atmospheric conditions aloft were favorable for a slow rate of vortex decay. The wake vortex from Japan Air Lines flight 47 would have had an age of about 100 seconds, and flight 587 would have encountered the wake vortex at a time before vortex linking and rapid vortex decay. The predicted circulation of the wake vortex at the times of the apparent encounters would have been between 63 and 80 percent of the vortex’s initial strength. In testimony at the public hearing, the main author of the wake vortex investigation report stated that, even though his work supported a wake encounter, the wake was “nothing extraordinary.” 1.16.2.2 Flight 587 Simulation The Safety Board developed a desktop computer simulation of flight 587 using A300-600 simulator model data provided by Airbus. The Board developed the desktop computer simulation to independently compute the response of the A300-600 to the thrust levels and flight control inputs recorded on the FDR and to compare the expected behavior of the airplane, as predicted by the simulator, with the actual behavior recorded by the FDR. This comparison could help determine whether external forces or moments (such as those from an atmospheric disturbance) were required to produce the motion of the airplane or whether the motion could be completely accounted for by the forces and moments produced by the engine thrust and control surface positions. The load factor and engine N1 data fluctuations recorded on the FDR suggested that flight 587 encountered the wake of Japan Air Lines flight 47 for the second time between about 0915:50 and 0915:54 and that the motion of the airplane was affected by the wake vortex during this time. To account for the effects of the wake vortex during this 4-second period, the Safety Board’s simulation incorporated external pitching, rolling, and yawing moments and vertical and horizontal wind gusts designed to make the simulator motion closely match the motion recorded on the FDR. After the 4-second period, the airplane was assumed to be free of the wake, so the external moments and wind gusts were removed. The external moments and wind gusts fully accounted for the effect that the wake turbulence had on the airplane, as recorded by the FDR. Any additional effects of the wake turbulence that were not recorded on the FDR (because of limited sampling rates, for example) would have had a negligible impact on the airplane motion. Throughout the simulation, the simulator cockpit control positions and aerodynamic surface positions were driven to match the positions recorded on the FDR as closely as possible without sacrificing the match of the motion recorded by the FDR. To evaluate the magnitude of the effects of the wake vortex-induced external moments and vertical and horizontal wind gusts required to match the motion recorded on the FDR, the desktop computer simulation was run without any cockpit control or control surface movements. The simulator computed the response of the airplane solely to the forces and moments induced by the wake encounter.

Factual Information 57 Aircraft Accident Report The simulation indicated that, although external winds and moments, which were assumed to be attributable to the wake encounter, were required to match the airplane motion recorded on the FDR, the large roll and yaw oscillations, lateral load factors, and sideslip angles achieved during the accident sequence were the result of control wheel and rudder pedal inputs. The external winds and moments, by themselves, produced only an initial 10° deviation in bank angle (from the existing 23° bank angle) and only subtle changes in heading, resulting in sideslip angles of less than 2.5°. Another simulation incorporated an alternative yaw damper design in which the yaw damper inputs could not be overridden by pilot pedal deflections at the rudder limits. The Safety Board evaluated the effects that this yaw damper design would have on the rudder pedal inputs made during the accident sequence. The results of this simulation indicated that such a system allowed the yaw damper to attenuate (but not prevent) the development of the sideslip angle resulting from alternating full rudder pedal inputs. 1.16.2.3 Loads on the Vertical Stabilizer At any given altitude and airspeed, many parameters affect the loads on the vertical stabilizer;98 the most significant of these parameters are sideslip angle and rudder angle. During the design of the A300-600, Airbus developed a model of the loads on the vertical stabilizer based on linearized wind tunnel data that described the effects of sideslip angle and rudder angle on the vertical stabilizer structural loads. With the use of this linear loads model, the Safety Board calculated the shear, bending, and torsion loads on the vertical stabilizer during the final seconds of flight 587’s recorded FDR data (before the sound of the loud bang at 0915:58.5). Figure 13 shows the calculated bending moment about the root chord in the vertical stabilizer axis system.99 98 Aerodynamic loads on the vertical stabilizer are produced by the pressure distribution over its surface. Inertial loads on the vertical stabilizer result from the acceleration of its mass. During the accident sequence, the inertial loads on the vertical stabilizer were extremely small compared with the aerodynamic loads. 99 For structural analysis purposes, loads on the vertical stabilizer are expressed in terms of their components in the vertical stabilizer axis system, which is rotated about the pitch axis relative to the airplane body axis system. The airplane body axis system is coincident with the longitudinal, lateral, and vertical axes of the airplane.

Factual Information 58 Aircraft Accident Report Figure 13. Bending Moment About the Root Chord in the Vertical Stabilizer Axis System The Safety Board was especially interested in determining the loads when the right rear main attachment lug fractured (0915:58.4). This time was established by the following: • The sideslip and heading angles in the Safety Board’s simulations of the accident flight diverged from those based on the FDR data about the time of the loud bang recorded on the CVR (0915:58.5), indicating that the accident airplane’s directional stability was reduced about this time (which is consistent with the loss of the vertical stabilizer). • A momentary change in the trend in lateral acceleration (from decreasing to increasing) occurred at 0915:58.4. This momentary change was associated with a 0.2 G jump in lateral acceleration recorded about this time. Such a jump is consistent with the sudden inability of the vertical stabilizer to transfer side force loads into the fuselage.

Factual Information 59 Aircraft Accident Report • If the loud bang recorded on the CVR was associated with the fracture of the right rear lug, then the sound would have had to originate at 0915:58.4 because of the time that it would take for the sound to travel from the vertical stabilizer to the CVR microphone. This time is consistent with that of the change in the trend of the lateral acceleration. The rudder and sideslip angles about the time of the lug fracture were large enough that portions of the vertical stabilizer began to exhibit aerodynamic stall behavior, that is, regions of separated flow. This separated flow affected the loads such that the linear loads model (which does not account for flow separation) could overestimate the loads in those conditions (high sideslip and rudder angles) in which separated flow is present. As a result, a CFD analysis was performed to calculate directly the effects of the separated flow at the high sideslip and rudder angles of interest. Specifically, the Safety Board asked Airbus to perform a CFD analysis of the flowfield about the entire A300-600 airplane and to provide the aerodynamic pressure loads over portions of the vertical stabilizer. The conditions at which these calculations were made reflected the flight conditions and airplane orientation at the time that the vertical stabilizer separated from the aft fuselage. Because of uncertainties in the sideslip angle, rudder angle,100 and the absolute load values computed by CFD, the final estimate of loads at the time of the lug fracture were expressed as a range of values. At the time that the vertical stabilizer separated from the airplane, the range of the shear, bending, and torsion loads on the vertical stabilizer were as follows: • shear force: 353,000 to 436,000 N ±5 percent • bending moment: 1,580,000 to 1,840,000 Nm ±5 percent (see figure 14) • torsion moment: 18,600 to 48,100 Nm ±5 percent The bending moment load ranges shown in figure 14 are presented along with the “effective sideslip angle” range101 and the rudder range at the time that the vertical stabilizer separated from the airplane. Figure 15 compares the estimated aerodynamic loads with the A300-600 design envelopes (as defined by the torsion versus bending correlated shear force diagram). 100 Even though Safety Board investigators were eventually able to derive a meaningful time history of the rudder angle after the second wake encounter, the filtering of the rudder sensor data before they were recorded on the FDR and the low, 2-Hertz (Hz) sample rate of those data hindered and delayed Board investigators’ knowledge of this parameter. 101 The effective sideslip angle at the vertical stabilizer differed from the sideslip angle at the cg because of yaw rate effects. The left yaw rate at the time of vertical stabilizer separation increased the sideslip angle at the vertical stabilizer relative to the sideslip angle at the cg.

Factual Information 60 Aircraft Accident Report Note: The calculated range of the root bending moment is defined by points A through D, which are described in addendum 2 to the airplane performance study. See the public docket for this accident for more information. Figure 14. Bending Moment Load Range at the Time of Vertical Stabilizer Separation Note: The four triangles correspond to the four points in figure 14. Specifically, the red triangle is point A, the gray triangle is point B, the green triangle is point C, and the orange triangle is point D. Figure 15. Estimated Aerodynamic Loads in Relation to the Torsion Versus Bending Correlated Shear Force Diagram 0.00 0.20 0.40 0.60 0.80 1.00 1.20 1.40 1.60 1.80 2.00 2.20 2.40 Effective sideslip angle, degrees Vertical stabilizer root bending moment, millions of Nm 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 A D B C 0 Maneuver loading Maneuver loading Gust loading Estimated aerodynamic loads at vertical stabilizer separation (including nonlinear effects)

Full-scale test fracture loads Limit load design envelope Ultimate load design envelope 587 flightpath (linear solution) -550,000 550,000 -2,000,000 2,000,000 Root bending moment (Nm) Torsion moment (Nm)

Factual Information 61 Aircraft Accident Report 1.16.3 Examinations of the Flight 587 Vertical Stabilizer and Rudder 1.16.3.1 Nondestructive Inspections Pieces of the flight 587 vertical stabilizer and rudder underwent several nondestructive inspections after the accident. The vertical stabilizer was inspected using ultrasonic inspection, Lamb wave imaging, and x-ray computed tomography (CT) scanning, and the rudder was inspected using x-ray radiography, Lamb wave imaging, thermography, ultrasonic inspection, and computer-aided tap testing.102 NASA-Langley conducted an ultrasonic inspection and Lamb wave imaging of the vertical stabilizer’s left and right skin panels. The ultrasonic inspection detected two notable delaminations (that is, fractures between the composite layers) near the front and rear spars on the left skin panel that extended upward from the lower end up to 43 inches at the front and up to 37 inches at the rear. The ultrasonic inspection detected no notable delaminations on the right skin panel, except for an area within about 4 inches of the right center lug. The Lamb wave imaging found no apparent evidence of any change in stiffness on the left and right skin panels of the vertical stabilizer, except for stiffness changes associated with thickness variations. The U.S. Army Research Laboratory, Aberdeen, Maryland, and the Ford Motor Company’s Nondestructive Evaluation Laboratory, Livonia, Michigan, conducted CT scanning of selected fractured pieces and cut sections from the vertical stabilizer lug areas (specifically, those in which delaminations had been identified during the ultrasonic inspections). The scanning produced two-dimensional slice images, and a visualization software program produced three-dimensional images from these two-dimensional slice images, as shown in Materials Laboratory Factual Report 03-033. Delaminations were observed, and multiple delaminations through the thickness were visible in some areas. Airbus conducted a hand-held ultrasonic inspection of the vertical stabilizer at the main attachment and transverse load lug areas, the lower ends of the spars, rib number 1, and the hinge attachment fittings. Airbus also conducted a hand-held ultrasonic inspection of the rudder hinge attachment fittings and ultrasonic imaging of the vertical stabilizer skin panels at the stringer locations. An Airbus Inspection Protocol document dated March 4, 2002, indicated that Airbus found debondings, delaminations, and damages at 102 Ultrasonic inspection is a contact technique that uses a transducer on the surface to measure the ultrasonic response of the structure. Lamb wave (also known as guided acoustic wave) imaging is a method for inspecting the stiffness and thickness of composites. CT scanning measures the transmitted x-ray intensity of a part that has been rotated and translated through an x-ray beam. Computers then use the data to reconstruct two- or three-dimensional renderings of the part. X-ray radiography is a quick, noncontact method for imaging subsurface features using x-rays and is commonly used to detect entrapped water in honeycomb structures. Thermography is a quick, noncontact technique for imaging subsurface features by measuring surface temperature changes. Computer-aided tap testing involves striking an impactor on the surface of a composite part and measuring the time of contact of the impactor, which is related to the local stiffness of the part. The data are collected and mapped into a color image in which each color is related to a range of stiffness values. For more information on these nondestructive inspection techniques, see Materials Laboratory Factual Reports 02-078 and 03-033 in the public docket for this accident.

Factual Information 62 Aircraft Accident Report the lower part of the vertical stabilizer in the lug areas, the spar areas, and rib number 1 area but not in the hinge attachment fitting areas.103 The document also indicated that Airbus found debondings, delaminations, and damages in and at the rudder hinge attachment fitting areas. NASA-Langley conducted x-ray radiography, Lamb wave imaging, and thermography of a portion of the rudder (from hinge attachment fitting 7 down to between hinge attachment fitting numbers 5 and 4). Entrapped water was detected at the lower portion of the rudder section by x-ray radiography and thermography.104 The Lamb wave imaging determined that the facesheet had fractured from the honeycomb in areas at the lower portion of the rudder section. According to testimony at the public hearing from the NASA-Langley official who conducted the nondestructive examination research, the locations of the water found during the nondestructive examinations seemed to correspond with areas that showed visible damage and with facesheets fractured from the honeycomb. He also testified that the water most likely got into the rudder while it was in Jamaica Bay. Representatives from the Center for Aviation Systems Reliability at Iowa State University, Ames, Iowa, conducted computer-aided tap testing of the rudder. During tap testing at Floyd Bennett Field on November 28 and 29, 2001, images of the left and right skin panels showed that areas of low stiffness were most likely caused by the debonding of the rudder skin from the honeycomb core structure along a number of buckling failures and that areas of high stiffness could be caused by manufacturing features such as core splices, core potting, and ply overlap.105 During tap testing at NASA-Langley from March 6 to 8, 2002, images of the left and right skin panels showed a high degree of consistency between the inside and outside surfaces of the rudder skin. The images also showed symmetrical areas of higher stiffness on the inside and outside surfaces. In addition, the images showed that the patterns for the large buckle failure near hinge attachment fitting number 5 were different between the left 103 Personnel from Sandia National Laboratory, Albuquerque, New Mexico, manually inspected the lower end of the vertical stabilizer skin panels and the attachment lugs when the vertical stabilizer was at Floyd Bennett Field in Brooklyn, New York (before the vertical stabilizer and the rudder were shipped to NASA-Langley). The results of the inspection were difficult to interpret because of the complex geometry of the structure in those areas. Those results for which interpretation was possible corresponded well with the results reported by Airbus and NASA-Langley. 104 Wayne State University in Detroit, Michigan, made several thermographic images of the rudder while it was at Floyd Bennett Field. The results were similar to those of NASA. 105 In addition, personnel from Sandia National Laboratory performed tap testing and ultrasonic mechanical impedance analysis when the rudder was at Floyd Bennett Field. Tap testing was completed using an instrument similar to the one used during computer-aided tap testing (a digital readout but no computer interface). The ultrasonic mechanical impedance analysis method evaluated the object’s vibrational response to an ultrasonic signal, and the response is related to local stiffness. The locations of stiffness changes detected by these techniques corresponded well with those detected by the computer-aided tap testing that was done at Floyd Bennett Field and at NASA-Langley.

Factual Information 63 Aircraft Accident Report and right skin panels.106 On the right skin panel, the buckle failure was located aft of hinge attachment fitting number 5 at almost 90º to the spar with a 45º branch angled upward and, at the aft half of the chord, a 45º branch angled downward. The left skin panel buckle failure was angled mostly in a downward 45º direction aft of hinge attachment fitting number 5, although a branch was also present upward along the leading edge spar. 1.16.3.2 Materials Testing and Microstructural Examination At the Safety Board’s request, NASA-Langley conducted materials testing and microstructural examination of the vertical stabilizer and rudder.107 Samples were selected from multiple locations on the vertical stabilizer and rudder to determine chemical composition, extent of cure, glass transition temperature, fiber and void volume fractions, and ply stacking sequence (layup). The chemical composition of each sample from the vertical stabilizer was assessed using infrared spectroscopy, which measured the total attenuated reflectance through a microscope. The results were typical for CFRP material with no significant variances in the spectrums for each specimen. The extent of cure and the glass transition temperature of one area from the upper end of the right skin panel were analyzed using modulated differential scanning calorimetry, dynamic mechanical analysis, and differential scanning calorimetry in both the as-received condition and in the dry condition.108 The moisture content for the as-received condition was approximately 0.58 percent. The modulated differential scanning calorimetry results corresponded to an extent of cure greater than 97 percent. The dynamic mechanical analysis results showed that, in the as-received condition, the onset glass transition temperature measured 134° C, which was between the qualification values of 144° C for the dry condition and 122° C for the 50 percent relative humidity (0.7 percent moisture content) condition. The portion of the sample that was tested in the dry condition had an onset glass transition temperature of 149° C. The differential scanning calorimetry results showed no significant variance among the extent of cure and the glass transition temperature of all samples, and the results indicated that the extent of cure was sufficient. 106 The most severe damage to the rudder occurred near hinge attachment fitting numbers 2 through 4, but the skin panels near these fittings were difficult to image. The most prominent facesheet-to-honeycomb fracture damage to the upper two-thirds of the rudder was the large buckles near hinge attachment fitting number 5. 107 Some testing and microscopy were completed at Airbus’ composites technology division in Bremen, Germany. 108 The curing temperature for the vertical stabilizer CFRP material is specified to be 250° F. According to Airbus materials qualification data, the onset glass transition temperature should be 144° C in the dry condition and 122° C after exposure to a climate of 50 percent relative humidity (corresponding to a moisture content of 0.7 percent weight).

Factual Information 64 Aircraft Accident Report Samples of the vertical stabilizer material were cut, mounted, and polished for microscopic observation and quantitative analysis. Results indicated that the materials were prepared to the desired fiber volume fractions with acceptable void content.109 No evidence of microcracking was observed. The observed layup in each sample was compared with the engineering drawing, and only the sample from the right forward lug showed layup discrepancies. The observed layup in each sample was compared with the engineering drawings, and only the sample from the right forward lug showed layup discrepancies. Among the 124 layers in this sample, 2 layers had orientations that were different from the drawing. Also, two layers appeared to be missing from one position through the thickness, but two additional layers were present in another position. The total number of layers of each orientation in this sample was correct, and the discrepancies represented a small fraction of the total number of layers. For the rudder, the extent of cure and the glass transition temperature of a sample from the right skin panel were analyzed using modulated differential scanning calorimetry and dynamic mechanical analysis.110 Portions of the sample were tested in the as-received condition and in the dry condition. The moisture content for the as-received condition was approximately 0.81 percent. The modulated differential scanning calorimetry results corresponded to an extent of cure of 100 percent. The dynamic mechanical analysis results showed that, in the as-received condition, the onset glass transition temperature measured 82.9° C, which was between the qualification values of 102° C for the dry condition and 75° C for the 70 percent relative humidity/70° C (0.75 to 0.90 percent moisture content) condition. The portion of the right skin sample that was tested in the dry condition had an onset glass transition temperature of 102.5° C. Additional details of the testing discussed in this section appear in Materials Laboratory Factual Report 02-082. 1.16.3.3 Fractographic Examination of the Main Attachment Lugs The Safety Board conducted a fractographic examination of the vertical stabilizer main attachment lugs. The fracture features were initially examined visually and then were examined using an optical stereoscope and scanning electron microscopy (SEM), which magnified the features. Fractures observed in the vertical stabilizer consisted primarily of translaminar fractures and delaminations. (Translaminar fractures require the breaking of fibers, the main load-bearing component of the composite. Delaminations do not require fiber breakage.) No evidence of fatigue was observed on any fracture surface. The right rear lug had translaminar fractures intersecting the lughole. The translaminar fracture surfaces had a rough appearance consistent with fracture primarily under tensile loading. When examined using SEM, fibers that were generally 109 According to Airbus engineering drawings, the fiber volume fraction for the vertical stabilizer CFRP material is 60 percent ± 4 percent. The maximum porosity permitted in the cross-section is 2.5 percent. The layup consists of fabric and tape layers, with the fabric layers oriented at ±45° and at 0/90° relative to the 0° fiber direction and the tape layers with fibers all oriented parallel to the 0° fiber direction. 110 Other samples were selected from the rudder for peel tests and flatwise tensile tests.

Factual Information 65 Aircraft Accident Report perpendicular to the fracture plane showed radial fracture patterns consistent with overstress fracture under tensile loading. The right rear lug also had delaminations within the lug. Examination of a delamination surface using SEM showed evidence of hackles111 associated with shearing at the fracture surface and did not show any evidence of fatigue. At the outboard side of the lug, the translaminar fractures were in locations and orientations that were consistent with a cleavage-tension failure mode. The right center lug area was fractured in the vertical stabilizer structure above the lughole. The translaminar fracture surfaces had a rough appearance consistent with fracture under tensile loading. Also, the lugs had delaminations that were limited to within the lug or within 4 inches of a translaminar fracture. The right forward lug had translaminar fractures that intersected the lughole. The translaminar fracture features were generally rough and were consistent with fracture under tensile loading. Also, the lug had delaminations that did not extend into the main portion of the vertical stabilizer beyond the lug. The left rear lug had a translaminar fracture in the vertical stabilizer structure above the lughole. The translaminar fracture features near the inboard side of the fracture were generally rough and were consistent with overstress fracture under tensile loading. Most of the translaminar fracture surface at the outboard side appeared smooth and had yellow-colored fibers, which were consistent with postfracture damage. The left aft lug had delaminations extending up to 37 inches from the lower end. Fracture features on the left aft delamination indicated a shear direction that was consistent with the lower pieces moving downward relative to the remaining structure. The left center lug area had a translaminar fracture through the vertical stabilizer structure at the rib 1 fastener location. Most of the translaminar fracture surface had a rough appearance that was consistent with overstress fracture under tensile loading, but fracture features that were consistent with compression loading were observed at the outboard edge, indicating bending to the left. The left forward lug had translaminar fractures intersecting the lughole with rough fracture features that were consistent with overstress fracture primarily under tensile loading. Multiple delaminations within the lug and a bearing indentation on the outboard side were consistent with bending to the left. Also, the left forward lug area had a delamination extending upward into the structure up to 43 inches from the lower end. Fracture features on the left forward delamination indicated a shear direction that was consistent with fracture under tensile loading and/or bending to the left. For detailed information on the fractographic examination of the vertical stabilizer main attachment lugs, see Materials Laboratory Factual Report 02-083 in the public docket for this accident. 111 Hackles are matrix fracture features that indicate a significant component of shear across the fracture surface. Hackles are formed when matrix microcracks that are spaced fairly regularly along planes of maximum tension join together.

Factual Information 66 Aircraft Accident Report 1.16.4 Structural Analyses and Tests 1.16.4.1 Finite Element Analysis and Progressive Failure Analysis At the Safety Board’s request, NASA-Langley and Airbus independently conducted an FEA to assess flight 587’s most likely failure scenarios. The following failure scenarios were assessed: (1) fracture of the right rear main attachment lug; (2) buckling of portions of the vertical stabilizer skin panels, resulting in fracture of the right rear main attachment lug, rudder hinge line failure, or rudder fracture; (3) rudder skin fracture; (4) actuation of a bent rudder hinge line, resulting in rudder fracture or rudder hinge line failure; and (5) flutter of the vertical stabilizer resulting from delamination of the rudder skin sandwich panel. NASA-Langley’s and Airbus’ analyses determined that the fracture of the right rear main attachment lug was the most probable initial failure. The analyses indicated that, after the right rear main attachment lug fractured, all of the remaining attachment fittings would fracture with no increase in external loading. Under the direction of Safety Board investigators, NASA-Langley and Airbus evaluated the fracture of the right rear main attachment lug using global (entire vertical stabilizer) and local (lug area only) models. In the local model, the right rear main attachment lug was analyzed, including the neighboring skin and stringer region between ribs 1 and 5, the right half of ribs 1 through 5, and the right half of the rear spar. NASA and Airbus used detailed FEA models to determine lug contact areas, contact pressures, and the stress and strain profiles112 under a loading representative of the accident condition (that is, the loading at the time that the vertical stabilizer separated from the aft fuselage) and Airbus’ full-scale certification test (see section 1.6.4.3). The FEA results showed that the lug contact areas, contact pressures, and the stress and strain profiles for the accident condition were in agreement with those for the full-scale certification test. NASA used a PFA model to determine the predicted failure load, failure mode, and location of failure initiation for the right rear main attachment lug for the accident condition and the full-scale certification test. The PFA results showed that, for the accident condition, the predicted failure load for the right rear main attachment lug was about two times its design limit load, as defined by the lateral gust condition. The PFA results also showed that the predicted failure load and location of failure initiation for the rear main attachment lugs during the full-scale certification test and for the accident condition were in agreement. In addition, the PFA results showed that the predicted failure mode of the rear main attachment lugs during the full-scale certification test and for the accident condition was consistent with a cleavage-tension failure. 112 As stated in section 1.6.4.2, stress is the force per unit area of material. Strain is the deformation per unit length of material.

Factual Information 67 Aircraft Accident Report 1.16.4.2 Postaccident Lug Tests As indicated in section 1.16.4.1, NASA-Langley’s and Airbus’ FEA models showed that the stress and strain profiles of the right rear lug at the time of vertical stabilizer separation were equivalent to those of the full-scale certification test at failure, and NASA’s PFA results showed that the failure load, failure mode, and location of failure initiation for the accident condition were equivalent to those of the full-scale certification test. However, no actual test data for the accident condition existed to validate the FEA and PFA results for the accident condition and to validate the most likely failure scenario for flight 587—fracture of the right rear main attachment lug. As a result, the Safety Board conducted three static lug tests at Airbus’ production facility in Hamburg, Germany. The purpose of the tests was to demonstrate the behavior of the lugs under the flight 587 tensile load conditions, which were derived from FDR data and FEA models. The FEA and PFA models indicated that lug strength was a function of the lug resultant force and the lug local lateral bending moment applied at the lug pin, which are primarily influenced by the root bending moment and net side load on the vertical stabilizer. The computed pin loading from the global and local analysis for the airplane model and accident condition was used to prescribe loading conditions for the static lug tests. The first test was performed on August 13, 2003, using a left rear main attachment fitting from an A310 skin panel that was used as a manufacturing test article. During the test, the lateral load application control commanded a shutdown because of a change in the fitting’s lateral stiffness. (As a result, the second and third static lug tests were conducted with displacement control instead of load control.) The load level achieved during this first test was 907 kN. Visible fiber cracks were observed on the outboard surface of the lug. The location of this damage was consistent with the initiation of failure in the cleavage-tension mode, as indicated by the PFA model results. Delaminations within the test lug were similar to those observed within the flight 587 right rear main attachment lug. Also, the fracture initiation location was consistent with that predicted by the PFA model and was similar to the location observed in the accident fitting. Further, the measured strain values for the first test fitting compared well with the strain values predicted by the FEA models. In addition, the strain level comparison between the FEA models for the first static lug test and the FEA models for aircraft configuration indicated that this test represented the behavior of the flight 587 right rear main attachment lug during the accident sequence. The second and third tests were conducted using fittings from the airplane used for American Airlines flight 903, which experienced an excursion outside the A300-600 certificated design envelope in 1997. (For more information about the flight 903 accident, see section 1.18.2.1.) The second test was performed on December 17, 2003, using the left rear main attachment fitting from the flight 903 airplane. The left rear main attachment fitting contained nonvisible damage that was not detected during a March 2002 nondestructive inspection (see section 1.18.2.1.1.) Loads were applied until the lug fractured at a load level of 893 kN. The type and location of the translaminar

Factual Information 68 Aircraft Accident Report fractures and delaminations were consistent with those observed during the first test and with the accident lug. As with the first test, the fractures occurred at locations that were consistent with those predicted by the PFA model and similar to the locations observed in the accident lug. Also, the measured strain values for the second test fitting compared well with the strain values predicted by the FEA models. In addition, the strain level comparison between the FEA models for the second test and the FEA models for aircraft configuration indicated that this test represented the behavior of the flight 587 right rear main attachment lug during the accident sequence. The third test was conducted on February 12, 2004, using the right rear main attachment fitting from the flight 903 airplane. The right rear main attachment fitting contained nonvisible damage that was greater than the damage that was detected during the March 2002 nondestructive inspection (see section 1.18.2.1.1). Loads were applied until a load level of 953 kN was reached; at that point, the maximum programmed load level had been achieved and maintained. The test was then stopped so that the load limitation could be removed. When the load application resumed, the test fitting fractured at a load level of 1,093 kN. Examination of the test data revealed that significant damage had occurred to the test fitting at a load level of 953 kN. This damage influenced the lug loading conditions during the subsequent loading. Overall, the type and location of the fractures and delaminations in the third test lug were consistent with those observed during the first and second tests and with the accident lug. As with the first and second tests, the fractures occurred at locations that were consistent with those predicted by NASA’s PFA model and was similar to the location observed in the accident lug. Also, the measured strain values for the third test fitting compared well with the strain values predicted by the FEA models up to 953 kN. In addition, the strain level comparison between the FEA models for the third test and the FEA models for aircraft configuration indicated that this test represented the behavior of the flight 587 right rear main attachment lug during the accident sequence. In summary, the results of the three static lug tests produced failure load levels, a failure mode, and a failure initiation location that were consistent with the results of NASA-Langley’s and Airbus’ FEA models and NASA’s PFA model. Also, the tested lugs had fracture features that were similar to those observed on the right rear main attachment lug from the accident airplane. In addition, even though the lugs used in the second and third test (from the flight 903 airplane) contained nonvisible damage, the tests indicated that the lugs performed to their design strength and that the nonvisible damage did not have a detrimental effect on the lugs’ overall performance. 1.16.4.3 Summary of Structural Analyses and Tests NASA’s and Airbus’ FEA models determined that failure of the right rear main attachment lug was the most probable initial failure. The FEA models and NASA’s PFA model also determined that the failure initiated at the final observed maximum vertical stabilizer root bending condition during the accident flight, when the vertical stabilizer

Factual Information 69 Aircraft Accident Report was subjected to a global root bending moment of more than two times the value defined by the limit load design envelope. (As previously stated, for certification, the vertical stabilizer is only required to support loads of 1.5 times limit load without catastrophic failure.) The structural analyses showed that the large aerodynamic loading produced by the accident scenario would result in the right rear main attachment lug experiencing reaction forces and associated stresses that were equivalent to those that produced lug fractures in the Airbus full-scale certification test (lateral gust condition) and the Safety Board’s static lug tests. Figure 16 compares the resultant lug forces at the time of fracture for the tests and analyses that were pertinent to the flight 587 investigation. Note: The lug forces defined by the gray and orange lines correspond to the conditions defined by the gray and orange triangles shown in figure 15. Figure 16. Comparison of Lug Forces at the Time of Fracture The stresses developed exceeded the strength values for the CFRP material used in the manufacturing of the lugs; thus, the accident lug and the tested lugs fractured because of a tensile static overload. The physical evidence and the structural analyses showed that the accident lug’s and the tested lugs’ fracture features were consistent with a cleavage-tension failure observed in composite-bolted joints. Figure 17 shows the load on the flight 587 right rear main attachment lug and a depiction of the cleavage-tension failure mode. AA587 Lug Failure Load Comparison Lug Resultant Force (kN) Lateral Gust Limit Load (RT) 475 kN Lateral Gust Ultimate Load (RT) 712 Loading Condition B 944 kN Load Condition D 804 kN 0 100 200 300 400 500 600 700 800 900 1000 1100 1 2 3 4 5 6 7 8 925 905 922 907 893 953 896 905 Accident Progressive Failure Analysis 1986 Full-Scale Test Result Full-Scale Test Progressive Failure Analysis NTSB Sub-Component Test #1 NTSB Sub-Component Test #2 NTSB Sub-Component Test #3 Sub-Component Test Progressive Failure Analysis Sub-Component Test Progressive Failure Analysis

Factual Information 70 Aircraft Accident Report Note: Number 1 is the initiating fracture, and number 2 is the secondary fracture. The circle indicates the location of the pin and bushing, which were missing from the lug when it was found in the wreckage. Figure 17. Load on the Flight 587 Right Rear Main Attachment Lug and a Depiction of the Cleavage-Tension Failure Mode The structural analyses also indicated that, after the right rear main attachment lug fractured, all of the remaining lugs fractured sequentially. The fracture of the right rear main attachment lug initiated a nearly instantaneous separation of the vertical stabilizer from the aft fuselage. Load 2 1 Load 1 2

Factual Information 71 Aircraft Accident Report 1.16.5 Systems Testing 1.16.5.1 Rudder Servo Controls and Linkages Between March 14 and 22, 2002, the three servo controls and linkages were examined, tested, and disassembled at the TRW Aeronautical Systems (the manufacturer of the rudder servo controls) facility near Paris, France.113 Each of the rudder servo controls showed some corrosion and superficial damage, but each one functioned satisfactorily. No significant discrepancies were noted during the disassembly. The control rods and bellcranks were intact from the bottom of the vertical stabilizer to the rudder servo controls, and no freeplay was observed. The three input springrods had white deposits on their internal components but no substantial corrosion. The lower and middle springrods passed a compression test but failed an extension test. The upper springrod could not be tested because it was bent. 1.16.5.2 Artificial Feel and Trim Unit The artificial feel and trim unit was examined and disassembled on April 11 and 12, 2002, at Airbus’ production facility in Hamburg. The examination found that some internal parts had been damaged by the postaccident fire and that the spring feel force could not be tested because melted components impeded the spring from compressing. The examination also found that the rudder trim jackscrew and nut portion were in good condition. As part of the examination, the artificial feel and trim unit was measured and was determined to be in the zero trim position. The disassembly showed no evidence of a malfunction in the unit. 1.16.5.3 Rudder Control System Ground Tests From September 9 to 12, 2002, ground tests were performed on an A300-600 airplane at Airbus’ facility in Toulouse to evaluate the characteristics of the rudder control system. No significant differences existed between the test airplane and the accident airplane regarding the rudder control system and related electronic flight control systems. The tests recorded the response of the rudder to slow and fast pedal inputs and slow and fast yaw autopilot commands.114 Data showing rudder pedal position versus rudder position were examined from these tests and from human performance tests that were also conducted in September 2002 at Airbus’ facility in Toulouse (see section 1.16.6.2). The data showed a constant relationship between the rudder and pedal positions when the rudder was being driven at a slow rate by the pedal. The data also showed that the pedal led the rudder when the rudder 113 Before this work, the three rudder servo controls had been sent to the Army Research Laboratory, where CT scans were performed. 114 During the tests, the pedal rates ranged from about 1º per second (slow) to 80º per second (fast), and the yaw autopilot was commanded to move at rates that ranged from 1º per second (slow) to the maximum 37º per second (fast).

Factual Information 72 Aircraft Accident Report was being driven at a fast rate by the pedal (relative to the slow pedal rate data). In addition, the data showed that the pedal lagged behind the rudder when the pedal was being driven at a fast rate by the autopilot (relative to the slow pedal rate data). The Safety Board did not test how a failure condition involving the yaw damper (specifically, a failure in one of the eight bearings in the differential unit that caused the yaw damper linkage to become jammed to the main bellcrank) would cause the yaw damper to move the rudder pedals. However, because yaw damper and autopilot inputs both occur at the differential unit, which is a relatively rigid structure, the Board determined that the relationship seen when the pedal was being driven at a fast rate by the autopilot—the pedal lagging behind the rudder—would also be seen if a yaw damper had become jammed to the main bellcrank. 1.16.5.4 Yaw Autopilot and Yaw Damper Actuators On October 17, 2002, the yaw autopilot actuator was examined at the Safety Board’s laboratory for proper electrical wiring between the main connectors and the solenoid valve. No determination could be made because of the extensive heat and physical damage to the actuator. On June 2 and 3, 2003, the yaw autopilot actuator was disassembled at the Goodrich Actuation Systems (the yaw autopilot actuator manufacturer) facility in St. Ouen L’Aumone, France, to determine whether the actuator was working properly. Again, no determination could be made because of the extensive heat and physical damage to the actuator. On June 4 and 5, 2003, the yaw damper actuator was examined at the Goodrich Actuation Systems (the yaw damper actuator manufacturer) facility in Vernon, France, to determine whether the actuator was operating properly. No determination could be made because of the extensive heat and physical damage to the actuator. 1.16.5.5 Flight Control Linkages FDR data from the accident flight showed large movements of flight control linkages and surfaces, primarily in the yaw and roll axes. As a result, on May 15, 2003, the flight control linkages on an American Airlines A300-600 airplane, N14065, were inspected at the company’s maintenance facility in Tulsa for possible cross-coupling115 or interference with moving parts. No areas of potential flight control linkage coupling or interference with moving parts were identified. 1.16.6 Human Performance Tests 1.16.6.1 Vertical Motion Simulator Tests The Safety Board conducted tests and observations using the vertical motion simulator (VMS) at NASA’s Ames Research Center, Moffett Field, California. The VMS is the largest motion-based simulator in the world. The VMS cab is mounted on a 115 Cross-coupling is binding of the roll control linkages with the yaw control linkages.

Factual Information 73 Aircraft Accident Report 6-degrees-of-freedom motion platform that provides a 60-foot vertical, 40-foot lateral, and 12-foot forward and aft motion capability. The cab has two side-by-side pilot stations, each of which is configured with three side-by-side monitors to indicate cockpit displays,116 a transport-category-style control wheel and column, adjustable rudder pedals, and two throttle levers. The VMS tests and observations, which were conducted from August 12 to 22, 2002, consisted of a reconstruction of the accident flight sequence using data from the accident airplane’s FDR and other available sources. One objective for reconstructing the accident flight sequence was to observe and evaluate accelerations and angular motions that were similar to those that occurred during the accident flight. Another objective was to observe and evaluate cockpit displays, visual cues, and flight control motions that were similar to those experienced during the accident flight. The reconstruction of flight 587 was based on data from the accident airplane’s FDR, calculations from the airplane performance study for this accident, and audio information from the accident airplane’s CVR. The reconstruction began just before flight 587 departed from JFK and continued until the FDR ceased recording. The cab motion was driven with the time histories of computed pilot station accelerations (longitudinal, lateral, and vertical) and angular position data that were based on the FDR’s accelerometer and angular position data. The VMS motion was driven with computed accelerations that matched, as closely as possible, the accident airplane’s motion during the first and second wake encounters. These accelerations were of particular interest because they could serve as possible explanations for pilot reactions on the controls. The VMS was not able to replicate the target longitudinal, lateral, and vertical accelerations for short periods of time during the accident sequence, and the entire sequence could not be replicated in a single series of motion because of limitations in the VMS motion system. Further, it is possible that small differences between the actual acceleration and the derived values (that is, the acceleration between data points) may exist because of the low sample rate of the pitch, roll, and heading data recorded on the FDR.117 During the VMS runs, primary flight control inputs, including the rudder pedals, control wheel, control column, and throttles, and heading, altitude, airspeed, attitude, and position data were developed from FDR data and portrayed on the cockpit displays. An outside visual scene based on a database of prominent visual features and coastline near JFK was also presented during VMS runs. In addition, selected VMS runs included a synchronized audio file (played over headsets) that contained portions of the accident flight’s CVR recording. For each VMS run, time histories of cab motion parameters, 116 The outboard monitor at each station presented graphical strip charts of input and actual accelerations for the longitudinal, lateral, and vertical axes and flight control positions. The inboard monitor at each station presented a compass rose navigation display of heading and track information and a wind vector indicator with digital readouts of windspeed and direction. The center monitor at each station was a primary flight display that showed altitude, attitude, and airspeed information; displayed a digital readout of event time; and contained an operable sideslip indicator that presented lateral acceleration data (based on Airbus specifications for the A300-600 sideslip indicator). 117 Pitch, roll, and heading were sampled only one time per second.

Factual Information 74 Aircraft Accident Report including input data and measured cab accelerations values and flight control positions, were displayed on monitors in the VMS control room.118 Members of the human performance group for this accident participated in the VMS runs. Many participants described the first notable event experienced in the cab (that is, the first encounter with wake turbulence) as typical of a crossing wake encounter. Some participants felt a slight yaw before the flight controls moved. The slight yaw was described as a characteristic motion of an A300 flying through turbulence. The slight yaw motion was followed by a vertical acceleration, which was described by the participants as a “bump” that seemed to result from the wake encounter rather than flight control movements. Regarding the second notable event experienced in the cab (that is, the second encounter with wake turbulence), the participants generally agreed that “very slight” cab motions were felt before the first movements of the control wheel and rudder pedal to the right. The cab motions were described as “barely perceptible” left lateral accelerations. Most participants did not experience any cab motion until less than 1 second before the first wheel motion. The first movements of the control wheel and rudder pedal to the right were “large and abrupt.” The participants did not observe a visual or acceleration cue that would cause a pilot to apply the observed initial magnitude of wheel and pedal in response to the second notable event. After the first movements of the wheel and pedal to the right, large lateral accelerations were felt, and additional large, abrupt flight control movements in the yaw, pitch, and roll axes were observed. Although the participants felt lateral accelerations, they indicated that it was difficult to sense whether vertical and longitudinal accelerations were also present. The VMS was also used to evaluate how the same reconstruction would feel with a variable ratio rudder travel limiter system. During those VMS runs in which a variable ratio limiter system was simulated, some participants stated that the movements of the pedals was so fast that it was hard to keep their feet on the pedals as they moved. 1.16.6.2 Control Force and Control Surface Displacement Ground Tests Between September 10 and 17, 2002, members of the human performance group participated in A300-600 ground tests at Airbus’ facility in Toulouse. The purpose of the tests was to record (1) pilot input forces to the rudder pedal, control wheel, and control column under dynamic conditions and (2) the corresponding flight control surface positions. These measurements were compared with the static force versus deflection curves in the Airbus A300-600 Aircraft Maintenance Manual to better understand the 118 Two monitors displayed graphical strip charts of input and actual accelerations for the longitudinal, lateral, and vertical axes and flight control positions (identical to those presented in the cab). Two monitors presented a flight control display that provided dynamic flight control position information and rudder travel limiter position information in a pictorial format. The remaining four monitors presented the out-of-window visual scene, the primary flight display, the navigation display, and a chase plane view.

Factual Information 75 Aircraft Accident Report interaction between the pilots and the airplane during dynamic conditions. The tests were conducted at 165, 190, 240, and 325 knots.119 The rates of control movements were 0.25, 0.5, and 1 Hz. Direct feedback concerning the pilot’s performance was not provided to the three pilot subjects who participated in the tests. The tests showed that the control wheel and rudder pedal forces applied at the three higher airspeeds—190, 240, and 325 knots—were either similar to, or greater than, the forces applied at the 165-knot airspeed.120 The tests also showed rate saturation in the flight control surfaces (that is, when control inputs are made at a rate faster than the control surface can move). In addition, the force feel system for the rudder pedal requires a force of 65 pounds for the pedal to reach full travel at 165 knots; the tests showed that average pedal force for all three subjects was almost always above this value regardless of the set airspeed.121 Similarly, the force feel system for the control wheel requires a force of 11.2 pounds for the wheel to reach full travel; the tests showed that the applied control wheel forces were typically between 30 and 40 pounds. Tests were also conducted in which the subjects were instructed to move the control wheel and rudder pedal to 50 percent of their available range. The tests showed that the pedal force applied during the 50-percent condition resulted in full rudder travel, even though that force was one-half of the force applied at the 100-percent condition. The tests also showed that the control wheel force applied during the 50-percent condition resulted in reduced aileron motion. 1.16.7 Temperature Tab Study To determine if heat in the aft fuselage had compromised the integrity of the vertical stabilizer’s main attachment and transverse load fittings, a temperature tab study was conducted. Temperature tabs show the temperatures that result from the radiated heat from the APU bleed air duct and from radiant heat from the sun. The tabs have windows that are marked for specific temperatures, and a blackened window indicates that the tabs were exposed to temperatures greater than that marked by the window. Temperatures of 250º and greater degrade composite materials. Five temperature tabs were installed in the aft fuselage of an American Airlines A300-600 airplane, N70054. The temperature tab ranges were 120º to 180º F, with windows marked in 20º increments, and 180º to 250º F, with windows marked for 180º, 200º, 230º, and 250º F. 119 These four airspeeds represented different amounts of rudder pedal limiting and different amounts of control column force. 120 Even though the amount of force required to achieve full rudder pedal travel on the A300-600 decreases as airspeed increases, the amount of force to achieve maximum control wheel travel is independent of airspeed. 121 The lowest average peak force value was 61.1 pounds, which one subject applied during the 240-knot condition.

Factual Information 76 Aircraft Accident Report Two temperature tabs (one showing the 120º-to-180º F range and the other showing the 180º-to-250º F range) were placed adjacent to the fuselage skin. Another temperature tab (showing the 120º-to-180º F range) was placed over the bleed air duct on the left side of the fuselage. The last two temperature tabs (one showing the 120º-to-180º F range and the other showing the 180º-to-250º F range) were placed on the vertical stabilizer access cover. The airplane operated for several months with the five temperature tabs inside the aft fuselage. On August 1, 2002, the temperature tabs were examined. The tabs that were adjacent to the fuselage skin showed exposure to 120º F, the tab that was placed over the bleed air duct showed exposure to 160º F, and the tabs that were placed on the vertical stabilizer access cover showed exposure to 120º F. 1.16.8 Cockpit Voice Recorder Sound Spectrum Study The CVR group performed a sound spectrum study to identify any airframe vibration or flutter signals or unknown or unusual sounds during the airborne portion of the CVR recording. The recording was examined on a spectrum analyzer, which presents the frequency content of the signals graphically. The information from this visual presentation allows detailed analyses of the analog waveform and provides detailed timing information. The CVR group applied a 100-Hz, low-pass filter to the CVR to document any airframe vibration or flutter. This filter passed sound energy below 100 Hz through a signal processor, which calculated the frequency content of the sound energy, and eight spectrograms (also known as voiceprints) displayed the resulting signals. One spectrogram showed signals for the time that the airplane was starting its takeoff roll, and seven spectrograms depicted the last 50 seconds of the cockpit area microphone CVR recording. (Three of the spectrograms were not useable as an examination technique because the sound spectrum analysis could not compensate for the loud noises toward the end of the CVR recording.) The spectrograms did not reveal any unusual vibration or flutter that preceded the sound of two thumps recorded on the CVR at 0915:52.9 (about 1 second before the first officer’s statement, “max power”). The CVR group examined all of the CVR channels to document any unknown or unusual cockpit or airplane sounds. The sound of a brief squeak and rattle at 0915:37.3 and the sound of two thumps at 0915:52.9 were associated with movement of cockpit items in response to the airplane’s encounter with wake turbulence. The CVR group identified no specific events or noises on the CVR that, by themselves, could be positively associated with the departure of the vertical stabilizer. Also, the Board did not determine the sources of sounds after the airplane was believed to have started its uncontrolled descent.

Factual Information 77 Aircraft Accident Report 1.16.9 Speech Study The Safety Board examined speech evidence from the CVR recording to determine whether nonverbal sounds, physical straining, and indications of psychological stress were present during the accident sequence. The Board made subjective evaluations and computer scorings of the audio information from the CVR hot microphone channels, which captured speech through the boom microphones attached to the headsets worn by each pilot. The CVR transcript (see appendix B) did not identify any nonverbal sounds for the captain. The transcript did identify varied sounds for the first officer, including the grunt sound at 0916. Research has shown that fundamental frequency122 (pitch) can convey information about a speaker’s psychological stress.123 With regard to fundamental frequency, the Safety Board used the following guidelines from two previous accident investigations to evaluate the approximate degree of psychological stress experienced by a pilot and its effect on performance:124 • An increase in fundamental frequency by about 30 percent (compared with that individual’s speech in a relaxed condition) is characteristic of stage 1 level of stress, which could result in the speaker’s focused attention and improved performance. • An increase in fundamental frequency by about 50 to 150 percent is characteristic of stage 2 level of stress, which could result in the speaker’s performance being hasty and abbreviated and thus degraded; however, the speaker’s performance would not likely display gross mistakes. • An increase in fundamental frequency by about 100 to 200 percent is characteristic of stage 3 level of stress, or panic, which would likely result in the speaker’s inability to think or function logically or productively. Each CVR statement was analyzed for computer-generated measures of fundamental frequency. Specifically, average speech measures were examined during the different stages of flight to assess whether the flight 587 pilots responded to presumed increases in stress with corresponding increases in the speech measures. Consistent with 122 Fundamental frequency is the rate (in Hz) at which the vocal chords of the larynx open and close during speech, releasing puffs of air. For example, a fundamental frequency of 150 Hz indicates that the vocal chords open and close 150 times per second. 123 M. Brenner, E.T. Doherty, and T. Shipp, “Speech Measures Indicating Workload Demand,” Aviation, Space, and Environmental Medicine, Vol. 65 (1994): 21-26. 124 For more information, see National Transportation Safety Board, Uncontrolled Descent and Collision With Terrain, USAir Flight 427, Boeing 737-300, N513AU, Near Aliquippa, Pennsylvania, September 8, 1994, Aircraft Accident Report NTSB/AAR-99-01 (Washington, DC: NTSB, 1999). Also see National Transportation Safety Board, EgyptAir Flight 990, Boeing 767-366ER, SU-GAP, 60 Miles South of Nantucket, Massachusetts, October 31, 1999, Aircraft Accident Brief NTSB/AAB-02/01 (Washington, DC: NTSB, 2001).

Factual Information 78 Aircraft Accident Report previous psychophysiological evidence,125 the speech study assumed that, under normal operations, the pilots would be the most relaxed when the airplane was parked at the gate (pre-taxi), their stress level would increase as they began taxi operations, and their stress level would be the greatest during takeoff. The study found that both the captain and the first officer appeared to respond with characteristic changes in speech fundamental frequency to the increasing demands of the different stages of flight (pre-taxi, taxi, and takeoff). The first officer showed a large response to the wake encounters, but the captain did not show such a response. As a result, the average fundamental frequency values for each statement made by the captain and the first officer during the takeoff and wake encounter segments of the flight were evaluated. The evaluation indicated that the captain displayed a relatively uniform profile of stress that remained within a generally alerted level (stage 1). The first officer’s last three statements before 0915:58.4 (when the right rear main attachment fitting fractured) showed progressively increasing fundamental frequency values that were significantly higher than those of his previous statements. These last three statements reached a high stress level associated with degraded performance (stage 2) but remained below a stress level associated with panic (stage 3). 1.17 Organizational and Management Information American Airways was incorporated in 1930, and its name changed in 1934 to American Airlines, Inc. American Airlines is owned by the AMR Corporation and is headquartered in Dallas, Texas. American provides passenger and cargo service throughout North America, South America, the Caribbean, Latin America, Europe, and the Pacific. AMR Corporation also owns and operates American Eagle, a regional airline that provides service at American’s hubs and other cities throughout the United States, Canada, the Bahamas, and the Caribbean. American Airlines acquired Reno Air in February 1999 and Trans World Airlines (TWA) in April 2001. As of November 2001, American Airlines’ fleet consisted of 869 transport-category airplanes, 35 of which were A300-600 airplanes (including the accident airplane).126 Other airplanes in American’s fleet at the time were the Boeing 717, 727, 737, 757, 767, and 777; the Fokker F.100; and the McDonnell Douglas MD-80. As of March 2002, American Airlines employed 12,746 pilots. (Of the 869 airplanes in American’s fleet and the 12,746 company pilots, 107 airplanes and 1,906 pilots were acquired through TWA.) 125 For more information, see J.J. Speyer, R.D. Blomberg, and J.P. Fouillot, “Evaluation of the Impact of New Technology Cockpits: Onwards From A300FF, A310, A320 to A330, A340.” Presented at the International Conference, Human Machine Interaction and Artificial Intelligence in Aeronautics and Space, Toulouse, France, 1990, and reprinted in the Airbus Industrie publication Workload and Vigilance, Physiologic Ambulant Monitoring, Automation and Error Tolerance, Cockpit Resource Management. Also see G.F. Wilson, “An Analysis of Mental Workload in Pilots During Flight Using Multiple Psychophysiological Measures,” International Journal of Aviation Psychology, Vol. 12, No. 1 (2002): 3-18. 126 In 1988, American Airlines became the first A300-600 customer in the United States, ordering 25 airplanes initially and then another 10 airplanes.

Factual Information 79 Aircraft Accident Report 1.17.1 Flight Crew Training American Airlines’ flight crew training academy is located in Fort Worth, Texas. The American Airlines General Flight Training Manual (dated September 1, 2001) indicated that pilot training was grouped into four categories: indoctrination, qualification (also known as initial training, transition training, and upgrade training), continuing qualification (also known as recurrent training), and special training (any training that was not covered by the three other categories). The manual also indicated that courses could be divided into four segments: distributed training, ground training, flight training, and qualification. Distributed training included electronic material distributed via computer system, computer disk, or the Internet; paper material, such as handouts, study guides, or flight operations manuals; and videotapes. Ground training consisted primarily of systems and procedures training conducted by professional ground school instructors who were not qualified as line pilots. Flight training consisted primarily of maneuvers and line operational simulator training. The maneuvers training was primarily conducted by professional simulator instructors who were not qualified as line pilots. The line operational simulator training was conducted by American Airlines check airmen who were qualified as line pilots. Qualification training consisted of training to qualify and/or certify pilots in a specific airplane. The American Airlines A300 fleet standards manager stated, during public hearing testimony, that A300 pilots receive about 225 hours of initial training before they qualify on the airplane. The fleet standards manager also stated that A300 pilots receive about 25 hours of recurrent ground school and simulator training every 9 months.127 The recurrent training is presented during 2 days of ground school and 2 days (4 hours each) of simulator training. 1.17.1.1 Selected Event Training On August 16, 1995, the FAA issued Flight Standards Handbook Bulletin for Air Transportation (HBAT) 95-10, “Selected Event Training.” The HBAT defined selected event training as “voluntary flight training in hazardous inflight situations which are not specifically identified in FAA regulations or directives” and contained guidance and information on the approval and implementation of selected event training for Part 121 operators that use flight simulation devices as part of their flight training programs. The FAA issued the HBAT in response to Safety Board recommendations regarding training in unusual attitude recovery but expanded the HBAT to include recognition and containment of situations that might lead to unusual attitudes. HBAT 95-10 indicated that some examples of selected event training were false stall warning (stickshaker) at rotation; full stalls; excessive (greater than 90º) roll attitudes; high (greater than 35º) pitch attitudes; engine failure at low altitude and airspeed, after 127 On September 1, 2001, American Airlines changed its recurrent training cycle for pilots from 12 to 9 months.

Factual Information 80 Aircraft Accident Report takeoff, and during go-around; engine-out minimum control speed on autopilot; and engine-out instrument landing system to a missed approach with the autopilot engaged. HBAT 95-10 further indicated that, because of the broad range of operations and equipment in use in the air transportation industry, the maneuvers included as selected event training could vary among operators. Just before HBAT 95-10 was issued, American Airlines initiated a selected events training program. Specifically, on July 27, 1995, American Airlines’ managing director of flight training and standards sent a letter to the American Airlines principal operations inspector (POI), explaining that the company had made changes to its training manual and asking that these changes be approved. The letter stated, “based on recent NTSB concerns and recommendations for operators to provide flight crewmembers with flight training in hazardous inflight situations, we are taking the initiative to conduct this type of training during simulator flight training periods.” The letter cited examples of maneuvers to be included during this training, including unusual attitude recoveries at excessive (90º or beyond) roll attitudes and high (35º or beyond) pitch attitudes. The POI approved the revisions to American Airlines’ training manual on August 1, 1995. 1.17.1.2 Advanced Aircraft Maneuvering Program American Airlines conducts the AAMP as the upset training module of its selected event training program. The AAMP is presented during initial, recurrent, transition, and upgrade training with descriptions highlighting the aerodynamic differences in airplane designs and varying engine, wing, and flight control configurations. According to American Airlines, the AAMP has evolved during the past several years as additional input has been received from various sources. Sections 1.17.1.2.1 through 1.17.1.2.5 present information on the development of the program, AAMP ground school training, AAMP simulator training, AAMP training materials, and comments on the program, respectively. Section 1.17.1.2.6 presents the results of the Safety Board’s training simulator study, which examined an AAMP exercise involving recovery from an excessive bank angle, and section 1.17.1.2.7 discusses the Board’s comparison of rudder pedal responses in an A300-600 airplane and American Airlines’ A310/300 training simulator. 1.17.1.2.1 Development of the Program AAMP development began in 1996 after a review of worldwide accidents from 1987 to 1996 involving large multiengine transport-category airplanes128 found that the leading causal factor for these accidents was loss of control.129 According to American Airlines, the aviation industry believed that many of the accidents might have been prevented if the pilots had been trained to specifically recognize and respond to airplane upsets. At that time, pilots of large transport-category airplanes generally did not receive 128 This review was done as part of the development of the joint industry Airplane Upset Recovery Training Aid (see section 1.17.2.2.2). 129 Other causal factors included controlled flight into terrain (CFIT), windshear, and wake vortex encounters.

Factual Information 81 Aircraft Accident Report any training in upset recovery or perform upset recovery maneuvers during flight operations. American Airlines involved airplane manufacturers in the early development of the AAMP. The chief test pilot from McDonnell Douglas was one of the airplane manufacturer representatives who provided comments on the AAMP during its early development. The AAMP course developer (an American Airlines captain) indicated that the chief test pilot’s comments were “very helpful” and that he “pretty much wrote the book” on the flight handling characteristics segment of the program. In a postaccident interview, the chief test pilot stated that “the rudder was the main area for discussion” because it needed to be “very well understood.” The chief test pilot was also concerned about the use of simulation outside of the range of valid data. The AAMP course developer and American Airlines’ director of training traveled to the Boeing Company in Seattle, Washington, to present the AAMP. They asked test pilots and aeronautical engineers to observe the program to help “make the program better” and “ensure the accuracy of the program.” Airbus was also invited to participate, but, according to the AAMP course developer, no test pilot or representative from Airbus attended the course at the time. American Airlines held a 2-day AAMP Industry Conference on May 29 and 30, 1997, in Dallas. Participants included the FAA, the Safety Board, airlines, Boeing, McDonnell Douglas, Airbus, and the U.S. military. The first day of the conference was a presentation of AAMP ground school training, and the second day consisted of a question and answer session and a simulator demonstration. During the conference, American Airlines’ chief pilot and vice president of flight requested feedback on the AAMP from the Boeing Commercial Airplane Group, the Boeing Douglas Products Division, Airbus, and the FAA. Section 1.17.1.2.5 discusses the coordinated response from these organizations. 1.17.1.2.2 Ground School Training Information AAMP initial ground school training consisted of 6.5 hours of classroom instruction, and recurrent AAMP ground school training consisted of videotapes that included classroom subjects and a simulator briefing.130 American Airlines provided initial AAMP ground school training to existing company pilots after the program was developed. The accident captain attended AAMP ground school training in May 1997, and the accident first officer attended AAMP ground school training in March 1997. Company pilots that were subsequently hired received initial AAMP ground school training during their initial training. American Airlines also distributed an AAMP flight training booklet to pilots during their initial AAMP ground school training. The booklet included information that 130 The videotapes shown during recurrent training were excerpts from AAMP videotapes that were created and distributed to company pilots beginning in December 1997. See section 1.17.1.2.3 for information about the AAMP videotapes.

Factual Information 82 Aircraft Accident Report supplemented the AAMP training and provided space for pilots to take notes during the training. The A300 fleet standards manager indicated that the booklet was not intended to be a stand-alone document and that the booklet was not handed out during recurrent AAMP ground school training. Section 1.17.1.2.4 provides additional details on the AAMP flight training booklet. American Airlines’ A300 fleet standards manager stated that, as a result of the flight 587 accident, AAMP ground school training for each fleet now includes discussions about the design maneuvering speed; the rudder travel limiter system; and the sensitivity, restrictive movement, and limited displacement of the rudder pedal. Also, the training now cautions pilots that only a small amount of rudder should be used, if needed, for roll upset recovery. 1.17.1.2.3 Simulator Training Information The presentation at the public hearing by the American Airlines A300 fleet standards manager indicated that the following AAMP simulator profiles were designed to develop and reinforce specific flying skills: • High AOA [angle of attack] maneuvering demo – NOT full stalls[131] • Unusual attitudes – nose high & nose low[132] • Microburst – demanding level • Engine failure – low altitude & low energy • GPWS [ground proximity warning system] – mode 2 ‘Terrain’ profile • High altitude upset – fleet specific The accident captain received his initial AAMP simulator training in December 1997 and his recurrent AAMP simulator training in July 1998, July 1999, July 2000, and June 2001. The accident first officer received his initial AAMP simulator training in November 1997 and his recurrent AAMP simulator training in November 1998, November 1999, and December 2000. The first officer was scheduled to receive his next recurrent AAMP simulator training at the end of November 2001. The A300 fleet standards manager indicated that, in response to HBAT 95-10, one AAMP simulator exercise involved an uncommanded roll to at least 90º. The fleet standards manager stated that, for this exercise, the simulator instructor told pilots that they were following a heavy jet (some instructors specifically stated that the airplane was a Boeing 747) and issued the appropriate wake turbulence warnings. The Safety Board notes that the NASA aviation safety reporting system (ASRS)133 contained only a few wake turbulence reports that involved a large transport-category airplane, such as the 131 According to the A300 fleet standards manager, American Airlines did not conduct full stall exercises because the simulators could not replicate them. 132 The excessive bank angle exercise discussed later in this section was presented during this AAMP simulator profile.

Factual Information 83 Aircraft Accident Report A300, as the trailing airplane, but the available reports of such events between 1988 and 1999 indicated that the maximum bank angle estimated by pilots was usually 30º or less and was no more than 60º. The Board further notes that a study conducted by the Flight Safety Foundation,134 which included a review of the Board’s accident data, the FAA’s incident data, and ASRS pilot reports, concluded that wake turbulence encounters were less frequent and less severe for large transport-category airplanes, such as the A300-600, than for smaller transport-category airplanes. American Airlines’ manager of simulation engineering stated that, during this exercise, the simulator instructor pressed a touch-screen button that was programmed to roll the airplane about 10º either left or right and then roll the airplane in the opposite direction past 90º.135 The simulator inhibited the use of the ailerons, spoilers, and rudder until the airplane reached a bank angle of 50º or a maximum of 10 seconds had elapsed. After the airplane’s bank angle reached 50º, yaw and roll control were phased back in during the next 1.3 seconds. The phasing in of control authority and the angular momentum of the airplane resulted in a bank angle of at least 90º. The roll rate after about 50º and the final bank angle (that is, the bank angle before recovery) depended on how effectively the pilot responded to the upset. According to one of the American Airlines A300 simulator instructors who provided the first officer’s most recent simulator training, if pilots just used aileron during the roll maneuver, they would put themselves into a sideslip condition, so “a little bit” of rudder was necessary. The instructor also stated that recovery from the roll maneuver was better when the pilots got on the flight controls earlier and that pilots needed to make corrections immediately. After the flight 587 accident, American Airlines changed the manner in which it conducted upset recovery training. The simulator instructor now uses programmed buttons in the simulator to place the airplane into an upset. Once an unusual attitude is established, the instructor freezes the simulator at this position, and the pilot is able to study the situation while the instructor discusses it. Afterward, the instructor initiates the exercise and releases the simulator back to the pilot, who must execute the proper recovery. Also, the exercise is no longer described as a departure behind a heavy jet. The American Airlines A300 fleet standards manager stated that American Airlines recognized that simulators had some limitations (for example, a simulator cannot replicate lateral, positive, and negative G forces or full stalls) but that simulators were the best tools available to teach upset recovery. His presentation at the public hearing indicated that American had invited Boeing, McDonnell Douglas, and Airbus to review AAMP simulator data. Further, the American Airlines manager of simulation engineering 133 ASRS is a national repository for reports regarding aviation safety-related issues and events. ASRS reports are voluntarily submitted by pilots and other aviation professionals when they want to alert others about a potentially unsafe condition or event. 134 P.R. Veillette, “Data Show That U.S. Wake-Turbulence Accidents Are Most Frequent at Low Altitude and During Approach and Landing.” Flight Safety Digest, Flight Safety Foundation, March-April 2002. 135 During climbout, the simulator replicated some light chop.

Factual Information 84 Aircraft Accident Report stated that sideslip and AOA were monitored when the AAMP simulation exercises were developed, each AAMP rolling and pitching exercise was flown and evaluated in each simulator fleet type, AAMP roll and pitch maneuvers stayed within valid simulator data, and the aerodynamic coefficient data tables provided by aircraft manufacturers for the simulators were not changed. According to the A300 fleet standards manager, the AAMP was not intended to be a turbulence recovery training aid, but the program recognized that some situations involving wake turbulence could result in an upset.136 The fleet standards manager stated that, at the time that the AAMP was being developed, more than 50 percent of American’s fleet consisted of McDonnell Douglas Super 80s and F.100s, which have short wingspans and are thus possibly susceptible to an upset from an encounter with wake turbulence. He also stated that American never thought that the larger airplanes in its fleet at the time— the DC-10, MD-11, Boeing 757, Boeing 767, and A300—could end up in an upset from a “normal” encounter with wake turbulence. 1.17.1.2.4 Training Materials As stated in section 1.17.1.2.2, American Airlines distributed an AAMP flight training booklet to company pilots during their initial AAMP ground school training. The original booklet, dated October 1, 1996, contained, among other things, information on the aerodynamics of swept-wing airplanes, unusual attitude recovery procedures, events that cause airplane upsets, and air mass anomalies (that is, windshear, microbursts, wake turbulence, and mountain wave activity). The booklet has been revised several times; the version that was current at the time of the accident was dated May 1, 2000. The booklet that the accident pilots received during their initial AAMP training was dated January 1, 1997. That booklet contained the following information regarding pilot responses to wake turbulence:137 • Rolling moment on aircraft with shorter wing spans can be dramatic. • Resulting attitude may be nose low with more than 90º of bank. • Apply the appropriate unusual attitude recovery procedure. • Do not apply any back pressure on yoke at more than 90º of bank. ROLL FIRST – THEN PULL. • High AOA maneuvering = RUDDER.[138] • Corner speed – high lift devices extended. 136 The Safety Board notes that, in December 1994, the FAA issued HBAT 94-17, “Pilot Training in Heavy Wake Vortex Turbulence: Awareness and Containment,” to address this issue. 137 The booklet described wake turbulence as a factor that had caused an increase in loss of control accidents and incidents. 138 The September 1, 1997, booklet deleted the word “maneuvering” and added the word “coordinated” before “rudder.” American Airlines made this change to address airplane manufacturers’ concerns about the company’s emphasis on the use of the rudder (see section 1.17.1.2.5).

Factual Information 85 Aircraft Accident Report The January 1, 1997, booklet contained the following aerodynamic information: The effectiveness of the rudder as a roll control will increase with increasing AOA. At the higher angles of attack, THE RUDDER becomes the most effective roll control. Smooth application of coordinated rudder[139] will improve roll response significantly at higher AOA. The January 1, 1997, booklet contained the following information about high AOA maneuvering demonstrated during AAMP simulator training: • Apply climb power • Maintain 15º to 30º deck angle • Respect the stick shaker (Fly in the PLI [pitch limit indication]) • Now roll alternately left and right to 40º of bank – MAINTAIN HIGH AOA • First, use only ailerons and spoilers – Note: Sluggish roll response – Developing sink rate • Second, use only rudder – (smoothly)[140] – Note: Improved roll response – Developing climb rate • Third, practice combination (both aileron & rudder) – Note: Optimum roll response In addition to the AAMP flight training booklet, American Airlines created a series of five AAMP videotapes, which presented the following subjects: unusual attitude recoveries, automation dependency, CFIT and mountain wave, control malfunctions and flight instrument anomalies, and microbursts. The videotapes on unusual attitude recoveries, automation dependency, and control malfunctions and flight instrument anomalies were distributed to company pilots for use in their personal libraries. The videotapes on CFIT and mountain wave and microbursts were not distributed to pilots, but information from these videos, as well as the other three videos, was presented during recurrent training. The videotape on unusual attitude recoveries was dated December 19, 1997, and was made during an actual AAMP training class that occurred during either March or April 1997. The class was attended by about 200 company pilots and was taught by the AAMP course developer. The unusual attitude recoveries videotape emphasized the 139 The vice president of training for Airbus North America customer services stated, during public hearing testimony, that the term “coordinated rudder” was “essentially to zero sideslip” and that this term would have been well understood by the airline pilot community. Similarly, American Airlines’ manager of simulation engineering stated at the public hearing that coordinated rudder was “flying the airplane without sideslip or yaw.” 140 The September 1, 1997, booklet added the words “note lead/lag [response times]” within the parentheses. This information was not in the booklet that the captain and the first officer received but was current at the time of the accident.

Factual Information 86 Aircraft Accident Report smooth application of rudder with small inputs for coordinated use and suggested avoiding, at high AOAs, large rudder inputs that would induce large sideslip angles. The videotape discussed information about lead and lag response times for the rudder and emphasized that a lack of understanding of the rudder could lead to overcontrolling the airplane. The videotape also demonstrated a high AOA control application in the simulator. The instructor on the videotape stated the following regarding recovery from unusually nose-high situations: Now some of you [pilots attending the AAMP training class] out there might say ‘well, I’m going to use a little coordinated rudder[141] to help the nose come down.’ Fine, that’s fine, that’s good technique. A little, OK, smoothly applied, I mean, understand right here: if you jam full right rudder, that’s the spin entry procedure, see? To address airplane manufacturers’ concerns about the company’s emphasis on the use of the rudder (see section 1.17.1.2.5), American Airlines included a segment at the end of the videotape that reinforced the proper use of the rudder. The segment repeated warnings about how powerful the rudder could be, reiterated that rudder-generated sideslip could lead to a loss of control, and reemphasized that the rudder must be applied in smooth, appropriate amounts. The A300 fleet standards manager indicated that, “AAMP always taught…the pilots to respect the power of the rudder.” His presentation at the public hearing included the following excerpts that were included in the December 1997 videotape: To complete this unusual attitude recovery procedure segment of the Advanced Aircraft Maneuvering Program, I’d like to briefly review the proper use of rudder at high angles of attack. As I stated in the aerodynamics segment, smooth application of small amounts of rudder, coordinated with the aileron, will significantly improve the roll response at high angles of attack. I’d like to emphasize that we have very large, powerful rudders on our aircraft. We do not want to introduce high sideslip angles at high angles of attack, by either kicking the rudder or applying the rudder in excess at high alpha. It only requires a small amount, smoothly applied for a coordinated rudder to achieve the desired result. This coordinated rudder will significantly improve the roll response at high angles of attack. At the public hearing, the vice president of training for Airbus North America customer services stated that he had previously reviewed this videotape and was concerned that it had defined coordinated rudder as “rudder in the direction of the roll.” The Airbus vice president also stated that he was concerned that the videotape taught procedures rather than awareness. The videotape on control malfunctions and flight instrument anomalies, dated March 1, 1999, also discussed the use of the rudder. The crossover AOA was presented to 141 The AAMP instructor specifically stated that the term “coordinated rudder” meant moving the control wheel and the rudder pedal in the same direction.

Factual Information 87 Aircraft Accident Report show that the rudder became more powerful than the aileron and spoilers at high AOAs. A Boeing test flight pilot demonstrated that forward yoke pressure on the control column would regain aileron and spoiler control over the rudder by reducing the AOA. 1.17.1.2.5 Comments on the Program In a May 22, 1997, letter to the chief test pilot at Airbus, an American Airlines A300 technical pilot indicated his concern that AAMP handout pages stated that “at higher angles of attack, the rudder becomes the primary roll control.” The technical pilot’s letter also expressed concern that “the program infers that aileron application in these situations is undesirable since it will create drag caused by spoiler deflection.” Further, the letter stated that the AAMP instructor had been teaching pilots to use the rudder to control roll in the event of a wake turbulence encounter. The American Airlines A300 technical pilot asked the Airbus chief test pilot for his thoughts on this subject and suggested a teleconference a few days later. In a May 23, 1997, facsimile, the chief test pilot stated that he shared the A300 technical pilot’s concern about the use of rudder at high AOAs and agreed to a teleconference to discuss the matter. In a June 13, 1997, internal letter to colleagues, the Airbus chief test pilot indicated that he had spoken with American Airlines. The letter detailed the chief test pilot’s general views regarding the use of the rudder at low airspeeds and the use of flight training simulators, which he had discussed during the teleconference. The letter stated that, although the rudder becomes more effective for roll control as airspeed is reduced, normal lateral control (aileron and spoilers) is effective down to the stall speed. The letter indicated Airbus’ recommendation to use the rudder as necessary to avoid sideslip but not as the primary source of roll. The letter also indicated that flight training simulators could not be expected to be accurate at the edges of the flight envelope and did not include dynamic maneuvers outside the normal flight envelope. In addition, the letter stated that simulators were “particularly inaccurate for large sideslip angles” and that a pilot might draw the wrong conclusion from maneuvers involving the use of rudder at low airspeeds. As stated in section 1.17.1.2.1, during the May 1997 AAMP Industry Conference, American Airlines’ chief pilot and vice president of flight requested feedback on the program from the Boeing Commercial Airplane Group, the Boeing Douglas Products Division, Airbus, and the FAA. In an August 20, 1997, letter, representatives from these organizations provided their joint response, indicating that the AAMP was already an “excellent” program and that the intent of the letter was to provide “additional and corrected technical information as well as the benefit of [the representatives’] experience in unusual areas of the flight envelope for training pilots in various airplane models.” The letter addressed six subject areas, including the use of rudder and airplane recovery from upsets. Regarding the use of rudder, the letter stated that “the excessive emphasis on the superior effectiveness of the rudder for roll control vis-à-vis aileron and spoilers, in high angle of attack, is a concern” and that a more appropriate standard would be to first use the full aileron control and, if the airplane is not responding, to then use rudder as necessary to obtain the desired airplane response. Also, the letter stated that sideslip angle was a

Factual Information 88 Aircraft Accident Report “crucial” parameter that needed to be discussed in the program because “it is probably not well understood by many line pilots but has a significant impact on an airplane’s stability and control.” Regarding airplane recovery from upsets, the letter indicated that, in a high AOA, nose-high upset, the wing should be unloaded first using down elevator and down stabilizer trim before roll is introduced.142 The letter stated that roll should only be introduced after exhausting the use of pitch axis controls and considering the reduction of thrust (on airplanes with wing-mounted engines). The letter further stated that “introducing roll angles at extremely high angles of attack creates sideslip” and that “sideslip introduced by rapid roll may result in departure from controlled flight.” In addition, the letter indicated that reducing thrust on wing-mounted engines is another way to assist a pilot in lowering an airplane’s nose. In a letter dated October 6, 1997,143 American Airlines’ chief pilot and vice president of flight responded to the letter from the representatives from the Boeing Commercial Airplane Group, the Boeing Douglas Products Division, Airbus, and the FAA. The chief pilot and vice president of flight explained that American Airlines does not advocate using “rudder first” or “rudder only.” Also, he pointed out that four different sections of the AAMP emphasized that, when an airplane is not responding to aileron and spoiler control, smooth application of coordinated rudder should be used to obtain the desired roll response. American Airlines’ chief pilot and vice president of flight also disagreed with the position taken in the representatives’ letter concerning airplane recovery from upsets, stating that company pilots “will not hesitate to roll the lift vector off the vertical [axis] to generate the required nose down pitch rate” if unloading with elevator does not result in an adequate nose-down pitch rate. He further stated, “any delay in initiating the roll (if required) could lead to a very tenuous situation.” In addition, he stated that American Airlines would not teach its pilots to use nose-down stabilizer trim as the next step after unloading because of the “significant risks associated with running stabilizer trim during an upset recovery” or to reduce thrust before rolling the lift vector off the vertical axis because it may be “counter-productive” for airplanes with wing-mounted engines. On February 6, 2003, American Airlines provided the Safety Board with a copy of a May 27, 1997, memorandum from the company’s managing director of flight operations technical to the company’s chief pilot and vice president of flight. The memorandum stated that the managing director of flight operations technical had “grave concerns about some flawed aerodynamic theory and flying techniques that have been presented in the AAMP.” The memorandum also stated that it was wrong and “exceptionally dangerous” 142 The AAMP recovery procedure at the time for this type of upset instructed the pilot to unload with forward yoke pressure toward zero G force and roll (limiting the bank angle to about 70º) toward the nearest horizon to lower the airplane nose. (The current procedure limits the bank angle to about 60º, as indicated in section 1.17.2.2.) 143 In a December 2, 2002, letter to the Safety Board, Airbus indicated that this letter from American Airlines was not received until January 20, 1998.

Factual Information 89 Aircraft Accident Report to teach pilots to use the rudder as the primary means of roll control in recoveries from high AOAs. The managing director of flight operations technical asked the chief pilot and vice president of flight to consider several points, including the following: • The use of excessive roll at high AOAs will cause a spin or a snap roll. • The rolling moment caused by rudder input is generated by sideslip, which is slow to take effect but then rapidly becomes uncontrollable, resulting in a spin, snap roll, or pilot-induced oscillation. • Yaw dampers remain active at high AOAs, with unpredictable and perhaps adverse consequences. • Transport-category airplanes are designed so that ailerons are effective at slow airspeeds and high AOAs. • The Boeing chief test pilot said that he “vehemently disagreed” with the aggressive use of rudder at high AOAs because “it is extremely dangerous and unpredictable.” The McDonnell Douglas chief test pilot expressed “serious concerns and disagreement” about the rudder theories presented in the AAMP. In addition, the memorandum stated that American Airlines was conducting high AOA training in simulators that did not accurately replicate the behavior of the airplane and was “very likely” to provide a false sense of confidence to pilots. The managing director of flight operations technical suggested that American Airlines take “immediate corrective action to change our training programs and advise our flight crews of the correct nature and danger of rudder inputs at high angles of attack.” 1.17.1.2.6 Training Simulator Study On December 4, 2002, members of the human performance group conducted a study in the American Airlines A310/300 training simulator to examine the AAMP excessive bank angle recovery exercise that the accident pilots completed.144 After receiving initial AAMP ground training and an AAMP simulator briefing,145 six pilots from the group performed the exercise multiple times using different pilot input strategies. The simulator instructor set up the exercise as a departure behind a 747 and initiated a roll event when the airplane was banked at an altitude between 2,000 and 2,500 feet and an airspeed of about 240 knots. The airplane exhibited an uncommanded roll in one direction (determined arbitrarily by the computer) followed immediately by a substantial uncommanded roll in the opposite direction. The simulator momentarily inhibited the airplane’s response to pilot roll and yaw inputs during the event to allow the 144 The training simulator study did not include any of the changes to the excessive bank angle recovery exercise that were introduced after the flight 587 accident. 145 During the briefing, the simulator instructor stated that the amount of bank generated during the exercise could be a function of the pilot’s response, a quick reaction might prevent an excessive amount of roll, and some coordinated rudder should be used during the recovery. This simulator instructor provided the accident first officer with his A300-600 upgrade training and his initial A300-600 recurrent training.

Factual Information 90 Aircraft Accident Report airplane to reach a substantial bank angle before recovery began. Each pilot was instructed to recover the airplane according to the method detailed in the AAMP ground training. This procedure was repeated five additional times for each pilot except that the roll maneuver was initiated during level flight after the pilot indicated his readiness. Also, the pilots were instructed to use each of the following five specific recovery methods: partial wheel and no rudder, full wheel and no rudder, full wheel and partial rudder, full wheel and full rudder, and the pilot’s preference. The first of the six trials had an upset initiation when the airplane was typically flying with a 20° left bank at an airspeed of 235 knots. All of the pilots responded with a full control wheel input (between 77° and 80°) supported by a rudder pedal input (ranging from 6.7° to 14.5° with an average of 10.8°). Five of the six pilots had essentially simultaneous rudder pedal and control wheel inputs. Three of the pilots recovered the airplane before it had reached a maximum bank angle of 90°, and the other three pilots recovered the airplane with a maximum bank angle between 108° and 114°. In post-trial comments, four of the pilots stated that they were surprised by the onset of the event. The four recovery methods used during the second through fifth trials showed little difference among the average maximum bank angle reached (between 104° and 107°), and none of the recoveries was achieved before the airplane reached a bank angle of 100°, even with the wide variation of the inputs made. Three of the six pilots reported that partial wheel and no rudder was the worst recovery method, and all six pilots questioned whether this method provided sufficient control authority to achieve recovery. Two of the pilots reported that a recovery with full wheel and full rudder was the worst method because of the possibility of overcontrol. Data from the fifth trial (full wheel and full rudder) suggested a discrepancy between the simulator and the airplane concerning compliance in the rudder control system.146 Specifically, at an airspeed of 240 knots, the maximum pedal travel on the A300-600 should be limited to 7.9°. When the pilots made full rudder inputs, the maximum pedal travel varied from 10.3° to 18.9°. Some of the pilots reported that they did not have a sensation of going past a pedal stop when making the full pedal inputs. During the last of the six trials (the pilot’s recovery method preference), most of the pilots responded with nearly full control wheel and partial rudder pedal inputs. Slightly less input was made on both controls than during the first trial, and the pedal response was typically delayed by at least 1 second after the control wheel response. On the basis of post-trial comments and pilot actions during the first and last trial, the pilots appeared to prefer a recovery strategy of full wheel and limited rudder in 146 Compliance in the rudder control system can result from several factors, but it is predominately the result of the cables stretching elastically when forces applied to the rudder pedal are in excess of the forces required to reach the pedal stop. According to American Airlines and Airbus, the compliance of the rudder control system in the simulator is mathematically computed rather than determined by actual cables.

Factual Information 91 Aircraft Accident Report response to the simulator exercise. Also, five of the six pilots indicated, at least once during the six trials, that there was a lack of flight control response during the initial upset. 1.17.1.2.7 Comparison of Rudder Pedal Responses in the A300-600 Airplane and the American Airlines A310/300 Training Simulator From January 31 to February 2, 2002, Safety Board investigators performed tests on an American Airlines A300-600 airplane at American’s maintenance facility in Tulsa. With the assistance of an American Airlines representative, the investigators measured rudder pedal limits at different airspeeds (30, 150, 165, 190, 220, 240, 250, 275, 310, and 335 knots), the travel of the control wheel, and the dimensions of the wheel. To measure the pedal limits, an investigator sat in the left cockpit seat and pushed the left pedal until the stop was contacted (normal force) while another investigator in the right cockpit seat recorded the actual pedal motion. The investigator in the left cockpit seat then pushed the left pedal as hard as he could (high force), and the actual pedal motion was again recorded. Safety Board investigators repeated these tests on April 23, 2003, in the American Airlines A310/300 training simulator. With the assistance of two American Airlines representatives, the investigators assessed how the portrayal of rudder pedal characteristics in the simulator compared with those of the actual A300-600 airplane. The investigators found that the rudder pedal motion in the simulator and the airplane produced by normal and high pilot input forces resulted in different pedal displacements despite the pedal travel limits, as shown in figure 18. The differences were attributed to the software representation of the elastic cable stretch in the simulator, which was less stiff than the cable stretch on the A300-600 airplane. Figure 18. Rudder Pedal Motion With Normal and High Pilot Pedal Force in the A300-600 Airplane and the American Airlines A310/300 Training Simulator 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 0 50 100 150 200 250 300 350 400 Airspeed, knots Pedal travel, inches A300-600--normal force Simulator--normal force A300-600--high force Simulator--high force

Factual Information 92 Aircraft Accident Report 1.17.1.3 Postaccident A300 Pilot Training In early 2003, the American Airlines A300 fleet standards manager and an A300 technical pilot provided classroom training to every company A300 pilot on the airplane’s rudder control system. The training covered vertical stabilizer side force characteristics, 14 CFR Part 25 certification, rudder travel limiter effects, rudder pedal force and displacement, and pilot input/yaw damper interaction.147 The training emphasized several points. First, certification standards do not account for a maneuver with alternating rudder inputs, even though such a maneuver may result in excessive loads on the vertical stabilizer. Second, as airspeed increases, the rudder pedals become more sensitive. Third, applying a rudder pedal force of 110 pounds or more will override any yaw damper input. Last, if pilot control inputs cause undesirable or unexpected airplane motion, the pilot should place the control in its neutral position until the airplane stabilizes. In addition, the A300 pilots were informed that the training presentation was available on the company’s pilot Web site and that they would be receiving additional training on the A300 rudder control system during recurrent training. 1.17.2 Flight and Operations Manuals 1.17.2.1 Use of Rudder American’s A300 Operating Manual, Land, page 3 (dated November 15, 2001), contained a reference to the use of alternating rudder inputs in the “L/G [Landing Gear] UNSAFE INDICATION” procedure when the landing gear handle is selected down. The procedure included the following note: If one gear remains unlocked, perform turns to increase load factor and perform alternating side slips in an attempt to lock the gear. Prior to performing any side slip maneuver, ensure all Flight Attendants and passengers are seated. On July 17, 2002, American Airlines issued A300 Operating Manual Bulletin number 300-1-141, “L/G [Landing Gear] UNSAFE INDICATION” procedure. The bulletin contained a warning not to perform the alternating sideslips described in the note for the procedure. The bulletin revised the note to state the following: If one gear remains unlocked, perform coordinated turns to increase load factor (not to exceed 45º of bank). Prior to performing the turns, ensure that all Flight Attendants and passengers are seated with seat belts fastened. 147 Training in these areas had been identified as weak or nonexistent.

Factual Information 93 Aircraft Accident Report American’s A300 Operating Manual, Flight Controls, page 8, dated September 8, 1999, indicated the following information under the heading “Yaw Control System/Rudder Control”: Two independent rudder travel limiting systems, controlled by the rudder travel feel and limitation computers, progressively decrease the maximum rudder travel from ± 30º below 165 knots (low speed range) to ± 3.5º above 310 knots (high speed range). American’s A300 Operating Manual, Abnormals/Flight Controls, page 6, dated March 26, 2001, contained procedures for a rudder travel fault, which included the following note: “use rudder with care above 170 knots to prevent overcontrolling with loss of rudder travel limiter.” 1.17.2.1.1 Manufacturer’s Information Airbus’ A300-600 FCOM volume 2, Procedures and Techniques, page 1, revision 25 (dated February 2001), contained one restriction on the use of rudder, which appeared in the procedures for a recovery from stall warning. The procedures stated that, if an airplane was out of a stall and no threat of ground contact existed, the pilot was to retract the landing gear (if extended), recover normal speed, and select the flaps as required. If one engine was inoperative, the pilot should “use with care” power and rudder. In March 2002, Airbus issued an A310/A300-600 FCOM bulletin that included, among other things, information about restrictions on rudder use. Section 1.18.4.1.2 provides details about the information in this bulletin. Airbus’ A300-600 FCOM, volume 2, Abnormal Procedures, page 5, revision 25 (dated February 2, 2001), included the following procedure for a “landing gear unsafe” indication if the landing gear is selected down: “If one gear remains unlocked, accelerate to VMAX [maximum selectable speed for landing gear extended], perform turns to increase the load factor and perform alternating side slips in an attempt to lock the gear.” Revision 26 (dated March 2002) added a note to the procedure. The note stated the following: Sideslip is used to generate aerodynamic loads on the landing gear structure to force the downlock into position. The sideslip should be initiated using the rudder on the same side of the aircraft as the unsafe gear indication, i.e., if the right main landing gear is unlocked, slowly apply right rudder up to full deflection if necessary while maintaining wings level to generate sideslip. If the gear still fails to lock, then slowly return the rudder to neutral, allow the airplane to stabilize, and then slowly apply opposite rudder. If necessary, repeat this cycle in an attempt to lock the gear. Airbus’ A300-600 FCOM contained one reference before the accident to the reduction in rudder pedal travel at higher airspeeds. The reference appeared in volume 1 in the Flight Controls/Yaw Control section, page 1, and stated “the rudder travel limiter

Factual Information 94 Aircraft Accident Report reduces the pedals and rudder deflection from ± 30º at speeds below 165 kt [knots] to ±3.5º at 310 kt and above.”148 1.17.2.2 Unusual Attitude Recovery American Airlines’ A300 Operating Manual, Maneuvers, discussed unusual attitude recognition and recovery. Page 12, dated November 15, 1997, stated the following procedure for a nose-high recovery: • Unload with forward yoke pressure toward “0” g force. • Roll the airplane toward the nearest horizon – limit bank angle to approximately 60º. • Increase thrust in most nose high recoveries. • As airplane symbol approaches the horizon, make a coordinated roll to wings level with a slight nose down attitude. • Adjust airspeed, thrust, and pitch as necessary. On March 8, 2002, American Airlines issued A300 Operating Manual Bulletin number 300-1-137, “Upset Recovery/Unusual Attitudes.” The information contained in the bulletin provided piloting techniques, maneuvers, and guidelines for recovery from an upset/unusual attitude, as recommended by Airbus, and replaced the unusual attitude information dated November 1997. The bulletin included the following procedure for a nose-high recovery: Pilot-Flying and Pilot-Not-Flying • Recognize and confirm the situation. Pilot-Flying • Apply nose-down elevator up to full deflection. • Apply nose-down trim as appropriate. • Reduce thrust (altitude permitting). • Roll to obtain a nose down pitch rate (if necessary). • Complete the recovery: • When approaching the nearest horizon, roll to wings level. • Check airspeed and adjust thrust. • Establish pitch attitude. Pilot-Not-Flying • Call out attitude, airspeed, and altitude throughout the recovery. • Verify all required actions have been completed and call out any omissions. 148 This FCOM information was not correctly cited. The rudder deflection is limited to 3.5° at 390 knots rather than 310 knots, and the rudder deflection is limited to 5° at 310 knots (as stated in section 1.6.2). According to Airbus, the FCOM has been corrected.

Factual Information 95 Aircraft Accident Report 1.17.2.2.1 Manufacturer’s Information Airbus’ A300-600 FCOM, volume 2, Procedures and Techniques, page 2 (dated February 2002), stated the following lateral and directional control information: Unusually large amounts of aileron and spoiler input may be required to recover from an upset. If during this upset, the angle of attack increases beyond a certain value (stick shaker and buffeting), then the airflow over the wing separates and the efficiency of ailerons and spoilers decreases. Since the rudder is rarely aerodynamically stalled, it is still possible to generate induced roll rate using the rudder. CAUTION: At high angle of attack, pilots must be extremely careful when using the rudder for assisting lateral control. Excessive rudder can cause excessive sideslip, which could lead to departure from controlled flight. Page 3 of the Procedures and Techniques section of the FCOM included the following information regarding recovery techniques from a high bank angle: Though the bank angle for an upset has been defined as unintentionally more than 45 degrees, it is possible to experience bank angles greater than 90 degrees. A smooth application of up to full lateral control should provide enough roll control to establish a very positive recovery roll rate. If full roll control application is not satisfactory, it may then be necessary to apply some rudder in the direction of the desired roll. CAUTION: Only a small amount of rudder is needed. Too much rudder applied too quickly or held too long may result in loss of lateral and directional control or structural failure. In addition, page 4 of the Procedures and Techniques section of the FCOM contained the nose-high recovery procedures that American Airlines included in its Upset Recovery/Unusual Attitudes A300 Operating Manual Bulletin issued in March 2002 (see section 1.17.2.2). 1.17.2.2.2 Airplane Upset Recovery Training Aid In June 1996, the Air Transport Association proposed that, in response to increasing Safety Board interest in loss of control airplane accidents (including the September 1994 accident involving USAir flight 427), a joint industry working group be formed to produce a training aid for airplane upset recovery. The working group consisted of representatives from airplane manufacturers (Boeing, Airbus, and McDonnell Douglas), airlines (including American Airlines, United Airlines, and Delta Air Lines, which were already using upset recovery programs in simulator training), the FAA, and pilots’ unions. The effort was the first time that the three airplane manufacturers worked together on technical, noncommercial issues.

Factual Information 96 Aircraft Accident Report In public hearing testimony, the vice president of training for Airbus North America customer services indicated that the manufacturers wanted upset training to be developed as awareness training because of the infinite number of variables that could be experienced. The Airbus vice president also stated that many of the carriers wanted to develop upset training procedures that could be adapted to all of their fleets. The joint industry Airplane Upset Recovery Training Aid was distributed to operators in August 1998. The training aid, which included a workbook, videotape, and CD-ROM, was aimed at preventing loss of control accidents on large, swept-wing airplanes. The training aid provided information for air carrier pilots and managers on jet aerodynamics, stability, control, and upset recovery and a model curriculum for classroom and flight simulator training in unusual attitude recovery. The training aid defined an upset as an airplane in flight that “unintentionally exceeds the parameters normally experienced in line operations or training.” The parameters were a pitch attitude greater than 25º airplane nose up or 10º airplane nose down and a bank angle greater than 45º. The training aid also defined an upset as an airplane in flight that was “within the above parameters but flying at airspeeds inappropriate for these conditions.” The Airbus vice president of training indicated that the Airplane Upset Recovery Training Aid was intended to be a stand-alone document, as with previous joint industry training products, such as the Controlled Flight Into Terrain Training Aid and the Wake Turbulence Training Aid. He also indicated that each operator could decide how to use the information in the training package and that there could thus be differences among operators regarding upset training. The Airbus vice president for training further indicated that consideration was given to adopting one of the airlines’ existing upset training programs as the joint industry training aid. He stated that, even though the programs had good points that would be included in the industry training aid, the idea of including the programs in their entirety was rejected because the manufacturers had concerns in some areas. For example, the Airbus vice president indicated that the manufacturers were concerned about the AAMP’s emphasis on rudder and utilization of simulation. Airbus did not initially favor the use of simulators for upset recovery training because the forces that a pilot would experience in terms of increased weight or G loading, both vertically and laterally, could not be duplicated in a simulator. Also, Airbus was concerned about simulator fidelity and the “high possibility” of negative training149 if simulator training were not conducted properly.150 149 Negative training is a situation in which training leads to less effective performance in the operational environment than would have occurred if no training had been conducted. 150 The Airbus vice president indicated that there could be some value to simulator training if the simulator is properly tuned, instructors are properly qualified, and parameters are tightly maintained so that the training a pilot receives is valid. He further stated that, because of the risk that a pilot would not receive valid training, and considering that the Airplane Upset Recovery Training Aid is for awareness education and is not a procedure-based initiative, other tools are probably more appropriate than simulators to teach upset training.

Factual Information 97 Aircraft Accident Report The joint industry Airplane Upset Recovery Training Aid was also distributed to the participants at Airbus’ 10th Performance and Operations Conference,151 which was held in San Francisco, California, from September 28 to October 2, 1998. At the conference, the chief test pilot in Airbus’ flight division presented a paper on the Airplane Upset Recovery Training Aid. The Airbus chief test pilot stated that, from the beginning of the working group’s efforts, a conflict existed between the technical advice provided by the manufacturers’ training pilots and the views expressed by the airlines that were already practicing upset training. As a result, the chief flight test pilots from Airbus, Boeing, and McDonnell Douglas became members of the working group. The Airbus chief test pilot indicated that the three test pilots, despite different backgrounds and work experiences, did not disagree with each other’s technical advice but that the disagreement between the airplane manufacturers and the airlines regarding airplane handling and recovery techniques continued until January 1998. Two of the areas in which the airplane manufacturers and the airlines had differing opinions were the use of rudder and the use of simulators. Regarding the use of rudder, the Airbus chief test pilot indicated that the existing upset recovery simulator training courses emphasized using rudder for roll control at low airspeeds. He stated that, although the rudder remained effective down to very low airspeeds, the airplane manufacturer test pilots were “very wary” of using rudder close to stall speed.152 According to the Airbus chief test pilot, the airplane manufacturers were able to convince the airline training managers to deemphasize the use of the rudder in their existing courses. The airplane manufacturer test pilots advocated that aileron inputs could be assisted, if necessary, by coordinated rudder in the direction of the desired roll. They also cautioned, “excessive rudder can cause excessive sideslip, which could lead to departure from controlled flight.” Regarding the use of simulators, the Airbus chief test pilot indicated that the airplane manufacturers were concerned about the types of maneuvers that were being flown in simulators and the conclusions that were being drawn from them. Specifically, the airplane manufacturers were concerned that the airline training managers were developing handling techniques that were outside of the simulator’s guaranteed domain. The airplane manufacturers believed that simulator upset training should be confined to an airplane’s normal flight envelope and that the training should stop at the stall warning. American Airlines’ A300 fleet standards manager stated, in public hearing testimony on this accident, that American was “a little surprised” at some of the comments 151 All Airbus operators are invited to attend the Performance and Operations Conferences. 152 The Airbus chief test pilot indicated that fighter pilots are accustomed to using the rudder for evasive maneuvers when flying not far from stall speed but that large airplanes are not similar to fighter airplanes.

Factual Information 98 Aircraft Accident Report made by the Airbus chief test pilot and did not think that his comments reflected what American was teaching in the AAMP. For example: • The Airbus chief test pilot indicated that “the thrust effects of underwing-mounted engines were being ignored, whereas it has a significant influence on recovery.” American’s presentation at the public hearing indicated that the AAMP flight training booklet states, “the thrust vector effect on all AA [American Airlines] fleet aircraft is significant. The low-mounted engines on the B-757/767 & A-300 fleets add a powerful moment to the pitch axis. The DC-10 & MD-11 can also produce a very significant pitch moment.” • The Airbus chief test pilot stated that “the training being given in the airlines at the time to recover from excessive nose-up pitch attitudes emphasized rolling rapidly towards 90º of bank.” American’s presentation at the public hearing indicated that “AAMP taught pilots to roll the aircraft only if pushing the yoke forward does not lower the pitch attitude. It also noted the danger of loss of control caused by an overly aggressive roll.” According to the vice president of training for Airbus North America customer services, the Airplane Upset Recovery Training Aid was being revised to address, among other things, the issues discussed in the Safety Board’s Safety Recommendations A-02-01 and -02 (see section 1.18.4.1). On August 5 and 6, 2003, representatives from airlines (including American), aircraft manufacturers (including Airbus), the FAA, the Safety Board, the Air Line Pilots Association, and private companies with an interest in upset training attended a conference to review and provide comments on a draft, dated April 28, 2003, of the revised training aid. The conference participants received another draft of the revised training aid, dated May 19, 2004, for final review. On August 6, 2004, the revised training aid was issued. As a result of the flight 587 accident, the training aid now includes the following language: It is important to guard against control reversals. There is no situation that will require rapid full-scale control deflections from one side to the other. The rudders on modern jet transport airplanes are sized to counter the yawing moment associated with an engine failure at very low takeoff speeds and to ensure yaw control throughout the flight envelope, using up to maximum pedal input. This very powerful rudder is also capable of generating large sideslips. An inappropriate rudder input can produce a large sideslip angle, which will generate a large rolling moment that requires significant lateral control input to stop the airplane from rolling. The rudder should not normally be used to induce roll through sideslip because the transient sideslip can induce very rapid roll rates with significant time delay. The combination of rapid roll rates and time delay can startle the pilot, which in turn can cause the pilot to overreact in the opposite direction. The overreaction can induce abrupt yawing moments and violent out of phase roll rates, which can lead to successive cyclic rudder deflections, known as rudder reversals. Large aggressive control reversals can lead to loads that can exceed structural design limits.

Factual Information 99 Aircraft Accident Report From a structural capability standpoint, the pilot does not have to be concerned about how fast or how hard to push the rudder pedal in one direction (from zero to full available pedal deflection) throughout the normal flight envelope. However, it is important to emphasize that limiters do not protect against the structural loads or excessive sideslip angles that can be generated from rapid full deflection flight control reversals. In most cases effective situational awareness will avoid an upset from developing in the first place. However, it is important that the first actions for recovering from an airplane upset be correct and timely. Exaggerated control inputs through reflex responses must be avoided. It is worth repeating that inappropriate control inputs during one upset recovery can lead to a different upset situation. 1.17.2.3 Design Maneuvering Speed American’s A300 Operating Manual at the time of the accident contained only one reference to VA. This reference appeared along with the following information about the turbulence penetration speed: “Turbulence Penetration Speed—VA (AFM)[153], 270 knots/.78 Mach, whichever is lower.” 1.17.2.3.1 Manufacturer’s Information The Airbus A300-600 AFM, Limitations, page 1, dated February 3, 1988, contained a table under the heading “Airspeeds.” Under the table heading “Conditions,” the following text appeared: “Full application of rudder and aileron controls, as well as maneuvers that involve angles of attack near the stall, should be confined to speeds below VA.” Under the table heading “Airspeeds,” a graph showed the relationship of Mach 0.78 (VA) to airspeed and altitude. The Airbus A300 AFM was not distributed to line pilots. The vice president of training for Airbus North America customer services testified at the public hearing that VA was a design speed and not an operational speed. 1.17.3 Federal Aviation Administration Oversight The FAA’s certificate management office (CMO) for the AMR Corporation (which owns American) is located in Dallas. At the time of the accident, the CMO organizational staffing consisted of 84 positions, 2 of which were temporary and 10 of which were vacant. Within the CMO were certificate management units for American Airlines and for American Eagle. At the time of the accident, staffing for the certificate management unit for American Airlines consisted of 53 positions, including 1 temporary position and 8 vacant positions. The American Airlines POI was responsible for supervising 25 inspectors, including the A300 aircrew program manager (APM). The POI was also responsible for directing the work of eight geographic inspectors located at remote work sites. 153 AFM is the abbreviation for airplane flight manual.

Factual Information 100 Aircraft Accident Report The FAA indicated that oversight of the AAMP is performed two ways. First, each inspector receives AAMP ground and simulator training when the inspector undergoes initial and recurrent training. Second, the A300 APM and assistant APM monitor the AAMP during ground instruction observations and initial and recurrent training observations of check airmen and designated pilot examiners. In March 2002, the American Airlines POI and A300 APM reviewed the AAMP ground and simulator portions of the A300 training program. According to the FAA, the training the POI and APM observed matched the descriptions in the approved training program curriculum. 1.17.3.1 National Simulator Program The FAA’s National Simulator Program (NSP) helps to ensure that a simulator is properly programmed to replicate the respective airplane for flight crew training programs approved by the POI. Two ACs that detail the process for evaluating and qualifying simulators are AC 121-14, “Airplane Simulator and Visual Systems Evaluation,” and AC 120-40, “Airplane Simulator Qualification.” According to the ACs, the simulator evaluation process includes an objective evaluation and a subjective evaluation. During an objective evaluation, the actual instrumentation and controls in the flight simulator are examined, and the flight simulators are tested to ensure that they perform and respond in the same manner as the aircraft being simulated (within certain specific performance tolerances). The tests described in the ACs can be replicated in a simulator because they have been accomplished in the actual aircraft during flight. The data from these flights are the data to which the simulator performance must be matched (within the published tolerances). During a subjective evaluation, the simulator is compared with the aircraft in a much broader operational envelope that more closely represents normal flight operations. According to the FAA, the NSP does not place limits on the aerodynamic parameters beyond which the simulator is not qualified to represent the real aircraft. The unusual flight attitudes (that is, extreme pitch and roll angles) that are demonstrated during selected event training (including AAMP simulator training) are not contained in the ACs for simulator qualification. Because the aircraft manufacturers provided no flight test data to validate these maneuvers, the NSP was not able to ensure that the simulators were properly programmed to replicate the manufacturers’ respective airplanes throughout these maneuvers. HBAT 95-10 states that each operator is responsible for reviewing its simulator capabilities to ensure that the simulators used to perform selected event training maneuvers have the ability to accurately support the inclusion of those maneuvers in an approved training program. The NSP conducts annual recurrent evaluations of simulators in accordance with the requirements of the applicable AC. The last NSP annual recurrent evaluation of the American Airlines A300 simulator before the accident was on September 7, 2001.154 154 American Airlines performs secondary evaluations 6 months after an NSP evaluation. The APMs regularly attend these evaluation sessions. The A300 simulator received a secondary evaluation on January 9, 2002, and none of the findings related to the circumstances of this accident.

Factual Information 101 Aircraft Accident Report 1.18 Additional Information 1.18.1 Flight 587 Witness Information Several pilots witnessed the flight 587 accident. The captain of Northwest Airlines flight 1867, which was in line to take off from runway 31L at JFK, saw pieces falling from the flight 587 airplane and then saw the airplane enter a nose dive and crash. The Northwest Airlines first officer indicated that the airplane’s wings appeared to be intact and that the airplane appeared to be rolling to the left and diving. The first officer also indicated that no fire was visible but that traces of smoke were visible. Jet Blue flight 41 was holding short of runway 31L while Northwest Airlines flight 1867 was awaiting takeoff clearance. The Jet Blue captain observed an airplane that was out of control in a left bank position and then in a near-vertical descent. The captain also observed the airplane rolling back and forth while in a nose-down position and a fire in the right wing area. The captain stated that the airplane impacted the ground with a deep orange fireball that was about twice the length of the fuselage and that dark smoke from the fire turned to light smoke about 10 minutes later. The Jet Blue first officer observed an airplane in a “vertical rocking nose-down position.” The first officer also observed a smoke trail and, about 4 seconds before airplane impact, an orange ball of flame (about the size of an engine) in the middle of the airplane. The first officer stated that, after airplane impact, a large fireball with bright orange flames and black smoke was visible. He also stated that the weather was clear with no bird activity visible. Jet Blue flight 79 was holding short of runway 31L waiting for takeoff clearance. The captain of that flight observed an airplane spinning and spiraling in a downward direction. The captain also observed a silver-colored object falling (but not as fast as the airplane) and described the object to be of a size between an engine and a tail. The captain stated that, as the airplane descended, a whitish-gray smoke cloud enveloped the airplane. The captain also stated that the airplane appeared to be intact when it impacted the ground and that, about 1/2 second after impact, an orange-yellow flame was visible, which was followed by gray smoke. The Jet Blue first officer of this flight observed an airplane rolling to the left at a 90º bank and falling. The first officer also observed, about 3 seconds before airplane impact, a fireball (yellow to white in color and the size of an engine) behind the wing. The first officer further observed a flying object tumbling through the air near the airplane, and he stated that the object could have been the horizontal stabilizer. The first officer also stated that the airplane appeared to be intact when it impacted the ground at an 85º to a 90º angle and that the airplane exploded instantly, with black smoke and orange flames visible. In addition to the pilot witnesses, about 400 witnesses and potential witnesses155 to this accident were identified through information collected by the Safety Board; the Federal Bureau of Investigation (FBI); the Port Authority of New York and New Jersey 155 A witness was considered to be an individual who reported observing the accident airplane in flight and was able and willing to provide information regarding the observation.

Factual Information 102 Aircraft Accident Report Police Department; and the Rockaway, New York, Police Department. The level of detail provided by the witnesses varied significantly. Some witnesses provided specific details, whereas the only information provided by other witnesses was that they observed an airplane crash. To give the witnesses an opportunity to provide the Safety Board with a first-hand account of their observations, 355 questionnaires were mailed between November 21, 2001, and January 9, 2002. (Of the 355 questionnaires, 18 were returned to the Board as undeliverable.) In the questionnaire, the witnesses were asked to provide a written statement that indicated where they were located and what they observed and/or heard. The questionnaire also asked the witnesses to discuss the direction the airplane was traveling, any parts that might have separated or fallen from the airplane, any indications of smoke or fire coming from the airplane, the duration of their observation, and their final view of the airplane. The Board also established an Internet e-mail address on its Web site for witnesses to the accident who had not been in contact with Board personnel. Six categories were established to document and track the reported witness observations: sources of witness information, reports of in-flight fire, reports of in-flight smoke, reported sounds while the airplane was in flight, observed movements while the airplane was in flight, and reports of in-flight airframe/component separations. After all of the witness information was received, the Safety Board determined that a total of 354 witnesses had provided sufficient detail to document. Of the 354 witnesses, 138 (39 percent)156 provided written accounts to the Board, and 66 (19 percent) participated in interviews with Board personnel. Also, the FBI provided the Board with interview summaries for 141 witnesses (40 percent), and the Port Authority and Rockaway Police Departments provided the Board with information for 224 witnesses (63 percent).157 The Board’s review of this information revealed the following regarding the witnesses’ observations: • Fire: 198 witnesses (56 percent) reported observing the airplane or a portion of the airplane on fire at some point during their observation. The most frequent response specified as the location of the fire was the fuselage. • Smoke: 82 witnesses (23 percent) reported that they observed smoke emanating from the airplane at some point during their observation. The two most frequent responses specified as the location of the smoke were smoke involving a miscellaneous area and smoke involving the fuselage. • Noise: 176 witnesses (50 percent) reported a sound or sounds associated with the airplane during their observation. • Motion: 279 witnesses (79 percent) reported seeing downward motion of the airplane, and 69 witnesses reported seeing spinning, corkscrewing, or cartwheeling motion. Also, 67 witnesses (19 percent) saw the airplane in a left bank or turn, and 27 witnesses (8 percent) saw the airplane in a right bank or 156 Percentages in this section have been rounded to the nearest whole number. 157 Some witnesses provided information about the flight 587 accident to more than one organization.

Factual Information 103 Aircraft Accident Report turn. In addition, 29 witnesses (8 percent) saw the airplane climb, and 47 witnesses (13 percent) described the airplane’s motion as wobbling, dipping, or rocking in a left-right motion. • Parts separation: 225 witnesses (64 percent) reported that they saw something separate or fall from the airplane at some point during their observation. Of these 225 witnesses, 126 indicated that they had seen a miscellaneous part or object fall from the airplane, 39 saw a part separate from the vertical stabilizer, 37 saw a part separate from the left engine, and 26 saw a part separate from the right engine. 1.18.2 Airbus Vertical Stabilizers That Reached High Loads In addition to the flight 587 airplane, another A300-600 airplane and an A310 airplane had vertical stabilizers that exceeded ultimate load during in-service events. The event involving the A300-600 airplane was American Airlines flight 903 in May 1997 (see section 1.18.2.1), and the event involving the A310 was a flight by the German airline Interflug in February 1991 (see section 1.18.2.2). Table 7 shows information for these events and for other A300-600 and A310 vertical stabilizer high loading in-service events. The Safety Board compared the number of A300-600 and A310 vertical stabilizer high loading events with those for Airbus’ other airplane models. As shown in table 8, the A300-600 and A310 airplanes each experienced three high loading events in which rudder pedal use was involved. Table 8 also shows that the A300B2/B4, which has a comparable number of flight hours as the A310 and more flight hours than the A300-600, experienced no high loading events and that no later-model Airbus airplanes experienced similar events.158 158 Although the A340 has experienced two high loading events, neither event showed any evidence of rudder pedal use. One event, which involved turbulence, reached a limit load of 1.04; the other event, which involved the loss of the air data computer, reached a limit load of 1.17.

Factual Information 104 Aircraft Accident Report Table 7. A300-600 and A310 Vertical Stabilizer High Loading Events Date Category Speed (knots) Configuration Description Crew rudder input Alternating rudder inputs Side loads (Gs) Limit load (1.0) Inspection information A300-600 Airplanes 11/01 Operation 250 Clean Successive alternating rudder inputs Yes Yes 0.38 1.83 to 2.14 Flight 587 accident airplane 5/97 Operation 190 to 230 Clean Stall; loss of control; several alternating rudder inputs Yes Yes 0.55 and 0.7 1.53 Inspection on 3/11/02. Local damage at rear RHS attachment found. 5/99 System malfunction 180 to 190 Slats extended Rudder oscillations during go-around at A/P disconnect No No 0.32 1.16 Inspection on 3/13/02. No findings. 5/89 Operation 250 Clean Rudder jerk Yes Yes 0.38 1.11 Inspection on 3/16/02. No findings. A310 Airplanes 2/91 Operation 50 to 300 15º slats and 0º flaps Missed approach; three successive stalls; loss of control with repetitive rudder movements Yes Yes 0.36 and 0.69 1.55 and 1.35 Inspection on 4/3/02. No findings.

Factual Information 105 Aircraft Accident Report Source: Airbus Note: American Airlines flight 587 (November 2001), American Airlines flight 903 (May 1997), and the Interflug flight (February 1991) are shown in bold print. Limit load compares the bending moment for the event with the discrete tuned gust condition at the time of certification. The data are estimates based on Airbus’ linear loads model. The loads were calculated in early 2002 and are shown for the A300-600 and A310 airplanes in order of severity (most to least). RHS, right horizontal stabilizer; A/P, autopilot. A “clean” configuration indicates that the flaps, slats, and landing gear have all been retracted. Date Category Speed (knots) Configuration Description Crew rudder input Alternating rudder inputs Side loads (Gs) Limit load (1.0) Inspection information A310 Airplanes 9/94 Operation 190 to 225 15º slats and 15º flaps Missed approach and stall Yes No 0.37 1.12 Inspection on 3/26/02. No findings. 11/99 System malfunction 275 Clean Rudder trim runaway with A/P engaged; lateral upset at A/P disconnect Yes Yes 0.49 1.06 Inspection on 3/28/02. No findings.

Factual Information 106 Aircraft Accident Report Table 8. Airbus Service History of Vertical Stabilizer High Loading Events Source: Airbus Note: The number of flight hours were as of February 2004. In addition, a Boeing representative stated that his company maintained records of significant in-flight events, as reported by airlines, involving Boeing- and McDonnell Douglas-designed airplanes. According to the representative, Boeing was not aware of any events involving the company’s products in which a vertical stabilizer experienced an in-flight maneuver or a gust greater than limit load. 1.18.2.1 1997 American Airlines Flight 903 Accident On May 12, 1997, American Airlines flight 903, an Airbus A300-600, N90070, experienced an in-flight loss of control near West Palm Beach, Florida. Of the 2 flight crewmembers, 7 flight attendants, and 156 passengers aboard the airplane, 1 passenger sustained serious injuries and 1 flight attendant received minor injuries during the upset. The airplane sustained minor damage. The flight was assigned an airspeed of 230 knots and was cleared to descend from 24,000 to 16,000 feet in preparation for landing at MIA. The FDR indicated that, while the autopilot was engaged in the descent, the power levers moved from the mechanical autothrottle limit of 44º to the manual limit of 37º. As the airplane leveled off at 16,000 feet, its airspeed decreased. The pilot began a right turn to enter a holding pattern and added some power, which stabilized the airspeed at 178 knots. However, the right bank and the resultant AOA were increasing, despite left aileron input by the autopilot. The airplane’s bank angle increased past 50º, and the AOA increased rapidly from 7º to 12º. At this point, the stickshaker activated, the autopilot independently disconnected, and the pilot increased power and used full left rudder to arrest the roll. The bank angle reached 56º, and the AOA reached 13.7º at 177 knots. The airplane then pitched down and entered a series of pitch, yaw, and roll maneuvers as the flight controls Airplane model Number of events exceeding limit load Number of events involving rudder pedal input Number of flight hours of fleet worldwide A300B2/B4 0 0 9,765,529 A310 3 3 9,552,784 A300-600 4 3 6,694,865 A320 0 0 32,720,365 A330 0 0 4,210,781 A340 2 0 6,059,301

Factual Information 107 Aircraft Accident Report oscillated for about 34 seconds. The maneuvers eventually dampened, and the flight crew recovered the airplane at an altitude of about 13,000 feet. The Safety Board determined that the probable cause of this accident was the flight crew’s failure to maintain adequate airspeed during level-off, which led to an inadvertent stall, and its subsequent failure to use proper stall recovery techniques. Contributing to the cause of the accident was the flight crew’s failure to properly use the autothrottle. Airbus indicated that the bending moment on the flight 903 airplane’s vertical stabilizer reached 1.53 times that defined by the lateral gust limit load condition when the first fully recorded alternating rudder input occurred. The high loading was the result of a 5º overtravel of the rudder. Subsequent alternating rudder inputs were not recorded on the FDR but were estimated to have produced loads beyond ultimate load. At the public hearing on the flight 587 accident, the Airbus loads and dynamics manager stated that, at the time of the flight 903 event, Airbus assessed the loads level using “engineering judgment” that accounted for the movement of the airplane and the rudder deflections but did not perform a loads evaluation. The Airbus manager further stated that the early 2002 loads calculations (shown in table 8) confirmed the results of the 1997 assessment. 1.18.2.1.1 Flight 903 Postaccident Actions In a June 12, 1997, facsimile, Daimler-Benz Aerospace, which assessed the lateral loads on the flight 903 airplane, urgently recommended that Airbus inspect the vertical stabilizer and its attachments, the rudder and its attachments, the rear fuselage, and the horizontal stabilizer attachments because they could have encountered loads that exceeded the design limit loads for the A300-600. A June 19, 1997, internal Airbus memorandum indicated that Airbus’ analysis of the FDR data confirmed high longitudinal and lateral load factors. The memorandum also indicated that design limit loads were apparently exceeded in some areas of the airplane and that ultimate design loads could have been reached in some other areas, including the vertical stabilizer. Further, the memorandum stated that a close inspection of the airplane was needed as soon as possible. That same day, Airbus informed American Airlines, via e-mail, that some areas of the airplane, particularly the aft part, had sustained very high loads and that the loads required that the airplane be “deeply inspected.” Airbus requested that American send the details and the findings of the airplane inspections already performed. (American had conducted inspections of the airplane at MIA after the event.) In a June 20, 1997, facsimile, American Airlines provided Airbus with details on the inspections that were performed. According to Airbus, American’s inspection report indicated that all inspections of the vertical stabilizer elements were “OK” and that the airplane had sheared fasteners, deformed nacelles, and engine component damage. That same day, an internal Airbus memorandum indicated that, on the basis of the inspection results, Airbus had no reason to recommend grounding the airplane. The memorandum also indicated that American Airlines would perform additional inspections no later than the airplane’s next A check.

Factual Information 108 Aircraft Accident Report On June 24 and 25, 1997, Airbus provided American with a list of inspection tasks to be performed on the airplane and indicated that it wanted to receive information on the inspection results. On June 27, 1997, American forwarded Airbus the results of the additional inspections tasks. According to Airbus, the inspection report noted some damage to the wing areas and engine nacelles but no damage on the vertical stabilizer or fittings. A June 30, 1997, internal Airbus memorandum indicated that American had conducted the inspections with an airline structural engineer present and that no findings resulted from the inspections. On March 11, 2002, the vertical stabilizer on the airplane was inspected for damage at American Airlines’ maintenance facility in Tulsa. As stated in section 1.16.4.2 and in table 7, this nondestructive inspection revealed delamination damage (ply separation) on the right rear main attachment fitting. The delamination area was connected to the lughole surface, but this area is not normally visible unless the attachment pin has been removed. After the inspection, American removed the vertical stabilizer from service, and the left and right rear main attachment fittings were tested at Airbus’ Hamburg facility (see section 1.16.4.2). 1.18.2.2 1991 Interflug Incident On February 11, 1991, an Airbus A310 operated by the German airline Interflug experienced an in-flight loss of control during a missed approach to runway 25L at Sheremetyevo Airport in Moscow, Russia. None of the 9 crewmembers and 100 passengers was injured. The flight, which had departed from Schonefeld Airport in Berlin, Germany, was uneventful until the airplane was at an altitude of 1,550 feet. At that point, ATC instructed the pilots to go around because of a blocked runway. The pilots initiated the go-around maneuver with the autopilot engaged at an altitude of 1,275 feet. Afterward, the airplane entered an extreme pitch angle, which resulted in a severe loss of speed and, at an altitude of 4,000 feet, a breakdown of airflow over the wing and a subsequent stall. The airplane descended to 1,700 feet, at which point the pilots used full engine power to make a steep climb. The airplane subsequently stalled three more times. After several minutes, the pilots stabilized the airplane at 11,000 feet. The pilots landed the airplane manually. The probable cause of this incident was movement of the control column by the pilot while the airplane was flying in go-around mode under AFS authority. The crew was not informed about AFS behavior at this stage of the flight.159 According to FDR data (provided to the Safety Board after the flight 587 accident), the Interflug pilot made alternating rudder inputs of about one-third of the full pedal deflection. The speed of the airplane varied during this time. When the airplane 159 Report on the Investigation of the Abnormal Behaviour of an Airbus A310-304 Aircraft on 11.02.1991 at Moscow, Air Accident Investigation Department at the German Federal Office of Aviation, Reference 6X002-0/91.

Factual Information 109 Aircraft Accident Report reached high speed, the pedal inputs resulted in ultimate loads on the vertical stabilizer, but the same pedal inputs at low speed did not result in high loads on the vertical stabilizer. 1.18.2.3 2002 American Airlines Incident On October 28, 2002, American Airlines flight 934, an A300-600, was en route from Guayaquil, Ecuador, to MIA. When the airplane was at an altitude of 31,000 feet and an airspeed of 290 knots, the pilots requested a deviation around clouds south of Panama. The first officer stated that he wanted to see the winds indicated on the airplane’s inertial reference system display. When the first officer reached up to select the wind mode on the display, he inadvertently kicked the left rudder pedal with his left foot and disconnected the autopilot. The captain (the flying pilot) reported that he felt a violent tail shift from the left to the right followed instantly by the autopilot disconnect and warning chime. Less than 1 second later, the airplane began to climb slowly and bank 25º to the right. The airplane then entered a Dutch roll. In a postincident interview, the captain stated that he moved his feet onto the rudder pedals and his hands onto the control wheel. The captain also stated that he input some right rudder because he thought the airplane was “skidding” and that, while holding right rudder, he neutralized the ailerons after rolling wings level to deal with the Dutch roll. The captain further stated that he asked the first officer to check whether the yaw dampers were engaged because the captain thought that might have been the cause of the rudder problems. (The yaw dampers were engaged.) In addition, the captain stated that the event was “prolonged” and that the airplane might have swung three or four times before it was under control. Finally, the captain stated that the airplane climbed 750 feet before the Dutch roll stopped and that, afterward, the airplane descended slowly to rejoin the airway. In a postincident interview, the first officer stated that his action caused a “bump” on the left rudder pedal rather than a steady force application. The first officer also stated that he did not think he hit the control column with either foot or moved the column. The first officer reported that, during the event, the airplane began a climbing right turn and the airplane’s nose was yawing to the right. He also reported that the airplane felt as if it were “skidding sideways” and that the motion felt “pretty violent.” The first officer stated that the event lasted about 20 seconds and that he did not get on the flight controls during the recovery. The first officer further stated that the captain was hand-flying the airplane and that he was “extremely light” on the controls. The Safety Board analyzed FDR data from the incident and determined that the first officer made a rudder pedal input (which did not reach the stop) in one direction and that the captain made a full rudder pedal input in the other direction, which he held for several seconds. The captain indicated that he did not know that he had input full rudder or that the pedal changed its range of travel.160 The Safety Board calculated the loads on 160 At an airspeed of 290 knots, only about 0.8 inch of rudder pedal travel and 28 pounds of pedal force were needed for full rudder.

Factual Information 110 Aircraft Accident Report the vertical stabilizer, using Airbus’ linear loads model, and determined that they were below limit load. 1.18.3 Federal Aviation Administration Airworthiness Directives 1.18.3.1 Airworthiness Directive 2001-23-51 On November 16, 2001, the FAA, along with the DGAC, issued emergency AD 2001-23-51, which required operators of A300-600 and A310 series airplanes to perform a one-time detailed visual inspection to prevent a failure of the vertical stabilizer-to-fuselage attachment points and rudder-to-vertical stabilizer attachment points.161 The AD indicated that such a failure could result in the loss of the vertical stabilizer and/or rudder and a consequent loss of control of the airplane. The purpose of the visual inspection was to detect repairs and alterations to, and damage of, the vertical stabilizer main attachment fittings and transverse load fittings; the rudder hinge fittings, hinge arms, and support fittings for all rudder hinges; and rudder actuator support fittings. The AD indicated that (1) damage of the metallic areas would include pulled or loose fasteners, wear areas, distorted flanges, cracks, and corrosion and (2) damage of the composite areas would include delamination; distorted surfaces that might indicate delamination; cracks in the paint surface; evidence of moisture damage; and cracked, slitting, or frayed fibers. The AD required that any identified damage be repaired and that operators report the results of their inspection findings to the FAA. The AD was effective upon receipt and was required to be accomplished within 15 days. 1.18.3.2 Airworthiness Directive 2002-06-09 On March 15, 2002, the FAA issued AD 2002-06-09, which required detailed inspections to detect and correct reduced structural integrity of A300 and A310 series airplanes after an extreme in-flight lateral loading event. The AD stated that operators were to determine whether the lateral load factor equaled or exceeded 0.3 G and that acceptable methods for making this determination included aircraft communication addressing and reporting system information, FDR data, or quick access recorder data. The AD provided a specific list of tasks that were to be accomplished during the inspections and indicated that any damage found during the inspections had to be repaired before the airplane was returned to service. The AD stated that operators were to submit to Airbus a report of the inspection results and other relevant information. The AD indicated that, for airplanes with a lateral load factor of greater than or equal to 0.3 G but less than 0.35 G, operators were to submit the report within 5 days after accomplishing the 161 On November 15, 2001, American Airlines issued Fleet Campaign Directive EF0351X, which required a detailed visual inspection of the vertical stabilizer-to-fuselage attachment points and the rudder-to-vertical stabilizer attachment points for the company’s A300-600 fleet. The purpose of the inspection was to look for evidence of unusual conditions or degradations to the attachment points or adjacent structure. On November 17, 2001, American Airlines issued Fleet Campaign Directive EF0351B, which was an upgraded version of Fleet Campaign Directive EF0351X that met the inspection requirements mandated by FAA AD 2001-23-51.

Factual Information 111 Aircraft Accident Report inspections. After the inspection and reporting requirements were accomplished, the airplane could be returned to service. For airplanes with a lateral load factor of equal to or greater than 0.35 G, the AD did not specify a time requirement for reporting the inspection results to Airbus, but the AD did indicate that the airplane could not be returned to service once the inspection and reporting requirements were accomplished. The AD also stated that Airbus would develop an airplane loads assessment and would recommend, if necessary, supplementary inspections of applicable areas of the airplane. For airplanes with a lateral load factor of greater than or equal to 0.3 G but less than 0.35 G, supplementary inspections were to be conducted within 30 days of the extreme lateral loading event, but the airplane could be in service before these inspections were completed. The AD did not specify a time requirement for conducting supplementary inspections for airplanes with a lateral load factor of equal to or greater than 0.35 G, but the AD did indicate that these inspections had to be completed before further flight of the airplane. 1.18.4 Previous Safety Recommendations Related to the Circumstances of the Flight 587 Accident 1.18.4.1 Safety Recommendations A-02-01 and -02 After the flight 587 accident, the Safety Board learned that many pilot programs did not include information on the structural certification requirements for the vertical stabilizer and rudder on transport-category airplanes and that sequential full opposite rudder inputs (even at speeds below VA) might result in structural loads that exceed those addressed by the requirements. The Board became concerned that pilots might have the impression that rudder travel limiter systems would prevent sequential full opposite rudder deflections from damaging the structure. However, the structural certification requirements for transport-category airplanes do not take such maneuvers into account. As a result, sequential opposite rudder inputs, even when a rudder limiter is in effect, can produce loads that are higher than those required for certification and may exceed the structural capabilities of the airplane. Because of its concerns, the Safety Board issued Safety Recommendation A-02-01 and -02 on February 8, 2002. Safety Recommendations A-02-01 and -02 asked the FAA to take the following actions: Require the manufacturers and operators of transport-category airplanes to establish and implement pilot training programs that: (1) explain the structural certification requirements for the rudder and vertical stabilizer on transport-category airplanes; (2) explain that a full or nearly full rudder deflection in one direction followed by a full or nearly full rudder deflection in the opposite direction, or certain combinations of sideslip angle and opposite rudder deflection can result in potentially dangerous loads on the vertical stabilizer, even at speeds below the design maneuvering speed; and (3) explain that, on some aircraft, as speed increases, the maximum available rudder deflection can be obtained with comparatively light pedal forces and small pedal deflections. The FAA should

Factual Information 112 Aircraft Accident Report also require revisions to airplane and pilot operating manuals that reflect and reinforce this information. In addition, the FAA should ensure that this training does not compromise the substance or effectiveness of existing training regarding proper rudder use, such as during engine failure shortly after takeoff or during strong or gusty crosswind takeoffs or landings. (A-02-01) Carefully review all existing and proposed guidance and training provided to pilots of transport-category airplanes concerning special maneuvers intended to address unusual or emergency situations and, if necessary, require modifications to ensure that flight crews are not trained to use the rudder in a way that could result in dangerous combinations of sideslip angle and rudder position or other flight parameters. (A-02-02) In an April 15, 2002, letter, the FAA stated that it agreed with the intent of these safety recommendations. The FAA indicated that several aviation safety inspectors reviewed the training programs of the three main U.S. operators of Airbus airplanes. This review determined that none of the operators were training their pilots to use dangerous combinations of sideslip angles and rudder position or other flight parameters. The FAA also stated that, on February 15, 2002, it issued Notice N8400.28, “Transport Category Airplanes – Rudder and Vertical Stabilizer Awareness,” to notify POIs of air carriers that operate transport-category airplanes about the Safety Board’s concerns regarding the operational use of rudder pedals and the potential subsequent effects on the vertical stabilizer. The notice directed POIs to inform their air carriers of the following: Sequential full opposite rudder inputs (sometimes referred to as “rudder reversals”), even at speeds below the design maneuvering speed, may result in structural loads that exceed those addressed by the 14 CFR Part 25 requirements. In fact, pilots may have the impression that the rudder limiter systems installed on most transport-category airplanes prevent sequential full opposite rudder deflections from damaging the structure. However, the 14 CFR Part 25 structural certification requirements for transport-category airplanes do not take such maneuvers into account; therefore, such sequential opposite rudder inputs, even when a rudder limiter is in effect, can produce loads higher than those required for certification and may exceed the structural capabilities of the aircraft. Pilots may not be aware that, on some airplane types, full available rudder deflections can be achieved with small pedal movements and comparatively light pedal forces. In these airplanes, at low speeds the rudder pedal forces required to obtain full available rudder may be three times greater than those required to obtain full available rudder at higher airspeeds. Notwithstanding the concerns noted above regarding the potential danger of large and/or sequential rudder inputs in flight, it should be emphasized that pilots should not become reluctant to command full rudder when required and when appropriate, like during an engine failure shortly after takeoff or during strong or gusty crosswind takeoffs or landings. The instruction of proper rudder use in such conditions should remain intact, but should also emphasize the differences

Factual Information 113 Aircraft Accident Report between aircraft motion resulting from a single, large rudder input and that resulting from a series of full or nearly full opposite rudder inputs. The POIs were to provide a copy of FAA Notice N8400.28 to representatives of each transport-category airplane operator for information and voluntary implementation as deemed appropriate by the operator.162 In addition, the FAA stated that, on February 15, 2002, it contacted selected manufacturers and industry organizations to inform them that it shared the Safety Board’s concerns regarding pilot training on the use of the rudder in transport-category airplanes and subsequently sent a letter to raise awareness of the Board’s safety recommendations. In response, the manufacturers prepared flight technical operations bulletins (see sections 1.18.4.1.2 and 1.18.4.1.3), which the FAA believed would convey the best information available from each manufacturer regarding the Board’s concerns. The FAA stated that Notice N8400.28 was an interim step to ensure that the shared concerns of the Board and the FAA were known to transport-category airplane operators and that the concerns were conveyed to the operators’ pilots as quickly as possible. The FAA added that changing training program requirements by rulemaking was “usually a time-consuming process with no guarantee of final passage into rule.” The FAA indicated that the procedures contained in HBAT 99-07, “Flight Standards Policy – Company Operating Manuals and Company Training Program Revisions for Compliance with Current Airplane [or Rotorcraft] Flight Manual Revisions,” allowed certain changes in the approved sections of AFMs to be more readily captured into pilot training programs. The FAA further stated that, as manufacturers developed pertinent safety information, changes in their respective AFMs might be appropriate. Training programs could also be changed by mutual agreement between the operator and the FAA based on the information in the flight technical operations bulletins. The FAA stated that it would continue to review the information developed by the manufacturers and the information resulting from the Safety Board’s ongoing investigation of the flight 587 accident. The FAA indicated that it might consider initiating rulemaking to change training program requirements, as appropriate, as more information becomes available. In a July 22, 2002, letter, the Safety Board noted that the FAA’s review of training programs was limited to the programs of Airbus airplane operators. The Board believed that the training programs of operators of other manufacturers’ airplanes also needed to be reviewed. The Board stated that the FAA’s plan to use nonregulatory means to meet the intent of Safety Recommendation A-02-01 might be an acceptable alternative action but recognized that the FAA indicated that it might ultimately make a regulatory change. The Board stated that it would assume, unless the FAA indicated otherwise, that the FAA 162 In a February 19, 2002, letter to American Airlines’ vice president for safety, security, and environmental, the POI for AMR Corporation relayed the language in Safety Recommendations A-02-01 and -02 and indicated that his office wanted to meet to discuss American Airlines’ response to the Safety Board’s recommendations. A copy of FAA Notice 8400.28 was enclosed with the POI’s letter. See section 1.18.4.1.1 for American’s response to the Board’s recommendations.

Factual Information 114 Aircraft Accident Report would develop some regulatory changes in pilot training programs in response to Safety Recommendation A-02-01. Pending completion of changes to pilot training programs in response to the recommendations, the determination of whether these revisions would be implemented through the procedures in HBAT 99-07 or through regulatory changes, and the FAA’s consideration of reviewing the training programs of operators of other manufacturers’ airplanes, Safety Recommendations A-02-01 and A-02-02 were classified “Open—Acceptable Response.” 1.18.4.1.1 American Airlines Flight Operations Technical Informational Bulletin In February 2002, American Airlines issued Flight Operations Technical Informational Bulletin 2002-02, “Jet Transport Aircraft Flight Controls,” in response to the Safety Board’s recommendations. The bulletin included information on rudders, rudder travel limiters, rudder reversals, sideslip angle, and vertical stabilizer loading. The bulletin stated that a rudder travel limiter was “designed into the directional control system to reduce the available rudder throw as airspeed increases to avoid excessive structural loads on the vertical stabilizer.” The bulletin also stated that a rudder reversal was also known as a “rudder doublet” and was defined as “a large rudder deflection input in one direction followed immediately by a rudder deflection input in the opposite direction.”163 In addition, the bulletin stated that “large ‘rudder reversals’ or ‘rudder doublets’ must be avoided on Transport Category Aircraft” because “these inputs can result in loss of control or structural failure of the aircraft.” During postaccident interviews, American Airlines pilots indicated that they were familiar with the function of the rudder travel limiter, and most of these pilots thought that the rudder travel limiter would prevent an overload of the vertical stabilizer. The pilots also indicated that they did not know about the rudder doublet concept.164 1.18.4.1.2 Airbus Flight Crew Operating Manual Bulletin In March 2002, Airbus issued A310/A300-600 FCOM Bulletin number 15/1, “Subject No. 40, Use of Rudder on Transport Category Airplanes, in response to the Safety Board’s recommendations.” The bulletin emphasized proper operational use of the rudder and highlighted certification requirements and rudder control system design characteristics. The bulletin included the following information in a box labeled “CAUTION:” Sudden commanded full, or nearly full, opposite rudder movement against a sideslip can generate loads that exceed the limit loads and possibly the ultimate loads and can result in structural failure. 163 At the time of the accident, neither American’s AFM nor its A300 Operating Manual used the terms “rudder doublets” or “rudder reversals.” 164 The American Airlines A300 fleet standards manager and the vice president of training for Airbus North America customer services indicated, during public hearing testimony, that most pilots would not have heard of rudder doublets before the flight 587 accident unless they were test pilots.

Factual Information 115 Aircraft Accident Report This is true even at speeds below the maximum design maneuvering speed, VA. Certification regulations do not consider the loads imposed on the structure when there is sudden full, or nearly full, rudder movement that is opposite of the sideslip. The bulletin also made the following operational recommendation: RUDDERS SHOULD NOT BE USED: – To induce roll, or – To counter roll, induced by any type of turbulence. Whatever the airborne flight condition may be, aggressive, full or nearly full, opposite rudder inputs must not be applied. Such inputs can lead to loads higher than the limit, or possibly the ultimate loads and can result in structural damage or failure. The rudder travel limiter system is not designed to prevent structural damage or failure in the event of such rudder system inputs. Note: Rudder reversals must never be incorporated into airline policy….[165] As far as dutch roll is concerned, yaw damper action and natural aircraft damping are sufficient to adequately dampen dutch roll oscillations. The rudder should not be used to complement the yaw damper. Note: Even if both yaw damper systems are lost, the rudders should not be used to dampen the dutch roll. Refer to the YAW DAMPER FAULT procedure. At the public hearing on this accident, the American Airlines A300 fleet standards manager testified that American had not received “such specific limitations or prohibited maneuvers on the rudder use” before the flight 587 accident. 1.18.4.1.3 Boeing Flight Operations Technical Bulletin On May 13, 2002, Boeing issued a flight operations technical bulletin titled, “Use of Rudder on Transport Category Airplanes,” in response to the Safety Board’s recommendations. The bulletin applied to all Boeing, Douglas, and McDonnell Douglas airplane models and included information on rudder maneuvering considerations, VA, and 165 At the time of the accident, Airbus’ FCOM did not contain the terms “rudder doublets” or “rudder reversals.”

Factual Information 116 Aircraft Accident Report actions taken in response to the Board’s recommendations. The summary section included the following information: • It is important to use the rudder in a manner that avoids unintended large sideslip angles and resulting excessive roll rates. The amount of roll rate that is generated by using the rudder is proportional to the amount of sideslip, NOT the amount of rudder input. • If the pilot reacts to an abrupt roll onset with a large rudder input in the opposite direction, the pilot can induce large amplitude oscillations. The large amplitude oscillations can generate loads that exceed the limit loads and possibly the ultimate loads, which could result in structural damage. In addition, an attachment to the bulletin provided answers to commonly asked questions regarding rudder usage. 1.18.4.2 Safety Recommendations A-03-41 Through -44 On November 17, 2002, Delta Connection flight 5109, a Canadair CRJ-2, N868CA, operated by Comair, encountered severe turbulence while in a descent near Rockville, Virginia. Flight 5109 was a scheduled passenger flight from Atlanta, Georgia, to Washington, D.C., with 2 pilots, 1 flight attendant, and 48 passengers aboard. No one aboard the airplane was injured during the incident, and the airplane was returned to service the next day after it was visually inspected for damage in accordance with the manufacturer’s procedures. Analysis of the data from the incident airplane’s FDR showed that large vertical accelerations occurred during the turbulence event. Further analysis of the data by Canadair showed that, during the event, the airplane’s wing experienced loads that were outside of their certificated design envelopes. Specifically, Canadair’s analysis revealed that the airplane experienced vertical accelerations ranging from 4.3 G positive to 1.9 G negative. The inspection procedures in Canadair’s aircraft maintenance manual for severe turbulence or extreme maneuvers included a minimum positive G threshold for a vertical acceleration but no minimum threshold for negative G excursions or for lateral G excursions.166 In addition, the investigations of American Airlines flight 587 and flight 903 revealed that both airplanes experienced lateral accelerations of about 0.4 G. After the flight 903 accident, American Airlines conducted a visual inspection of the airplane in accordance with the applicable procedures in its A300 Operating Manual. The inspection procedures specified the threshold criteria for positive and negative vertical G excursions but not for lateral G excursions. 166 On December 20, 2002, as a result of its engineering and loads assessment, Canadair performed supplemental inspections of the airplane to ensure its structural integrity. No damage was identified.

Factual Information 117 Aircraft Accident Report The Safety Board found that some manufacturers’ maintenance manuals did not include inspections for damage caused by extreme (positive or negative) lateral accelerations or extreme negative vertical accelerations. The Board was concerned that existing inspection criteria might not be adequate to detect damage after high loading events that greatly exceeded the manufacturers’ threshold and that airplanes that encountered such high loads might be returned to service in an unairworthy condition. As a result, on September 4, 2003, the Safety Board issued Safety Recommendations A-03-41 through -44, which asked the FAA to take the following actions: Require all manufacturers of transport-category airplanes to review and, if necessary, revise their maintenance manual inspection criteria for severe turbulence and extreme in-flight maneuvers to ensure that loads resulting from positive and negative vertical accelerations, as well as lateral accelerations, are adequately addressed. (A-03-41) Require all manufacturers of transport-category airplanes to establish and validate maximum threshold values for positive and negative vertical and lateral G accelerations beyond which direct manufacturer oversight and intervention is required as a condition for returning the airplane to service. (A-03-42) Require all operators of airplanes that have experienced accelerations exceeding the threshold values established as a result of Safety Recommendation A-03-42 (or that the operator has reason to believe might have exceeded those thresholds), as determined from FDR and other available data, to notify the FAA immediately of such high loading events and provide all related loads assessment and inspection results. (A-03-43) Require manufacturers of transport-category airplanes to immediately notify the appropriate certification authority of any event involving accelerations exceeding the threshold values (or that the manufacturer has reason to believe might have exceeded those thresholds) necessitating the intervention of the manufacturer, and provide all related loads assessment and inspection results. (A-03-44) On November 20, 2003, the FAA stated that it issued AD 2002-06-09 on March 15, 2002, which required certain inspections of A300, A300-600, and A310 airplanes after extreme lateral loading events (see section 1.18.3.2). The FAA also stated that it planned to work in partnership with industry to address the issues raised in Safety Recommendations A-03-41, -42, and -44, including pilot reporting, operations and maintenance manuals, FDR capabilities, and operator/manufacturer/authority interface. The FAA noted that many of the issues would be challenging and would require coordination with, and the participation of, numerous civil aviation organizations, including the Air Line Pilots Association and the Air Transport Association. The FAA stated that it should have a detailed plan for this work by March 2004. In response to Safety Recommendation A-03-43, the FAA stated that manufacturers have not currently established maximum threshold values for positive and negative vertical and lateral G accelerations but that implementation of the actions recommended in Safety Recommendation A-03-43 would occur automatically once

Factual Information 118 Aircraft Accident Report manufacturers establish such thresholds (as recommended in Safety Recommendation A-03-42). The FAA further stated that it would develop a bulletin to provide guidance for inspectors to use in determining that appropriate manufacturer oversight and intervention occurs as a condition for returning an airplane to service. On April 21, 2004, the Safety Board stated that it looked forward to reviewing the FAA’s plan to work with industry in addressing the issues discussed in Safety Recommendations A-03-41, -42, and -44. Pending the FAA’s development of this plan, its review by the Board, and the FAA’s actions in response to the recommendations of the plan, Safety Recommendations A-03-41, -42, and -44 were classified “Open—Acceptable Response.” The Safety Board also stated that, although the planned actions in response to Safety Recommendation A-03-43 are positive steps, the Board was concerned that these actions might not be fully responsive to the intent of the recommendation. The Board expressed its concern that airplanes might be exceeding design and certification standards more frequently than was previously known or expected and that, as a result, such events needed to be tracked and evaluated. The Board further stated that, at a March 16, 2004, meeting, staff from the FAA and the Board discussed the Board’s position that relying solely on the pilot-in-commend to report exceeded threshold values was not a reliable tracking and evaluation method and that the evaluation of acceleration threshold exceedances needed to be based on FDR or other available data. The FAA indicated that it would consider a requirement to regularly check the FDR for evidence of an airplane having exceeded the acceleration threshold values established in response to Safety Recommendation A-03-42. Pending the development of a system for the FAA to track and evaluate acceleration events that exceed a manufacturer’s threshold values, as determined from FDR and other available data and not solely from pilot-in-command reports, Safety Recommendation A-03-43 was classified “Open—Acceptable Response.” On August 23, 2004, the FAA stated that the Aerospace Industries Association and the Air Transport Association were convening a working group “to review current maintenance manual inspection process for high load events and to develop an advisory ‘best practices’ standard for using flight data in these processes.” The FAA also stated that both organizations were in identifying working group participants and developing a meeting schedule. The FAA anticipated that working group would complete its activities within 1 year.

Factual Information 119 Aircraft Accident Report 1.18.5 Previous Safety Recommendations Related to the Circumstances of the Flight 903 Accident After the flight 587 accident, the Safety Board reexamined FDR data from the May 1997 American Airlines flight 903 accident (see section 1.18.2.1).167 The Board determined that the flight 903 airplane’s rudder exceeded its designed travel limits because of a rapid increase in airspeed during the upset and apparent high forces applied to the rudder pedal when it was at the in-flight limit. As stated in section 1.6.2, the A300-600 rudder has the following travel limits in terms of indicated airspeed: a maximum of 30° at 165 knots and below; 14.5° at 220 knots; 9.3° at 250 knots; 7° at 270 knots; 5° at 310 knots; 4° at 350 knots; and 3.5° at 395 knots and above. The flight 903 investigation determined that the rudder travel limiter could only maintain these limits in response to airspeed changes that occurred at a moderate rate, such as those typically experienced during normal commercial operations. The investigation also determined that the rudder travel limiter could not maintain these limits in response to more rapid airspeed changes, such as those experienced during the flight 903 upset. The flight 903 investigation specifically determined that, in the airspeed range of 165 to 220 knots, the rudder travel limiter could maintain the designed rudder travel limitations for airspeed changes up to about 2.4 knots per second. However, during the flight 903 upset, the airplane experienced a much more rapid airspeed increase—from 190 to 220 knots in 3 seconds—which equated to an increase of up to 10 knots per second and exceeded the rate at which the rudder travel limiter system could respond by as much as four times. The airspeed then continued to increase during the next 20 seconds at a rate of 2.6 knots per second. Because of the increasing airspeed, the rudder travel limiter position lag (introduced by the previous 3-second rapid increase) was present throughout most of the upset (even though the position lag was decreasing). Because of the rapid initial airspeed change and continued airspeed increase, the rudder exceeded its designed rudder travel limit for about 20 seconds. During that time, the rudder moved four times in response to pilot input; the rudder exceeded the design limit by about 8° twice and by about 5° twice. The Safety Board stated that rudder travel beyond the designed rudder travel limits could lead to high loads on the vertical stabilizer and that this potential would be especially high during in-flight upsets because rapid airspeed changes accompanied by rudder inputs are more likely to occur during upsets than during normal flight. A review of the flight 903 FDR data for rudder position showed that, even after accounting for the slow response rate of the rudder travel limiter, the rudder still appeared to exceed the estimated position at which it should have been limited by the rudder travel 167 The Safety Board agreed to include a statement in this report to address the claims that a linkage exists between American Airlines flight 587 and American Airlines flight 903. By including this statement, the Board seeks to set forth the reasons for declining to make a causal connection between the two events. See appendix C for an explanation of the differences.

Factual Information 120 Aircraft Accident Report limiter. This exceedance was as high as 4° near the end of the upset. Testing of the rudder travel limiter determined that, if a pilot applied a sufficiently large pedal force when the pedal was at its travel limit, such a pedal force would further slow or stop the movement and, consequently, the effectiveness of the rudder travel limiter. The flight 903 event demonstrated that slowing or stopping the rudder travel limiter by application of large pedal forces could result in the rudder position substantially exceeding the designed travel limit. The Safety Board was concerned that such an increase in available rudder beyond its designed rudder travel limits could permit excessive rudder movements and possibly result in high loads on the vertical stabilizer. As a result of its concerns, the Safety Board issued Safety Recommendations A-04-44 and -45 on May 28, 2004. Safety Recommendations A-04-44 and -45 asked the FAA to take the following actions: Require Airbus to develop a design modification for the A300-600 rudder travel limiter system so that it can respond effectively to rapid airspeed changes such as those that might be experienced during upsets and not be adversely affected by pedal forces, and issue an airworthiness directive to require the installation of that modification. (A-04-44) Evaluate other transport-category airplanes with rudder limiting systems to determine whether any of those systems are unable to effectively respond to rapid airspeed changes such as those that might be experienced during upsets, or whether any of those systems are adversely affected by pedal forces and, if so, require corrective modifications to those systems. (A-04-45) The FAA responded to Safety Recommendations A-04-44 and -45 on August 12,

1. Regarding Safety Recommendation A-04-44, the FAA stated that it was aware that

the Board was considering additional design-related safety recommendations pertaining to the A300-600 flight control systems. The FAA also stated that it would like to assess these recommendations before making any final decisions about the design of the A300-600 flight control system. Regarding Safety Recommendation A-04-45, the FAA stated that its aircraft certification offices would ask transport-category airplane manufacturers for information regarding the maximum expected airplane accelerations and maximum rudder travel limiter rates. The FAA indicated that the offices would be also asking the manufacturers if rudder pedal forces might adversely affect their rudder limiting devices. The FAA further stated that, after the manufacturers’ systems information was received and analyzed, the FAA would be in a position to determine whether any of those systems would be unable to respond effectively to airspeed changes, such as those that might be experienced during upsets, and would be adversely affected by pedal forces. Such information, according to the FAA, would help determine what airworthiness actions might be required.

Factual Information 121 Aircraft Accident Report 1.18.6 Previous Safety Recommendations Related to Upset Recovery Training 1.18.6.1 Safety Recommendation A-96-120 On October 18, 1996, the Safety Board issued Safety Recommendation A-96-120. This recommendation was issued in response to three uncommanded roll and/or yaw events that occurred while Boeing 737 airplanes were approaching to land: the March 3, 1991, United Airlines flight 585 accident in Colorado Springs, Colorado; the September 8, 1994, USAir flight 427 accident near Aliquippa, Pennsylvania; and the June 9, 1996, Eastwind Airlines flight 517 incident in Richmond, Virginia. Safety Recommendation A-96-120 asked the FAA to take the following action: Require 14 CFR Part 121 and 135 operators to provide training to flight crews in the recognition of and recovery from unusual attitudes and upset maneuvers, including upsets that occur while the aircraft is being controlled by automatic flight control systems, and unusual attitudes that result from flight control malfunctions and uncommanded flight control surface movements. On January 16, 1997, the FAA stated that it agreed with this recommendation and that it was considering a notice of proposed rulemaking (NPRM) “to require that air carriers conduct training that will emphasize recognition, prevention, and recovery from aircraft attitudes normally not associated with air carrier flight operations.” On July 15, 1997, the Safety Board classified A-96-120 “Open—Acceptable Response.” However, on April 19, 1999, the Board classified the recommendation “Open—Unacceptable Response” because the FAA had not taken the necessary regulatory action to require unusual attitude training for air carrier pilots. On August 11, 1999, the FAA stated that it initiated an NPRM proposing to revise 14 CFR Part 121, Subparts N and O. The FAA indicated that the NPRM would include training in the recognition and recovery of unusual attitudes and upset maneuvers. The FAA anticipated that the NPRM would be published in December 2000. On December 20, 1999, the Safety Board stated that, on the basis of the FAA’s planned actions, Safety Recommendation A-96-120 was classified “Open—Acceptable Response.” On February 11, 2003, FAA staff advised the Safety Board that an NPRM package with changes to 14 CFR Subparts N and O was being coordinated internally and was expected to be submitted to the Office of the Secretary of Transportation in May 2003. On June 16, 2004, FAA staff advised the Board that an aviation rulemaking committee was reviewing the NPRM effort and that the issuance of the NPRM was unlikely before the end of 2004. 1.18.6.2 Other Upset Recovery Training Safety Recommendations The Safety Board had issued three safety recommendations to the FAA (before A-96-120) for upset recovery training for airline pilots. First, on May 1, 1970, the Safety Board issued Safety Recommendation A-70-21 as a result of the November 16, 1968,

Factual Information 122 Aircraft Accident Report accident in which a flight crew lost control of a Boeing 737 near Detroit, Michigan, during poor weather conditions. Safety Recommendation A-70-21 recommended that Airlines be required to provide additional flightcrew training, whereby pilots would be required to demonstrate periodically, proficiency in the area of recovery from unusual attitudes. It was suggested that a simulator be utilized to provide flightcrew familiarization in the following areas. A. The various instrument displays associated with and resulting from encounters with unusual meteorological conditions. B. The proper flightcrew response to the various displays. C. Demonstration of and recovery from possible ensuing unusual attitudes. On May 21, 1970, the FAA stated that unusual attitude maneuvers had been deleted from the pilot proficiency check in 1965 but that airline training now emphasized the proper use of trim, attitude control, and thrust, which the FAA believed was far more effective than the practice of recovery from unusual attitude maneuvers. The FAA also stated that it was inconceivable to require training maneuvers that would place a large jet airplane in a nose-high, low airspeed, high AOA situation. On July 8, 1970, the FAA stated that changes in airline training and operational procedures had resulted from this safety recommendation and cited a “marked decrease in upset events” as evidence that these actions had addressed the intent of the recommendation. The FAA further stated that it would discuss with industry representatives the feasibility of simulating large excursions from flightpath caused by abnormal meteorological conditions. Because no further action was taken by the FAA, the Safety Board classified Safety Recommendation A-70-21 “Closed—Unacceptable Action” on August 17, 1972. Second, on September 15, 1972, the Safety Board issued Safety Recommendation A-72-152 as a result of the March 31, 1971, accident involving a Boeing 720B, which yawed and crashed while the flight crew was attempting a three-engine missed approach from a simulated engine-out instrument landing system approach. The Safety Board was concerned about the flight crew’s inability to rapidly assess the situation and recover. Safety Recommendation A-72-152 recommended that [Title] 14 CFR 61, Appendix A, and 14 CFR 121, Appendices E and F be amended to include a requirement for pilots to demonstrate their ability to recover from abnormal regimes of flight and unusual attitudes solely by reference to flight instruments. For maximum safety, these demonstrations should be conducted in an appropriate flight simulator. Should existing or proposed simulators be incapable of realistically duplicating aircraft performance in the regimes of flight beyond normal operation, it is further recommended that the FAA take appropriate measures to require that such existing or proposed simulators be replaced or modified to include such a capability. On September 26, 1972, the FAA stated that it did not believe that simulators were capable of simulating certain regimes of flight that were beyond the normal flight envelope of an aircraft. The FAA further stated that, because an aircraft simulator was not a required part of an air carrier training program, the FAA could not require that a simulator be replaced or modified to simulate regimes of flight outside the flight envelope

Factual Information 123 Aircraft Accident Report of the aircraft. As a result of the FAA’s response, the Safety Board classified Safety Recommendation A-72-152 “Closed—Unacceptable Action” on January 16, 1973. Third, on April 29, 1992, the Safety Board issued Safety Recommendation A-92-20 as a result of the July 10, 1991, L’Express Airlines Beech C99 accident at Birmingham, Alabama. The airplane was on an instrument approach into clearly identified thunderstorm activity, resulting in a loss of control of the airplane from which the flight crew was unable to recover. Safety Recommendation A-92-20 asked the FAA to take the following action: Require that recurrent training and proficiency programs for instrument-rated pilots include techniques for recognizing and recovering from unusual attitudes. On July 9, 1992, the FAA stated that pilots were required to demonstrate recovery from unusual flight attitudes on their private pilot examination. The FAA also stated that an instrument rating required a pilot to be proficient in recovery from unusual attitudes. The FAA noted that, by the time a pilot had the required experience to become a pilot with an air carrier operating under 14 CFR Part 121 or 135, the pilot would have received extensive training and flight checks for procedures and techniques in recovery from unusual attitudes. On January 26, 1993, the Safety Board stated that instrument-rated pilots should receive recurrent training in techniques for recognizing and recovering from unusual attitudes and that proficiency programs should include this same training. The Board also stated that requiring such training annually would greatly enhance a pilot’s ability to safely recover from an unusual attitude. Because the FAA planned no actions on this recommendation, the Safety Board classified Safety Recommendation A-92-20 “Closed— Unacceptable Action.” 1.18.7 Previous Safety Board Actions Regarding Data Filtering 1.18.7.1 Safety Recommendations A-94-120 and -121 The Safety Board participated in the investigations of three Boeing 767 accidents that occurred overseas during either 1992 or 1993. The investigations determined that flight control position data recorded on the airplanes’ FDRs were filtered by the engine instrument crew alert system (EICAS). As a result, the Board issued Safety Recommendations A-94-120 and -121 on June 16, 1994. Safety Recommendation A-94-120 asked the FAA to take the following action: Require design modification to the Boeing 757/767 so that flight control position data to the DFDR [digital flight data recorder] is accurate and not filtered by the EICAS. The sample rate should also be increased to an appropriate value. In an August 29, 1994, letter, the FAA indicated its belief that it was not necessary to redesign the Boeing 757 and 767 FDR to record unfiltered data control positions because the airplanes’ FDR installations met the accuracy requirements of

Factual Information 124 Aircraft Accident Report 14 CFR 121.343. In an August 1, 1995, letter, the Safety Board disagreed with the FAA’s position and stated that the current method used to record flight control position for the Boeing 757 and 767 would meet the regulatory requirement for static, but not dynamic, conditions. (Under dynamic conditions, the parameter is undergoing change at the maximum rate that can be expected.) On November 20, 1996, the FAA indicated that it issued NPRM 96-7, which proposed to upgrade recorder capabilities in most transport-category airplanes, including the Boeing 757 and 767, and to preclude the use of a filter. On May 16, 1997, the Safety Board noted that the proposed rule appeared to preclude the use of a filter by a statement in new appendixes for 14 CFR Parts 121, 125, and 135. The statement indicated that recorded values had to meet accuracy requirements during dynamic and static conditions; thus, data filtering techniques, including EICAS-filtered data parameters, would not meet this proposed requirement. The Board further noted that airplanes using data filtering systems would need to be retrofitted or would need to undergo design modifications to meet the proposed requirement. The Board indicated that the NPRM was a positive step toward ensuring that correct and adequate control position data would be recorded on FDRs but was concerned that airplane manufacturers and air carriers might overlook the new rules in the appendixes or not realize that data filtering systems had to be replaced. The Board stated that it would appreciate information on the FAA’s plans if it did not intend to issue alerts highlighting the new requirements and the time schedule detailed in the NPRM. In a September 10, 1997, letter, the FAA stated that, on July 9, 1997, it issued the final rule (14 CFR 121.344, Appendix M) to upgrade recorder capabilities in most transport-category airplanes. (The final rule also amended 14 CFR Parts 125 and 135 to require certain operators to upgrade recorder capabilities.) The FAA also stated that the final rule precluded the use of a filter for FDR data and specified the sampling rate for all parameters. On August 4, 1998, the Safety Board noted that the FAA’s letter did not mention any alerts or alternate plans to highlight the new requirements. However, the Board thought that the FAA appeared to refer to the Board’s concern within the “Discussion of Comments to the NPRM” section of the final rule. In that section, the FAA agreed that further explanation of the dynamic test condition requirement was necessary and stated that it intended to issue an AC to clarify the recording of dynamic and static data and other acceptable means to comply with the rule. The Board stated that it was pleased that the FAA had recognized the need to further emphasize the means for compliance with the new requirements and to notify operators of the elimination of filtered data. The Board urged the FAA to expedite the issuance of the AC because operators and manufacturers had begun preparations to retrofit their fleets. In a February 25, 2000, letter, the FAA indicated that, on October 5, 1999, it issued AC 20-141, “Airworthiness and Operational Approval of Digital Flight Data Recorder Systems,” which addressed all filtered data and not just EICAS data. The AC stated that the applicant must identify any parameters that are filtered before they are recorded and must show, by test, that “no significant difference” exists between these parameters and the recorded parameter data under static and dynamic conditions. On May 11, 2000, the

Factual Information 125 Aircraft Accident Report Safety Board indicated that the final rule and the AC satisfied the intent of Safety Recommendation A-94-120 and classified it “Closed—Acceptable Action.” Safety Recommendation A-94-121 asked the FAA to take the following action: Review other airplane designs to ensure that flight control position data filtered by systems such as EICAS are not substituted for accurate data. In an August 29, 1994, letter, the FAA indicated that it had reviewed the flight control position data to the FDR on McDonnell Douglas MD-80/90 and MD-11 airplanes and found that the flight control positions were recorded accurately. On November 20, 1996, the FAA indicated that it reviewed the flight control position data to the FDR of aircraft manufactured by Aerospatiale, CASA, Cessna, Grumann, Gulfstream, Israel Aircraft Industries, Lockheed, and Saab and concluded that the data filtered by systems such as EICAS were not substituted for accurate data. The FAA also indicated that it was planning to complete similar reviews for airplanes manufactured by Airbus, Canadair, Dassault (Falcon), DeHavilland, Dornier, Embraer, Fokker, Jetstream, Lear, LET, and Illyushin. Further, the FAA indicated that it would take “whatever steps were necessary” to ensure that the recorded data were accurate and representative of control surface positions. In a May 16, 1997, letter, the Safety Board indicated that it was pleased with the FAA’s review efforts and commitment to take any necessary action. On February 9, 1998, the FAA stated that it had issued its final rule to amend 14 CFR Parts 121, 125, and 135, which required certain operators to record additional FDR parameters and precluded the use of a filter. The FAA considered its action to be completed on this safety recommendation. On August 4, 1998, the Safety Board indicated that the FAA’s February 9 letter made no mention of the status of its planned review of other manufacturers’ airplane designs. The Board stated that, regardless of the issuance of the rulemaking and the rulemaking’s elimination of filtering, the FAA should finish its review and notify the Board of the findings. Further, the Board stated that, if the FAA found additional airplanes with filtered control surface data, then it should ensure that all affected operators take the necessary steps to record accurate data. On April 4, 2000, the FAA indicated that it had completed a review of Embraer and Dassault (Falcon) aircraft and concluded that the recorded data were accurate and representative of control surface positions. The FAA stated that there was “no need to continue an independent review of the remaining existing airplanes” because “implementation of the final rule ensures that the recorded data are accurate and representative of control surface positions.” The FAA further stated that its principal aviation safety inspectors assigned to 14 CFR Part 121, 125, and 135 operators were familiar with the rule change and that the inspectors would ensure that their operators comply with the rules. In addition, the FAA stated that it had issued AC 20-141 in response to Safety Recommendation A-94-120. On August 9, 2000, the Safety Board indicated that it was disappointed that the FAA did not complete the review of airplane designs because it would have provided an additional level of assurance that accurate FDR data were being recorded. However, the

Factual Information 126 Aircraft Accident Report Board stated that it was pleased overall with the FAA’s actions on this safety recommendation. As a result, Safety Recommendation A-94-121 was classified “Closed—Acceptable Action.” 1.18.7.2 Postaccident Correspondence on Data Filtering In a February 6, 2002, letter, the Safety Board indicated that the flight 587 investigation revealed that vital flight control surface position information was not directly recorded on the accident airplane’s FDR because of the SDAC filter (see section 1.11.2). The Board believed that the filtered data supplied by the SDAC did not meet the accuracy requirements under dynamic conditions called for in 14 CFR 121.344, Appendix M. The Safety Board stated that the presence of filtered data was “surprising and disappointing,” considering the FAA’s actions regarding Safety Recommendations A-94-120 and -121 (see section 1.18.7.1). Specifically, the Board indicated that it accepted the FAA’s assertion that the issuance of the 1997 final rule (which precluded the use of a filter and added the requirement for a dynamic test condition) and AC 20-141 (which specified test procedures for recorded parameter data under static and dynamic conditions), as well as the work of POIs, would ensure that operators would not record filtered FDR data. The Safety Board believed that the FAA needed to take immediate steps to identify those A300 airplanes that recorded filtered flight control surface data and to take corrective actions as soon as possible to bring these airplanes into compliance with existing regulations. The Board also noted that it was important for the FAA to complete the review called for in Safety Recommendation A-94-121 to ensure that all aircraft that record filtered data are identified and brought into compliance with regulations as soon as possible. In addition, the Board expressed concern that older aircraft, which have not historically recorded filtered data, could be retrofitted with new or upgraded avionics that supply filtered data to the FDR. The Safety Board requested that, within 30 days, the FAA advise the Board, in writing, of the steps that the FAA intended to take to address the problem involving A300 airplanes that record filtered data and to identify and correct any other aircraft that are similarly recording filtered data. In a March 6, 2002, letter, the FAA stated that, when Safety Recommendations A-94-120 and -121 were issued, it surveyed all transport-category airplane manufacturers to determine if FDR data on their airplane models were filtered. The FAA indicated that the manufacturers might not have had a clear understanding of what filtered data meant in the context of Safety Recommendation A-94-121 and that, as a result, the manufacturers defined “filtered” as they saw fit. The FAA further indicated that Airbus reported that the FDRs on its airplanes did not record filtered data. The FAA recognized that it gave assurances to the Safety Board that the wording of its 1997 final rule on data filtering would preclude the recording of filtered flight control position data on most transport-category airplanes. However, the FAA stated the following regarding the wording of the final rule:

Factual Information 127 Aircraft Accident Report Although it [the final rule] did not specifically preclude filtering, it was thought that filtering was technically unfeasible in a compliant system. However, the preamble to the rule left the option open for filtering by use of the undefined term ‘readily retrievable.’ Filtered data was accepted as long as there was a method of readily retrieving the data. The FAA added that AC 20-141, which was introduced several months after the final rule, specifically addressed filtering but did not disallow it. The FAA stated, “again, it was thought that the technical guidance outlined in the AC made filtering unfeasible.” The FAA stated that, as a result of the recent concerns about data filtering, it compiled all historical data surrounding Safety Recommendations A-94-120 and -121 and conducted a new survey of transport-category airplane manufacturers to determine whether FDRs on their airplane models recorded filtered flight control position data. The FAA also stated that it contacted Airbus to find out whether the Safety Board’s assertions regarding FDR data filtering on its models were accurate. Airbus indicated, contrary to its earlier position, that it did record filtered data but that the filtering did not conflict with the requirements of 14 CFR 121.344. On September 3, 2002, the Safety Board indicated that it had provided the FAA with a detailed list of concerns regarding filtered data and was prepared to discuss these issues at a planned October 1, 2002, meeting with the FAA and Airbus. The specific issues discussed at this meeting included compliance with FDR rules as they pertained to the recording of filtered data on Airbus airplanes, the possible impact of data filtering and sampling rate on a pending flight recorder NPRM, and the FAA’s findings in response to its new manufacturer survey (see section 1.18.7.3). 1.18.7.3 Safety Recommendation A-03-50 At the October 1, 2002, meeting with Airbus and the Safety Board, the FAA reported on the results of Phase I of the new manufacturer survey. The FAA stated that Boeing had reported that the 747-400 recorded filtered data for four parameters. The FAA also stated that Phase I of the survey would be complete once Airbus’ results were received. Airbus stated that its understanding of the regulatory requirements pertaining to filtered data differed from the intent of the rule but that it was willing to work with the FAA to correct the problem. In an October 25, 2002, letter to the FAA, Airbus provided the results of its survey, which indicated that the A310 and A300-600 models recorded filtered data for five parameters: aileron left, aileron right, rudder, elevator, and stabilizer position. Airbus also stated that it was willing to develop a service bulletin to increase the sampling rate for flight control parameters on existing and newly manufactured Airbus airplanes.

Factual Information 128 Aircraft Accident Report On November 6, 2003, the Safety Board issued Safety Recommendation A-03-50, which asked the FAA to take the following action: Require that within 2 years, all Airbus A300-600/A310 and Boeing 747-400 airplanes and any other aircraft that may be identified as recording filtered data be retrofitted with a flight data recorder system capable of recording values that meet the accuracy requirements through the full dynamic range of each parameter at a frequency sufficient to determine a complete, accurate, and unambiguous time history of parameter activity, with emphasis on capturing each parameter’s dynamic motion at the maximum rate possible, including reversals of direction at the maximum rate possible. On February 2, 2004, the FAA stated that FDRs either should not record filtered flight control surface parameters168 or, if filtered data were recorded, a proven and unambiguous method must exist for retrieving, to within required tolerances, the original unfiltered values from the filtered data. The FAA also stated that the most recent information on filtered flight control surface parameters revealed that the Boeing 747-400 does not filter such data, contrary to what was originally reported. The most recent information also revealed that the A320 rudder position parameter was filtered and not retrievable. Thus, the only transport-category airplanes determined by the FAA to have filtered, nonretrievable flight control surface parameters are the Airbus A310, A300-600, and A320. The FAA stated that it planned to initiate clarifying rulemaking to ensure that existing airplane FDR systems that record filtered, nonretrievable flight control surface parameters were corrected and to prevent future occurrences of such filtering. The FAA expressed its concern that 2 years would not be sufficient time to accomplish the necessary rulemaking, design, and incorporation of a cost-effective corrective action. On May 10, 2004, the Safety Board stated that the FAA’s planned actions were responsive to the intent of the recommendation. The Board recognized that displays of information used by a pilot to fly an airplane could be filtered but believed that a global exception that allowed filtering of all signals displayed to the pilot was unacceptable. The Board pointed out that unfiltered, high-sampling-rate flight control position data were critically important for accident/incident investigation purposes. These data could be displayed to pilots in many A310, A300-600, and A320 airplanes, but the pilots would not normally use this information to fly the airplane. The Board believed that the recording of filtered data should be limited only to those data that were normally displayed and used by the pilot for flying the airplane. Pending the issuance of the FAA’s planned rulemaking, Safety Recommendation A-03-50 was classified “Open—Acceptable Response.” 168 The FAA stated that it found no regulatory agreement on which non-flight control parameters, if any, should be unfiltered. According to the FAA, the European airworthiness authorities and the FAA agreed that certain recorded parameters should reflect the data displayed to the pilots and not the raw sensor data on which the displayed values were based. The FAA further stated that it planned to address the filtering of non-flight control parameters at a forum with participation from industry, airworthiness authorities, and the Safety Board and then take action on this issue based on the results of the forum.

Factual Information 129 Aircraft Accident Report 1.18.7.3.1 Public Meeting on Safety Recommendation A-03-50 On July 7, 2004, the FAA held a public meeting to discuss issues related to Safety Recommendation A-03-50. The purpose of the meeting was to determine the aviation industry’s position on the definitions of “parameter filtering” and “readily retrievable data,” the parameters that should not be filtered, and the impact of incorporating the Safety Board’s recommendation. Representatives from the Safety Board, Airbus, Boeing, the Allied Pilots Association, and the Air Line Pilots Association made presentations at the meeting. All of the meeting participants indicated that they were against data filtering except Airbus, which indicated that its airplanes met the intent of 14 CFR 121.344. 1.18.8 Aircraft-Pilot Coupling According to a 1997 report by the National Research Council (NRC),169 “unfavorable aircraft-pilot coupling (APC) events are rare, unexpected, and unintended excursions in aircraft attitude and flight path caused by anomalous interactions between the aircraft and the pilot.” APC events can be oscillatory or divergent, and the coupling between the pilot and the aircraft can either be open- or closed-loop, depending on the complexity with which the pilot is controlling the aircraft. When the pilot dynamics and the aircraft dynamics, including the flight control system dynamics, combine to produce an undesirable and unstable system, an APC event results. Although these events are rare, they can be catastrophic. APC events include a trigger, which causes the pilot to alter his or her control strategy; specifically, the pilot switches from a low-gain to a high-gain piloting technique.170 The three types of triggers associated with APC events are pilot triggers, which result when a pilot overcontrols the aircraft or responds with an inappropriate reaction to a stimulus; environmental triggers,171 which typically involve an environmental circumstance that causes the pilot to enter destabilizing control inputs (for example, atmospheric turbulence or the threat of imminent collision); or vehicle triggers, which typically involve changes in the aircraft’s response to control inputs or changes in the feedback to the pilot, resulting in inconsistencies between the pilot’s input strategy and the aircraft dynamics.172 A trigger alone will not result in an APC event; the dynamics of the aircraft’s flight control system also have to be susceptible to such an event. Although much research has been completed concerning adverse interactions between pilots and aircraft, APC events are often complex situations that are difficult to analyze. As a result, during flight testing 169 National Research Council, Aviation Safety and Pilot Control – Understanding and Preventing Unfavorable Pilot-Vehicle Interactions (Washington, DC: National Academy Press, 1997). 170 According to the NRC report, pilot gain is the sensitivity with which the pilot reacts to a given stimulus. If the situation is urgent, the pilot is likely to react with large corrective inputs, even for small system errors. When this situation happens, the pilot is said to be exhibiting high gain. More relaxed responses imply a lower pilot gain. 171 An environmental trigger may increase a pilot’s stress level, resulting in increased pilot gain. 172 Environmental or vehicle triggers often precede pilot triggers.

Factual Information 130 Aircraft Accident Report and certification, test pilots perform specific maneuvers to help reveal potential aircraft susceptibility to APC events (see section 1.18.8.1). The NRC report provided specific design goals to be used in developing flying qualities requirements for APC prevention. These design goals include the following: • The system should perform consistently throughout as much of the flight envelope as possible so that the pilot will not incorrectly change behavior based on the system response. • The system should achieve predictable input-output characteristics, should be designed for linear proportional responses, and should avoid nonlinear control system characteristics (that is, responses that are not proportional to input). • The maximum maneuvering rates and severe turbulence should not result in actuator rate and/or position limiting. • The system should strive to minimize the number of modes and failure states consistent with aircraft performance requirements. Finally, the NRC report made the following finding and recommendation, respectively: Operational line pilots have little or no exposure to APC potential and are not trained to recognize the initial symptoms or to understand that APC does not imply poor airmanship. This may limit reporting of APC events. Insufficient attention to APC phenomena generally seems to be associated with a lack of understanding and relevant experience. This shortcoming should be addressed through improved education about APC phenomena for pilots and other personnel involved in aircraft design, simulation, testing, certification, operation, and accident investigation. 1.18.8.1 Aircraft-Pilot Coupling Testing Maneuvers AC 25-7, “Flight Test Guide for Certification of Transport Category Airplanes,” which was issued in April 1986, provided guidelines for flight test methods and procedures to show compliance with the regulations contained in subpart B (airplane performance and handling characteristics) of 14 CFR Part 25. AC 25-7A was issued in March 1998 and was revised in June 1999. AC 25-7A contained APC testing guidance that was not included in AC 25-7. AC 25-7A stated that capture (gross acquisition) tasks and fine tracking tasks could highlight APC problem areas that might exist.173 For example, AC 25-7A stated that 173 AC 25-7A states that capture tasks can give the pilot a general impression of the handling qualities of the airplane. Various capture tasks—for pitch attitude, bank angle, heading, flightpath angle, AOA, and G— can be done to evaluate different aspects of the airplane’s response as long as the necessary cues are available to the pilot. AC 25-7A also states that capture tasks should not be used as the only evaluation task because they would not expose all of the problems that might arise in closed-loop, fine tracking tasks.

Factual Information 131 Aircraft Accident Report heading capture tasks (usually small heading changes of 5º or less) could be used to evaluate the “yaw controller” (that is, the rudder) alone. The AC did not include bank angle capture tasks for evaluating the yaw controller. Also, AC 25-7A stated that fine tracking tasks using pitch and roll controls would expose APC susceptibility of an airplane flying in turbulence. These fine tracking tasks would not involve the use of the rudder. In addition, AC 25-7A listed upset and/or collision avoidance maneuvers that were found to be effective in evaluating APC susceptibility when the airplane was flying at high altitude and under lateral load conditions of 0.3 G. None of these maneuvers would involve the use of the rudder. Finally, AC 25-7A stated that “artificial trim and feel systems which produce controllers with too small a displacement and light force gradients may also lead to severe over control.” 1.18.9 Reports of Rudder Use in Upset Recovery Efforts NASA’s ASRS included the results of a special study of uncommanded, in-flight upsets aboard multiengine turbojet aircraft in the United States. During a 6-month period from May 1 to October 31, 1995, 33 such upsets were reported, most of which were induced by wake turbulence. Structured telephone interviews were conducted for all pilots who reported those upsets. The telephone interviews indicated that wake turbulence was the most common cause of these upsets and that pilots used rudder during recovery efforts in 11 (one-third) of the 33 reported upset events. The Safety Board reviewed the ASRS database and found the following reports of rudder use by transport-category pilots in response to wake turbulence events: • The flight crew of a 737 being vectored on approach reported that the airplane sustained a high rate of roll from wake turbulence that resulted in an estimated bank angle of 20º. The flying pilot responded by applying a substantial amount of rudder in addition to most of the available aileron. • The captain of a 737 airplane on final approach reported that the airplane encountered a steady roll to the left from wake turbulence and reached an estimated bank angle of about 25º. The flying pilot (a student captain on an initial operating experience examination) applied full right rudder and aileron to recover. The flying pilot subsequently stated that unusual attitude training was an important factor in his “proper” response. • The flight crew of a 757 on short final reported that the airplane experienced wake turbulence, resulting in two rolling events. The captain, who was the flying pilot, reported that he applied rudder and aileron to stop the initial bank angle, which was estimated to be about 15º to 20º. The airplane then rolled sharply in the opposite direction. The captain reported that he applied full rudder and aileron until the airplane reached a bank angle of about 40º to 45º, at which time he initiated a successful missed approach. The FDR showed bank angles of 15º or less.

Factual Information 132 Aircraft Accident Report • The captain of a 727 flying at an altitude of 12,000 feet and an airspeed of 250 knots reported that the airplane experienced wake turbulence, resulting in two rolling events. The first officer (the flying pilot) applied full rudder and aileron to stop the first roll at about 35º of bank. The first officer then applied full rudder and aileron in the opposite direction to stop a second bank, which began about 3 to 4 seconds later in the opposite direction and might have resulted in more than 35º of bank. The captain commended the first officer for regaining control without overcontrolling and aggravating the situation. 1.18.10 Airbus Technical Note On April 8, 2004, Airbus issued a technical note, titled “AAL 587 – Pedals Force Analysis,” that provided Airbus’ estimate of the rudder pedal forces during the seconds before the vertical stabilizer separated from the airplane. Airbus used FDR data for rudder pedal position, estimates of rudder position, estimates of yaw damper position, and ground test data to derive the pedal force estimate. The technical note indicated that, during the accident sequence, the forces applied by the first officer to the rudder pedals were much higher than the forces required to reach the rudder travel limit for 240 knots. Airbus found that the highest force applied by the pilot during the accident sequence was about 140 pounds but that the pedal force required to reach the rudder travel limit during that time was about 30 pounds. The note further indicated that the rudder control cable was stretched each time that the rudder travel limit was contacted.

133 Aircraft Accident Report 2. Analysis 2.1 General The captain and the first officer (the flying pilot) were properly certificated and qualified under Federal regulations. No evidence indicates any preexisting medical conditions that may have adversely affected the flight crew’s performance during the flight. Flight crew fatigue was not a factor in this accident. The accident airplane was properly maintained and dispatched in accordance with Federal regulations. Before takeoff, the number 2 pitch trim and yaw damper system would not engage. American Airlines avionics technicians found a fault with the number 2 flight augmentation computer, and the fault cleared when the circuit breaker for this computer was reset. The air traffic controllers who handled American Airlines flight 587 were properly trained and qualified. The local controller complied with Federal Aviation Administration (FAA) wake turbulence spacing requirements when handling flight 587 and Japan Air Lines flight 47, which departed immediately before flight 587. Flight 587’s vertical stabilizer and rudder separated from the fuselage before impact and were recovered separately about 1 mile before the main wreckage site. At 0915:58.5, the flight data recorder (FDR) recorded a 0.2 G lateral acceleration, which corresponded to the sound of a loud bang recorded by the cockpit voice recorder (CVR) at the same time. The Safety Board’s airplane performance study indicated that this change in lateral acceleration and the ensuing out-of-control airplane motion resulted from the separation of the vertical stabilizer from the fuselage. In addition, the study showed that, before vertical stabilizer separation, the airplane responded properly to all rudder deflections and that the rudder remained properly attached until the vertical stabilizer broke off the fuselage. (The vertical stabilizer separation is discussed further in section 2.2.) Both engines separated from the airplane before ground impact. Neither engine showed evidence of uncontainments, case ruptures, or preimpact failure, and engine operation was normal throughout the airplane’s ground operations, takeoff, and initial climb. FDR and CVR data showed that engine separation occurred during the out-of-control airplane motion that followed the separation of the vertical stabilizer. Fuel may have been ignited during the engine separation and may have caused a flash fire. Also, during the airplane’s descent, the out-of-control motion would have disrupted the airflow into the engines and likely caused engine compressor surges. (Visible flames emanating from the engines are typical during engine compressor surges.) Therefore, the

Analysis 134 Aircraft Accident Report Safety Board concludes that the witnesses who reported observing the airplane on fire174 were most likely observing a fire from the initial release of fuel or the effects of engine compressor surges. Shortly after takeoff, flight 587 encountered wake turbulence from Japan Air Lines flight 47—first at 0915:36 and again at 0915:51. Immediately after the onset of flight 587’s second wake turbulence encounter (about 7 seconds before the vertical stabilizer separation), the FDR recorded a series of five cyclic movements of the rudder and rudder pedals. The Safety Board’s investigation did not reveal any indication of a mechanical failure that could have caused these movements. The Board’s ground tests of the rudder control system on another A300-600 revealed that rudder movement created by a yaw damper or an autopilot input to the system resulted in an FDR recording of the rudder and rudder pedal parameters that did not match the timing and sequence of the movements recorded by flight 587’s FDR. The only way to move the rudder in a manner that created an FDR trace of these parameters that matched flight 587’s FDR trace was for the pilot to depress the rudder pedals. Therefore, the Safety Board concludes that flight 587’s cyclic rudder motions after the second wake turbulence encounter were the result of the first officer’s rudder pedal inputs. (Possible explanations for the first officer’s rudder pedal inputs are discussed in section 2.3.) During the time that the first officer was making the five cyclic rudder pedal inputs, the captain began to question him (at 0915:55 he asked, “you all right?”) and coached him (at 0915:56 he said, “hang on to it”). However, the captain did not intervene or take control of the airplane, which would have been within his authority as pilot-in-command. It appears that the captain believed that the wake was causing the airplane motion, even after the vertical stabilizer had separated from the airplane (saying, at 0916:12, “get out of it, get out of it”). It would have been difficult for the captain to observe the first officer’s rudder pedal inputs.175 Accordingly, given the captain’s limited knowledge of the circumstances and the short duration of the accident sequence, the captain’s response to the situation was understandable. 2.2 Separation of the Vertical Stabilizer The in-flight separation of the vertical stabilizer from the fuselage of a transport-category airplane is an extremely rare,176 if not unprecedented, occurrence. To evaluate and understand the circumstances of the vertical stabilizer separation on flight 587, the Safety Board examined the vertical stabilizer structure to evaluate its conformity with design specifications, analyzed the fracture and damage patterns indicated by the wreckage, calculated the aerodynamic loads on the vertical stabilizer and analyzed their effects on the structure during flight, assessed the most likely failure 174 Of the 354 witnesses that provided sufficient detail to document, 56 percent reported seeing the airplane or a portion of the airplane on fire at some point during their observation. 175 It is not possible to determine whether the captain’s feet were resting on his rudder pedals. However, if his feet had been resting on the pedals, the captain could have felt the pedal movements made by the first officer.

Analysis 135 Aircraft Accident Report scenarios using vertical stabilizer structural models, conducted three postaccident static lug tests, and evaluated certification documents. No deviations from the original design and materials specifications were found in the vertical stabilizer (including the repair to the left center lug area that was made during manufacturing) that would have contributed to the vertical stabilizer separation. Also, a detailed inspection of flight 587’s wreckage, including an extensive examination of the vertical stabilizer main attachment fitting fractures, revealed that each main attachment fitting had features that were consistent with overstress fracture and exhibited no evidence of fatigue features or other preexisting degradation. Fracture features and damage patterns on the right forward, center, and rear lugs were consistent with overstress failure under tensile loading. The right rear lug, in particular, had fracture features that were consistent with failure in the cleavage-tension mode. Fracture features and damage patterns on the left forward, center, and rear lugs had features that were consistent with the vertical stabilizer bending to the left after separation of the lugs on the right side. Safety Board investigators conducted an airplane performance study to describe the motion of the accident airplane, identify the causes of the motion, and calculate the resulting aerodynamic loading on the vertical stabilizer.177 The airplane performance study revealed that the first officer’s cyclic rudder pedal inputs, which began about 7 seconds before the vertical stabilizer separation, led to increasing sideslip angles that, along with the continued rudder deflections, produced extremely high aerodynamic loads on the vertical stabilizer. The airplane performance study indicated that, at 0915:58.4, when the vertical stabilizer separation began, the aerodynamic loads on the vertical stabilizer were about two times the loads defined by the limit load design envelope (see figure 15).178 Given the aerodynamic loads at the time that the vertical stabilizer separated, it can be determined that the vertical stabilizer’s structural performance was consistent with design specifications and had exceeded certification requirements. However, to determine if stresses in the vertical stabilizer at the time of failure corresponded to a material failure, 176 On March 5, 1966, British Overseas Airways flight 911, a Boeing 707, departed Tokyo for Hong Kong with 124 people and the cabin crew aboard. Because of the clear weather at the time, the pilot asked for and received an amendment to the scheduled flight plan that would allow his passengers an up-close view of Mt. Fuji. Shortly after the airplane began its descent toward the mountain, witnesses reported seeing the airplane trailing white vapor and shedding pieces. The witnesses also reported that they saw a large puff of vapor that came from the airplane’s vertical stabilizer and that the airplane pitched up and entered a flat spin. The witnesses further reported that the vertical stabilizer assembly and engines were missing, the outer wing had failed, the forward fuselage broke off, and the airplane continued in a flat spin until it crashed into the base of Mt. Fuji. All of the airplane occupants were killed. The report on this accident indicated that, when approaching Mt. Fuji, the airplane was violently impacted by a severe mountain wave, which led to vertical stabilizer failure and subsequent in-flight breakup. (A U.S. Navy aircraft, which was dispatched to search for the flight 911 wreckage, encountered extreme turbulence near the area of the crash. In fact, the G meter installed on the U.S. Navy aircraft registered +9 to -4 Gs during the flight.) The report also identified the white vapor as jet fuel flowing out of the airplane after separation of the engines. 177 For more information about the airplane performance study, see section 1.16.2. 178 Limit load is the maximum load to be expected in service, and ultimate load is limit load multiplied by a safety factor of 1.5. During public hearing testimony, an FAA airframe engineer stated that airplanes are expected to experience limit load only once in their lifetime and are never expected to experience ultimate load. For more information, see section 1.6.4.1.1.

Analysis 136 Aircraft Accident Report the Safety Board conducted a detailed structural analysis of the accident condition. The structural analysis was to determine if the aerodynamic loading on the flight 587 vertical stabilizer was sufficient for fracture of the attachment lugs and subsequent separation of the vertical stabilizer and the sequence in which such a separation would progress. The structural analysis included an assessment of Airbus’ full-scale certification test, which was conducted during the design and certification process to demonstrate that the vertical stabilizer could withstand limit and ultimate loads. During the test, the vertical stabilizer was loaded to about two times the design limit load for the lateral gust condition before the left rear main attachment lug fractured because of a tensile static overload. The test revealed that the lug fractured with a resultant lug force of about 905 kiloNewtons (kN), which was about twice the calculated resultant lug force at limit load for the A300-600 lateral gust condition (454 kN when calculated using hot and wet conditions). The test also revealed that the failure mode of the rear main attachment lug was consistent with a cleavage-tension failure. In the structural analysis of the accident condition, computational models predicted that, with increasing aerodynamic loads, the right rear lug would experience increasingly higher stresses that would eventually exceed the strength of the lug material and the right rear lug would be the first structural component to fracture. The models showed that this fracture would occur when the resultant lug forces and associated stresses reached about twice those defined by the lateral gust limit load condition; that is, they were well in excess of the forces and stresses corresponding to ultimate load (which are 1.5 times those defined by the lateral gust limit load condition). The models further showed that the fracture would be consistent with failure in the cleavage-tension mode and would quickly progress through the lug until it completely fractured. The remaining five main attachment fittings and six transverse load fittings would then fracture, causing the vertical stabilizer to separate from the fuselage. In addition, the results of a postaccident analysis of Airbus’ full-scale certification test were consistent with the results of that test. The postaccident analysis revealed that the lug stress and strain profiles for the accident condition were in agreement with the full-scale certification test. To validate the computational models used in the structural analysis, the Safety Board performed static lug tests on three vertical stabilizer rear attachment lugs and compared the test results to the predictions of the models. For all three lug tests, the resultant forces and strain levels at failure were about twice those defined by the limit load lateral gust condition, as predicted by the computational models. Further, the fracture of each lug was consistent with failure in the cleavage-tension mode, as predicted by the computational models and observed on the accident right rear lug. Thus, on the basis of all of the evidence discussed in this section, the Safety Board concludes that flight 587’s vertical stabilizer performed in a manner that was consistent with its design and certification. The vertical stabilizer fractured from the fuselage in overstress, starting with the right rear lug while the vertical stabilizer was exposed to aerodynamic loads that were about twice the certified limit load design envelope and were

Analysis 137 Aircraft Accident Report more than the certified ultimate load design envelope. Because these aerodynamic loads were caused by the first officer’s rudder pedal inputs, the analysis of these rudder pedal inputs is of central importance to this investigation. 2.3 Analysis of the First Officer’s Rudder Pedal Inputs The Safety Board’s investigation determined that three main factors influenced the first officer’s rudder use during the accident sequence: a tendency to react aggressively to wake turbulence, as evidenced by his responses to previous wake turbulence encounters; his pilot training, including the training he received at American Airlines regarding wake turbulence, upset recovery, and rudder pedal use; and the characteristics of the A300-600 rudder control system. This analysis describes each of these factors and considers how they may have affected the first officer’s rudder use (that is, his initial rudder input in response to the second wake turbulence encounter and his subsequent series of cyclic rudder pedal inputs) during the flight 587 accident sequence. 2.3.1 First Officer’s Reactions to Wake Turbulence Encounters Safety Board investigators interviewed several American Airlines pilots who had flown with the first officer. Even though the comments were generally positive, two pilots provided noteworthy accounts concerning the first officer’s reaction to wake turbulence encounters. One pilot, a 727 captain, recalled a 1997 flight on which the accident first officer was the flying pilot. According to the captain, the airplane encountered wake turbulence at an altitude of 1,000 to 1,500 feet during climbout. The captain said that the encounter was momentary and that he thought it required only a small aileron input to roll the airplane to wings level. However, the first officer responded by making a series of rapid, alternating full rudder pedal inputs. The captain recalled being startled by the first officer’s response and thinking the rudder pedal inputs were quite aggressive. He recalled that the inputs created an uncomfortable yawing moment with heavy side loads on the airplane.179 The captain said that he had never seen any other pilot react to wake turbulence in this manner. On the basis of the captain’s recollections, it appears that the first officer overreacted to this wake turbulence encounter. 179 The Safety Board notes that the 727, which has fuselage-mounted engines, requires comparatively less yawing moment from the rudder to counter an engine-out condition than airplanes with wing-mounted engines, such as the A300-600. Consequently, the yawing moment (and airplane response) resulting from a given rudder deflection is likely to be less pronounced on the 727 than on the A300-600.

Analysis 138 Aircraft Accident Report According to the 727 captain, when he questioned the first officer about his rudder pedal inputs, the first officer stated that he had used the rudder to level the wings and insisted that the company’s Advanced Aircraft Maneuvering Program (AAMP) training directed him to use rudder in that manner.180 The captain stated that he counseled the first officer to be less aggressive in his rudder inputs.181 The captain recalled that, on a subsequent flight, the first officer was still very quick to use the rudder during a wake turbulence encounter, although he did not think the first officer had pushed the rudder pedal to its stops on that occasion. The other pilot who provided an account concerning the first officer’s reaction to wake turbulence encounters was the flight engineer on a 1997 flight in a 727 being flown by the accident first officer. According to the flight engineer, when the airplane was on approach at an altitude of between 3,000 and 5,000 feet and about 7 miles from the runway, the airplane encountered wake turbulence from a preceding 737. The flight engineer said that the airplane rolled, but he did not think that the bank angle was greater than 30o. According to the flight engineer, the first officer reacted by immediately applying maximum engine power and executing a go-around. The flight engineer said that it was one of the more memorable events in his flying career. The Safety Board notes that the 727 is larger than the 737 (the airplane producing the wake) and that the flight was operating at an altitude with adequate ground clearance at the time of the wake turbulence encounter. In this situation, a go-around would not have been necessary; therefore, it appears the first officer overreacted to this wake turbulence encounter. Two wake turbulence issues were also present before the accident sequence. First, after receiving clearance for takeoff, the first officer asked the captain whether he was happy with the separation distance behind Japan Air Lines flight 47.182 The captain indicated that he was satisfied, and the takeoff proceeded. The first officer’s question would be expected in this situation and shows that he was aware of the potential for encountering wake turbulence after flight 587 became airborne. Second, about 0915:36, flight 587 encountered mild wake turbulence from Japan Air Lines flight 47. The effect of the turbulence was typical of a minor wake encounter—a momentary 0.3 G drop in normal load factor, a 0.04 G drop in longitudinal load factor, and a 0.07 G shift in lateral load factor. However, the first officer reacted to this first wake turbulence encounter by moving the control wheel rapidly right and left several times, with large control wheel deflections up to 37o right and 34o left.183 Board investigators noted, during vertical 180 The influence that the AAMP training may have had on the first officer is discussed in section 2.3.2.2. 181 The Safety Board notes that the captain did not admonish the first officer for using the rudder in response to wake turbulence but rather for the magnitude of his rudder pedal inputs. The use of rudder by other pilots in response to wake turbulence is discussed in section 2.4.1.1. 182 Air traffic control had cautioned the pilots about wake turbulence from Japan Air Lines flight 47 while instructing them to taxi into position and hold. 183 The Safety Board notes that the maximum available wheel deflection is 78° in either direction. Despite the first officer’s rapid wheel movements, the airplane remained in relatively level flight because the inputs were not held long enough to allow the airplane to respond.

Analysis 139 Aircraft Accident Report motion simulator testing, that these wheel movements seemed excessive for the momentary effect that the wake turbulence encounter had on the airplane. On the basis of the two pilots’ accounts of the accident first officer’s response to wake turbulence on prior flights and his reaction to flight 587’s first wake turbulence encounter, the Safety Board concludes that the first officer had a tendency to overreact to wake turbulence by taking unnecessary actions, including making excessive control inputs. 2.3.2 Training Factors The Safety Board’s investigation determined that pilots have generally had little exposure to, and therefore may not fully understand, the effect of large rudder pedal inputs in normal flight or the mechanism by which rudder deflections induce roll on a transport-category airplane. In addition, American Airlines’ AAMP training may have reinforced the first officer’s tendency to respond aggressively to wake turbulence, encouraged the use of full rudder pedal inputs and misrepresented the airplane’s actual response to large rudder inputs. Finally, A300-600 pilots (including those at American Airlines) were not well trained regarding the airplane’s reduction in rudder pedal travel with increasing airspeed. 2.3.2.1 Lack of Pilot Exposure Regarding Airplane Response to Large Rudder Pedal Inputs Most control inputs on transport-category airplanes occur in the pitch and roll axes. Consequently, through flight experience and training, pilots readily understand how airplanes respond to control column and wheel inputs during normal flight conditions. However, many pilots have only limited exposure to airplane responses to rudder pedal inputs (which primarily affect the yaw axis). In transport-category airplanes, rudder pedal inputs in the yaw axis are generally limited to aligning the airplane with the runway during crosswind landings and controlling engine-out situations. These maneuvers do not provide a sense of how large-magnitude rudder inputs at a high airspeed will create a yaw rate and sideslip angle buildup followed by a very large rolling moment. Abrupt rudder inputs can result in an overswing,184 which results in much greater yaw and sideslip angles than a steady-state sideslip. The roll rate resulting from this overswing is also amplified. Aligning the airplane with the runway during a crosswind landing involves using the rudder to create a sideslip (the resulting rolling moment is countered with the control wheel), and controlling an engine-out situation involves deflecting the rudder to counteract the yaw asymmetry resulting from the failed engine and minimize sideslip. Crosswind landings are relatively common. Engine-out situations are rare, but pilots receive extensive simulator training in handling engine-out situations. The most demanding engine-out situations occur shortly after takeoff, when an engine failure 184 An overswing results when a rapid rudder input is applied. An overswing is a sideslip angle that is initially greater than the steady-state sideslip angle resulting from the same rudder input and occurs because of the slightly underdamped nature of the airplane’s motion in the yaw axis.

Analysis 140 Aircraft Accident Report creates a large yawing moment because of the high thrust setting of the engines and when the effectiveness of the rudder is reduced by low airspeeds. In such situations, up to full deflection of the rudder may be required to balance the engine thrust. Both landing alignment maneuvers and engine-out maneuvers on takeoff occur at low airspeeds, so pilots’ use of a significant rudder deflection (and, consequently, their exposure to the characteristics of the rudder control system) occurs predominately at low airspeeds. Neither maneuver involves using the rudder to roll the airplane. Further, a pilot who attempts to use the rudder pedals to roll a transport-category airplane will experience a significant phase lag between the pedal input and the development of roll rate. The phase lag exists in part because the roll response is a secondary effect of the yawing moment generated by rudder movement; roll does not result from the rudder input directly. The airplane will initially yaw in response to a rudder pedal input, creating a change in sideslip angle; as the sideslip angle develops, it generates a rolling moment that rolls the airplane. Consequently, the rolling moment depends primarily on the sideslip angle (not the rudder angle), and the airplane can continue to develop a rolling moment in one direction, even though the rudder is subsequently deflected in the opposite direction. The rolling moment will only reverse after the sideslip angle reverses. If the motion of the airplane becomes highly dynamic with large yaw and roll rates and sideslip angles (such as those that would result from large rudder inputs), the relationship between the pedal inputs and the roll response of the airplane can become confusing. The coupling of the yaw and roll axes, the magnitude of the rolling moment that can eventually develop from the large rudder inputs, and the potential for yaw overswing resulting from abrupt rudder inputs are phenomena that are likely outside of most line pilots’ experience. Therefore, it is likely that most line pilots have not developed sufficient awareness and understanding to correctly anticipate an airplane’s response to such large rudder inputs. As a result, they would likely be surprised and confused if they were to encounter such responses in flight. (This issue is discussed in more detail in section 2.3.3.) 2.3.2.2 American Airlines Advanced Aircraft Maneuvering Program 2.3.2.2.1 Ground School Training During the AAMP ground school that the first officer attended (in March 1997), pilots were instructed that the rudder could be used to assist in controlling the airplane’s roll angle during upsets and unusual attitudes. For example, a videotape that was made during an actual AAMP class that occurred during March or April 1997 showed the instructor telling pilots that, under certain circumstances, a small, smooth application of rudder in the same direction as the control wheel was a good piloting technique. The tape showed the instructor stating, “Now some of you out there might say, ‘well, I’m going to use a little coordinated rudder to help the nose come down.’ Fine, that’s fine, that’s good technique. A little, OK, smoothly applied.”185 185 For more information about the content of the AAMP, see section 1.17.1.2.

Analysis 141 Aircraft Accident Report Further, the AAMP flight training booklet, which accompanied the AAMP ground school instruction at the time that the first officer attended the training, discussed wake turbulence as a factor that had caused an increase in loss of control accidents and incidents and reiterated the use of rudder as the most effective roll control device at high angles of attack. Pilots were also instructed during classroom training that even full rudder inputs could be appropriate in certain extreme situations. Therefore, the Safety Board concludes that the American Airlines AAMP ground school training encouraged pilots to use rudder to assist with roll control during recovery from upsets, including wake turbulence. 2.3.2.2.2 Simulator Training The AAMP excessive bank angle recovery simulator exercise186 may also have contributed to an inaccurate understanding of the need for, or effects of, rudder use in response to wake turbulence. The Safety Board notes that this simulator exercise scenario was somewhat similar to the circumstances of flight 587. During the simulator exercise, pilots were told they were taking off behind a heavy 747 and were issued the appropriate wake turbulence warnings. As a result, pilots would likely expect the possibility of a wake turbulence encounter. During climbout, the simulator depicted a little light chop, followed by the airplane rolling in one direction to about 10o. The similarity to flight 587 ended at this point because the simulator then depicted the airplane quickly rolling to beyond 90o in the opposite direction.187 The presentation of the upset would, more than likely, cause pilots to associate the uncontrollable roll to beyond 90° with a wake turbulence encounter. However, this wake turbulence encounter scenario is unrealistic for an A300-600. The Safety Board is aware of no accidents involving a heavy transport-category airplane departing from controlled flight as the result of a wake turbulence encounter.188 A study conducted by the Flight Safety Foundation, which reviewed Safety Board accident data, FAA incident data, and NASA Aviation Safety Reporting System (ASRS) pilot reports, concluded that wake turbulence encounters were less frequent and less severe for large transport-category airplanes such as the A300-600 than for smaller transport-category airplanes. Also, ASRS wake turbulence reports indicated that the maximum bank angle estimated by pilots was usually 30o or less, and none were greater than 60o.189 Further, the Board’s experience shows that pilot estimates of bank angle disturbances are often overstated and inaccurately large compared with actual FDR data. 186 For more information about this exercise, see section 1.17.1.2.3. 187 According to American Airlines, the objective of the excessive bank angle recovery exercise was to force the airplane into an unusual roll attitude (beyond 90o) to train pilots to recognize and recover from this flight condition. 188 According to the Safety Board’s aviation accident database, the last fatal air carrier accident caused by wake turbulence in the United States involved a DC-9 (a large transport-category airplane) in 1972 before the current air traffic control separation standards were adopted. See Delta Air Lines, Inc., McDonnell Douglas DC-9-14, N3305L, Greater Southwest International Airport, Fort Worth, Texas, May 30, 1972, Aircraft Accident Report NTSB/AAR-73/03 (Washington, DC: NTSB, 1973). 189 These wake turbulence events occurred between 1988 and 1999 and involved a large transport- category airplane, such as the A300-600, as the trailing airplane.

Analysis 142 Aircraft Accident Report Consequently, the AAMP excessive bank angle simulator exercise, which rolled an A300 to more than 90o as the result of an implied wake turbulence encounter, was misleading and might have contributed to an inaccurate expectation that wake turbulence encounters in an A300 could be potentially catastrophic events, requiring immediate and aggressive pilot response. The Safety Board also learned that, to ensure that the airplane reached a 90o bank angle during the excessive bank angle simulator exercise, American Airlines inhibited the aerodynamic effectiveness of control wheel and rudder pedal inputs during the initial portion of the roll upset. The effectiveness of the ailerons and rudder was not restored until 10 seconds after the upset was introduced or a bank angle of 50º was achieved (whichever came first), allowing the airplane to recover. Pilots were unaware that the flight controls were ineffective during the initial portion of the upset, yet instructors commonly briefed pilots to react quickly to the upset.190 The suppression of the aileron and rudder inputs during the initial part of the excessive bank angle simulator exercise would have promoted an inaccurate understanding of the proper use and effectiveness of the flight controls. Because no control input could prevent the airplane from rolling to 90° or more, a pilot might learn to position the controls at their full deflections to minimize the recovery time after the maximum bank angle was reached, even though the flight condition at the time might not call for full deflections. Because such full control inputs would have been an effective and appropriate recovery technique during the simulator exercise, a pilot might understandably expect similar results in an actual airplane. Because the excessive bank angle simulator exercise was programmed so that the airplane would not initially respond to control inputs, the exercise suggested that an external influence (the wake) was overpowering the controls and deprived the pilot of an opportunity to experience the actual airplane response to such inputs (including sideload accelerations), thus leaving the pilot with a misperception of the real effects of the inputs. This misperception could cause a pilot to be surprised or confused at the airplane’s actual significant response to full control wheel and full rudder pedal inputs during flight. The Safety Board recognizes that the intent of the AAMP excessive bank angle simulator training exercise was to teach pilots how to recover from an upset involving an unusual roll attitude of 90°. However, the scenario was unrealistic and might have had the unintended consequence of providing pilots with negative training in how to respond to wake turbulence. The presentation of an unrealistic scenario and the inhibition of flight controls could cause a pilot to develop control strategies that were effective in the simulator but might be inappropriate or even dangerous in an actual airplane. Therefore, the Safety Board concludes that the American Airlines AAMP excessive bank angle 190 Safety Board investigators interviewed three of the instructors who taught AAMP simulator exercises to the first officer. Two of the instructors stated that they taught pilots to input some rudder in this exercise; one instructor stated that, if pilots used only aileron to recover, they would put themselves in a sideslip, so a “little bit” of rudder was necessary. All three instructors indicated that a quick reaction was important.

Analysis 143 Aircraft Accident Report simulator exercise could have caused the first officer to have an unrealistic and exaggerated view of the effects of wake turbulence; erroneously associate wake turbulence encounters with the need for aggressive roll upset recovery techniques; and develop control strategies that would produce a much different, and potentially surprising and confusing, response if performed during flight. 2.3.2.3 Lack of Pilot Training on Restricted A300-600 Rudder Pedal Travel The Safety Board learned that, before the flight 587 accident, A300-600 pilots (including those at American Airlines) were not trained to understand that rudder pedal travel becomes limited as airspeed increases. (This feature of the A300-600 rudder control system is described in more detail in section 2.3.3.) Although the American Airlines A300 Operating Manual at the time of the accident noted that rudder deflection progressively decreased with airspeed and specified the amount of the deflection for low- and high-speed ranges, it contained no reference to the reduction in rudder pedal travel at higher airspeeds. Also, a company representative stated that, before the flight 587 accident, pilots were not instructed about the restricted rudder pedal displacement at higher airspeeds.191 In addition, although the Airbus A300-600 Flight Crew Operating Manual (FCOM) at the time of the accident noted that rudder pedal travel and rudder deflection were restricted as airspeed increased, the FCOM specified only the range of the restriction for the rudder deflection; the FCOM did not quantify the range of the restriction for the rudder pedals or mention that the pedal forces required to achieve maximum available rudder would be reduced as a result of the restricted pedal travel. A pilot’s lack of knowledge regarding restricted rudder pedal travel could lead to confusion if an unexpected pedal limit was encountered in flight. Specifically, as discussed further in section 2.3.3, at high airspeeds, less pedal travel is required to develop a yaw rate and sideslip angle than at low airspeeds; as a result, the airplane’s high-airspeed response to pedal inputs may seem out of proportion to the pedal input if the pilot is unaware of the pedal restriction and expects the range of pedal travel to be the same at all airspeeds.192 In such a situation, the pilot may fail to associate the airplane response with control inputs, instead attributing the response to some external cause (such as wake turbulence). Consequently, the pilot may not recognize the potential risk to the airplane and may continue making inappropriate control inputs. The Safety Board concludes that, before the flight 587 accident, pilots were not being adequately trained on what effect rudder pedal inputs have on the Airbus A300-600 at high airspeeds and how the airplane’s rudder travel limiter system operates. The Safety Board addressed this issue in Safety Recommendation A-02-01, which was issued February 8, 2002. Safety Recommendation A-02-01 asked the FAA to require 191 During the first quarter of 2003, the American Airlines A300 fleet standards manager went to the pilot bases and gave a presentation to all A300 pilots concerning subject areas that were identified as weak or nonexistent in training. The subject areas included vertical stabilizer sideforce characteristics, 14 Code of Federal Regulations (CFR) Part 25 certification, rudder travel limiter effects, rudder pedal force and displacement, and pilot input/yaw damper interaction. For more information, see section 1.17.1.3. 192 The use of the rudder at high airspeeds, other than for an engine failure, is rare.

Analysis 144 Aircraft Accident Report manufacturers and operators of transport-category airplanes to establish and implement pilot training programs that explained several points regarding rudder use, including that “certain combinations of sideslip angle and opposite rudder deflection can result in potentially dangerous loads on the vertical stabilizer, even at speeds below design maneuvering speed” and that, “on some aircraft, as speed increases, the maximum available rudder deflection can be obtained with comparatively light pedal forces and small pedal deflections.” In response, the FAA issued a notice that directed all principal operations inspectors (POI) to inform their air carriers about the Board’s concerns and contacted airplane manufacturers to inform them about the Board’s concerns. Airbus and Boeing prepared flight technical operations bulletins that highlighted these concerns, and the FAA indicated that resulting changes to the manufacturers’ airplane flight manuals might also result in changes in operators’ manuals. The Safety Board urges the FAA to verify that the actions taken to date in response to Safety Recommendation A-02-01 will result in all transport-category pilots gaining an accurate understanding of the operation of rudder travel limiter systems and the effects of rudder pedal inputs at high airspeed. The Board looks forward to receiving updated information on the FAA’s continuing efforts to implement Safety Recommendation A-02-01. 2.3.3 Characteristics of the A300-600 Rudder Control System Design The first officer’s use of rudder during the accident sequence may also have been influenced by characteristics of the A300-600 rudder control system design. As further explained in this section, the Safety Board analyzed the sensitivity of the rudder control system and determined that, even though the A300-600 rudder control system was found to have met all of the certification standards, the system is more sensitive than that on other transport-category airplanes. Pilots use the rudder to control an airplane about its yaw axis; however, as previously noted, pilots rarely exercise such control in flight except for aligning the airplane with the runway during crosswind landings and for controlling engine-out situations. On the basis of the results of the certification flight testing and the absence of any reported operational difficulties in controlling the airplane in these situations, the A300-600 rudder control system appears to meet all the certification requirements for yaw axis control and is well suited for these typical rudder use scenarios. With the advent in the mid-1990s of advanced maneuvering and upset training, such as the AAMP, transport-category pilots began to be trained to use the rudder in more than just the typical alignment maneuver and engine-out scenarios. Specifically, some airlines, including American, instructed their pilots that the rudder could also be used to assist the ailerons and spoilers in roll control under certain circumstances. However, because the rudder was not designed and certified for roll control, rudder systems might not be well suited for this use. Furthermore, the authority and sensitivity of the rudder

Analysis 145 Aircraft Accident Report control system may be much more critical when it is used for roll control than for the conventional scenarios. The Safety Board evaluated the sensitivity of the A300-600 rudder system to determine whether it played a role in the accident. Because there is no industry standard measure of pedal sensitivity, Board investigators defined, for the purposes of this evaluation, rudder pedal sensitivity as the lateral acceleration produced in the cockpit per pound of rudder pedal force above breakout force. Investigators also developed four metrics193 to compare various aspects of the A300-600 rudder control system design related to rudder pedal sensitivity with those of other transport-category airplanes, including the A300-600’s predecessors, the A300B2 and A300B4 (as shown in table 5).194 At 250 knots calibrated airspeed (KCAS), the A300-600 rudder pedal design showed the lightest pedal forces of all airplanes evaluated. In designing the A300-600, Airbus made two changes to the rudder control system originally used on the A300B2/B4, both of which had a significant effect on rudder pedal sensitivity. First, the amount of force required to depress the rudder pedals was decreased. According to Airbus, this change was made to maintain consistency with the control wheel forces, which were reduced in response to pilot feedback indicating a desire for lighter roll control (wheel) forces. The decrease in pedal force resulted in an increase in the A300-600 rudder pedal sensitivity. Second, the rudder travel limiter system was changed from a variable ratio design to a variable stop design. The variable ratio design allows a constant range of pedal travel but reduces the maximum possible deflection of the rudder through an internal limiter as airspeed increases. Consequently, a given pedal input results in reduced rudder deflection as airspeed increases. In contrast, the variable stop design limits both rudder deflection and rudder pedal travel as airspeed increases. With this design, a given amount of pedal input results in the same rudder deflection at all airspeeds, but the pedal travel (and consequently, pedal force) required to hit the pedal stops decreases as airspeed increases. With a variable ratio design, a given pedal input produces about the same airplane response in sideslip angle, yaw rate, and lateral accelerations at all airspeeds, but, with a variable stop design, a given pedal input produces a greater response for those parameters as airspeed increases. In other words, a variable stop design becomes more sensitive as airspeed increases. Specifically, as shown in figure 8, the A300B2/B4 variable ratio design has a relatively constant rudder pedal sensitivity at all airspeeds, whereas, with the A300-600 variable stop design, rudder pedal sensitivity significantly increases as airspeed increases. For example, the A300-600 is twice as responsive to a pedal displacement at 250 KCAS as it would be at 165 KCAS. The A300-600’s increase in rudder pedal 193 The metrics were (1) the ratio of maximum force to breakout force, (2) the degrees of rudder commanded per pound of force above the breakout force, (3) the pedal displacement as a percent of total displacement at low airspeed, and (4) the work involved in pushing the pedal to maximum. For more information, see section 1.6.2.3. 194 The Safety Board recognizes that these four metrics are not an exhaustive list and that other airplane design features may also affect rudder pedal sensitivity. For example, the Board’s metrics do not account for the yaw inertia of the airplane, which can depend on configuration characteristics, such as the number and location of engines.

Analysis 146 Aircraft Accident Report sensitivity as airspeed increases creates a control system change that pilots may not expect. Pilots may not be aware of the type of rudder control system that is installed on their airplanes or fully understand the characteristics of a variable ratio or variable stop rudder control system design because of the lack of explicit training or experience in this area. If a pilot assumed that the sensitivity of the rudder on any airplane remained relatively constant across a range of airspeeds, this assumption would lead to the erroneous expectation on an airplane equipped with a variable stop rudder travel limiter system that the response to a given pedal input, including the subsequent rolling moment, would be about the same regardless of the airspeed. The Safety Board emphasizes that the sensitivity of the variable stop rudder travel limiter system may be confusing to pilots only at higher airspeeds. In fact, the Board has found no indication of any undesirable sensitivity during conventional rudder use scenarios (that is, crosswind landings or engine-out situations). The Safety Board concludes that the Airbus A300-600 rudder control system couples a rudder travel limiter system that increases in sensitivity with airspeed, which is characteristic of variable stop designs, with the lightest pedal forces of all the transport-category aircraft evaluated by the Safety Board during this investigation. These characteristics likely played a role in the accident sequence, as discussed in section 2.4. 2.4 Analysis of the Accident Sequence The accident sequence began when the first officer made a right rudder pedal input in response to the second wake turbulence encounter. The accident sequence continued for 6.5 seconds as the first officer made five subsequent alternating full rudder pedal inputs until the vertical stabilizer separated from the airplane. As further explained in this section, a combination of the three factors discussed in section 2.3—the first officer’s tendency to react aggressively to wake turbulence, his pilot training, and characteristics of the A300-600 rudder control system design—influenced the first officer’s initial rudder pedal input and his subsequent alternating full rudder inputs. 2.4.1 Initial Rudder Pedal Input The second wake turbulence encounter occurred at 0915:51 while flight 587 was in a 23o left bank. This encounter produced momentary changes in the airplane’s load factor that were similar to those experienced during the first wake turbulence encounter 15 seconds earlier—a 0.4 G drop in normal load factor, a 0.06 G drop in longitudinal load factor, and a 0.05 G shift to the left in lateral load factor. The first officer reacted to this

Analysis 147 Aircraft Accident Report second wake encounter by moving the control wheel rapidly to the right. Further, unlike his response to the first wake encounter, the first officer also depressed the right rudder pedal. 195 The Safety Board considered why the first officer responded differently to the second wake turbulence encounter than he did to the first encounter. One possibility is the difference in the bank angle at the beginning of the two encounters. For the first encounter, the airplane was approximately wings level. Before the second encounter, the airplane was already in a 23º left bank, and, according to the Board’s simulations, the rolling moment generated by the second wake would have acted to roll the airplane (in the absence of countering control inputs) about 10º farther to the left and would have resulted in no significant yaw.196 However, if the first officer sensed a roll acceleration to the left while already in a left bank, he may have been prompted to react with a more aggressive control response. The Safety Board emphasizes that the second wake encounter did not place flight 587 in an upset condition, and the airplane’s response to the wake did not indicate that an upset was imminent.197 Therefore, the Safety Board concludes that the first officer’s initial control wheel input in response to the second wake turbulence encounter was too aggressive, and his initial rudder pedal input response was unnecessary to control the airplane. In analyzing the reason for these inputs, the Board evaluated the three factors discussed in section 2.3: the first officer’s reactions to wake turbulence encounters, training factors, and the A300-600 rudder control system design. 2.4.1.1 First Officer’s Reactions to Wake Turbulence Encounters As discussed in section 2.3.1, the first officer had a tendency to overreact to wake turbulence encounters, indicating an exaggerated concern with such encounters. The first officer expressed concern before takeoff about the spacing between Japan Air Lines flight 47 and flight 587, so he was clearly aware of the possibility of encountering wake turbulence. Further, the first wake turbulence encounter, although brief and minor, would have heightened the first officer’s awareness of the possibility of additional wake turbulence, thus preparing him to react to any subsequent encounter. Therefore, the initial rudder pedal input in response to the second wake turbulence encounter was consistent 195 Minor pedal movements (about 1º) were recorded on the FDR after the first wake encounter. However, these movements were not likely deliberate pedal inputs by the first officer. Further, the rudder movements recorded during this time were within the authority of the yaw damper and could have been the result of yaw damper inputs. 196 Nominal movement of the control wheel (and the corresponding aileron and spoiler deflection) could have countered this amount of additional roll. Further, the yaw damper is designed to compensate for yaw disturbances produced by standard wake turbulence. 197 The Airbus A300-600 FCOM and the joint industry Airplane Upset Recovery Training Aid defined upsets to include unintentional bank angles of greater than 45°. According to FAA Flight Standards Handbook Bulletin for Air Transportation 95-10, “Selected Event Training,” and American Airlines’ selected event training program, upset conditions include “excessive (greater than 90°) roll attitudes” and “high (greater than 35°) pitch attitudes.”

Analysis 148 Aircraft Accident Report with the first officer’s tendencies to overreact and overcontrol the airplane in response to wake turbulence encounters. The Safety Board notes that the first officer was not unique in responding to a wake turbulence encounter with a rudder pedal input. The ASRS special study of uncommanded, in-flight upsets found that pilots used rudder pedal inputs during recovery efforts in 11 (one-third) of the 33 reported events, most of which were induced by wake turbulence.198 Even the captain of the earlier 727 flight on which the first officer made a series of alternating full rudder pedal inputs did not admonish him for using the rudder in response to wake turbulence; rather, the captain cautioned the first officer only against making such large inputs. 2.4.1.2 Training Factors As discussed in section 2.3.2.2.2, the AAMP excessive bank angle simulator exercise was unrealistic because the airplane quickly achieved a 90o bank angle that pilots were led to believe resulted from the effects of a wake turbulence encounter. The roll upset recovery techniques taught during this exercise may have resulted in inappropriate (negative) training regarding the effects of wake turbulence and the proper response to it. Further, the inhibition of the flight controls during the initial part of the exercise misrepresented the true airplane response to large rudder inputs and could have led pilots to believe that large wheel and rudder pedal inputs would initially have little effect on the airplane. This misrepresentation could have imparted inappropriate training to overcontrol the airplane during a wake encounter and could contribute to surprise and confusion if large wheel and rudder pedal inputs were attempted in an actual wake turbulence encounter. Given his prior experiences with this simulator exercise,199 it is possible that, as the second wake hit flight 587, the first officer may have been concerned that the airplane was about to enter a hazardous bank angle upset and, therefore, responded with both the control wheel and rudder pedal as he had been encouraged to do in the simulator. However, the airplane’s response to the control wheel and rudder pedal was not what the first officer would have expected based on his simulator experience. In the simulator, despite using full wheel and possibly pedal, the airplane would still roll to 90°. However, during the accident sequence, the airplane responded to the first officer’s initial right control wheel input with an immediate and large right rolling moment. In addition, the airplane responded to the initial right rudder pedal input with a yawing moment to the right, which resulted in a left sideslip and an associated additional rolling moment to the right.200 Thus, the first officer was faced with an abrupt and aggravated rolling moment to the right while the airplane was developing a substantial right yaw and an abrupt heading change to the right. 198 For more information, see section 1.18.9. 199 The first officer received AAMP simulator training four times between November 1997 and December 2000. 200 The resulting rolling moment from the rudder input was slightly delayed from the lateral acceleration.

Analysis 149 Aircraft Accident Report 2.4.1.3 A300-600 Rudder Control System It is not known whether the first officer intended to command a large or a partial rudder deflection when he made his initial rudder pedal input. If his intention was to command a partial deflection, characteristics of the A300-600 rudder control system design might have contributed to the large magnitude of the deflection. As previously discussed, on the basis of the AAMP excessive bank angle simulator exercise (which depicted reduced control effectiveness) and the first officer’s apparent perception of the wake turbulence as an upset event, it is possible that the first officer thought a full rudder input would be an appropriate response. However, it is equally possible that the first officer may have intended to react to the wake turbulence with only a partial rudder pedal input and that the full rudder deflection that he achieved may have been the result of his lack of knowledge concerning the pedal restrictions or the sensitivity of the rudder control system. In either case, because of his lack of understanding of the rudder control system and the airplane’s response to rudder inputs at high airspeeds, the first officer was likely surprised and confused at the airplane’s response to his control inputs. 2.4.2 Subsequent Rudder Pedal Inputs The initial control wheel and rudder pedal inputs were not sufficient to develop the aerodynamic loads that ultimately caused the vertical stabilizer to separate from the airplane. The effects of four additional full rudder deflections (left-right-left-right) allowed the buildup of enough sideslip angle to achieve those loads. After the first officer made his initial rudder pedal input, he made a series of alternating full rudder inputs. The Safety Board’s airplane performance study revealed that the resulting motion of the airplane, including the hazardous buildup in sideslip angle that eventually led to the high loads that resulted in separation of the vertical stabilizer, was solely the result of these rudder pedal inputs and was not associated with the effects of wake turbulence. In fact, if the first officer had stopped making these inputs at any time before the vertical stabilizer separation, the natural stability of the airplane would have returned the sideslip angle to near 0º, and the accident would have been avoided. Therefore, it is crucial to analyze the factors that contributed to the sustained nature of the rudder pedal inputs made by the first officer: the role of training, the airplane’s response to the initial rudder pedal input as a potential triggering event for an adverse aircraft-pilot coupling (APC) event, and the characteristics of the A300-600 rudder control system design that may facilitate sustained, alternating rudder inputs. 2.4.2.1 Role of Training The Safety Board considered the role of training in the first officer’s inaccurate assessment of the airplane’s response to his initial rudder input. As already discussed, because most pilots are not trained in, and have no experience with, the effects of large or rapid rudder inputs at high airspeeds, it is likely that the large right yaw and subsequent rolling moment resulting from the first officer’s initial rudder pedal input were surprising and confusing to him. The first officer may have failed to perceive that his control wheel

Analysis 150 Aircraft Accident Report and rudder pedal inputs were the cause of the airplane motion in part because that motion may have appeared out of proportion to his pedal inputs. At 240 knots, the pedal would reach its stop with only about 30 percent of the pedal movement required during the rudder control check on the ground. In the absence of any specific training to the contrary, the first officer may have perceived that he was only using about 30 percent of the rudder authority (as opposed to all of it), making it harder for him to associate the airplane motion with his pedal inputs. This misperception of the cause of the airplane motion may also have been reinforced by the AAMP excessive bank angle exercise, during which the application of full rudder would have initially had no effect in recovering the airplane. Further, if the first officer was expecting the wake turbulence to have a large effect on the airplane, he may have found it very easy to ascribe the undesired motion to the wake rather than to his own control inputs. In addition, because the first officer’s initial control wheel and rudder pedal inputs to the right were apparently applied in response to the wake-induced roll to the left, the sudden acceleration of the airplane to the right (in response to his control inputs) could have been surprising. If the first officer believed that the airplane motion was a result of the wake, the sudden acceleration to the right may have led him to believe that the wake was acting to roll the airplane to the right. This belief, in turn, may have prompted a full and immediate application of control wheel and rudder pedal to the left. (This sequence of events would also be consistent with the AAMP excessive bank angle simulator exercise, which depicted a 10° roll in one direction followed by a 90° roll in the opposite direction after taking off behind a heavy airplane.) In summary, the first officer’s lack of training in the airplane’s actual response to rudder pedal inputs at high airspeeds and the negative training he received from the AAMP excessive bank angle simulator exercise may have contributed to his incorrect assessment of his interaction with the airplane during the accident sequence. In other words, because of these factors, the first officer likely did not recognize that the airplane’s motion was being caused by his control inputs rather than the wake turbulence. 2.4.2.2 Airplane Response to Initial Input as Triggering Event for an Adverse Aircraft-Pilot Coupling A 1997 National Research Council (NRC) report provides a broad definition of aircraft-pilot coupling (APC) events. According to the report, unfavorable or adverse aircraft-pilot coupling APC events are “rare, unexpected, and unintended excursions in aircraft attitude and flight path caused by anomalous interactions between the aircraft and the pilot.” APC excursions can be oscillatory or divergent (non-oscillatory) and can be catastrophic. They occur when the dynamics of the airplane and the dynamics of the pilot combine to produce an unstable system.201 201 For more information, see section 1.18.8.

Analysis 151 Aircraft Accident Report APC events do not typically occur unless a triggering event is present. The trigger is critical because it causes a pilot to alter his or her control strategy. After a trigger, a pilot switches from a low-gain control behavior or piloting technique to a high-gain behavior or technique, that is, one that uses large corrective inputs even for small errors.202 A trigger can be caused by a pilot who overcontrols an aircraft or responds in an inappropriate manner to a flight condition. According to the NRC report, either an environmental trigger203 or a vehicle trigger204 often precedes such a pilot trigger. The first officer’s initial overcontrol (wheel and pedal inputs to the right) was in response to an environmental trigger—the second wake encounter. His initial overcontrol and lack of an appropriate understanding regarding the airplane’s response to rudder pedal inputs at a higher airspeed (240 knots) may have combined to serve as a pilot trigger for an APC event. Consistent with the APC scenarios described in the NRC report, the environmental and pilot triggers increased the first officer’s gain, resulting in large corrective inputs that hindered a return to normal flight. The flight 587 accident was a more complex event than those events discussed in the NRC report because all three axes (pitch, roll, and yaw) were involved at the same time and the rudder was used to control roll, resulting in a phase lag. Nevertheless, the NRC report provides a valid framework and starting point for industry to use in fully developing the issues associated with the flight 587 accident and those events that involve the coupling of flight control inputs and catastrophic flightpath excursions. 2.4.2.3 Characteristics of the A300-600 Rudder Control System Design That May Be Conducive to Sustained Alternating Inputs The coupling of motion in the roll and yaw axes and the associated phase lag between pedal inputs and roll response in transport-category airplanes are phenomena that are not present in the pitch and roll axes and are likely unfamiliar to pilots. Because of these phenomena, an attempt to control roll with the rudder pedals could lead to confusion; increased pilot gain; and sustained, detrimental inputs on the controls. Certain rudder control system design characteristics may exacerbate these effects. Specifically, light rudder pedal forces and small displacements at high airspeeds, which are A300-600 design characteristics, have been identified as factors in some APC events. The FAA’s Advisory Circular (AC) 25-7A, “Flight Test Guide for Certification of Transport Category Airplanes,” addresses APC susceptibility and cautions against flight controls with small displacements and light force gradients—features that are both present 202 According to the NRC report, pilot gain is the sensitivity with which the pilot reacts to a given situation. If the situation is urgent, and the pilot reacts with large corrective inputs, even for small system errors, the pilot is said to be exhibiting high gain. More relaxed responses imply a lower pilot gain. 203 An environmental trigger typically involves an environmental circumstance that results in destabilizing control inputs. Atmospheric turbulence has been cited as an example of an environmental trigger. In addition, an environmental trigger may increase the pilot’s stress level, resulting in an increase in pilot gain. 204 A vehicle trigger typically involves a change in the effective aircraft dynamics, resulting in inconsistencies between the pilot’s input strategy and the aircraft dynamics.

Analysis 152 Aircraft Accident Report on the A300-600 rudder system at higher airspeeds. The AC indicates that such features can be associated with APC, which could help explain the first officer’s series of alternating full rudder inputs. Another design characteristic of the A300-600 rudder system that may increase its susceptibility to an APC event is the changing performance as airspeed increases (a characteristic of all variable stop rudder systems). For APC prevention, the NRC report notes that a flight control system should be designed “to perform consistently throughout as much of the flight envelope as possible.”205 Although the design characteristics of the A300-600 provide a consistent ratio between the rudder pedal and rudder surface deflection at all airspeeds, the response of the airplane to a given rudder pedal input increases as airspeed increases, resulting in significantly different performance characteristics at opposite ends of the design envelope. In the flight 587 accident sequence, the small pedal displacements of the A300-600 rudder control system at 240 knots may have facilitated the first officer’s large, rapid inputs to the rudder system. The first officer performed sustained full alternating rudder pedal inputs that led to a hazardous buildup in sideslip angle in a short period of time. A system with large pedal displacements would make achieving these inputs more demanding physically, providing greater feedback regarding the magnitude of the pilot’s efforts on the controls. Thus, the ability to achieve full rudder deflection with the small pedal displacements on the A300-600 at 240 knots was a likely factor in sustaining the flight 587 event. 2.4.3 Summary The first officer’s rudder pedal inputs, which created airloads that were sufficient to cause the vertical stabilizer to separate from the airplane, resulted from the confluence of several factors. First, the first officer had a predisposition to overreact to wake turbulence encounters. Second, his concerns about the effect of wake turbulence were likely exacerbated by the AAMP training provided by American Airlines, whose excessive bank angle simulator exercise portrayed wake turbulence encounters as capable of quickly upsetting an A300-600 to extreme bank angles and could have encouraged pilots to make large magnitude flight control inputs, including rudder pedal inputs, to roll the airplane out of such an upset. Third, as with most line pilots, the first officer likely did not understand the airplane’s response to large rudder inputs at high airspeeds or the mechanism by which the rudder rolls a transport-category airplane. Finally, light rudder pedal forces and small pedal displacement contributed to the high sensitivity of the A300-600 rudder pedal system at high airspeeds and increased the airplane’s susceptibility to a rudder APC event. 205 The NRC report notes that the consistent performance of the system would minimize the chance that the pilot would change a control strategy to compensate for the system response characteristics.

Analysis 153 Aircraft Accident Report 2.5 Prevention of High Loads Resulting From Pilot Rudder Pedal Inputs 2.5.1 Rudder Pedal Inputs at High Airspeeds Rudder control systems with a variable ratio rudder travel limiter may provide better protection against high loads from sustained rudder pedal inputs at high airspeeds than systems with a variable stop rudder travel limiter because variable ratio rudder travel limiter systems require more physical effort from a pilot (in terms of force and displacement) to produce cyclic full rudder inputs. For airplanes with variable stop rudder travel limiter systems, protection from dangerous structural loads resulting from sustained alternating large rudder pedal inputs can be achieved by reducing the sensitivity of the rudder control system (for example, by increasing the pedal forces), which would make it harder for pilots to quickly perform alternating full rudder inputs. As discussed previously, there is no certification standard regarding rudder pedal sensitivity or any requirement for the sensitivity to remain constant at all airspeeds. The Safety Board concludes that certification standards are needed to ensure that future airplane designs minimize the potential for APC susceptibility and to better protect against high loads in the event of large rudder inputs. Accordingly, the Safety Board believes that the FAA should modify 14 CFR Part 25 to include a certification standard that will ensure safe handling qualities in the yaw axis throughout the flight envelope, including limits for rudder pedal sensitivity. The Safety Board further believes that, after the yaw axis certification standard has been established, the FAA should review the designs of existing airplanes to determine if they meet the standard. For existing airplane designs that do not meet the standard, the FAA should determine if the airplanes would be adequately protected from the adverse effects of a potential APC after rudder inputs at all airspeeds. If adequate protection does not exist, the FAA should require modifications, as necessary, to provide the airplanes with increased protection from the adverse effects of a potential APC after rudder inputs at high airspeeds. The Safety Board notes that some rudder control system designs incorporate features (such as hinge moment capacity limits or yaw damper characteristics) that can help attenuate the hazardous buildup of sideslip and/or vertical stabilizer loads resulting from alternating rudder pedal inputs at high airspeed, even though these features may not have been designed for this purpose. However, because alternating pedal inputs are not considered in the airplane certification standards, the absence of rudder system features that, in addition to their primary function, mitigate the hazards posed by such inputs does not necessarily constitute a design deficiency. Some airplanes have hinge moment restrictions to limit the hydraulic force that the rudder actuator can apply.206 With this design feature (also called a blowdown limit), the hydraulic power available to move the rudder is limited and cannot overcome high vertical 206 The A300-600 does not have this design feature.

Analysis 154 Aircraft Accident Report stabilizer aerodynamic loads regardless of the pilot’s commands. This feature adds an extra level of safety to prevent high vertical stabilizer aerodynamic loads. In addition, the yaw damper can provide an additional level of protection against inappropriate alternating full rudder inputs commanded by the pilot. Most transport-category airplanes have yaw damper systems that automatically input a small amount of rudder deflection to dampen lateral-directional oscillations. These yaw damper systems, including the one on the A300-600, typically act independently of pedal commands, so the yaw damper may add to or subtract from the rudder commanded by the pilot. The yaw damper is not intended to correct for or contain inappropriate oscillatory rudder pedal inputs commanded by the pilot. However, because the yaw damper can suppress all lateral-directional oscillations, it will tend to have such an effect and will consequently delay the buildup of the sideslip angle that can result from such pedal commands. The Safety Board notes that the A300-600 yaw damper system allows a pilot input to override a yaw damper command when the rudder is at the full deflection limit permitted by the rudder travel limiter system for a particular airspeed. Under these conditions, a pilot input can override a yaw damper command in the opposite direction and keep the rudder at the full deflection limit by providing increasing pressure on the rudder pedals. Simulation and FDR data indicated that the first officer’s rudder pedal inputs during the flight 587 accident sequence were consistent with a suppression of yaw damper inputs at the rudder deflection limits. The simulations indicated that, if the yaw damper inputs had not been suppressed, the yaw damper would have moved the rudder partially back toward neutral, thereby lessening (but not preventing) the buildup of the sideslip angle and aerodynamic loads on the vertical stabilizer. Such a delay could have provided an additional level of safety because the initial response of the airplane to a sustained rudder pedal input would not have been as severe and could have reduced the chance of pilot surprise or confusion. The Safety Board concludes that, because of its high sensitivity (that is, light pedal forces and small pedal displacements), the Airbus A300-600 rudder control system is susceptible to potentially hazardous rudder pedal inputs at higher airspeeds. Therefore, the Safety Board believes that the FAA and the Direction Général de l’Aviation Civile should review the options for modifying the Airbus A300-600 and the Airbus A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds and, on the basis of this review, require modifications to the A300-600 and A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds. 2.5.2 Alternating Full Control Inputs Alternating full inputs on the control wheel and rudder pedals, such as those made by the first officer, should not be necessary to control a transport-category airplane under

Analysis 155 Aircraft Accident Report any circumstance.207 Industry literature (that is, the NRC report and AC 25-7A) indicates that an effective way to stop an APC event is to cease the inputs.208 Recognition of an APC event by either the pilot making the inputs or the nonflying pilot before structural damage is crucial. However, according to the NRC report, pilots are not trained to recognize the initial indications or to understand that APC does not necessarily imply poor airmanship. The Safety Board concludes that, to minimize the potential for APC events, transport-category pilots would benefit from training about the role that alternating full control inputs can play in such events and training that emphasizes that alternating full rudder inputs are not necessary to control a transport-category airplane. Therefore, the Safety Board believes that the FAA should develop and disseminate guidance to transport-category pilots that emphasizes that multiple full deflection, alternating flight control inputs should not be necessary to control a transport-category airplane and that such inputs might be indicative of an adverse APC event and thus should be avoided. 2.5.3 Pilot Guidance on Design Maneuvering Speed During this accident investigation, the Safety Board learned that many pilots might have an incorrect understanding of the meaning of the design maneuvering speed (VA) and the extent of structural protection that exists when the airplane is operated below this speed. From an engineering and design perspective, maneuvering speed is the maximum speed at which, from an initial 1 G flight condition, the airplane will be capable of sustaining an abrupt, full control input limited only by the stops or by maximum pilot effort. In designing airplanes to withstand these flight conditions, engineers consider each axis (pitch, roll, and yaw) individually and assume that, after a single full control input is made, the airplane is returned to stabilized flight conditions. Full inputs in more than one axis at the same time and multiple inputs in one axis are not considered in designing for these flight conditions. The American Airlines managing director of flight operations technical told the Safety Board, during a postaccident interview, that most American Airlines pilots believed that the airplane would be protected from structural damage if alternating full rudder pedal inputs were made at an airspeed below maneuvering speed. The American Airlines A300 fleet standards manager confirmed this belief during testimony at the Board’s public hearing for this accident. The Board notes that the American Airlines A300 Operating Manual contained only one reference to design maneuvering speed, which indicated that it was the turbulence penetration speed (270 knots). However, as evidenced by flight 587, 207 As a result of the flight 587 accident, the industry-developed Airplane Upset Recovery Training Aid now states, “it is important to guard against control reversals. There is no situation that will require rapid full-scale control deflections from one side to the other.” 208 Within the AC, see chapter 2, “Flight,” and section 3, “Controllability and Maneuverability.”

Analysis 156 Aircraft Accident Report cyclic rudder pedal inputs, even when made at airspeeds below maneuvering speed, can result in catastrophic structural damage. Existing regulations and guidance pertaining to maneuvering speed may have contributed to the misunderstanding regarding the degree of structural protection provided by operating below maneuvering speed. Title 14 CFR 25.1583, “Operating Limitations,” lists maneuvering speed among the airspeed limitations that must be furnished to the pilots of transport-category airplanes and states that, along with maneuvering speed, pilots must also be furnished “with a statement that full application of rudder and aileron controls, as well as maneuvers that involve angles of attack near the stall, should be confined to speeds below this value.” Although it is true that full control inputs should be confined to airspeeds below maneuvering speed, the statement in Section 25.1583 could also be read to incorrectly imply that an airplane could withstand any such inputs so long as they were made below maneuvering speed. The explanation of design maneuvering speed in AC 61-23C, “Pilot’s Handbook of Aeronautical Knowledge,” may be even more misleading, stating that, “any combination of flight control usage, including full deflection of the controls, or gust loads created by turbulence should not create an excessive air load if the airplane is operated below maneuvering speed.” This statement strongly—and incorrectly—suggests that, if multiple control inputs were made below maneuvering speed, the airplane would be protected against structural damage. The Safety Board has no reason to believe that the misunderstanding about maneuvering speed is limited to A300-600 pilots. As a result, the Safety Board concludes that there is a widespread misunderstanding among pilots about the degree of structural protection that exists when full or abrupt flight control inputs are made at airspeeds below the maneuvering speed. Therefore, the Safety Board believes that the FAA should amend all relevant regulatory and advisory materials to clarify that operating at or below maneuvering speed does not provide structural protection against multiple full control inputs in one axis or full control inputs in more than one axis at the same time. 2.6 Upset Recovery Training In October 1996, the Safety Board issued Safety Recommendation A-96-120, which recommended that the FAA “require 14 CFR Part 121 and 135 operators to provide training to flight crews in the recognition of and recovery from unusual attitudes and upset maneuvers, including upsets that occur while the aircraft is being controlled by automatic flight control systems, and unusual attitudes that result from flight control malfunctions and uncommanded flight control surface movements.”209 More than 8 years have passed since the issuance of Safety Recommendation A-96-120. Although the FAA has expressed agreement with the intent of the recommendation, it has not yet taken the necessary regulatory action to require unusual attitude training for air carrier pilots. In contrast, the air carrier industry has 209 This recommendation was classified “Open—Acceptable Response” on December 20, 1999. For more information, see section 1.18.6.1.

Analysis 157 Aircraft Accident Report recognized the need for such training by voluntarily developing programs, such as the American Airlines AAMP, and issuing the Airplane Upset Recovery Training Aid. There is widespread agreement among operations and training managers that unusual attitude training helps prepare flight crews for such unusual situations. However, without a regulatory requirement and published guidance from the FAA, the design and adoption of such programs has been voluntary, and approval of the POI assigned to the individual operators has been without the benefit of broader guidance from training experts within the FAA. As discussed in section 2.3.2.2, the Safety Board’s investigation found deficiencies in the American Airlines AAMP, including the following: • ground school training that encouraged the use of rudder for roll control; • a simulator exercise in which pilots were encouraged to employ large rudder inputs without being fully trained in the operating properties of the specific rudder control system or fully understanding the structural loads that might be imposed on the airframe by certain inputs; • a simulator exercise that provided unrealistic portrayals of an airplane response to wake turbulence and significantly suppressed control input effectiveness to induce a large rolling potential that was unlikely to occur with an airplane as large as an A300-600; and • a simulator exercise that encouraged the use of rudder in a highly dynamic situation without portraying the large buildup in sideslip angle and sideload that would accompany such rudder inputs in an actual airplane. The Safety Board’s review of other carriers’ upset recovery programs indicated that the shortcomings in the AAMP are not unique and that inconsistencies exist among programs, especially regarding simulator use. The Safety Board concludes that FAA standards for unusual attitude training programs that take into account industry best practices and are designed to avoid inaccurate or negative training would lead to improvement and standardization of industry training programs. Accordingly, the Safety Board urges the FAA to take expeditious action to require such unusual attitude training, as recommended in Safety Recommendation A-96-120. Pending the completion of such regulatory action by the FAA, the Safety Board reclassifies Safety Recommendation A-96-120 “Open—Unacceptable Response.” Further, the Safety Board believes that the FAA should adopt and disseminate written guidance for use in developing and accepting upset recovery programs; such guidance could take the form of an AC and should reflect the industry’s best practices and be designed to avoid inaccurate or negative training. Regarding simulator training, the Safety Board recognizes that some members of the training community advocate the introduction of upset situations in simulators by having pilots close their eyes or look away as the upset is established, rather than by attempting a simulated context for the onset. The Board also recognizes that some

Analysis 158 Aircraft Accident Report members of the training community believe that advanced simulators should not be used in upset training because the range of simulator fidelity is relatively narrow and the portrayal of accelerations is not comparable with what could occur during an aggressive upset.210 Therefore, the Safety Board concludes that the use of lower levels of automation, such as simulators without motion or simple computer screen displays, may be more appropriate to provide the necessary awareness training with less danger of introducing incorrect information. Accordingly, the Safety Board believes that, along with developing upset recovery program guidance, the FAA should evaluate issues concerning the level of automation appropriate to teaching upset training and develop and disseminate guidance that will promote standardization and minimize the danger of inappropriate simulator training. 210 For example, see the testimony of the vice president of training for Airbus North America customer services at the Safety Board’s public hearing (p. 232 of the public hearing transcript).

159 Aircraft Accident Report 3. Conclusions 3.1 Findings 1. The captain and the first officer (the flying pilot) were properly certificated and qualified under Federal regulations. No evidence indicates any preexisting medical conditions that may have adversely affected the flight crew’s performance during the flight. Flight crew fatigue was not a factor in this accident. 2. The accident airplane was properly maintained and dispatched in accordance with Federal regulations. 3. The air traffic controllers who handled American Airlines flight 587 were properly trained and qualified. The local controller complied with Federal Aviation Administration wake turbulence spacing requirements when handling flight 587 and Japan Air Lines flight 47, which departed immediately before flight 587. 4. The witnesses who reported observing the airplane on fire were most likely observing a fire from the initial release of fuel or the effects of engine compressor surges. 5. Flight 587’s cyclic rudder motions after the second wake turbulence encounter were the result of the first officer’s rudder pedal inputs. 6. Flight 587’s vertical stabilizer performed in a manner that was consistent with its design and certification. The vertical stabilizer fractured from the fuselage in overstress, starting with the right rear lug while the vertical stabilizer was exposed to aerodynamic loads that were about twice the certified limit load design envelope and were more than the certified ultimate load design envelope. 7. The first officer had a tendency to overreact to wake turbulence by taking unnecessary actions, including making excessive control inputs. 8. The American Airlines Advanced Aircraft Maneuvering Program ground school training encouraged pilots to use rudder to assist with roll control during recovery from upsets, including wake turbulence. 9. The American Airlines Advanced Aircraft Maneuvering Program excessive bank angle simulator exercise could have caused the first officer to have an unrealistic and exaggerated view of the effects of wake turbulence; erroneously associate wake turbulence encounters with the need for aggressive roll upset recovery techniques; and develop control strategies that would produce a much different, and potentially surprising and confusing, response if performed during flight.

1. Before the flight 587 accident, pilots were not being adequately trained on what effect

rudder pedal inputs have on the Airbus A300-600 at high airspeeds and how the airplane’s rudder travel limiter system operates.

Conclusions 160 Aircraft Accident Report

1. The Airbus A300-600 rudder control system couples a rudder travel limiter system

that increases in sensitivity with airspeed, which is characteristic of variable stop designs, with the lightest pedal forces of all the transport-category aircraft evaluated by the National Transportation Safety Board during this investigation.

1. The first officer’s initial control wheel input in response to the second wake

turbulence encounter was too aggressive, and his initial rudder pedal input response was unnecessary to control the airplane.

1. Certification standards are needed to ensure that future airplane designs minimize the

potential for aircraft-pilot coupling susceptibility and to better protect against high loads in the event of large rudder inputs.

1. Because of its high sensitivity (that is, light pedal forces and small pedal

displacements), the Airbus A300-600 rudder control system is susceptible to potentially hazardous rudder pedal inputs at higher airspeeds.

1. To minimize the potential for aircraft-pilot coupling events, transport-category pilots

would benefit from training about the role that alternating full control inputs can play in such events and training that emphasizes that alternating full rudder inputs are not necessary to control a transport-category airplane.

1. There is a widespread misunderstanding among pilots about the degree of structural

protection that exists when full or abrupt flight control inputs are made at airspeeds below the maneuvering speed.

1. Federal Aviation Administration standards for unusual attitude training programs that

take into account industry best practices and are designed to avoid inaccurate or negative training would lead to improvement and standardization of industry training programs.

1. The use of lower levels of automation, such as simulators without motion or simple

computer screen displays, may be more appropriate to provide the necessary awareness training with less danger of introducing incorrect information. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the in-flight separation of the vertical stabilizer as a result of the loads beyond ultimate design that were created by the first officer’s unnecessary and excessive rudder pedal inputs. Contributing to these rudder pedal inputs were characteristics of the Airbus A300-600 rudder system design and elements of the American Airlines Advanced Aircraft Maneuvering Program.211 211 Members Carmody and Healing voted against the Vice Chairman’s revision, which reversed the order of the two contributing factors shown in the staff draft report. For more information, see the Board Member Statement that follows section 4, “Recommendations.”

161 Aircraft Accident Report 4. Recommendations 4.1 New Recommendations As a result of the investigation of this accident, the National Transportation Safety Board makes the following recommendations: To the Federal Aviation Administration: Modify 14 Code of Federal Regulations Part 25 to include a certification standard that will ensure safe handling qualities in the yaw axis throughout the flight envelope, including limits for rudder pedal sensitivity. (A-04-56) After the yaw axis certification standard recommended in Safety Recommendation A-04-56 has been established, review the designs of existing airplanes to determine if they meet the standard. For existing airplanes designs that do not meet the standard, the FAA should determine if the airplanes would be adequately protected from the adverse effects of a potential aircraft-pilot coupling (APC) after rudder inputs at all airspeeds. If adequate protection does not exist, the FAA should require modifications, as necessary, to provide the airplanes with increased protection from the adverse effects of a potential APC after rudder inputs at high airspeeds. (A-04-57) Review the options for modifying the Airbus A300-600 and the Airbus A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds and, on the basis of this review, require modifications to the A300-600 and A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds. (A-04-58) Develop and disseminate guidance to transport-category pilots that emphasizes that multiple full deflection, alternating flight control inputs should not be necessary to control a transport-category airplane and that such inputs might be indicative of an adverse aircraft-pilot coupling event and thus should be avoided. (A-04-59) Amend all relevant regulatory and advisory materials to clarify that operating at or below maneuvering speed does not provide structural protection against multiple full control inputs in one axis or full control inputs in more than one axis at the same time. (A-04-60)

Recommendations 162 Aircraft Accident Report Adopt and disseminate written guidance for use in developing and accepting upset recovery programs; such guidance could take the form of an advisory circular and should reflect the industry’s best practices and be designed to avoid inaccurate or negative training. (A-04-61) Along with developing the guidance recommended in Safety Recommendation A-04-61, evaluate issues concerning the level of automation appropriate to teaching upset training, and develop and disseminate guidance that will promote standardization and minimize the danger of inappropriate simulator training. (A-04-62) To the Direction Général de l’Aviation Civile: Review the options for modifying the Airbus A300-600 and the Airbus A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds and, on the basis of this review, require modifications to the A300-600 and A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds. (A-04-63) 4.2 Previously Issued Recommendations Resulting From This Accident Investigation As a result of the investigation of this accident, the Safety Board issued the following recommendations to the Federal Aviation Administration: Require the manufacturers and operators of transport-category airplanes to establish and implement pilot training programs that: (1) explain the structural certification requirements for the rudder and vertical stabilizer on transport-category airplanes; (2) explain that a full or nearly full rudder deflection in one direction followed by a full or nearly full rudder deflection in the opposite direction, or certain combinations of sideslip angle and opposite rudder deflection can result in potentially dangerous loads on the vertical stabilizer, even at speeds below the design maneuvering speed; and (3) explain that, on some aircraft, as speed increases, the maximum available rudder deflection can be obtained with comparatively light pedal forces and small pedal deflections. The FAA should also require revisions to airplane and pilot operating manuals that reflect and reinforce this information. In addition, the FAA should ensure that this training does not compromise the substance or effectiveness of existing training regarding proper rudder use, such as during engine failure shortly after takeoff or during strong or gusty crosswind takeoffs or landings. (A-02-01)

Recommendations 163 Aircraft Accident Report Carefully review all existing and proposed guidance and training provided to pilots of transport-category airplanes concerning special maneuvers intended to address unusual or emergency situations and, if necessary, require modifications to ensure that flight crews are not trained to use the rudder in a way that could result in dangerous combinations of sideslip angle and rudder position or other flight parameters. (A-02-02) Require all manufacturers of transport-category airplanes to review and, if necessary, revise their maintenance manual inspection criteria for severe turbulence and extreme in-flight maneuvers to ensure that loads resulting from positive and negative vertical accelerations, as well as lateral accelerations, are adequately addressed. (A-03-41) Require all manufacturers of transport-category airplanes to establish and validate maximum threshold values for positive and negative vertical and lateral G accelerations beyond which direct manufacturer oversight and intervention is required as a condition for returning the airplane to service. (A-03-42) Require all operators of airplanes that have experienced accelerations exceeding the threshold values established as a result of Safety Recommendation A-03-42 (or that the operator has reason to believe might have exceeded those thresholds), as determined from FDR and other available data, to notify the FAA immediately of such high loading events and provide all related loads assessment and inspection results. (A-03-43) Require manufacturers of transport-category airplanes to immediately notify the appropriate certification authority of any event involving accelerations exceeding the threshold values (or that the manufacturer has reason to believe might have exceeded those thresholds) necessitating the intervention of the manufacturer, and provide all related loads assessment and inspection results. (A-03-44) Require that within 2 years, all Airbus A300-600/A310 and Boeing 747-400 airplanes and any other aircraft that may be identified as recording filtered data be retrofitted with a flight data recorder system capable of recording values that meet the accuracy requirements through the full dynamic range of each parameter at a frequency sufficient to determine a complete, accurate, and unambiguous time history of parameter activity, with emphasis on capturing each parameter’s dynamic motion at the maximum rate possible, including reversals of direction at the maximum rate possible. (A-03-50) For additional information about Safety Recommendations A-02-01 and -02, see section 1.18.4.1 of this report. For additional information about Safety Recommendations A-03-41 through -44, see section 1.18.4.2 of this report. For additional information about Safety Recommendation A-03-50, see section 1.18.7.3 of this report.

Recommendations 164 Aircraft Accident Report 4.3 Previously Issued Recommendations Classified in This Report Safety Recommendation A-96-120 (previously classified “Open—Acceptable Response”) is classified “Open—Unacceptable Response” in section 2.6 of this report. For more information about this recommendation, see sections 1.18.6.1 and 2.6 of this report. BY THE NATIONAL TRANSPORTATION SAFETY BOARD ELLEN ENGLEMAN CONNERS Chairman CAROL J. CARMODY Member MARK V. ROSENKER Vice Chairman RICHARD F. HEALING Member DEBORAH A. P. HERSMAN Member Adopted: October 26, 2004

165 Aircraft Accident Report Board Member Statements Member Carol J. Carmody’s Statement, in which Member Richard F. Healing joined I support the probable cause language in the original staff draft, which listed contributing factors as the American Airlines Advanced Aircraft Maneuvering Program and characteristics of the A300-600 rudder system. I heard no reason either during the staff presentations, or in the explanation provided by the Vice Chairman in submitting his substitute, to reverse this order. To diminish the role of the AAMP in the accident is to downplay the role it played in the pilot’s actions which caused the accident. One of the undeniable facts of this accident is the pilot’s inappropriate use of rudder. Staff was unable to find any example of unusual rudder use by the pilot before his AAMP training. When questioned by a captain for using the rudder in an earlier incident, the first officer “insisted that the AAMP directed him to use the rudder pedals in that manner.” To elevate the characteristics of the A300-600 rudder system in the hierarchy of contributing factors ignores the fact that this system had not been an issue in some 16 million hours of testing and operator experience—until the AAMP trained pilot flew it. The justification for the change was that the Board must address the future and, therefore, must give more attention to the aircraft rudder characteristics. That is what our recommendations are designed to do, and our recommendations do address the design issues. The probable cause should reflect accurately what the investigation and the report demonstrate; the substitute probable cause does not do that.

this page intentionally left blank

167 Aircraft Accident Report 5. Appendixes Appendix A Investigation and Public Hearing Investigation The National Transportation Safety Board was initially notified of this accident on November 12, 2001, about 0930 eastern standard time. A full go-team was assembled and departed from Ronald Reagan Washington National Airport in Washington, D.C., for New York shortly thereafter. The team arrived on scene later that day. Accompanying the team to New York was former Chairman Marion Blakey and former Board Member George Black. The following investigative teams were formed: Aircraft Operations, Human Performance, Aircraft Structures, Aircraft Systems, Powerplants, Maintenance Records, Air Traffic Control, Meteorology, Aircraft Performance, Witnesses, and Materials. Specialists were also assigned to conduct the readout of the flight data recorder and transcribe the cockpit voice recorder in the Safety Board’s laboratory in Washington, D.C. In accordance with the provisions of Annex 13 to the Convention on International Civil Aviation, the Safety Board’s counterpart agency in France, the Bureau d’Enquêtes et d’Analyses pour la Sécurité de l’Aviation Civile (BEA) participated in the investigation as the representative of the State of Design and Manufacture. Parties to the investigation were the Federal Aviation Administration (FAA), American Airlines, the Allied Pilots Association, National Air Traffic Controllers Association, Association of Professional Flight Attendants, General Electric Aircraft Engines, Honeywell Engines and Systems, and the Federal Bureau of Investigation. Airbus Industrie participated in the investigation as a technical advisor to the BEA, as provided in Annex 13. Public Hearing The Safety Board held a public hearing on this accident from October 29 to November 1, 2002, in Washington, D.C. Acting Chairman Carol Carmody presided over the hearing; former Board Members John Hammerschmidt, John Goglia, and George Black also participated in the hearing. The issues presented at the hearing were the design and certification of the Airbus 300-600 vertical stabilizer; the design, certification, and operation of the A300 rudder system; wake turbulence; and American Airlines’ operations and training. The technical panel comprised investigators from the Safety Board and the BEA. Parties to the public hearing were the FAA, American Airlines, Airbus, and the Allied Pilots Association.

168 Aircraft Accident Report Appendix B Cockpit Voice Recorder Transcript The following is the transcript of the Fairchild A-100A cockpit voice recorder, serial number missing, installed on American Airlines flight 587, an Airbus A300-600, N14053, which experienced an in-flight separation of the vertical stabilizer shortly after takeoff from John F. Kennedy International Airport in Jamaica, New York, on November 12, 2001. LEGEND HOT Crewmember hot microphone voice or sound source RDO Radio transmission from accident aircraft CAM Cockpit area microphone voice or sound source RMP Radio transmission from local ramp control PA Voice transmitted over aircraft public address system INT Voice transmitted over aircraft interphone system GND Radio transmission from JFK ground control TWR Radio transmission from JFK control tower JAL47 Radio transmission from Japan Airlines flight 47 PD14 Radio transmission from police department flight 14 DEP Radio transmission from New York departure control -1 Voice identified as Pilot-in-Command (PIC) -2 Voice identified as Co-Pilot (SIC) -3 Voice identified as pushback crewman -? Voice unidentified * Unintelligible word @ Non-pertinent word # Expletive

Break in continuity ( ) Questionable insertion [ ] Editorial insertion ... Pause Note 1: Times are expressed in eastern standard time (EST). Note 2: For ATC transmissions, generally, only radio transmissions to and from the accident aircraft were tran- scribed.

Appendix B 169 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0845:35 START of RECORDING START of TRANSCRIPT 0845:50 CAM [sound similar to paper rustling] 0846:04 CAM-1 [unintelligible comment] 0846:05 HOT-2 now what? 0846:08 HOT-2 it's part of the job. quick nap. [sound of yawn] 0846:44 CAM-1 ** seagulls getting in *. why are they flying around that con- struction site? 0846:50 CAM-1 oh, coffee truck. 0846:51 HOT-2 [sound of chuckle] flying around 'cause it looks like a dump. that's why. they don't know any better. 0847:02 HOT-2 good question. 0847:10 HOT-2 this thing's going triple the speed it was. 0847:18 HOT-2 did you see that thing the union passed just before they ap- proved the whole thing they changed some something with the list or something.

Appendix B 170 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0847:24 CAM-1 St. Louis thing. 0847:26 HOT-2 what did they do? 0847:28 CAM-1 aah, you know.... we were talking about this last time, I guess you know. @@ was (always saying) how I, I was getting the, the information, and um, I guess there were some uh, holes in the previous document, where the pilots of TWA guys in St. Louis given a certain scenario could cross through the fence and come out of the AA system as Captains. 0848:00 HOT-2 eeewh. 0848:03 CAM-1 beyond that I, I don't, I can't really explain it. * uh, but my un- derstanding is, they, they plugged those holes in the fence. 0848:13 HOT-2 'kay. 0848:20 CAM-1 sit there and read this, this the legalese stuff * . I mean you really have to sit down and study this to get it. 0848:25 HOT-2 really hard. oh yeah. 0848:32 HOT-2 and it's also a "mute" point seeing how it's passed now. 0848:35 CAM-1 yeah.

Appendix B 171 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0848:39 HOT-2 which is good which means @@ was causing trouble and he.... plugged the hole. 0848:44 CAM-1 you know he's a force now. he outta run for aaaah, union job. 0848:58 CAM-1 boy, he's a New Yorker with an attitude. 0849:02 HOT-2 we need a new @. 0849:04 CAM-1 yeah. 0849:06 CAM-1 well, @. irreplaceable. what was he saying to you this morn- ing, anything? 0849:11 HOT-2 nothing. 0849:12 CAM-1 'cause he's still on the inside, isn't he? 0849:14 HOT-2 oh yeah. 0849:15 CAM-1 huh?

Appendix B 172 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0849:16 HOT-2 he's a @.... he's on the inside, very much so.... he still goes down, you know, DDR, doing you know.... whatever.... he's very much on the inside. trust me, when friggin has a problem he goes.... this guy did this or whatever. call @ man. @ got a friggin wealth of knowledge sitting there. it's like @.... except that there's a wealth of knowledge on how to give things back which we shouldn't have been tapping. 0849:54 CAM-1 what? 0849:57 HOT-2 @ was calling up @. you know we were paying @? this # un- ion didn't even tell us way back then. 0850:02 CAM-1 is that right? 0850:03 HOT-2 oh yeah. @ was hired as a consultant. and taken off flight.... no one told us about that. 0850:15 CAM-1 I didn't know that. 0850:16 HOT-2 yeah. 0850:17 CAM-1 so they, they really didn't tell us. 0850:18 HOT-2 oh no. 0850:19 CAM-1 they still haven't told us. we just found out.

Appendix B 173 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0850:21 HOT-2 [sound of hiccup and cough] excuse me, I was just reading uh, aaaah I think I found it out in the accounting thing. I was scouring through um, APA's accounting. all the people that got flight time pay and how much it was. you know and that's where I found it, that @ got removed from, trip pay. paid by APA, which could only be one, I mean, what else is he doing? 0850:50 CAM-1 yeah. 0851:03 HOT-2 [sound similar to yawn] 0851:11 HOT-2 [sound of singing] 0851:24 HOT-2 I think across from it, it said consulting. [sound of chuckle] 0851:27 CAM-1 said what? 0851:28 HOT-2 said removed from trip. it said like reason or whatever. it said consulting or something. 0851:32 CAM-1 *. 0851:33 HOT-2 consultant, yeah. 0851:56 HOT-2 well we're getting paid, that's nice. thank you very much. can't beat that. 0852:17 CAM-1 ***.

Appendix B 174 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0852:18 CAM [sound of clunk] 0852:44 HOT-1 the door is closed. 0852:46 HOT-2 *. 0852:50 HOT-? before *. 0852:52 HOT-2 *. 0852:53 INT-3 ground to cockpit? 0852:54 INT-1 hello. 0852:55 INT-3 hello cockpit. we just locked up and we're all secure below, standing by. 0852:58 RDO-2 American five eighty eight, ready to do push-back. 0853:01 INT-1 okay, brakes released. standby for the clearance. 0853:03 RMP five eighty seven, stand by. you're gonna be number two to push. I'll give you a call. 0853:06 RDO-2 stand by, American five eighty seven.

Appendix B 175 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0853:08 HOT-2 uuuuh, probe heat. 0853:11 HOT-1 on. 0853:11 HOT-2 ECAM doors display, slides? 0853:12 HOT-1 green and armed. 0853:13 HOT-2 beacon, nav lights? 0853:14 HOT-1 on, on. 0853:15 HOT-2 cabin ready? 0853:15 HOT-1 received. 0853:18 HOT-2 checklist is done. we're not cleared. 0853:21 HOT-1 okay. 0853:24 HOT-2 number two. 0853:26 HOT-1 three four and all right five thousand pounds heavy? 0853:47 HOT-1 hmmmm.

Appendix B 176 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0853:55 INT-1 I guess there's traffic out there somewhere. 0853:58 HOT-1 where's the TPS? 0854:05 INT-3 oh yeah, it's just pulling up now. 0854:18 HOT-1 two.... three.... oh, two three nine, okay. 0855:23 HOT-2 [sound of humming] 0855:27 HOT-1 what's the temperature? 0855:57 PA-1 well ladies and gentlemen, Captain States again. we're all but- toned up ready to go. we're just waiting for an airplane behind us uuuh, to move on out of our way, and then we will be pushing back. 0856:07 CAM [sound of hi-lo chime] 0856:08 PA-4 [sound of male flight attendant beginning passenger an- nouncement in Spanish] 0856:08 RMP American five eighty seven.... 0856:09 RDO-2 yes.

Appendix B 177 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0856:11 RMP five eight seven, do you still have a ground crew there? 0856:12 RDO-2 I believe we have ground crew. 0856:14 HOT-2 yes, we have ground crews still? 0856:15 RMP American five eighty seven, (have your ground crew to refer- ence the company seven thirty seven departing the alley), you're cleared to push. 0856:16 HOT-1 huh? what? 0856:20 RDO-2 reference the seven three, we're cleared to push, American five eighty seven heavy. 0856:30 INT-1 evidently there's a seven thirty seven back there uh, once you see him, we're cleared to push. 0856:31 INT-3 okay cockpit um, they just disconnected and, should be an- other couple of minutes. 0856:37 INT-1 okay, whatever you like. 0856:49 HOT-2 I can't believe how much money GE makes just renting little shacks to construction people. you know if GE's in uh, it's huge money. I mean they don't, they don't....

Appendix B 178 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0856:56 HOT-1 they're, they're, you know if you looked into it, you could probably find GE in virtually, everything. 0857:02 HOT-2 GE is actually like one of the largest banks in the world. it's like the largest bank in the world. 0857:05 HOT-1 yeah. 0857:07 HOT-2 they have more flexibility because they don't have the restric- tions of a bank. banks have certain restrictions as to what they can and can't do as far as, their hands tied. ah,ah, it's unbe- lievable. 0857:22 HOT-2 they, they own more aircraft than American Airlines. 0857:25 HOT-1 GE does? 0857:32 HOT-2 I'm not gonna say size wise but a lot of those corporate jets and all that other stuff.... 0857:35 HOT-1 yeah. 0857:36 HOT-2 ...more aircraft. 0857:37 HOT-1 just numbers, yeah. 0858:00 INT-3 hey cockpit, that aircraft is clear, we'll start our pushback.

Appendix B 179 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0858:04 INT-1 brakes released, cleared to push. 0858:10 HOT-1 three sixty nine, what were we threeeee.... forty nine. 0858:17 HOT-2 what do you need? 0858:32 HOT-1 fifty one, fifty one, one fifty six, twenty one one. * change, forty two C. 0859:27 INT-3 ground to cockpit, you're cleared to start. 0859:29 INT-1 cleared to start. 0859:34 HOT-1 starting two. 0859:37 HOT-1 valves open. 0859:37 CAM [sound similar to ECAM chime] 0859:53 INT-3 parking brakes park. 0859:55 INT-1 brakes are parked, cleared to disconnect, see you out front. 0859:58 INT-3 ground to cockpit, disconnecting, see ya out front.

Appendix B 180 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0900:00 INT-1 so long. 0900:02 INT-3 so long. 0900:15 HOT-2 forty five N two. 0900:17 HOT-1 the valve is closed. 0900:21 HOT-1 starting one. 0900:25 HOT-1 valve's open. 0900:47 HOT-1 see ya salute, four guys going away. 0901:03 HOT-2 forty five N two. 0901:05 CAM [sound similar to Selcal buzzer] 0901:07 HOT-2 APU? 0901:07 HOT-1 valves closed, done. 0901:13 HOT-2 you got your four guys, all set? 0901:13 HOT-1 yep, dos, tres.

Appendix B 181 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0901:14 RDO-2 American five eighty seven, we’re gonna be going over to ground. we’ll talk to you later. 0901:15 RMP five eighty seven, cleared to contact ground, have a good flight. 0901:20 RDO-2 good day. 0901:24 RDO-2 morning ground, it's American five eighty seven heavy with the information Delta coming out of uh, Tango Alpha. 0901:30 HOT-2 clear right. 0901:31 HOT-1 clear left. fifteen when you're ready. 0901:32 CAM [sound of several clicks] 0901:33 GND American five eighty seven heavy Kennedy ground, runway three one left for departure. taxi left on Bravo. hold short of Juliet. 0901:39 RDO-2 left Bravo, short of Juliet, American five eighty seven heavy. 0901:55 HOT-2 come back. 0902:05 HOT-1 your leg, you check the rudders.

Appendix B 182 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0902:23 HOT-2 rudders check. 0902:26 HOT-1 okay. 0902:40 HOT-2 taxi checklist is complete. 0902:59 HOT-2 takeoff checklist, anti-ice? 0903:01 HOT-1 off. 0903:02 HOT-2 auto-brakes. 0903:03 HOT-1 max. 0903:38 HOT-2 okay, the box is updated. we have, stand alone sheet, for.... runway thirty one left. flaps fifteen, bleeds on. assumed tem- perature is supposed to be forty two. we have forty two set. weight was three forty nine point three. and your stand alone sheet's for three forty nine three. weights check, temperature check. and I'm gonna double check the winds here. forty two degrees is supposed to give us one oh one point one. we got one oh one point one. numbers are one fifty, fifty four and fifty six.... three thirty at eleven. winds checked. takeoff data and TRP for thirty one left. 0904:28 HOT-1 two hundred forty six people, crew of nine, two hundred fifty five SOBs. takeoff data, set and cross-checked, flex power. three one left, Kennedy.

Appendix B 183 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0904:36 HOT-2 set and cross-checked. takeoff data and TRP. 0904:39 HOT-2 AFS panel and radios? 0904:41 HOT-1 aah, fifty six is preset, two forty two, everything else remains the same, set checked. 0904:45 HOT-2 gotcha. 0904:47 HOT-2 flaps fifteen, stab trim is nose up point seven.... stab trim? 0904:53 HOT-1 uuuuh, point seven nose up set. 0904:56 HOT-2 slats and flaps? 0904:57 HOT-1 calls for fifteen, fifteen, set at fifteen, fifteen, fifteen. fifteen, uploaded. 0905:01 HOT-2 verified fifteen, fifteen. 0905:05 HOT-2 ECAM? 0905:06 HOT-1 checked. 0905:08 HOT-2 takeoff config?

Appendix B 184 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0905:09 HOT-1 norm f' takeoff. 0905:11 HOT-2 takeoff briefing? 0905:12 HOT-1 all right, you start out. if something happens prior to V one, call what you see, I'll decide whether or not to abort. uuh, unless it an engine failure or an inability to fly, we'll plan on continuing the takeoff. uh, it's a hundred feet and then uh, a left turn to what? 0905:40 HOT-1 uh, runway heading to three hundred feet, that's a heading to two one zero to a thousand feet and then it's the uh, engine uh, clean-up or the airplane clean-up stuff.... after the immedi- ate action items you have the airplane, the radio we'll plan on left hand traffic to come back to uh, either one of the three ones.... highest min safe altitude on runway heading is twenty eight hundred foot, and once you make a left turn over water it's eighteen hundred feet. the terrain is flat with towers. oth- erwise you plan on about a heading two two zero, five thou- sand feet. questions? 0906:15 HOT-2 no. 0906:16 HOT-1 briefing complete.... the Concorde returns. 0906:53 GND Japan Air forty seven, continue via Bravo, turn right at Juliet, cross runway four left. 0907:00 JAL47 Japan Air forty seven, on Bravo, Juliet cross runway two two uh, four left.

Appendix B 185 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0907:07 GND Japan Air four seven, that's correct, thanks. 0907:55 HOT-2 I was flying in here about three nights ago, comin' innnn, 'bout ten o'clock, doing that twelve, twelve, thirty departure turn, Dingo turn. so I don't know comin' in here, not ten o'clock somewhere there, nine o'clock, somewhere, and uh.... 0908:01 GND Japan Air forty seven heavy, monitor the tower one one niner point one. so long. 0908:05 JAL47 one one nine one, Japan Air forty seven, so long. 0908:12 HOT-2 Egypt Air, was told to do. they were rocketing off towards the city and they were told to.... 0908:17 HOT-1 Egypt Air was told to do what? 0908:19 HOT-2 turn thirty degrees, somewhere you know, like, you know, it was thirty degrees off their course. they were turn told to pick up a heading, and he said "roger" and he didn't turn. and the controller said, "pick up this heading." and he didn't turn. he says, "you need to turn immediately now Egypt Air, and I wanna know why you're not turning." finally he turned he says, "Egypt Air, we need to discuss on the ground why it took you fifteen miles to make a heading change when I asked you and you responded." they were really.... 0908:47 HOT-1 pissed.

Appendix B 186 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0908:48 HOT-2 ...pissed, and uh I think they were like ready to.... 0908:51 HOT-1 launch the fleet. 0908:52 HOT-2 oh yeah, 'cause he was heading towards the city. he was.... 0908:54 HOT-1 oh really. 0908:56 HOT-2 oh yeah, that's why he's ticked, that's why he's so ticked. 0908:58 GND American five eighty seven heavy, follow the Japan Air heavy Boeing seven forty seven ahead. monitor the tower one one niner point one. so long. 0909:03 RDO-2 follow Japan Air over to tower nineteen one, American Five Eighty seven heavy. 0909:09 HOT-2 really ticked. 0909:13 HOT-1 follow JAL. 0909:17 HOT-2 these guys just uh, merged. with Japan and another j.... what's the other Japan company? 0909:20 HOT-1 All Nippon?

Appendix B 187 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0909:21 HOT-2 no, not Nippon, there's another one I think. they merged this morning. 0909:27 HOT-1 really. 0909:27 HOT-2 [sound of yawn] yeah. the big news, Japan and what other Japanese airline is .... I *, I don't think it was All Nippon it was uh.... 0910:15 HOT-1 crossing two two right. clear on the left. 0910:20 HOT-2 on the right. 0910:27 TWR Japan Airlines forty seven heavy, Kennedy tower, runway three one left, taxi into position and hold. 0910:32 JAL47 runway three one left, taxi into position and hold. 0910:34 TWR PD fourteen uh, caution wake turbulence, there'll be uh, sev- eral heavy jets departures over Canarsie momentarily. 0910:41 PD14 roger that PD fourteen, we'll be looking. 0910:44 CAM [sound of clunk] 0910:51 PA-1 well ladies and gentlemen, at long last, we are number two for takeoff. uuh, toward the northwest today. immediately after takeoff we'll be in a left hand turn heading for the shoreline

Appendix B 188 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT and uh, getting ourselves pointed southbound. 'bout another two or three minutes it'll be our turn to go. flight attendants, prepare for takeoff please. 0911:08 TWR Japan Airlines forty seven heavy, wind three zero zero at one zero runway three one left, cleared for takeoff. 0911:12 JAL47 runway three one left, cleared for takeoff, Japan Air forty seven heavy. 0911:27 HOT-1 yeah, I guess that controller was bent outta shape, huh? 0911:29 HOT-2 ticked. 0911:33 HOT-1 can't hardly blame him. 0911:35 HOT-2 ah, I'm sure. 0911:36 TWR American five eighty seven heavy Kennedy tower, caution wake turbulence runway three one left, taxi into position and hold. 0911:41 RDO-2 position and hold three one left, American five eighty seven heavy. 0911:44 HOT-1 position and hold. I see traffic out there. hopefully he's going to the right side.

Appendix B 189 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0911:55 HOT-2 takeoff briefing we got, PA? 0911:57 HOT-1 [sound of single chime] 0911:58 HOT-1 complete. 0912:00 HOT-2 ignition. 0912:05 HOT-1 Reach? ignition's off. 0912:07 HOT-2 bleeds? 0912:09 HOT-1 bleeds are on. 0912:12 HOT-1 he say Reach? 0912:13 HOT-2 Reach four oh one or something like that yeah. 0912:16 HOT-1 Air Force is coming to Kennedy. 0912:19 HOT-2 is that a Reach, that's the Air Force? 0912:20 HOT-1 yeah, that's the.... 0912:20 HOT-2 transponder?

Appendix B 190 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0912:21 HOT-1 TARA. 0912:22 HOT-1 it's a tanker. 0912:24 HOT-1 the call sign. that looks like a seven four out there though. 0912:30 HOT-1 all right, position and hold on the uh, left side. 0912:36 HOT-1 final appears clear, transponder is TARA.... 0912:38 HOT-2 brake.... thank you. brake fans? 0912:39 HOT-1 fans are off. 0912:40 HOT-2 lights to go. I'm gonna make... left turn two twenty. go out the Bridge five thousand feet's the top. if we have a problem, I'll clean it up at six.... ten.... left traffic for this runway.... 0913:05 TWR Japan Air forty seven heavy, fly the Bridge Cimb, contact New York departure, good morning. 0913:10 JAL47 Bridge Climb, switch to departure, Japan Air four seven, good morning. 0913:21 HOT-1 you have the airplane.

Appendix B 191 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0913:21 HOT-2 I got the brakes. 0913:22 HOT-1 I have the radios. 0913:27.6 TWR American five eight seven heavy, wind three zero zero at niner, runway three one left, cleared for takeoff. 0913:31.7 RDO-1 cleared for takeoff, American ah, five eight seven heavy. 0913:35.3 HOT-2 you happy with that distance? 0913:38.5 HOT-1 aah, he's.... we'll be all right once we get rollin'. he's sup- posed to be five miles by the time we're airborne, that's the idea. 0913:45.5 HOT-2 so you're happy. lights? 0913:47.1 HOT-1 yeah, lights are on. 0913:47.8 HOT-2 takeoff check's complete, I'm on the roll. thank you sir. 0913:53.5 HOT-1 thrust SRS, runway. 0913:54.7 CAM [sound similar to increase in engine RPM] 0914:03.8 HOT-2 you got throttles.

Appendix B 192 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0914:08.9 HOT-1 eighty knots, thrust blue. 0914:23.4 HOT-1 V one. 0914:24.3 HOT-1 rotate. 0914:25.7 HOT-1 V two 0914:28.5 HOT-1 V two plus ten. 0914:30.4 HOT-2 positive rate, gear up please. 0914:31.5 HOT-1 gear up. 0914:33.1 CAM [sound of thump and two clicks] 0914:38.5 HOT-2 heading select. 0914:41.9 HOT-1 clear left. 0914:42.6 TWR American five eight seven heavy, turn left. fly the Bridge Climb. contact New York departure. good morning. 0914:48.3 RDO-1 American five eighty seven heavy, so long.

Appendix B 193 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0914:51.4 HOT-1 gear's up. 0914:52.5 HOT-2 check speed, level change. 0914:54.8 HOT-2 flaps up. 0914:56.5 HOT-2 climb power. 0914:57.1 CAM [sound of click] 0915:00.0 RDO-1 ah New York, American five eighty seven heavy, thirteen hundred feet, we're climbing to five thousand. 0915:04.7 DEP American five eight seven heavy, New York departure. radar contact. climb maintain one three thousand. 0915:10.2 RDO-1 one three thousand feet, American five eighty seven heavy. 0915:14.6 HOT-2 one three I see, slats retract. 0915:16.5 HOT-1 slats. 0915:17.2 CAM [sound of several clicks] 0915:28.5 HOT-1 clean machine.

Appendix B 194 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0915:28.5 HOT-2 [sound similar to yawn] thank you. 0915:36.4 DEP American five eighty seven heavy, turn left, proceed direct WAVEY. 0915:37.3 HOT-1 [sound of brief squeak and a rattle] 0915:41.0 RDO-1 uh, we'll turn direct WAVEY, American five eighty seven heavy. 0915:44.4 HOT-2 left turn direct WAVEY…. 0915:44.7 HOT-1 little wake turbulence, huh? 0915:45.6 HOT-2 …yeah. 0915:47.3 HOT-2 [sound similar to five sets of stabilizer trim switch clicks] 0915:48.2 HOT-2 two fifty thank you. 0915:51.8 CAM [sound of a thump] 0915:52.3 CAM [sound of click] 0915:52.9 CAM [sound of two thumps] 0915:54.2 HOT-2 max power. [spoken in strained voice]

Appendix B 195 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0915:55.0 HOT-1 you all right? 0915:55.3 HOT-2 yea, I'm fine. 0915:56.3 HOT-1 hang onto it. hang onto it. 0915:56.6 CAM [sound of snap] 0915:57.5 HOT-2 let's go for power please. 0915:57.7 CAM [sound of loud thump] 0915:58.5 CAM [sound of loud bang] 0916:00.0 HOT-2 [sound similar to human grunt] 0916:00.2 CAM [roaring noise starts and increases in amplitude] 0916:01.0 HOT-2 holy #. 0916:01.0 CAM [sound similar to single ECAM chime] 0916:02.0 CAM [sound similar to single ECAM chime] 0916:04.4 CAM [sound similar to stall warning repetitive chime for 1.9 seconds]

Appendix B 196 Aircraft Accident Report INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNICATION TIME & TIME & SOURCE CONTENT SOURCE CONTENT 0916:06.2 CAM [roaring noise decreases and ends] 0916:07.5 HOT-2 what the hell are we into *. we're stuck in it. 0916:07.5 CAM [sound similar to continuous repetitive chimes for one second] 0916:09.6 CAM [sound similar to continuous repetitive chimes for three sec- onds] 0916:12.8 HOT-1 get out of it, get out of it. 0916:14.8 END of RECORDING END of TRANSCRIPT

197 Aircraft Accident Report Appendix C Differences Between American Airlines Flights 903 and 587 American Airlines flight 903 entered a stall and experienced a loss of control because the flight crew did not maintain an adequate airspeed during the level-off. At the start of the stall event, the airplane was in a 42º right bank and was rolling farther to the right, despite a full control wheel input to the left. The flight crew did not recognize that the airplane had entered a stall, did not use proper stall recovery techniques, and did not recover the airplane in a timely manner. As a result, the airplane remained in a stalled condition for more than 35 seconds, during which time the effectiveness of the lateral controls was reduced because of the stall. When lateral controls are ineffective and the airplane is in an uncontrolled roll toward an extreme bank angle, the use of the rudder to help control the bank angle is appropriate, even though rudder use in a stall poses a significant risk of exacerbating the stall and departing farther from controlled flight. The proper response to recover from a stall is to move the control column forward, thereby decreasing the angle of attack and restoring lateral control. In the absence of this corrective action, the continued use of the rudder to keep the airplane upright may be necessary. Such was the case in the flight 903 stall event. During this event, flight 903 entered a series of pitch, yaw, and roll maneuvers as the flight controls oscillated. The airplane was eventually recovered at an airspeed of 280 knots. No evidence from the flight 903 investigation indicated that Airbus A300-600 rudder control sensitivity at high airspeeds was a safety issue. The flight crew did not have any difficulty in regaining control of the airplane after exiting the stall, even though the stall recovery occurred at an airspeed at which the rudder control system sensitivity would have been similar to that during flight 587’s second wake encounter. A contributing factor to the high loads experienced by flight 903 was the slow moving rudder travel limiter; the Safety Board issued safety recommendations to address the rudder travel limiter system on May 28, 2004. Flight 587 had not entered a stall and was not in an upset. Further, the lateral controls were always fully effective; consequently, the use of the rudder to assist with roll control during the second wake encounter was only discovered during the flight 587

Appendix C 198 Aircraft Accident Report investigation. A slow moving rudder travel limiter was not a factor in the flight 587 accident (see table C-1 for a comparison of the issues from both investigations). Table C-9. Comparison of the Issues From the Flight 903 and Flight 587 Investigations No Yes Slow moving rudder travel limiter Yes No High speed sensitivity No Yes Rudder input necessary No Yes Stall/loss of control Yes Yes Pilot training 587 903 Issue No Yes Slow moving rudder travel limiter Yes No High speed sensitivity No Yes Rudder input necessary No Yes Stall/loss of control Yes Yes Pilot training 587 903 Issue Table C-1.

FD07289 ｜ 2004_美国_HAR0401.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2004 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

!" # $% &%

National Transportation Safety Board Washington, D.C.

Highway Accident Report School Bus Run-off-Bridge Accident Omaha, Nebraska, October 13, 2001 NTSB/HAR-04/01 PB2004-916201 National Transportation Safety Board Notation 7610 490 L’Enfant Plaza, S.W. Adopted February 10, 2004 Washington, D.C. 20594

National Transportation Safety Board. 2004. School Bus Run-off-Bridge Accident, Omaha, Nebraska, October 13, 2001. Highway Accident Report NTSB/HAR-04/01. Washington, DC. Abstract: On Saturday, October 13, 2001, about 2:00 p.m. central daylight time, a 2000 Thomas Built Buses, Inc., 78-passenger school bus carrying 27 Seward High School students and 3 adults (excluding the driver) was traveling westbound through a work zone on U.S. Route 6 in Omaha, Nebraska. As the Seward bus entered the work zone lane shift at the approach to the West Papillion Creek Bridge, it encountered a 1986 Motor Coach Industries 52-passenger motorcoach carrying Norfolk High School students traveling eastbound. Although no collision occurred between the Norfolk and Seward buses, the westbound school bus departed the traveled roadway on the right and subsequently struck the W-beam barrier on the approach to the bridge, steered to the left momentarily, and then steered abruptly back to the right, striking the W-beam again and, finally, a three-rail barrier between the guardrail and the concrete bridge railing. The bus passed through the remains of the three-rail barrier, rode up onto the bridge’s sidewall, and rolled 270 degrees clockwise as it fell about 49 feet, landing on its left side in a 1-foot-deep creek below the bridge. Three students and one adult sustained fatal injuries. The remaining passengers and the busdriver sustained injuries ranging from serious to minor. Major safety issues identified in this report include the effect of highway design, speed, and vehicle handling characteristics upon driver performance; adequacy of work zone safety management; lack of emergency preparedness of students; visibility of emergency signage and exit door levers; and school bus extrication training. As a result of this accident investigation, the National Transportation Safety Board makes recommendations to the Federal Highway Administration, Nebraska Department of Roads, Omaha Fire Department, National Association of State Directors of Pupil Transportation Services, and Thomas Built Buses, Inc. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Recent publications are available in their entirety on the Web at http://www.ntsb.gov. Other information about available publications also may be obtained from the Web site or by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, S.W. Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2004-916201 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Highway Accident Report Contents Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi Factual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Accident Narrative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Preaccident Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Seward Witness Interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Norfolk Witness Interviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Injuries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 School Bus Emergency Evacuation Drills . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Emergency Egress . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 School Bus Occupant Protection Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Accident Bus Driver Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Vehicle and Wreckage Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Postaccident Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Highway Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Accident Location . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Location of Physical Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Traffic Volume . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Work Zone Accident Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Work Zone Definitions and Geometry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Traffic Control Construction Signing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Maintenance History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Work Zone Safety Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Work Zone Traffic Control Plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Work Zone Speed Selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Work Zone Safety Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Management and Operational Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 State School Bus Driver Qualification Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Seward School District Driver Hiring and Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 ECU Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Accident Reenactment and Simulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Guardrail Crash Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Toxicological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Contents iv Highway Accident Report Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Toxicological Impairment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Sleep Loss and Fatigue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Weather . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Mechanical Condition of Bus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 Driver’s Qualifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 Accident Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 Ability of Driver to Maintain Lane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 Possible Impingement on Accident Vehicle’s Travel Lane . . . . . . . . . . . . . . . . . . . . . . 58 Perceived Threat of Frontal Collision by Accident Vehicle Driver . . . . . . . . . . . . . . . 60 Highway Design and Driver Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 Roadway Width . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Horizontal and Vertical Alignment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Speed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Preparation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 Failsafe Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 Work Zone Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 Adequacy of State and Federal Requirements for Traffic Control Plans . . . . . . . . . . . 70 Traffic Operations During Construction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Maintenance of Bridge Approach and Barrier Systems . . . . . . . . . . . . . . . . . . . . . . . . . 74 Occupant Safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 Emergency Preparedness of Students . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Obscured Emergency Exit Levers and Signage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 School Bus Extrication Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Appendixes A: Investigation and Public Hearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 B: Recall of Bendix EC-17 Electronic Control Unit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

v Highway Accident Report Acronyms and Abbreviations AASHTO American Association of State Highway and Transportation Officials ABS antilock braking system ADT average daily traffic ATSSA American Traffic Safety Services Association Bendix Bendix Commercial Vehicle Systems CDL commercial driver's license CFR Code of Federal Regulations CVSA Commercial Vehicle Safety Alliance DCSO Douglas County Sheriff's Office ECM electronic control module ECU electronic control unit EDGEN Engineering Dynamics Corporation General Analysis Tool EDSMAC4 Engineering Dynamics Corporation Simulation of Automobile Collisions FHWA Federal Highway Administration FMCSR Federal Motor Carrier Safety Regulation FMVSSs Federal Motor Vehicle Safety Standards HVE Human Vehicle Environment MCI Motor Coach Industries MUTCD Manual on Uniform Traffic Control Devices NASDPTS National Association of State Directors of Pupil Transportation Services NDOR Nebraska Department of Roads NHTSA National Highway Traffic Safety Administration NSP Nebraska State Patrol SERB self-energy restoring barriers SIMON Simulation Model Non-linear TCP traffic control plan Thomas Built Thomas Built Buses, Inc. TLTWO two-lane, two-way operation U.S. 6 U.S. Route 6 UMA United Motorcoach Association

vi Highway Accident Report Executive Summary On Saturday, October 13, 2001, about 2:00 p.m. central daylight time, a 2000 Thomas Built Buses, Inc., 78-passenger school bus carrying 27 Seward High School students and 3 adults (excluding the driver) was traveling westbound through a work zone on U.S. Route 6 in Omaha, Nebraska. As the Seward bus entered the work zone lane shift at the approach to the West Papillion Creek Bridge, it encountered a 1986 Motor Coach Industries 52-passenger motorcoach carrying Norfolk High School students traveling eastbound. Although no collision occurred between the Norfolk and Seward buses, the westbound school bus departed the traveled roadway on the right and subsequently struck the W-beam barrier on the approach to the bridge, steered to the left momentarily, and then steered abruptly back to the right, striking the W-beam again and, finally, a three-rail barrier between the guardrail and the concrete bridge railing. The bus passed through the remains of the three-rail barrier, rode up onto the bridge’s sidewall, and rolled 270 degrees clockwise as it fell about 49 feet, landing on its left side in a 1-foot-deep creek below the bridge. Three students and one adult sustained fatal injuries. The remaining passengers and the busdriver sustained injuries ranging from serious to minor. The National Transportation Safety Board determines that the probable cause of this accident was the failure of the Nebraska Department of Roads to recognize and correct the hazardous condition in the work zone created by the irregular geometry of the roadway, the narrow lane widths, and the speed limit. Contributing to the accident was the accident bus driver’s inability to maintain the bus within the lane due to the perceived or actual threat of a frontal collision with the approaching eastbound motorcoach and the accident bus driver’s unfamiliarity with the accident vehicle. Contributing to the severity of the accident was the failure of the traffic barrier system to redirect the accident vehicle. Major safety issues identified in this accident include: • Effect of highway design, speed, and vehicle handling characteristics upon driver performance. • Adequacy of work zone safety management. • Lack of emergency preparedness of students. • Visibility of emergency signage and exit door levers. • School bus extrication training. As a result of this accident investigation, the National Transportation Safety Board makes recommendations to the Federal Highway Administration, Nebraska Department of Roads, Omaha Fire Department, National Association of State Directors of Pupil Transportation Services, and Thomas Built Buses, Inc.

!" # ( )

! "#$%

#& *

!+ ="&=&

? @ J !? J" K X @ Y[ ! \ " K =]

^&& & & &

+%& &

\&

& _%\

%& =!

"%\

% & \ ` !\" (*

] &

= & \ \ % = &

+% = & { \ & &+% = &

Factual 2 Highway Accident Report Figure 2. Transition east of the accident site from a six-lane highway to a two-lane, undi- vided highway (upper right). (Source: Douglas County, Nebraska, Sheriff’s Office [DCSO])

Factual 3 Highway Accident Report As the bus approached the West Papillion Creek Bridge, the roadway shifted slightly to the driver’s left and then to the right. (See figure 3.) As the bus entered the work zone lane shift at the approach to the West Papillion Creek Bridge, it encountered a 1986 Motor Coach Industries (MCI) 52-passenger motorcoach carrying Norfolk High School students traveling eastbound. Although no collision occurred between the Norfolk and Seward buses, the westbound school bus departed the traveled roadway on the right and subsequently struck the W-beam barrier on the approach to the bridge, steered to the left momentarily, and then steered abruptly back to the right, striking the W-beam again and, finally, a three-rail barrier between the guardrail and the concrete bridge railing. The bus passed through the remains of the three- rail barrier, rode up onto the bridge’s sidewall, and rolled 270 degrees clockwise as it fell about 49 feet, landing on its left side in a 1-foot-deep creek below the bridge (see figures 4 through 6). Figure 3. Eastbound view of westbound lane shift, as shown in a summer 2001 Nebraska Department of Roads (NDOR) photo-logging image.

Factual 4 Highway Accident Report Figure 4. Aerial view of accident site.

( + !" # (+*

( , !" #

| }

= |\

-/) \ = &

& [ #* =

& \ =

(,*

! "#

# # $ ## #

# $

#% #

#

# =

|

\

= \ &Y

=

~ &&=& = \

X = &[

& & &[ J

\ =]

\ & '

& #'

&

*

+

#

/

#

## #

3 43 53 63 73 83 93 ;

Factual 7 Highway Accident Report On the day of the accident, the Seward High School band, which was scheduled to compete in a band competition at Burke High School in Omaha at 1:00 p.m., departed Seward High School about 11:00 a.m., 30 minutes behind schedule for the 1 1/2-hour trip to Omaha. The Seward band was transported in a five-vehicle convoy consisting of three school buses and two vans. The Norfolk High School band, which was scheduled to compete in the same competition at 4:30 p.m., departed Norfolk High School about 1:45 p.m. in a six-vehicle convoy4 consisting of two MCI motorcoaches, two school buses, and two vans (to transport the band equipment). After the competition, the Seward band began its return trip. The first Seward bus was the accident vehicle. The second Seward bus was about 3 to 4 bus lengths behind the first bus, separated by a passenger vehicle, and the third bus was about 1/2 mile behind the first bus. The accident occurred about 10 minutes into the Seward band’s return trip, when the first Seward school bus (accident bus) passed the first Norfolk bus traveling in the opposite direction in the U.S. 6 work zone (see figure 4), and then struck the guardrail as it approached the second Norfolk bus. The accident bus driver stated that he did not remember any events that occurred after departing the competition. Therefore, Safety Board investigators relied upon witness interviews to reconstruct the accident sequence. Seward Witness Interviews Safety Board investigators interviewed5 some of the students who had been on the accident bus. They also interviewed the driver of and one parent who traveled on the second Seward bus. A parent traveling on the second Seward bus, as well as two students on the accident bus, recalled an instance earlier in the day, while en route from Seward to Burke High School. These witnesses observed the right tire or tires of the bus leaving the interstate’s travel lane, contacting the “rumble strip” on the right shoulder. The two students noted that they were alerted to the occurrence by the distinctive sound and vibration that accompanies driving on the rumble strip. Although the sound and vibration initially startled them, neither student reported feeling apprehensive or concerned about the driver’s subsequent performance. The parent traveling on the second bus had observed the bus from behind and cited several occasions during which the accident bus was “really on the right side…hugging the white line.” She also recalled a curved stretch of road in Gretna, Nebraska, about 20 miles southwest of Omaha, where the bus splashed through a puddle of water on the shoulder. She emphasized that the driver had not “swerved” out of his lane, rather that his general alignment in the lane was frequently off-center, to the right. Yet, while noticeable, 4 The leading vehicle had become separated from the rest of the convoy earlier, when the five vehicles following it had stopped for a traffic light. For the purposes of this report, the five remaining vehicles will be referred to by their order of procession, excluding the one that had become separated from the others. 5 Safety Board interviews with the accident bus passengers, October 31 and November 1, 2001.

Factual 8 Highway Accident Report it caused her no concern at that time. “I really didn’t think anything about it because it was on a curve, and it’s a big bus,” she told investigators. She was familiar with the driver, and regarded him as capable, stating, “He pretty much concentrates on his driving.” The driver of the passenger vehicle that was traveling directly behind the accident bus at the time of the accident provided a statement to the DCSO and Safety Board investigators on October 15, 2001, 2 days after the accident. The driver stated that just before the bus entered the slight left curve preceding the bridge, its right-rear tire left the pavement, followed by the front of the bus appearing to enter the eastbound lane before returning to the westbound lane, subsequently striking the guardrail. She stated that the accident bus continued along the guardrail until it rolled (clockwise) over the guardrail and off the bridge. Although she could not recall her precise speed as the vehicles approached the bridge, she stated that all traffic appeared to be traveling at the same pace. She was uncertain whether she saw the brake lights of the bus illuminated and could not recall any details concerning the eastbound traffic. She also noted that traffic appeared unusually heavy for a Saturday. The witness, who travels U.S. 6 over the West Papillion Creek Bridge daily, told investigators that as she travels westbound through the left and right curves, it appears to her that oncoming traffic is moving into the westbound lane, even though she realizes that in fact, it does not. She also explained that just before she arrives at the point where the road narrows, there appears to be insufficient room for vehicles to travel in both directions. On the return trip, none of the students aboard the accident bus observed the oncoming Norfolk buses, nor did they recall any of the features of the roadway or the work zone outside the bus. Some of the students interviewed stated that they had hung their band uniforms against the windows adjacent to their seats, obstructing their outside view. All were seated (or lying on the seats), and none described any activity that they considered unduly distracting to the driver. The driver and students traveling on the second Seward bus also witnessed the accident and provided statements to the DCSO about 3 1/2 hours after the accident. One stated that she observed a bus,6 eastbound on U.S. 6, “swaying into the opposite lane,” followed by what she believed to be the accident bus driver’s attempt to try to “swerve out of the way” of the oncoming bus. Another student stated that she observed an eastbound bus that appeared to “swerve kind of close to” the accident bus, followed by the accident bus swerving to the right. A third student seated in the front of the bus reported that she observed a “white or gray” eastbound bus “kind of swerve into our lane, then drive past.” A fourth student stated that she saw a gray bus “with wording on the side” approaching from the opposite direction. She stated that the gray bus was “just barely in our lane, but was swerving out of it.” 6 Subsequently identified as an MCI motorcoach that was transporting students from Norfolk High School to the same band competition that the Seward bus had departed.

Factual 9 Highway Accident Report The 20-year-old driver of the second Seward bus provided a statement to DCSO less than 2 hours after the accident. He indicated that he was not watching at the moment the bus overturned, but had witnessed the events immediately preceding the accident. He stated that, just before the accident, the accident bus was traveling “pretty close to the right side of the road,” and thereafter, “went briefly off the [right] curb and dust flew.” He stated that they had slowed for the work zone; he was traveling at approximately 40 mph and slowing further on the approach to the bridge. Safety Board investigators also spoke with one of the adult chaperons that traveled on the second bus and had witnessed the accident. She stated that the accident bus was not traveling very fast; she believed that the buses were driving “very cautiously” and “very reasonably for the conditions.” Norfolk Witness Interviews Safety Board investigators interviewed the drivers7 of the three eastbound buses that encountered the Seward bus convoy at the West Papillion Creek Bridge and three passengers8 (two on the second Norfolk bus and one on the third Norfolk bus) who witnessed the accident. The three interviewed passengers commented on the narrowness of the roadway, one noting, “…it was really close in that S-curve thing. It was so close you could reach out and touch it [the Seward bus].” The Norfolk drivers’ accounts of the accident are summarized below. Driver of First Bus (#1027). The driver of the first bus in the Norfolk convoy stated that he travels to Omaha about six times per year, using U.S. 6, and that he was comfortable driving through the work zone at 40 mph. He stated that he held his speed at 40 to 45 mph as he traveled through the curves and estimated he was about 300 feet ahead of the second Norfolk bus. He said that he saw the approaching accident bus as they entered the slight curve in the work zone. He did not believe that the roadway was too narrow for the two buses to pass each other. He estimated the accident bus’s speed at between 45 to 50 mph, which he thought was too fast for conditions. As he passed the school bus, he glanced in his left sideview mirror and saw the accident bus go off the north side of the roadway. He did not realize the bus was crossing a bridge at the time. Driver of Second Bus (#1024). Although the driver of the second bus had driven to Omaha before, this was the first time he had taken U.S. 6 since the construction had begun. He estimated that he was traveling 200 to 300 feet behind the preceding bus, with the third bus another “200 feet or so” behind him. He stated, “I’m not sure if I was even going 40 [mph] when I came into the curves…I slowed down somewhat.” 7 Safety Board interviews with the Norfolk drivers, October 14 and 30, 2001. 8 Safety Board interviews with Norfolk passengers, June 27, 2002.

Factual 10 Highway Accident Report The driver stated that as he neared the curve in the roadway, he clearly saw the accident bus driver approaching from the opposite direction.9 He estimated the accident bus to be traveling about 55 mph. The driver noted that the first indication he had that the accident bus might be in trouble was when he saw the driver abruptly turn his steering wheel to the right, stating, “everything was routine until then.” He added, “…from a distance, I couldn’t really tell where his eyes were looking, but his head looked like he was faced straight ahead.” When the accident bus was about 100 feet in front of the Norfolk driver and closing, he said he clearly saw the accident bus driver, with a startled look on his face. He noted that the accident bus driver had both hands on the steering wheel and saw him turn the steering wheel to the [accident bus driver’s] right. He believed that the right rear of the school bus then struck the north side of the curbing on the roadway. The rear of the bus began to rotate to the south (clockwise) and tilt to the [the accident bus driver’s] left. He estimated it rotated about 20 degrees, and he thought it was going to strike his vehicle as they passed each other. He slowed to about 20 mph. As they passed each other, he glanced in his left side-view mirror and saw the bus “flip over in a cloud of dust” and disappear. He did not remember seeing any brake lights on the accident bus. He did not realize they were on a bridge at the time and thought the bus had just gone off the pavement. Driver of Third Bus (#12). The driver of the third, and last, Norfolk bus estimated he was 300 to 400 feet behind the second bus (#1024). The driver of the third bus estimated that they had been traveling at 45 mph, slowing to 40 mph after a sign that indicated a curve ahead. He stated that he slowed down further as he went into the curve. He stated that he first saw the accident bus as he was going into the curve and the bus ahead of him proceeded. He described the accident bus as “kind of hanging off to the right hand side of the road… out of control.” He stated that the bus was too far to the right, and he observed the driver gripping the wheel and seemingly trying to bring the bus over to the left, explaining, “then he started coming toward me.” He stated that he then tried to steer his bus as far as possible to the right, but before the driver of the accident bus could maneuver his bus to the left, he struck the guardrail. This driver stated that he saw the accident bus move up the guardrail and then appear to straighten out, so that it was no longer heading toward the eastbound traffic lane. The driver told investigators that his vehicle had not crossed the centerline, stating “…from my point of view, from the back, I did not see any tires or nothing cross that line, the centerline.” Driver of Fourth Vehicle (Van). The driver of the next vehicle in the convoy and the school’s band director, a passenger in that van, related that they were traveling about 40 mph through the work zone. They first noticed that something was happening when they saw the brake lights of the school bus in front of them come on and the bus slow rapidly. They then noticed the oncoming accident bus traveling westbound. The rear of the 9 These events occurred within a few seconds as the vehicles approached and passed each other.

Factual 11 Highway Accident Report bus was angled to the south and they thought it might strike the school bus in front of them. The driver and band director saw the bus in front of them move as far to the right as it could without going off the pavement to avoid the accident bus. They said that they could clearly see the accident bus driver’s face, that he appeared panicked and was trying to regain control of the vehicle by turning the steering wheel to his left. The bus appeared to “ramp up” the bridge railing, its right front wheel off the ground. They then saw the steering wheel being “ripped” to the driver’s right. All the wheels subsequently came off the ground and the bus tipped over to the right (north) and out of sight. They further recalled seeing the undercarriage of the bus as it tipped over the railing. Injuries Table 1. Injury codes.10 Medical and Pathological Information All 30 of the accident bus passengers and their driver were injured. The severity of their injuries and their seating locations are shown in figure 7. Injuries Busdriver Bus passengers Total Fatal 0 4 4 Serious 1 16 17 Minor 0 10 10 None 0 0 0 Total 1 30 31 10 Title 49 Code of Federal Regulations (CFR) 830.2 defines a fatal injury as any injury that results in death within 30 days of the accident. It defines a serious injury as an injury that requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; results in a fracture of any bone (except simple fractures of the fingers, toes, or nose); causes severe hemorrhages, nerve, muscle, or tendon damage; involves any internal organ; or involves second or third degree burns, or any burns affecting more than 5 percent of the body surface.

Factual 12 Highway Accident Report Figure 7. Bus seating chart. OMAHA, NEBRASKA HWY-02-M-H004 ICAO INJURY LEGEND SAMPLE F = FEMALE M = MALE # = AGE *International Civil Aviation Organization INJURY LEVEL AGE GENDER * F - 14 : Minor Source: NTSB N M S

F

=

= None Minor Serious Fatal M-16 : S F-40 : S F-40 : F M-15 : S M-22 : S A B C D E F F-15 : M 2 3 4 5 6 7 8 9 10 11 12 13 1 M-14 : F M-15 : S M-14 : S M-17 : S M-14 : F F-15 : S M-14 : M M-16 : S M-17 : M M-16 : M F-14 : S M-17 : S F-14 : M M-16 : M M-16 : S M-17 : M M-17 : M M-17 : M M-16 : M F-17 : S F-18 : S F-50 : S M-17 : S M-17 : F M-14 : S

Factual 13 Highway Accident Report Four passengers (3 students and 1 adult) were fatally injured; the remaining 27 occupants (24 students, 2 adults, and the driver) received injuries ranging from serious to minor. According to autopsy reports,11 three of the fatally injured passengers (rows 1, 3, and 13) experienced blunt-force trauma to both sides of the thorax and to the right side of the pelvis and head. The fourth fatally injured passenger (row 2) was asphyxiated (drowned). He had been most likely knocked unconscious during the impact with the creek bed and came to rest face down in the water. Typical serious injuries to passengers included hip, rib, arm, and leg fractures. Minor injuries included lacerations, abrasions, and contusions. Survival Aspects Many students recalled12 the bus’s rolling and being upside down during the accident sequence. Some reported a sense of floating or weightlessness while the bus was in midair. Others reported grabbing the luggage rack rails when they felt the bus begin its roll off of the bridge. In the accident’s aftermath, students reported seeing bus seats and seat cushions strewn about the bus. The student in row 2 who drowned was trapped inside the bus by the left side of the bus and a seatback. Two other students (rows 1 and 12) who were trapped inside the bus, but survived, were pinned between the seat bottoms and loose seat cushions. Another student, who was ejected from row 9, was trapped between the bus’s left side and the creek bed.13 One student interviewed recounted unsuccessfully attempting to free a friend trapped beneath a seat cushion, and another recalled seeing a friend pinned beneath a broken bus seat. School Bus Emergency Evacuation Drills Safety Board interviews with student passengers indicated that one student had received school bus emergency evacuation training while in high school. Further, only four students mentioned having received any form of school bus emergency evacuation training in either elementary or middle school. According to the Seward School District’s transportation supervisor,14 although two evacuation drills are conducted each school year, none of the accident bus’s passengers had received such training because most of them rode buses only for special events. The director added that Seward’s school buses only pick up students who live outside the city limits, noting that friends or family normally drive students who live inside the city limits to school. 11 Douglas County coroner, October 14, 2001. 12 Safety Board interviews with accident bus passengers, October 31 and November 1, 2001. 13 Safety Board interview with the Chief, Battalion 6, Omaha Fire Department (the incident commander during the accident response), March 2002. 14 Safety Board interview with the Seward School District transportation supervisor, October 15, 2001.

Factual 14 Highway Accident Report The Nebraska State Department of Education requires15 that At least twice during the school year, each pupil who is transported in a student transportation vehicle shall be instructed in safe riding practices and participate in emergency evacuation drills. School districts are required to self-certify to the State Department of Education annually that these drills have been conducted. The Federal guideline (commonly referred to as Guideline 17)16 also recommends twice-yearly emergency evacuation drills. Guideline 17 further recommends that, prior to each departure, students transported on activity or field trips on school buses or school-chartered buses be instructed in safe riding practices and on the location and operation of emergency exits. Emergency Egress The accident bus had a total of 6 emergency exits: 1 emergency exit door (row 9, left); 2 emergency exit roof hatches (front and rear); and 3 emergency exit windows (rows 9 and 12, right, and row 13, left). Passengers interviewed during the course of the investigation stated that they exited the accident bus as follows: through the windshield (3), through the front roof hatch (3), through the rear roof hatch (7), through the side windows (2) or were carried off the bus (8) or ejected (1). For seven passengers, the method of egress was unknown. Postaccident examination revealed that a first aid kit mounted on the front wall of the bus apparently shifted during impact, obstructing the emergency door release handle and instructions for the front-loading door. (See figures 8a and 8b.) In addition, the overhead luggage racks partially blocked the 2-inch-high lettering denoting the three emergency exit windows and emergency exit side door. (See figure 9.) 15 Department of Education Rule 92, Regulations Governing the Operational Procedures for Student Transportation Vehicles, Section 006, “Emergency Evacuation Drill Procedure.” 16 NHTSA Highway Safety Program Guideline No. 17, Pupil Transportation Safety (information obtained on September 10, 2003, from http://www.nhtsa.dot.gov).

Factual 15 Highway Accident Report Figure 8. Obscured emergency door release handle and signage. Figure 9. Unobscured view of emergency door release handle and signage. Figure 8a. Figure 8b.

Factual 16 Highway Accident Report The two emergency roof hatches had already been removed by emergency responders when Safety Board investigators conducted the postaccident vehicle examination on October 15, 2001. Interviews with student passengers indicated that immediately following the accident, three students kicked out the front roof hatch and kicked open the rear roof hatch because they were unfamiliar with their operation. Examination of the hatches showed that the latches used to open the hatch doors were in the closed position. Instructions on the inside of the hatch indicated that the hatch could be opened by turning the knob in the center of the hatch clockwise and pushing upward. (See figure 10.) School Bus Occupant Protection Standards The Federal Motor Vehicle Safety Standards (FMVSSs)17 that apply specifically to school bus occupant protection are FMVSS 220, School Bus Rollover Protection, which establishes performance requirements for reinforcing the school bus body structure to withstand forces encountered in rollover crashes; FMVSS 221, School Bus Body Joint Strength, which establishes performance requirements for the strength of the body panel joints in school bus bodies; and FMVSS 222, School Bus Passenger Seating and Crash Protection, which establishes performance requirements for school bus passenger seating and restraining barriers. These standards contain testing procedures and criteria. Figure 10. Unobscured view of emergency exit window signage. 17 Title 49 CFR Part 571. Figure 9.

Factual 17 Highway Accident Report Accident Bus Driver Information The accident bus driver was a 22-year-old, full-time college student at Concordia University and had recently begun his third year as a busdriver for the Seward School District. He held a Nebraska “Class B” commercial driver’s license (CDL) with a passenger endorsement,18 issued on September 24, 1999,19 as well as a Nebraska School Bus Driver Certificate. Both were current and valid at the time of the accident. Prior to being issued the Nebraska CDL, the driver held a Wyoming Class “B” CDL. His driving history showed no traffic convictions or traffic accidents in Nebraska, but did reflect two speeding convictions from Wyoming.20 The driver applied for the job of busdriver with the Seward School District on August 20, 1999. According to the driver’s Figure 11. Emergency roof hatch as shown in manu- facturer’s literature. 18 Required CDL endorsement for operating a commercial motor vehicle transporting 16 or more people, including the driver (49 CFR 383.5 and 383.93). 19 When the driver applied for the Seward bus driver’s position in August 1999, he still had a valid Wyoming CDL and thus was preliminarily qualified to apply for the job. 20 April 4, 1997—Speeding (85 mph in a 65 mph zone) and March 31, 1999—Speeding (85 mph in a 75 mph zone). Neither conviction involved a commercial motor vehicle. Figure 10.

Factual 18 Highway Accident Report employment records, he had previously worked as a laborer for the city of Rawlings, Wyoming, and as a cook and a lifeguard. In addition, the driver told Safety Board investigators that he had worked as a dump truck driver on a ranch in Wyoming for 2 years. The accident bus driver held a current physical examination card issued on September 1, 2001, and valid through September 1, 2003. The examination form did not indicate any disqualifying physical conditions. The required vision examination was recorded as having been conducted by the examining physician and reported his distance acuity as 20/20 (left), 20/20 (right), and 20/20 (both), with normal color vision. It further reported his horizontal field of vision as 110 degrees (right) and 115 degrees (left). The accident bus driver stated21 that he normally began driving about 7:00 a.m. and that his morning route ended about 8:15 a.m. His afternoon route began about 3:00 p.m. and ended about 4:30 p.m. The busdriver, who transported 20 to 25 kindergarten through 12th grade students daily, also drove on student activity trips five to eight times per year. Although he had previously driven to Omaha, he stated that prior to the initial trip on the day of the accident, he had never driven there via U.S. 6 and, until then, was unaware of the roadway construction. According to the accident bus driver and the Seward School District’s transportation supervisor, the Seward Band Director selected this U.S. 6 route because it was the shortest way to Burke High School. While driving eastbound on U.S. 6 on the way to the band competition, the busdriver first encountered roadway construction from a different highway project at the intersection of U.S. 6 and Nebraska 31 near 204th Street, about 36 blocks before the accident site. He said that he was not uncomfortable driving through either U.S. 6 work zone. The accident bus driver normally drove a 1991 59-passenger Thomas Built conventional school bus with an automatic transmission on his daily route. He had driven the accident bus, a 78-passenger Thomas Built transit-style bus,22 three or four times in the previous 2 years, and stated that he experienced no difficulties on such occasions. The busdriver also stated that he had received about 3 hours of “behind the wheel” training on the accident bus, which was conducted by the Seward District’s head mechanic in a rural area outside the city limits, in accordance with State school bus qualification requirements. (For further details, see Management and Operational Information, State School Bus Driver Qualification Process, later in this report.) Most of the witnesses to the accident expressed confidence in the driver, stating that they observed him to be competent and safe. The witnesses consistently described his demeanor, both in general and on the day of the accident, as quiet, yet friendly. Of those interviewed who rode with the driver previously, none could recall having observed anything unusual about his attitude or behavior on the day of the accident. 21 Safety Board and DCSO interview with the accident bus driver, October 29, 2001. 22 Conventional and transit-style school buses will be discussed in further detail in the next section, Vehicle and Wreckage Information.

Factual 19 Highway Accident Report Vehicle and Wreckage Information Description The accident bus was a 2000 Thomas Built, Saf-T-Liner ER, model 1405S, two- axle, 78-passenger, rear engine transit-style school bus. The vehicle was 39 feet long and weighed about 22,762 pounds empty. It was equipped with a Cummins, model ISC 8.3L, six-cylinder, in-line diesel engine; an Allison, model 3060, four-speed automatic transmission; and a Dana, model J-230, differential. The bus had type 30 airbrakes and an antilock braking system (ABS). The electronically controlled engine had an electronic control module (ECM); the transmission, and the ABS had electronic control units (ECU s). The odometer reading was 14,233 miles, and the engine had been operated a total of 495.9 hours. The width of the accident bus, with both mirrors, was about 9.8 feet, and, without mirrors, about 7.8 feet.23 The first two Norfolk buses, which were MCI buses, measured about 8 feet wide without mirrors and about 10.1 feet wide with mirrors. The third Norfolk bus was similar in width to the Seward bus. In addition to its greater passenger capacity, this 78-passenger transit-style bus24 differed from the driver’s regular bus, a 59-passenger Thomas Built conventional school bus,25 in several ways. (See figure 11.) The engine of a conventional school bus is housed beneath the hood in front of the driver, and the right-front corner of the bus is easily visible from the driver’s seat, in the lower-right portion of the driver’s field of view. In a rear-engine transit-style bus, the right corner is aft of the driver’s visual field. 23 Measurements for the Seward and Norfolk buses are based upon the Safety Board’s mapping of like buses. 24 A transit-style or “Type D” school bus consists of a body installed upon a chassis, with the engine mounted in the front, midsection, or rear. These vehicles have a gross vehicle weight rating of more than 10,000 pounds and are designed for carrying more than 10 passengers. The engine may be located (1) behind the windshield and beside the driver’s seat; (2) at the rear of the bus, behind the rear wheels; or (3) toward the middle of the bus, between the front and rear axles. The entrance door and driver’s seat are forward of the front axle. 25 A conventional or “Type C” school bus consists of a body installed upon a flat-back cowl chassis with a gross vehicle weight rating of more than 10,000 pounds and is designed for carrying more than 10 passengers. The engine is located forward of the windshield; the entrance door and driver’s seat are aft of the front axle.

Factual 20 Highway Accident Report Figure 12. Transit-style school bus. Figure 13. Conventional school bus. Figure 11a. Figure 11b.

Factual 21 Highway Accident Report Additionally, the front (steering) axle on a transit-style bus is located beneath and behind the driver, whereas on a conventional bus, the steering axle is positioned beneath the engine, in front of the driver. Damage Exterior. The bus’s exterior sustained severe damage, particularly on the left side (see figure 12). The left-front and -rear corners of the bus sustained the heaviest damage, resulting in intrusion into the driver’s compartment and seat rows 10 through 13. (See figures 13 and 14.) The most significant deformation occurred to the roof at the left-rear corner of the bus, extending 42 inches inboard from the left side and downward 61 inches. The right side of the bus had lesser deformation, extending from floor to ceiling, and penetrating approximately 7 inches at rows 3 and 7. The bus also sustained damage to the lower panels between the axles (figure 15) from aft of the right passenger boarding door and extending to almost the rear axle. Figure 14. Left side of accident bus. Figure 12.

Factual 22 Highway Accident Report Figure 15. Left-front roof deformation. Figure 16. Left-rear roof deformation. Figure 13. Figure 14.

Factual 23 Highway Accident Report All of the front lights, including bus stop warning lights, were damaged. Both air tanks were dislodged and the air lines were torn away. The left-rear service/spring brake had separated into two pieces. The right-rear leaf springs were misaligned; the right-front shock absorber was broken. Numerous other dents, scratches, and bent metal (both skin and structural) occurred on various parts of the bus, which was damaged beyond repair. An L-shaped piece of steel bridge railing, approximately 19 feet long, lodged between the bus’s undercarriage (floor) and front axle. The guardrail passed underneath the bus and rearward to near the center of the bus, causing damage to the cross members supporting the floor. The window glazing shattered on the 14 left-side windows and on the 1st, 3rd, and 4th right-side windows, as well as in the windshield and rear window. The glazing on the boarding door window panels (top-right and lower-left and -right) also shattered. The underside of the bus sustained severe damage, and both of the lower baggage stowage compartments, located between the bus’s axles, were destroyed. Interior. The interior damage generally corresponded to the exterior damage along the bus’s left side and ceiling. The floor was intact, with the exception of some distortion near left-side rows 4, 8, 9, and 13. Figure 17. Right side of accident bus. Figure 15.

Factual 24 Highway Accident Report The front-left corner near the driver’s seat was collapsed inward 56 inches at its deepest point and downward 22 inches. The 24-inch-wide driver’s seat was deformed inward 8 inches. (See figure 16.) The bus’s sidewalls were deformed on both sides. Most severely damaged was the left sidewall, especially at the driver’s station and at rows 10 through 13. The left sidewall was also deformed outward about 5 inches between rows 2 and 9. The right sidewall was deformed inward about 8 inches adjacent to the areas between rows 2 and 4 and rows 6 and 9. The emergency exit door on the left side at row 9 sustained severe damage, but was functional. The standard emergency door latch lift on the side and rear exit doors was also operational. The rear emergency exit window’s frame and door were distorted, rendering the door inoperative, and the glazing was shattered. All three emergency window exits were Figure 18. Damage to driver’s seat. Figure 16.

Factual 25 Highway Accident Report affixed to their frames. The glazing on the left-side emergency exit window near row 13 was shattered, and the frame was inoperative. Both right-side emergency exit windows at rows 9 and 12 were intact and operational. The passenger seats did not sustain seat anchorage failures, but the clamps used to attach the seat pans/cushions to the metal frame either broke or became unlatched at rows 1, 2, 3, 4, and 12 on the right side and at rows 1, 8, and 12 on the left side. The overhead luggage racks, mounted along the right and left sides of the bus, were deformed. Pipe sections from the luggage racks protruded inward near row 7 on the right side and near row 3 on the left side. Postaccident investigation revealed that the midsection of the overhead luggage racks was damaged further during the recovery operation, when the bus was being pulled from the creek bed, and a chain, wrapped around the bus’s middle, ripped into the sheet metal. Inside the bus, first aid and safety equipment consisted of two first aid kits, one biohazard spill kit, two fire extinguishers, and safety triangles, all of which appeared intact and unused. The bus was equipped with a three-point lap/shoulder belt for the busdriver, which was operable. The belt webbing showed no evidence of stretching or friction rub. No other bus seats were equipped with passenger safety restraints. Postaccident Examination On October 19, 2001, representatives from the Safety Board, State and local law enforcement organizations, and Thomas Built conducted a mechanical examination of the accident bus at the Douglas County Maintenance Garage in Omaha. A mechanic from the Douglas County maintenance garage assisted. Engine and Transmission. The engine’s ECM was removed from the bus and subsequently downloaded on October 19, 2001, by a Safety Board investigator assisted by a Cummins technician at Cummins Great Plains in Omaha. This ECM was not designed to record vehicle speed, braking, engine rpm, or other parameters that could provide information about the accident scenario. The transmission had become completely dislodged from the bus during the accident. Although the transmission was equipped with an ECU, the ECU did not have recording abilities for parameters pertinent to accident reconstruction (such as gear position and recent shifts). The transmission did not have a retarder.26 Steering. The bus had a TRW, model TAS 65, integral27 power steering unit (gearbox). During the vehicle examination, all of the steering linkage was observed to be connected and moved slightly when the 20-inch steering wheel was turned. Due to vehicle 26 Device that assists the braking system in slowing the vehicle. 27 Integral means that the control valve, hydraulic cylinder (ram), and gearing mechanism are all contained within the steering box housing.

Factual 26 Highway Accident Report crush in the left front, the wheel did not turn freely. The steering gearbox was removed from the bus and shipped to TRW Commercial Steering in Lafayette, Indiana, for examination by Safety Board and TRW staff. A TRW engineer examined the exterior of the gearbox and observed no damage. The input shaft was rotated 5 1/4 turns in each direction; it rotated freely without resistance. The gearbox was then disassembled, and no defects were discovered. Slight ball bearing indentations were noted on the worm gear and determined by the TRW engineer to be from accident impact. Tires. The bus had six original tires, all Goodyear, size 12R22.5. The two front tires were model G159 with highway-type tread, and the four rear tires (dual wheels) were model G124 with mud and snow treads. The air pressure was between 100 and 110 for all except the right rear-inside dual, which was flat due to damage during impact. All of the tires had minimum tread depths of between 15/32 and 20/32 of an inch, within Federal standards.28 Brakes. The airbrake-equipped bus had standard S-cam (clamp type) foundation brakes with type 30 chambers and automatic slack adjusters. Because of vehicle damage, the engine could neither be started nor the airbrake system operated; therefore, the airbrake chambers were plumbed directly and shop air was utilized to obtain push-rod measurements. Both front brake push-rods measured 1 7/8th inch.29 The push-rod travel for the left-rear brake could not be obtained due to the air chamber having been completely dislodged and damaged during the accident. The right-rear air chamber was also plumbed directly and a push-rod measurement of 3/4 inch was obtained utilizing shop air; the wheel rim was bent against the brake drum and the drum was cracked, making the accuracy of the push-rod measurement unreliable. All brake shoes were about 3/4-inch thick and showed only slight wear. No defects were discovered during this examination that were inconsistent with accident damage. The bus was equipped with a Bendix model EC-17 ECU. (For details of the ECU testing, see the Tests and Research section.) Highway Information Accident Location The accident occurred in the westbound lane of U.S. 6 (West Dodge Road), approximately 0.33 miles west of Omaha in Douglas County.30 The school bus ran off the West Papillion Creek Bridge (Nebraska Department of Roads Structure #S006 36012). 28 Federal Motor Carrier Safety Regulation (FMCSR), 49 CFR 393.75(b)(c), requires front tires to have a minimum tread depth of 4/32 of an inch and all other tires to have a minimum tread depth of 2/32 of an inch. 29 According to 49 CFR 396.17 and Commercial Vehicle Safety Alliance (CVSA) standards, the maximum allowed stroke for a Type 30 S-cam brake is 2 inches. 30 Located at construction station number 355, photolog 01+360.110, Federal aid project number EACNH-EACBR-6-7 (133).

(

!" #

?J= \ ^_ __

& [` &^_\ =

K% &\

\

\ \ & \

\ !%

\# &" & & &[K%

&[[

=

= \ %

=

\ = \ [

\ %\ &

&\

& \%\ [ ^\

[#& #J\ ^~\

\ ‰

_^\ \%\ [ #^\ J% [ JJ\ ^J \ (>*#% %#

"

#'

# #

#'

#

#'

%

;`"" +q&_" {'

{'

(=*

Factual 28 Highway Accident Report Traffic Volume U.S. 6 is approximately 373 miles long, spanning the States of Nebraska and Colorado in the west to the Missouri River in the east.31 According to NDOR, the average daily traffic (ADT) counts on U.S. 6 in the vicinity of the accident location, including the percentage of truck traffic, are as follows (table 2): Table 2. Average daily traffic volume on U.S. 6 in vicinity of 167th Street (includes accident site). Work Zone Accident Statistics No fatal work zone accidents occurred within the boundary of the construction project32 from March 2000 until the accident on October 13, 2001, according to records provided by the Nebraska State Patrol (NSP). NDOR data for the area in the vicinity of the accident indicated the following (table 3): Table 3. Accidents occurring within 1 mile of 167th Street. 31 This segment of U.S. 6 is part of the National Highway System (23 United States Code 103b), which consists of the highway routes and connections to transportation facilities depicted on the map submitted by the Secretary of Transportation to Congress. Year ADT Daily trucks Percentage of ADT 1996 20,400 760 3.7 1997 23,000 835 3.6 1998 25,600 920 3.6 1999 29,500 1,010 3.3 2000 33,400 1,115 3.3 Source: NDOR. 32 This construction project boundary extended from 162nd Street in the east to 174th Street in the west. Fatal accidents Injury accidents Year Number of accidents Fatalities Injuries Number of accidents Injuries Property damage only accidents Total 19991 0 0 0 25 42 21 46 2000 0 0 0 12 15 5 17 20012 1 4 27 4 5 12 17 Totals 1 4 27 41 62 38 80 Source: NDOR. 1Data cover the year before construction began. 2Including the accident discussed in this report.

Factual 29 Highway Accident Report Work Zone Definitions and Geometry The Manual on Uniform Traffic Control Devices (MUTCD)33 defines a “construction activity area,” or work zone, as, …the area of a roadway where the work takes place. It is comprised of the work space, the traffic space and may contain one or more buffer space. The work space is that portion of the roadway closed to traffic and set aside for workers, equipment, and material. Work space may be fixed or may move as work progresses. Long-term work spaces are usually delineated by channelizing devices or barriers to exclude traffic and pedestrians. The traffic space is the portion of the roadway in which traffic is routed through the activity area. The buffer space is an optional feature in the activity area that separates traffic flow from the work activity or a potentially hazardous area and provides recovery space for an errant vehicle. Neither work activity nor storage of equipment, vehicles, or materials should occur is this space. Buffer spaces may be positioned longitudinally and laterally with respect to the direction of traffic.

1. Longitudinal Buffer Space—[Does not apply.]
2. Lateral Buffer Space

A lateral buffer space may be used to separate the traffic space from the work space…or a potentially hazardous area, such as an excavation or pavement edge drop off. A lateral space may also be used between two travel lanes, especially those carrying opposing flows. The width of the lateral buffer space should be determined by engineering judgment. At the time of the accident, the West Dodge Road approach to the construction work zone was a six-lane divided median highway. The accident segment of U.S. 6 was a temporary two-lane, two-way, undivided asphaltic concrete roadway inside a work zone. Each 10.5-foot-wide lane had narrow or no shoulders. On the east end of the project, the two-lane segment had been shifted northward about 5 1/2 feet to accommodate the toe of the slope (area where the fill dirt needed to construct the future eastbound lanes met the original roadway grade). East of the West Papillion Creek Bridge, the two-lane roadway was shifted southward to intercept the existing bridge deck. This shift resulted in a short- length horizontal curve to the left, followed by a short-length horizontal curve to the right.34 The westbound lane shift had an offset width (distance a lane shifts from the roadway’s original centerline, as shown in figure 18) of approximately 5 1/2 feet and was 184 feet long near the east end of the bridge. The eastbound and westbound travel lanes had cross slopes of 2 percent toward the north side of the roadway. The westbound approach lane to the bridge had a 3-percent ascending grade. 33 U.S. Department of Transportation, Federal Highway Administration, Manual on Uniform Traffic Control Devices (Washington, DC: FHWA, 1988), chapter 6 (revision 3–1993). 34 These right and left horizontal curves, which were in place at the beginning of construction, are referred to as “lane shifts” in this report.

(

!" # ‹ %%&

& \==[ = \‹ %%& & \= & [

\\‰=[Œ?X_ } Œ?XJ \

\ \

\ \

&

\ K ‘ [ ? ‘\

& \

& [ &

\ \ &

\^_

\  ?J



=

+ ^%\

%& & [=

\ \ ! ~"Y \+ && [= & %& \# (*q#

_ Œ?X~$$ J Œ?X~$$ J!= %~~"

&

[ \&

&\ (?*

Factual 31 Highway Accident Report The two lane shifts resulted in short-radii reverse curves (that is, “sharp”38 curves) on the westbound approach to the narrowed bridge deck. After the first curve to the left, westbound traffic was momentarily directed toward oncoming eastbound traffic and then parallel to the construction work space and activity on the south side of the bridge deck. Figure 21. Aerial view of the construction site. Arrow indicates work activity area on south side of bridge. (Source: DCSO) 38 The survey data collected during the accident investigation revealed that the curves did not have a constant radius over their length. The MUTCD, 1988 edition, chapter 6 (revision 3-1992), paragraph 6C-3, implies that short-length lane shifts do not require constant radius curves. Figure 19.

Factual 32 Highway Accident Report Traffic Control Construction Signing The westbound approach to the accident site had the signage recommended in the 1988 MUTCD.39 Safety Board investigators documented the following construction warning signs and devices (listed in order of appearance): • W20-1 sign: ROAD CONSTRUCTION AHEAD (left and right sides). • W4-2 sign: Lane reduction transition (left and right sides). • Flashing arrow panels (left and right sides). • Nonstandard warning sign: STAY IN YOUR LANE. • Nonstandard warning sign: BE PREPARED TO STOP. • W6-3 sign: Two-way traffic (left and right sides). • R4-1 sign: DO NOT PASS (at least two signs were mounted on other traffic control devices, including on a W6-3 sign and on a barricade). Maintenance History NDOR had constructed U.S. 640 in the early 1930s as an undivided two-lane highway with 10.5-foot-wide travel lanes. Part of the original construction included, on the north side of the bridge, a 1-foot-high, single, steel, L-shaped rail mounted on an 18- inch-high concrete wall and a 4-inch-wide concrete gutter. In 1935, NDOR improved the grade line, constructed a 42-foot curb and gutter concrete cross section, and built bridges over the west branch of the Papillion Creek and the Union Pacific Railroad tracks. These improvements widened the roadway into an undivided four-lane highway. In 1962, the West Papillion Creek Bridge was lengthened about 46 feet on its east end to accommodate water flow in the creek, according to NDOR representatives. During the project, a 46-foot-long three-rail barrier41 was placed on both sides of the east end of the bridge.42 The west end barriers (the end of the bridge not involved in the accident) and bridge railing were not modified. According to NDOR, no information existed in its bridge inventory database about these particular types of barriers (both the single-rail barrier installed as part of the original bridge construction and the three-rail barrier added during the 1962 bridge lengthening project). The ongoing construction project has replaced this bridge (and its abutments) with a new bridge that conforms to current Federal and American Association of State Highway and Transportation Officials (AASHTO) guidelines. According to NDOR, a statewide bridge barrier replacement project is underway to replace several types of old bridge barrier systems with ones that meet current design guidelines. 39 MUTCD, 1988 edition, chapter 6 (revision 3–1992), figure TA-39. 40 Much of U.S. 6 across Nebraska is a two-lane rural highway. 41 Identified as a curb and handrail in the 1962 bridge plans. 42 NDOR engineers believe that the three-rail barrier treatment met 1962 State standards. Little detail about this barrier design is available on the 1962 bridge design plans.

Factual 33 Highway Accident Report In 1985, NDOR resurfaced U.S. 6 from 204th Street to east of 132nd Street with asphaltic concrete and constructed W-beam approach barrier transition sections43 for both ends of the West Papillion Creek Bridge, in conformance to AASHTO standards.44 The east-end detail on the plans showed the 37-foot-long breakaway terminal section of the W- beam transition barrier faired into (joined smoothly with) the existing three-rail barrier section on both the north and south sides of the roadway. This design conformed to existing AASHTO guidelines.45 In March 2000, NDOR and the Federal Highway Administration (FHWA) initiated a joint 3-year, $35 million reconstruction project to expand the highway from a four-lane undivided highway (two eastbound and two westbound lanes) to a six-lane divided highway. The section of U.S. 6 east of 162nd Street had already been completed. The 1.06-mile (1.716-kilometer) construction project46 encompassed U.S. 6 from 162nd Street in the east to 174th Street in the west. The project, which included replacement of the existing bridges, barrier systems, and abutments, was intended to accommodate increased traffic. In addition, the project called for expanding existing lane widths from 10 1/2 feet to 12 feet and adding paved shoulders and a median. In November 2000, 8 months after the construction project began, three 10-foot- long, 3-foot-high, and 2-foot-wide portable concrete barriers replaced the end treatment section of the 1985 W-beam section barrier for westbound traffic. These temporary portable concrete barriers were flared into an embankment on the north side of the roadway. On May 15, 2001, during the construction project, a large, off-the-road earth moving truck was parked in the construction work space just west of the accident site. Unoccupied, it began to roll from a work access road and eastward down the 3-percent grade on U.S. 6, diagonally across the West Papillion Creek Bridge, and collided with the barrier transition on the northeast corner of the bridge. The truck struck the barrier transition where the 1962 three-rail barrier and the 1985 W-beam came together. NDOR was unable to provide photographs of the damage prior to repair, and no record of a police accident report could be located for the incident. The accident was recorded in the NDOR project inspector’s daily report. According to the Nebraska Code, NRS 60-699: (1) The operator of any vehicle involved in an accident resulting in injuries or death to any person or damage to the property of any one person, including such operator, to an apparent extent of more than one thousand dollars shall within ten days forward a report of such accident to the Department of Roads. 43 Guardrail or other device that provides continuity of protection when two different roadside barriers are joined together. (American Association of State Highway and Transportation Officials, Roadside Design Guide 2002 [Washington, D.C.: 2002], page 5-23.) In this case, the transition was from the roadway guardrail to the bridge railing. 44 American Association of State Highway and Transportation Officials, Guide for Selecting, Locating and Designing Traffic Barriers (Washington, D.C.: AASHTO, 1977). 45 Guide for Selecting, Locating and Designing Traffic Barriers, 1977. The 1977 edition would have been in effect in 1985 and was superseded in 1989. 46 Federal aid project number EACNH-EACBR-6-7 (133).

Factual 34 Highway Accident Report The general contractor evaluated the condition of the barrier following the May 15, 2001, incident. The NDOR contract for the construction project incorporated the following sections from NDOR’s 1997 metric edition of Standards and Specifications for Highway Construction: Section 105.11—Restriction on Moving and Use of Heavy Equipment, item 13. The Contractor shall be responsible for all damages done by the equipment. Section 107.09—Preservation and Restoration of Property, Trees, Monuments, etc., item 1. The Contractor shall preserve, protect, and prevent damage to all public and private property. Soon after this evaluation, the contractor had its bridge maintenance personnel devise and install a repair for the barrier. No engineers were involved in the barrier’s design or its repair. In addition, no one evaluated the structure’s strength or compliance with established guidelines. With the exception of NDOR photo-logging47 images, no known photographs exist of the completed repair. The segment of barrier affected by the May 2001 truck incident was visible in NDOR photo-logging images of the site made during the summers of 1996 and 2001. (See figures 20a and 20b. For further information on the repair area’s relationship to the accident sequence, see figure 26 later in this analysis.) The 2001 photo-logging image (figure 20b) shows that the concrete transition block48 constructed in the 1985 project was dislodged from the bridge deck and pushed to the north. The W-beam connected to the anchor block and several of the wooden posts supporting the W-beam transition were also missing or damaged. These images indicate that several feet of the three-rail barrier installed on the east end of the barrier in 1962 was removed and not replaced during the repair work. The images also show that a section of W-beam was attached to the remains of the 1985 W-beam barrier installation. This beam extended past the damaged area but was not anchored to the remains of the three-rail system. This W-beam was connected only to metal posts that were attached to the repair’s “stacked” H-beam arrangement. (See figure 20b.) This arrangement resulted in the W-beam not being secured at its west end and lacking the strength provided by tension from another structure. None of the assembly conformed to known guidelines for barrier design or construction. 47 Many highway agencies periodically make photographs or digital images at 100 feet r intervals along their roadway systems while traveling in each direction. These images are typically used for system analysis, inventories, and other purposes. NDOR photo-logged approximately every 3 years. Images from the summers of 1996 and 2001 were available; the 2001 images showed the “repaired” barrier in several frames. 48 Rectangular block of concrete into which an anchoring device, such as a bolt, is inserted, in this case, to secure part of the W-beam transition barrier.

Factual 35 Highway Accident Report Figure 22. Summer 1996 NDOR photo-logging image of the barrier system installed in 1985 (westbound view). Arrow indicates transition from W-beam to three-rail barrier. Figure 23. Summer 2001 NDOR photo-logging image of the repair to the barrier system after the May 2001 truck incident (westbound view). Shown is the east end of the remain- ing three-rail barrier and the west end of the repair to the three-rail barrier. Figure 20a. Figure 20b.

Factual 36 Highway Accident Report Photographs taken during the investigation of the October 13, 2001, accident show a structure made of an H-girder supporting an area from the northeast end of the bridge to east end of the damaged three-rail barrier. (See figure 21.) Connections between the H- beam stacks and the girder had failed due to the school bus’s impact. After the accident, NDOR placed portable concrete barriers that were 32 inches high, 10 feet long, and 2 feet wide49on the north side of the bridge to protect that section of the bridge railing damaged in the accident, and the portable concrete barrier was extended to the west end of the bridge. As a result, the centerline of the traveled roadway was moved approximately 2 feet south of its initial location. The construction work space on the south side of the bridge, which was not protected by a lateral buffer space or barrier, remained in place. Figure 24. Bridge repair by contractor shown immediately after October 13, 2001, acci- dent. (Source: DCSO) 49 According to National Cooperative Highway Research Program Report 350, Recommended Procedures for the Safety Performance Evaluation of Highway Features, this type of temporary barrier is neither designed to restrain large vehicles, such as the accident school bus, nor required to follow any design guide. Figure 21.

Factual 37 Highway Accident Report Work Zone Safety Guidelines The MUTCD50 (in effect at the time of the accident) stated, A Traffic Control Plan (TCP) describes traffic controls to be used for facilitating vehicle and pedestrian traffic through a temporary traffic control zone. The plan may range in scope from being very detailed, to merely referencing typical drawings contained in the MUTCD, standard approved highway agency drawings and manuals, or specific drawings contained in contract documents. The degree of detail in the TCP depends entirely on the complexity of the situation, and TCPs should be prepared by persons knowledgeable about the fundamental principles of temporary traffic control and the work activities to be performed. The MUTCD provides the following guidance for supervision of traffic control and safety in work zones: Each person whose actions affect temporary traffic control zone safety-from upper-level management personnel through field personnel-should receive training appropriate to the job decisions each is required to make. Only those who are trained in safe traffic control practices, and who have a basic understanding of the principles established applicable standards and regulations (including those of the MUTCD), should supervise the selection, placement, and maintenance of traffic control devices in work and incident management areas. When warranted, an engineering analysis should be made (in cooperation with law enforcement officials) of all accidents occurring in temporary traffic control zones. Temporary traffic control zones and accident records should be monitored to identify and analyze traffic accidents or conflicts. For example, skid marks or damaged traffic control devices may indicate the need for changes in the traffic control. Two-Lane, Two-Way Traffic on One Roadway of a Normally Divided Highway Two-lane, two-way operations (TLTWO) on one roadway of a normally divided highway is a typical application that requires special consideration in the planning, design, and construction phases. As unique operational problems (for example, increasing the risk of serious head-on collisions) can arise with the TLTWO, this typical application will be discussed here. Before including a TLTWO in the traffic control plan for a project, careful consideration should be given to its appropriateness. The following items should be considered during the decision-making process: • Is a suitable detour available? • What are the characteristics of the traffic? • Can traffic be maintained on the shoulder? • Can temporary lanes be constructed in the median? 50 MUTCD, 1988 edition, chapter 6 (revision 3-1992), page 6C-10.

Factual 38 Highway Accident Report • Can the work be accomplished by closing only one directional lane? If this option is selected for consideration, will it result in additional hazard to temporary traffic control zone personnel? • If a TLTWO is selected, will this result in a shorter contract time? • Will the TLTWO allow a contractor to perform the work more efficiently and thus result in a substantial decrease in contract cost? • What is the “track record” of similar installations? • Are there any width or height restrictions that would preclude the TLTWO or the use of a shoulder or the median as a temporary lane? • What are the condition of the pavement and the shoulders in the proposed TLTWO section? Due to width restriction, traffic may drive on the shoulders, which must be structurally adequate. The traffic control plan as shown in figure TA-39 shall include provision for separate opposing traffic whenever two-way traffic must be maintained on one roadway of a normally divided highway. The TLTWO shall be used only after careful consideration of other available methods of traffic control. When traffic control must be maintained on one roadway of a normally divided highway, opposing traffic shall be separated either with portable barriers (concrete safety-shape or approved alternate), or with channelizing devices throughout the length of the two-way operation. The use of striping, raised pavement markers, and complementary signing, either alone or in combination is not considered acceptable for separation purposes. In 2000 and 2003, the MUTCD was updated and the guidance provided regarding TLTWO was strengthened: When two-lane, two-way traffic control must be maintained on one roadway of a normally divided highway, opposing vehicular traffic shall be separated with either temporary traffic barriers (concrete safety-shape or approved alternate) or with channelizing devices throughout the length of the two-way operation. The use of marking and complementary signing by themselves shall not be used. [emphasis added] FHWA policy51 in the Federal-Aid Policy Guide contains further requirements: Section 630.1010(a), Part 5(i) Two-lane, two-way operation on one roadway of a normally divided highway (TLTWO) shall be used only after careful consideration of other available methods of traffic control. Where the TLTWO is used, the TCP [traffic control plan] shall include provisions for the separation of opposing traffic except: 51 U.S. Department of Transportation, Federal Highway Administration, Federal-Aid Policy Guide, 23 CFR 630j, Subchapter G—Engineering and Traffic Operations, Part 630—Preconstruction Procedures, Subpart J—Traffic Safety in Highway and Street Work Zones, transmittal 30 (Washington, DC: January 2002).

Factual 39 Highway Accident Report (A) Where the TLTWO is located on an urban type street or arterial where operating speeds are low;52 (B) Where drivers entering the TLTWO can see the transition back to normal one- way operation on each roadway; or (C) Where FHWA approves nonuse of separation devices based on unusual circumstances. Section 630.1010(a)-5(ii) (b) Responsible person. The highway agency shall designate a qualified person at the project level who will have the primary responsibility and sufficient authority for assuring that the TCP and other safety aspects of the contract are effectively administered. While the project or resident engineer may have this responsibility, on large complex projects another person should be assigned at the project level to handle traffic control on a full-time basis. (2) Construction zone accidents and accident data53 shall be analyzed and used to continually correct deficiencies which are found to exist on individual projects, and to improve the content of future traffic control plans. (d) Training. All persons responsible for the development, design, implementation, and inspection of traffic control shall be adequately trained.54 In the late 1970s, the Safety Board investigated an accident in Laramie, Wyoming,55 that was similar to the one that occurred in Omaha. The Laramie accident, which also occurred in a work zone with TLTWO operation, involved two tractor- semitrailers and a motor home in a head-on collision that killed nine people. The investigation found that TLTWO was used routinely by the States during divided freeway pavement maintenance (resurfacing) and that it was common practice to separate the opposing traffic flows with only yellow pavement markings. As a result, frequent and severe head-on collisions and other types of traffic accidents had been experienced. As a result of its investigation of the Laramie accident, the Safety Board made Safety Recommendation H-80-11 to the FHWA: 52 The term low operating speeds is not defined in any known Federal publication. Many freeways typically operate at posted speed limits of 55 mph; the speed limit in the accident work zone was 45 mph. 53 The 1988 MUTCD (1993 revision) states that this should be done only “when warranted.” 54 According to NDOR, none of the staff assigned to the U.S. 6 project had such training. 55 National Transportation Safety Board, Multiple Vehicle Collision in a Construction Zone, U.S. Interstate 80, Near Laramie, Wyoming, August 22, 1979, Highway Accident Report NTSB/HAR-80/01 (Washington, DC: NTSB, 1980).

Factual 40 Highway Accident Report H-80-11 Promote the development of a traffic control device to fill the gap between the shaped concrete barrier and traffic cones to serve as a continuous visual barrier to separate traffic in work zones. This and other accidents prompted the FHWA to begin to issue guidance to State departments of transportation and highways for the positive separation of traffic flows in these work zones. Based upon the FHWA’s development of design and performance criteria56 to improve the barrier options available for use by highway agencies, on March 22, 1984, the Safety Board classified Safety Recommendation H-80-11, “Closed— Acceptable Action.” Work Zone Traffic Control Plan The 1988 MUTCD57 allowed the use of traffic control plans that are not specific to a particular project. Such a “generic” plan was used for this project and consists of a set of accepted traffic control strategies for the conditions and situations frequently encountered in work zones. Construction engineering management personnel may then choose an appropriate plan element to fit the conditions that they might encounter during a project, as also noted in the 1988 MUTCD: A traffic control plan, in detail appropriate to the complexity of the work project or incident, should be prepared and understood by all responsible parties before the site is occupied. Any changes in the traffic control plan should be approved by an official trained in safe traffic control practices. The engineering judgment involved in determining the complexity of a construction project would include evaluating variables such as: • Traffic speed and volumes, • Alternative routes, • Duration of the construction project, • Physical size and complexity of the work site, and • Other variables specific to individual projects. As part of ongoing construction, the eastbound lanes of U.S. 6 were closed to accommodate construction of the three new eastbound lanes. The westbound lanes were open for two-way traffic and consisted of one 10 1/2-foot-wide eastbound lane and one 10 1/2-foot-wide westbound lane divided by solid, double yellow, retroreflectorized lines. The roadway edges were marked with solid, white, retroreflectorized lines. The north side barriers on the bridge and its approaches remained the same as before the beginning of the 56 Design Considerations for Two-Lane, Two-Way Work Zone Operations (FHWA/RD-83/112) and Performance Criteria for Channelizing Devices Used for Two-Lane, Two Way Operations (FHWA/RD- 83/057). 57 MUTCD, 1988 edition, chapter 6 (revision 3-1992).

Factual 41 Highway Accident Report project. The south side of the roadway and bridge was lined with 3-foot-high, retroreflectorized, orange and white channelization drums in the construction work space area. The traffic control plan for this project had been in place since March 2000, but it did not specifically describe any of these traffic control arrangements. The generic traffic control plan being used did not include a traffic control design for an urban divided median facility. It had typical plans for a “rural four-lane divided highway” and an “urban undivided four-lane roadway.” The traffic controls used on U.S. 6 most closely compare to the urban roadway example, although NDOR stated to investigators that it considers this to be a “rural” area. The AASHTO publication A Policy of the Design of Highways and Streets defines “urban” areas as “places within the boundaries set by responsible State and Local officials having a population of 5,000 or more.” Rural areas are defined as those areas outside of urban areas. The accident site was essentially on the city limit line for Omaha and was predominately residential. The MUTCD states that changes or deviations from the traffic control plan are left to the discretion of the project engineer and must be documented. According to NDOR, the applicable generic traffic control plan for the accident site was followed with no changes. The generic traffic control plan did not include a requirement for separating the two opposing lanes of traffic, even though the 1988 MUTCD required separation of the opposing lanes. . The applicable 1988 MUTCD included the following guidance: Before including a TLTWO in the traffic control plan for a project, careful consideration should be given to its appropriateness. The following items should be considered during the decision-making process. The MUTCD then cited eleven items that should be considered before installing TLTWO in a construction work zone to include: the characteristics of the traffic, the availability of other methods of traffic control, and the need to separate opposing traffic “whenever two-way traffic must be maintained on one roadway of a normally divided highway.” According to NDOR and its general contractor, the use of the two-lane, two-way- operation in the work zone “sort of evolved” over the life of the contract. NDOR and the contractor further stated that they did not consider the following options in developing a traffic control plan: constructing a temporary retaining wall to avoid the “lane shift” in the temporary two-lane roadway where the crash occurred; physically separating the opposing flows of traffic as required in 23 CFR 630.1010, Part 5(i) and the applicable MUTCD, even though it was not possible to see from one end of the TLTWO to the other due to the crest vertical curve near the crash site. Work Zone Speed Selection The Institute of Transportation Engineers’ Traffic Engineering Handbook58 furnishes guidance on speed zoning application, stating,

Factual 42 Highway Accident Report Work zones represent a special speed zoning challenge to transportation agencies. Speed zones are typically established during the development of the traffic control plans for the construction project; hence data on prevailing speeds are not available when the decisions are made. Consequently, the selection of the speed limit must often be made by considering design speeds, proximity of workers and equipment to traffic, the presence of positive barrier separation and other factors. The Traffic Engineering Handbook59 indicates how the States generally approach determining speed limit reductions for work zones by noting “Avoid Reduction,” “Always Reduce,” and “Consider Factors.” Nebraska is noted as “Consider Factors.” Work Zone Safety Evaluation NDOR stated that it relied upon its district construction engineer, project manager, and assistants to ensure the contractor’s conformance with the traffic control plan. None of these NDOR employees had specific or general training in traffic engineering but were reported by NDOR to have had American Traffic Safety Services Association (ATSSA)60 training, which did not include traffic operations and safety engineering training. The general contractor’s project management personnel had no training in construction work zone safety. The duties of the general contractor’s “safety consultant” were associated with occupational safety of the workers and not traffic safety or operations. NDOR further stated that its traffic engineering office did not periodically inspect work zones or monitor traffic crash experience in work zones. Traffic engineering personnel did participate in annual joint work area inspections by NDOR and divisional FWHA personnel. The FHWA and NDOR conducted statewide work zone traffic control reviews annually, as required by FHWA policy. In 2001, a team of engineers from FHWA and NDOR traveled approximately 2,000 miles in a 4-day review of approximately 50 Nebraska work zones.61 No specific criteria existed for evaluating or “grading” work zones; the committee of FHWA and NDOR engineers said that it used several factors as general guidelines: 58 Institute of Transportation Engineers, Traffic Engineering Handbook, fifth edition, (Washington, DC: Institute of Transportation Engineers, 1999), page 201. 59 Institute of Transportation Engineers, Traffic Engineering Handbook, fifth edition, (Washington, DC: Institute of Transportation Engineers, 1999), figure 8-10, “Work Zone Speed Limit Reduction Policies.” Handbook data obtained from L.R. Crowther and K.S. Opiela, “Procedure for Determining Work Zone Speed Limits,” National Cooperative Highway Research Program Results Digest 192 (Washington, DC: Transportation Research Board, September 1996). 60 ATSSA is an international trade association that trains 10,000 roadway safety workers yearly, in areas such as worker safety, traffic control, and work zone inspection. 61 FHWA and NDOR, “Study of Work Zone Crashes in Nebraska” (unpublished report, August 2001).

Factual 43 Highway Accident Report • Safety, • Signage, • Traffic maintenance, and • Accident statistics. The FHWA’s62 required “process review and evaluation” for NDOR’s July 26, 2001, review, graded the work zone on U.S. 6 (West Dodge Road) as “fair”63 for the year

1. This grade was given with the following comments:

Barricade was covered with plants, dirty barrels, many dirt covered barricade[s], barrels are down on their side[s], left lane closed signs on temporary stands when they should be on permanent posts. Sharp Drop Off at Pavement Edge sign in use (discontinued sign). NDOR’s 2001 Statewide work zone report included the following rating statistics: poor (2), fair (12), good (34), and very good (1). NDOR defines these ratings as follows: • Poor—Changes must be made to the traffic control devices. Typically, a poor score results in a call to the district or project manager to inform the manager about the problems and require that the project manager or contractor correct them. • Fair—Work zone could benefit from minor adjustments or from improved oversight to see that cones and barrels are correctly located. • Good—Traffic control devices are in better position and condition than for a project that is graded “fair,” with fewer minor adjustments noted. • Very Good—Little, if anything, is wrong with the work zone traffic control plan. The earth moving truck’s May 15, 2001, damage to the barrier had occurred before this inspection; the inspection mentions neither the incident nor the subsequent repair. In addition, no one commented about the proximity of the work space to the traffic space on the two bridges or proposed separating the opposing traffic lanes. 62 Title 23 CFR 630.1010-5(ii)(e)(1), Process review and evaluation, states “A review team consisting of appropriate highway agency personnel shall annually review randomly selected projects throughout its jurisdiction for the purpose of assessing the effectiveness of its procedures. The agency may elect to include an FHWA representative as a member of the team. The results of this review are to be forwarded to the FHWA Division Administrator for his review and approval of the highway agency’s annual traffic safety effort.” 63 Grade options were “very good,” “good,” “fair,” and “poor.”

Factual 44 Highway Accident Report Management and Operational Information State School Bus Driver Qualification Process The Nebraska Department of Education’s Rule 91 contains the requirements for obtaining a school bus driver’s license and school bus driver’s certificate, which applicants must accomplish in the order shown below: • Complete a 12-hour training period.64 Level I training consists of (at least) 2 hours of surpervised behind-the-wheel training in a school bus and instruction in the pretrip vehicle inspection process. • Complete a 10-hour classroom course consisting of lectures, video presentations, and hands-on equipment training65 by a State-certified instructor.66 The instructor also reviews the applicant’s behind-the-wheel evaluation form from the school district. This course is not a defensive driving course; it is a busdriver orientation course. • Obtain a Nebraska class “A” or “B” CDL with a passenger endorsement67 and pass a physical examination. • Apply for a Nebraska School Bus Driver Certificate, issued by the Department of Motor Vehicles at designated testing centers throughout the State. The applicant must pass a 20-question written test (100 percent is passing), possess a current physical examination card, and pass an additional eye exam conducted at the testing center. This certificate must be renewed every year on the applicant’s birthday. Renewing the certificate requires another complete physical examination (using 49 CFR 319.67 criteria), passing another written 20-question test, and passing the eye examination. After successfully completing the Rule 91 requirements, school bus drivers generally receive additional training and orientation from the school districts that hire them. Seward School District Driver Hiring and Training On October 15, 2001, the Safety Board interviewed the transportation supervisor of the Seward School District regarding the district’s hiring and training and transportation operations. According to the transportation supervisor, the Seward School District 64 The Level I training can be waived for up to 60 days after employment. However, the applicant must have a valid class “A” or “B” CDL with passenger endorsement and School Bus Driver Certificate before driving a school bus. 65 The course, which covers topics such as school bus equipment operation and rules of the road, does not include driving. 66 To become a State-certified instructor, one must attend a training course and conduct a lecture for evaluation purposes. Nebraska has 20 certified instructors. 67 As of June 12, 2000, this part of the licensing process consisted of a 25-question knowledge test; the applicant was not required to perform the walk-around pretrip inspection.

Factual 45 Highway Accident Report employs 17 full-time68 school bus drivers and 10 substitute and activity bus drivers. Each full-time driver is assigned a permanent route and drives the same vehicle every day. All full-time and substitute drivers are eligible to drive activity vehicles, usually on an overtime69 basis. Of the 27 drivers employed at the time of the accident, 5 were local college students (from Concordia University) ranging from 19 to 22 years old. According to the transportation supervisor, these drivers are usually employed only while attending the university; all other drivers are over 24. (The minimum age for school bus drivers in Nebraska is 18.)70 The transportation supervisor conducts a driver’s history check for traffic violation convictions (most recent 6 years) and for traffic accidents (most recent 4 years). She also conducts a criminal history check. Each driver must successfully pass a preemployment drug screen and be enrolled in the school district’s random drug testing program. The transportation supervisor stated that the school district follows the State’s procedures for training busdrivers (see State School Bus Driver Qualification Process in the preceding section), which is conducted by the head mechanic. District training consists of 2 to 3 hours of behind-the-wheel orientation and evaluation. Completed evaluations for each trainee, covering topics such as pretrip preparation, vehicle operation and maneuvering, approaching railroad crossings, and loading and unloading passengers, are submitted to the State instructor as part of the State-mandated, one-time Level I school bus driver training. No formal in-service training exists for busdrivers. According to the transportation supervisor, the small number of drivers allows her to become familiar with each driver’s strengths and weaknesses and to address citizen complaints on a case-by- case basis. The transportation supervisor further stated that school bus drivers must attend Level II training every 4 years. This training consists of 2 hours of classroom instruction by a State-certified instructor and changes every year to meet varying needs and issues. Drivers are also provided the State of Nebraska’s School Bus Driver’s Guide and the school district’s School Bus Driver’s Handbook for reference and study. Operations The city of Seward is about 20 miles west of Lincoln and has a population of about 5,300. According to the transportation supervisor, the school district comprises an elementary school, middle school, and senior high school. Of the 1,312 students in the school district, 634 are transported on school buses;71 a majority of the 18 regular school 68 “Full-time” drivers are regularly employed to drive a school bus, once in the morning and once in the afternoon. The driver usually works less than 40 hours. 69 Time worked other than regularly scheduled route driving time. The transportation supervisor selects overtime drivers from a volunteer pool, making assignments to those volunteers having the least overtime hours. Overtime assignments are not made based upon experience. 70 Nebraska Department of Education, Rule 91, Section 004.01D. 71 The total includes 226 senior high school, 94 middle school, and 314 elementary school students.

Factual 46 Highway Accident Report bus routes are in rural areas. The district also provides transportation for two private schools in Seward: St. John’s Lutheran School (72 students) and St. Vincent’s Catholic School (6 students). These private school students are picked up on regular (established) school bus routes. Vehicles. The transportation supervisor stated72 that all vehicles owned by the school district are available for use as student activity vehicles, although only three are designated for that purpose. The transportation supervisor further stated that the school district operates 24 school buses (twenty 59-passenger buses, one 78-passenger bus [the accident vehicle], one 77-passenger bus, one 60-passenger bus, and one 10-passenger bus) and ten 12-passenger vans. The school buses have onboard video equipment to monitor student activity. The accident bus was equipped with a video camera; no tape was in the machine at the time of accident. According to the transportation supervisor, not using a tape is normal practice on a student activity trip because the bus sits, unused, for several hours, and recording a video would run down the vehicle’s battery. The transportation supervisor noted that the school district reserves the buses best suited to transporting students longer distances (most mechanically sound and comfortable) for student activity trips; such vehicles are generally not used for regular school routes. Nonschool bus vehicles, such as vans or passenger vehicles owned by the school district, may be used only when the number of students is insufficient or the length of the trip is inappropriate for school bus vehicle transportation. The trip from Seward to Omaha was about 80 miles one way, and school buses were used to transport the bands due to the number of students and the band equipment required for the competition. Maintenance. The transportation supervisor stated that the school district employs two vehicle mechanics, who conduct all maintenance except tire changes, which are done at a local International Harvester dealership. The transportation supervisor also stated that diesel-powered vehicles (21) receive a lube and oil change every 3,000 miles. After 6,000 miles, according to the transportation supervisor, vehicles receive an inspection of the undercarriage components, including brake lining and adjustment, and all lighting, tires, and other safety equipment. In addition, hydraulic fluid levels are checked on vehicles that have hydraulic brake systems. According to the transportation supervisor, the same components are checked every 1,500 miles for the district’s three gasoline-powered buses. The transportation supervisor stated that school bus drivers are required to conduct a daily pretrip vehicle inspection before departing the bus yard73 and to record the results in a book kept inside each bus. At the end of the month, drivers submit this record to the head mechanic for review. In addition, drivers can report directly to a mechanic defects requiring immediate attention, such as those constituting a CVSA out-of-service violation or deemed critical by the driver (such as a broken heater during winter). 72 Safety Board interview with the Seward School District transportation supervisor, October 15, 2001. 73 Required by Nebraska Statute 79-602 and Title 92, Chapter 92, Section 003, Department of Education Code. Five drivers have take-home buses and conduct the pretrip inspections at their homes.

Factual 47 Highway Accident Report The mechanic maintains work orders and repair documents on a computer. Defects noted during the daily pretrip inspection are addressed on a priority system; those requiring immediate action are corrected before the vehicle leaves the bus yard, others when the mechanics have the opportunity to correct them. In addition to the daily pretrip inspection, the State requires a quarterly vehicle inspection for school buses. This inspection is conducted by the mechanics and consists of the items listed on the pretrip inspection form. If defects are noted, they are listed on the back of the form and corrective actions described. According to the transportation supervisor, the school district retains this form and sends a certificate of compliance to the State Department of Education at the end of the school year. The accident vehicle’s records indicated that it had received the following maintenance work: • October 13, 2000—Right-side body repair. • October 23, 2000—Replace luggage lock and key. • May 5, 2001—Replace a turn signal switch. • June 18, 2001—Oil change, oil filter, and fuel filter. Inspection records for the Seward School District indicated no mechanical defects or equipment deficiencies. Meteorological Information The weather report on the day of the accident called for partly cloudy skies and visibility at 10 miles with gusting westerly winds of 20 mph. At 2:03 p.m., about the time of the accident, the temperature was 61 degrees Fahrenheit (16 degrees Celsius) and the dew point was 43 degrees Fahrenheit (6 degrees Celsius).74 The roadway was clear and dry. Emergency Response The Douglas County 911 communications center received a citizen call reporting the accident at 2:06 p.m. The first Douglas County deputy sheriff arrived on scene at 2:11 p.m., followed shortly afterward by four other deputies. Additional police units from the Boystown and Valley, Nebraska, jurisdictions (2 and 14 miles away, respectively), along with the NSP, arrived at 2:28 p.m. 74 Weather data obtained from Eppley Airfield, Omaha, http://www.nndc.noaa.gov.

Factual 48 Highway Accident Report At 2:07 p.m., the Omaha Fire Department dispatched one engine company and one medic company in response to a call indicating a “vehicle accident with injuries, bus in a ditch.”75 Engine 55, which was about 3.5 miles away, and medic 52, housed about 7 miles away, responded. The commander of battalion 6, Omaha Fire Department (referred to in this report as the incident commander), heard the dispatch on a radio scanner and additional radio traffic describing a school bus in the creek with many injuries. The incident commander arrived at the accident scene about 2:12 p.m.76 He parked several hundred feet from the bridge and walked to the scene. Engine 55 and medic 52, who had arrived at the scene less than 1 minute before the incident commander, parked on the roadway approaching the bridge. Those units, whose personnel had advanced life support capabilities, went directly to the bus. The engine 55 captain subsequently requested a fire alarm assignment. (A fire alarm assignment consists of three engine companies, one aerial unit,77 one battalion chief, and one medic company.) At 2:15 p.m., the incident commander initiated a call for additional equipment. At 2:25 p.m., the incident commander requested a second alarm assignment, initially asking for five additional medic units from the Omaha Fire Department. In accordance with the fire department’s emergency preparedness plan, the incident commander identified the scene as a mass casualty incident.78 He also requested a medical helicopter from Omaha and asked for an estimated response time for four helicopters (two from Omaha and one each from Lincoln and Norfolk, Nebraska).79 Additional resources requested by the incident commander and responding within 25 minutes of his arrival included rescue 1 (a hazmat and high-angle rescue company consisting of four firefighters), engine 33 (a similarly trained company consisting of four firefighters), rescue 32 (a specialty equipment vehicle with two firefighters), three helicopters, and supervisor 1 (the paramedic shift supervisor). 75 This is the Omaha Fire Department’s standard response to a collision with injuries and no extrication needed. 76 Based upon a Safety Board investigator’s conversation with the incident commander during the investigation. Not all times were recorded in the logs because of communications problems. 77 Hook-and-ladder truck or ladder truck. 78 At the time of the accident, the Omaha Fire Department had an emergency preparedness plan for handling a multiple casualty, mass casualty, or disaster incident. The plan generally designated incidents requiring one or two medic units as multiple casualty incidents, incidents requiring more than two medic units but confined to one general area as mass casualty incidents, and incidents requiring multiple outside resources and not confined to one area as disaster incidents. The designation of mass casualty incident allows the area hospitals to prepare for multiple injuries and provides the incident scene officer (transport officer) with information on how many patients each hospital can accommodate. 79 In accordance with normal operating procedures, the incident commander attempted to contact the helicopters via channel 4, a nonrepeated frequency without PL (private line within a designated frequency) codes, but the helicopters did not respond. According the fire chief, two of the helicopters were from outside the Omaha area and may not have known the Omaha Fire Department’s radio frequencies and procedures.

Factual 49 Highway Accident Report The incident commander realized shortly after establishing command that communication via radio required the radio to be held as high as possible while standing at the crown of the bridge above the scene. At any other location, the radio could not access the repeater, and therefore no communication was possible. (See figure 22.) Communications between the incident commander and the extrication sector commander (battalion 5), whose unit arrived at 2:25 p.m., were hindered because the bridge was between the two radios. Further, when the commander of battalion 4 arrived at 2:35 p.m., he was unaware of the nature of the incident, believing that he had been dispatched to an automobile accident to assist with a medical helicopter landing, according to initial reports from dispatch. He had been given radio channel 280 as his operating frequency, which did not have the ability to reach the fire dispatcher from the accident location. Additionally, the incident commander had to move between two locations to establish radio communications with the various groups conducting rescue operations: (1) on the crown of the bridge (the high point) and (2) about 100 yards away, partway down the creek bank. While the incident commander was at the second location, inbound and outbound communications between him and other rescue personnel were severely limited due to the distance from dispatch. For example, the incident commander attempted to establish a staging area for emergency equipment at 164th and California Streets, just north of the incident, but none of the transmissions were received. Most students were still inside the bus when rescuers arrived. According to the incident commander, multiple passengers were trapped by their arms and legs between the inside wall of the bus and the seats. A 14-year-old female passenger was ejected and found Figure 25. Accident scene. 80 Channel 2 is a nonrepeated channel used in the city as a command channel. Figure 22.

Factual 50 Highway Accident Report trapped between the bus’s left side and the muddy creek bed. A 16-year-old male and an 18-year-old female were pinned between the bottom of the seat and several seat cushions that came apart. The 14-year-old male who drowned was trapped between the left side of the bus and a seatback and found face down in the muddy water. The incident commander noted that extrication of passengers from the accident bus was difficult because of the rescuers’ lack of knowledge of school bus construction and extrication methods. For instance, because the Jaws of Life device was too large to fit between the bus seats, hack saws were used to cut off seat legs entrapping victims. In addition, when the firefighters attempted to poke holes in the roof with their pick axes, they were hampered by the reinforced roof construction required for school buses. The incident commander said that as patients were brought up the bank and to a park 150 to 200 yards north of the accident, they were assessed and assigned to a caregiver (firefighters, doctors, and nurses or residents of neighboring houses). The most critically injured (six student passengers) were transported by helicopter to the area trauma center approximately 20 miles away. Others were transported by a medic unit to area hospitals.81 In all, it took about 1 1/2 hours (2:06 p.m. until about 3:40 p.m.) to transport all the surviving patients. At least three times during the incident, the incident commander went in person to each sector commander to determine whether additional resources were needed. According to the incident commander, delays in requesting additional medic units were the result of communication problems between the incident commander and dispatch due to the terrain and distance from the repeater. A call for three medic units from three surrounding communities came just short of 1 hour from the time of original request, which was not received by dispatch. The Omaha City Fire Department and other agencies involved in the emergency response conducted a postaccident critique the week after the accident. Participants agreed that the response was timely (given the rural area) and that the local fire and rescue agencies had adequate resources to handle the situation, but that the communications system needed upgrading. Tests and Research ECU Testing The accident school bus’s ECU was removed on January 7, 2002, with the assistance of a technician from Thomas Built. A Safety Board investigator hand-carried the unit to Bendix Commercial Vehicle Systems (Bendix) in Elyria, Ohio, where it was tested on January 9. The testing indicated no current system faults but did reveal a number of fault codes determined by Bendix personnel to have originated during the vehicle assembly process. These fault codes resulted from the ECU’s having been originally configured as a six-channel system with traction control. When used in the accident bus, 81 Saint Joseph Hospital, nine students and the busdriver; Methodist Hospital, five students; Nebraska Health System, seven students; Emmanuel Medical Center, five students and one adult; and Douglas County Morgue, two students and one adult.

Factual 51 Highway Accident Report which required a four-channel system without traction control, the ECU registered faults as it searched for the extra sensors and traction control. (The accident bus’s ECU, which was never replaced, was included in National Highway Traffic Safety Administration [NHTSA] recall 00V-232. The recall is discussed in further detail in appendix B of this report.) Accident Reenactment and Simulation Witness statements and Safety Board observations on scene indicated that the Seward bus driver might have perceived one of the three oncoming Norfolk buses as having crossed the centerline and veering into his lane and that he steered rapidly to the right in response. To test this theory, Safety Board investigators obtained an exemplar vehicle—a Thomas Built school bus that was nearly identical to the accident bus in all pertinent features—and videotaped a “driver’s eye view” during several westbound passes over the West Papillion Creek Bridge. These passes were conducted at roughly the same time of day as the accident; weather conditions and traffic volume were also similar, and the driver maintained speeds consistent with those reported by witnesses to the accident. The videotape confirmed visual observation of the existence of a visual phenomenon that might have been sufficient to cause the school bus driver to mistakenly believe that one of the approaching motorcoaches was crossing over into his lane. Further, a simulation study was developed to examine the conditions associated with two-lane/large vehicle traffic in this construction area. The simulation, which was developed using the Human Vehicle Environment (HVE) system82 and the Simulation Model Non-linear (SIMON),83 Engineering Dynamics Corporation Simulation of Automobile Collisions (EDSMAC4),84 and Engineering Dynamics Corporation General Analysis Tool (EDGEN)85 software programs, approximated the Seward bus driver’s view. The Seward bus positions were matched to the physical evidence and the buses’ witness-estimated speeds of 40 mph. Spacing of the oncoming Norfolk buses was based on the Norfolk drivers’ statements. The Norfolk buses were positioned close to the centerline, but still within their lane. The Seward bus driver’s potential view was simulated to include the roadway changes in alignment, the relative movement of the three approaching buses, and similar ambient light conditions. To animate the accident bus’s roll and vault, the simulation employed calculations of the bus’s travel. Factors such as the location of the bus at final rest, the point at which the railing posts were no longer damaged, and the distance from which the bus dropped were used to calculate the bus’s forward speed as it left the bridge at about 14 mph. During the 1.7-second drop, the bus rolled between 180 and 270 degrees. Thus, the data from the 82 The HVE system simulates vehicle and occupant kinematics. 83 SIMON allows users to simulate the response of one or more vehicles to driver inputs and environmentally related factors. SIMON was used to model the approach of the Seward and three Norfolk buses to the accident site. 84 EDSMAC4, fourth revision, permits simulation of single- or multiple-vehicle crashes. EDSMAC4 was used to animate the bus’s initial crash with the guardrail. 85 EDGEN is a three-dimensional kinematics spreadsheet that uses positions and velocities of vehicles or objects to determine the time required to travel between each location. EDGEN was used to animate the bus’s impact with the bridge rail and subsequent rollover and vault.

Factual 52 Highway Accident Report animation of the bus’s movements during the vault showed that the bus had rotational and vertical accelerations that were stopped quickly when the left side of the bus struck the creek bed. When the bus hit the creek bed, it had rotational acceleration and large vertical accelerations from the ground that were exerted laterally on the bus’s sides. Guardrail Crash Testing Safety Board staff reviewed the results of at least five crash tests86 conducted in 1979 by the Southwest Research Institute for the FHWA that involved school bus collisions with guardrail-type barriers. In the crash tests reviewed, the buses impacted the barriers at angles of 13.8 to 17.5 degrees and at speeds of 57 to 61 mph. In the tests conducted using W-beam guardrail, the bus rolled over the guardrail and twist. The buses in these tests initially rolled over the barrier, and the top of the bus just behind the driver made contact with the barrier. Due to the flat surface behind the guardrail, the buses continued along the rail and the posts. As the buses continued to roll to an upright position, the rail severely penetrated the top of the roof, completely cutting it from one side to another, just above the rear axle. Two additional crash tests were conducted with three-beam rail,87 with steel block- outs and steel posts. In the first test, a full height, solid block-out88 was used. The bus rolled over but stayed on the proper side of the barrier, sliding to rest after a 90-degree roll. The front tire that initially contacted the barrier separated from the wheel. In the second test, the bottom third of the block-out was cut away in a triangular piece, reducing the roll of the barrier. The bus rolled about 30 to 45 degrees initially and then returned to an upright position, also staying on the proper side of the barrier. Two additional crash tests used a SERB design, consisting of a three-beam rail with a block-out having a mechanical spacer (metal rod), which allowed movement (roll) at both ends of the spacer, and a cable attached to wood posts. In one crash test, the bus did not roll as much and was safely redirected in an upright position. In the second test, the bus was loaded to replicate students; it was redirected, but rolled onto its side. Toxicological Information Blood samples were obtained from the driver upon admission to the trauma center at approximately 5:20 p.m. (3 1/4 hours after the accident). Samples retained by the hospital and the DCSO were forwarded to the Civil Aeromedical Institute, Oklahoma City, Oklahoma, which performed toxicological testing at the request of the Safety Board. 86 The Southwest Research Institute conducted the tests as part of an evaluation for the self-energy restoring barriers (SERB) study. 87 A guardrail typically has two ridges that protrude outward. A three-beam guardrail has three ridges that protrude outward and is about 50 percent higher. 88 Section of guardrail post mounted between the post and the rail to prevent a vehicle’s wheel from snagging the posts.

Factual 53 Highway Accident Report Results of alcohol testing were negative. Screening tests for amphetamines, marijuana, cocaine, phencyclidine, benzodiazepines, barbiturates, antidepressants, antihistamines, meprobamate, methaqualone, and nicotine were also negative. Morphine, administered postaccident, was detected in the blood sample.

54 Highway Accident Report Analysis In the following analysis, the Safety Board will first exclude factors that neither caused nor contributed to the accident and then examine those factors that led to or had a role in the accident. The discussion that follows will focus upon the effect of highway design and vehicle handling characteristics upon driver performance, the adequacy of work zone safety and management, the occupant safety of interior bus surfaces, the lack of emergency preparedness of students, and the visibility of emergency signage and exit door levers. Exclusions Toxicological Impairment The results of postaccident testing of the accident driver for the presence of alcohol and 12 drugs, including illicit and common licit drugs with known performance- impairing effects, were negative. The final toxicological analysis from the Civil Aeromedical Institute laboratory indicated the presence of morphine; however, this could be attributed to postaccident administration of the drug for the serious injuries sustained by the driver. Sleep Loss and Fatigue According to the accident bus driver’s self-reported routine, he normally obtained about 7 1/2 hours’ sleep nightly. On the night before the accident, he reportedly obtained about 7 hours’ sleep, an amount that is not significantly less than usual. He went to bed an hour later than usual, but slept about 30 minutes beyond his normal waking time. This 1-hour shift in his routine resulted in a 25-hour (lengthened) day. It is well-accepted in the scientific sleep community that in free-running wake/rest cycles, during which individuals are deprived of the usual cues as to time of day, individuals default, on average, to a 25-hour day, suggesting that such a change is physiologically tolerable, if not optimal.89 In general, studies have concluded that most individuals tolerate such a change very well with no increased sleepiness. Investigators spoke with numerous witnesses who had accompanied the driver throughout the morning of the accident. None reported any indication that the driver appeared drowsy. Moreover, the relatively short duration of the trip—and the fact that he had returned to driving after a reasonable period of having been off-duty (while the students participated in the competition)—provides no evidence to indicate that fatigue was a factor in this accident. The Safety Board therefore concludes that the accident bus driver was not impaired due to drugs, alcohol, or fatigue. 89 See, for example, J. Aschoff, “Circadian Rhythms: General Features and Endocrinological Aspects,” ed. D.T. Krieger, Endocrine Rhythms (New York: Raven Press, 1979) 1-61.

Analysis 55 Highway Accident Report Weather According to weather reports for the local area, winds were westerly, gusting to 20 mph on the day of the accident. The large profile of a school bus such as the accident vehicle, coupled with gusting winds, can account for an added degree of difficulty in maintaining one’s lane, especially if crosswinds exist. In this case, however, the winds were westerly and witness reports, both specific to the time of the accident and earlier in the day, indicate that the accident bus driver displayed a persistent rightward bias in his alignment of the bus within the lane of travel, irrespective of the direction of travel or wind direction. Accordingly, it appears unlikely that the winds were responsible for the accident bus driver’s inability to maintain his lane. The Safety Board therefore concludes that the weather was not a factor in this accident. Mechanical Condition of Bus The primary postaccident examination of the Thomas Built school bus occurred on October 19, 2001, about 6 days after the accident. All vehicle systems that could have caused or contributed to the accident were examined: engine and transmission, brakes, tires, and steering. Engine and Transmission. The Cummins ECM did not have the capability to record data related to the precrash operation of the vehicle such as speed, rpm, and braking,90 information that would have been useful in determining what may have occurred just prior to the accident. The investigation was similarly hindered by the Allison, Mode 3060, transmission ECU’s lack of recording abilities. Steering. The steering linkage was intact, and the wheels moved slightly when the bent steering wheel was turned. The heavy crush in the left-front corner of the coach impeded the linkage from moving. The steering gearbox was found to be without defect. Tires. The like-new tires had adequate tread depth. The only tire for which the air pressure could not be checked was the right-rear-inside dual wheel, which had been torn open during the accident, causing a total loss of air. The other five tires had air pressures between 100 to 110 psi, which is in the normal range. Brakes. The right-rear push-rod stroke was measured at 3/4 inch. A 3/4-inch push- rod stroke is very unusual, if not impossible, for a type 30 brake unless the brakes are dragging. The cracked right-rear drum most likely impeded the stroke and resulted in this measurement. Although vehicle damage prevented examination of the brakes, the automatic slack adjusters are likely to have been working properly on the relatively new bus with an odometer reading of fewer than 15,000 miles. Further, although the Bendix ABS ECU had been recalled and should have been replaced nearly a year earlier, the Lincoln Truck Center’s inspection of the vehicle in September 2000 (see appendix B) did not reveal any chafed speed sensor wiring, which 90 Of the four major engine manufacturers (Detroit, Cummins, Mack, and Caterpillar), Cummins is the only one that manufactures an ECM unable to record these parameters.

Analysis 56 Highway Accident Report would have indicated a false ABS activation that can lead to a total loss of braking at low speeds. Postaccident testing also revealed no system faults. Consequently, though brake defects cannot be totally ruled out, the Safety Board found no evidence that the braking system had a role in this accident. The Safety Board therefore concludes that evidence does not indicate that the mechanical condition of the accident bus contributed to the accident. Emergency Response The Omaha Fire Department had a current standard operating procedure for handling multiple, casualty, mass casualty, and disaster incidents. The policy was well-documented and appeared sufficient for handling such events within Douglas County as long as the incident occurred within radio contact. However, because of the Omaha accident’s rural location and site beneath a bridge, 49 feet below the highway, communications between the incident commander and other agencies and officers on the scene were hampered. Communication via radio required the radio to be held as high as possible, while standing at the crown of the bridge above the scene. At any other location, the radio could not access the repeater, severely limiting inbound and outbound transmissions. The resulting communications failure prevented the incident commander from establishing a staging area for emergency vehicles at 164th and California Streets, just north of the incident, and, as a result, blocked travel lanes and contributed to about 1/2 mile of roadway congestion. Further, requests for three medic units from three surrounding communities were delayed almost an hour from the time of the original radio transmission because dispatch did not receive the first transmission. The Safety Board therefore concludes that, although not detrimental to the emergency response efforts on behalf of the accident victims, communications were inadequate and resulted in a less than optimal emergency response. According to the Director of Omaha’s 911 services, the equipment necessary to upgrade its communications system has been purchased and is now being installed; anticipated use by all departments is scheduled for spring 2004. Driver’s Qualifications At the time of the accident, the 22-year-old driver was licensed and met all requirements to be a school bus driver in Nebraska. He had more than 2 years’ experience as a busdriver and 2 years’ experience driving a dump truck in intrastate commerce. Although he had two prior speeding convictions, neither involved commercial motor vehicles, and both sufficiently predated his employment as a school bus driver that one could assume they did not reflect the accident bus driver’s operating tendencies at the time of the accident. Every witness interviewed by the Safety Board during this accident investigation who knew the accident bus driver and had ridden with him before, spoke favorably of the busdriver’s performance. None provided any information that would call into question his usual judgment and skill in performing the duties of a school bus driver. Further, in this accident, the busdriver either failed to maintain his lane or appears to have taken evasive action to avoid a collision or the perceived threat of a collision.

Analysis 57 Highway Accident Report Neither scenario suggests a general lack of experience as the root cause of the accident. Most likely, the significant event, actions taken to avoid oncoming traffic, had more to do with road design than with experience. The Safety Board therefore concludes that the accident bus driver’s qualifications neither caused nor contributed to this accident. Accident Discussion This analysis of the accident sequence focuses on the human performance aspects of the accident bus driver’s behavior in interaction with the work zone’s roadway geometry. Two possible accident scenarios have emerged from an evaluation of the factual information collected during this investigation: the accident bus struck the guardrail when the driver took evasive action to prevent either a perceived or an actual frontal collision with an approaching motorcoach. The contributing components of the speed limit in the work zone and of the driver’s unfamiliarity with the accident vehicle will also be discussed. Ability of Driver to Maintain Lane The handling characteristics of the transit-style accident bus may have affected the driver’s ability to maintain his lane. The accident bus differed from the driver’s regular route bus, which was a conventional-type school bus, in several important respects. They affected the maneuverability of the bus, and in particular, the timing of steering inputs by the driver in order to effect control. Greater anticipation and earlier initiation of a turn is necessary for a conventional bus than for a transit-style bus to attain the same turning radius. Further, the right-front corner of the transit-style bus is aft of the driver’s visual field; consequently, a driver who is experienced generally, but has limited experience driving this type of bus, must make extensive use of the mirror on the right side of the bus to align the vehicle and judge its right-side clearance. This difference changes the driver’s visual scan patterns and imposes greater visual demands and a more complex cognitive workload, as the driver strives to sense and integrate spatial cues. As the driver entered areas where the lateral alignment was more critical (for instance, on curves), the increased complexity of the roadway might have drawn his attention to the view ahead, reducing the frequency and/or duration of glances to the right mirror. Given the increased need for active maneuvering in such situations, it is not surprising that witnesses reported the driver drifted onto the right shoulder. With experience, drivers typically develop an intuitive sense of their vehicle’s spatial envelope, learning to gauge the width of their vehicle and to extrapolate the spatial arrangement of obstructions in their forward view. However, this driver had very limited recent experience operating a bus of this design. Consequently, his ability to judge the vehicle’s spatial proximity to the bridge rail was probably limited, a factor that was compounded by the series of slight curves on the approach to the bridge. The placement of the front (steering) axle probably compounded the driver’s spatial uncertainty because it altered the required timing of steering inputs to maneuver the accident bus, compared to his regular route bus, and may have resulted in less skilled steering responses, due to the driver’s limited familiarity with the steering and handling

Analysis 58 Highway Accident Report characteristics of the transit-style bus. Although the accident bus driver was able to recall the previous trip from Seward to Omaha, he did not recall the incidents en route, during which he drifted onto the shoulder. The rumble strip should have served as a salient warning to the driver, providing him feedback that the bus had drifted onto the shoulder, but the observations of his misalignment in the lane suggest that any warning provided by the rumble strip failed to have a discernible or lasting impact on his behavior. The Safety Board has found during investigations of other school bus accidents91 that most school transportation administrators usually try to assign drivers to a single bus, perhaps recognizing the value of the driver’s familiarity with the particular features and idiosyncrasies of that vehicle. When a bus undergoes repairs—or in this case, the trip itinerary necessitates a specially designated vehicle, thereby requiring that the driver use a bus with which he or she is less familiar—drivers may underestimate the potential risks of the vehicle’s handling characteristics. The Safety Board therefore concludes that the accident bus driver’s unfamiliarity with the accident vehicle, which differed both in its perceptual demands and in its handling characteristics from his regular route bus, may have contributed to his inability to accurately judge the lateral distance to the guardrail, bridge rail, and oncoming vehicle and to his inability to properly steer the bus through the work zone. This accident demonstrates the tragic consequences of underestimating key operational differences among buses. Therefore, the Safety Board will inform the National Association of State Directors of Pupil Transportation Services (NASDPTS) of the circumstances of this accident so that the association can, in turn, encourage its members to review their practices regarding assignment of drivers based upon familiarity with the bus, recurrent training, and “check rides” for drivers who are assigned a bus that fundamentally differs from the type of bus upon which they developed their skills. Possible Impingement on Accident Vehicle’s Travel Lane Although the persistent, rightward bias of the vehicle in its lane demonstrates the driver’s unfamiliarity with the accident bus, it is insufficient to explain the circumstances of this accident. Additional evidence regarding the roadway geometry of the work zone and handling characteristics of the larger vehicles suggests that the driver’s inability to accurately judge the lateral distance to the bridge rail was not solely responsible for this accident and that drivers traveling in both directions may have crowded each other’s lanes. 91 For example, see (a) National Transportation Safety Board, Motorcoach Loss of Control and Overturn, New Mexico State Route 475, March 2, 1999, Highway Accident Brief NTSB/HAB-01/01 (Washington, DC: NTSB, 2001); (b) National Transportation Safety Board, Bus Crashworthiness Issues, Highway Special Investigation Report NTSB/SIR-99/04 (Washington, DC: NTSB, 1999), case studies of school bus accidents that occurred in Buffalo, Montana (HWY-98-M-H022), on March 10, 1988, and Flagstaff, Arizona (WRH-96-F-H014), on August 14, 1996; and (c) National Transportation Safety Board, Mayflower Contract Services, Inc., Tour Bus Plunge From Tramway Road and Overturn Crash Near Palm Springs, California, July 31, 1991, Highway Accident Report NTSB/HAR-93/01 (Washington, DC: NTSB, 1993).

" +> !" # ‹ & & \ & \

\ \%[~\Y \ [

\ X \

]

=

\ ^Y \ [& = \%[ } & =+& =

\

= & = \%[ ^ & =

\ K

& \ & ! •%& " & \ & =] ! ~ ~ \%[\

\ =] \

& \\ =]‰=

& \=[ \

\ &\ \

\

\ =

‰ \

\ \% [ ‰ = [

\ (,* #

|

|

|

# (*

Analysis 60 Highway Accident Report wide), along with an additional 3 to 4 inches of off-tracking for each bus, clearly both lanes were almost fully occupied. Further, if the Norfolk bus was near the centerline to avoid the dirt embankment on the right, the accident bus may have been driven near the edgeline on the outside of the curve. As the accident bus approached the guardrail and bridge, the simulation indicates that, if the right side of the bus was near the edgeline, the operator would have had to steer the bus to the left about 70 degrees93 to avoid striking the guardrail. The rear of the bus tracked inside the front by about 4 inches at 41 mph. For the accident bus driver’s to avoid going across the lane and striking the second Norfolk bus, the accident bus would have had to track about 5 to 8 inches toward the guardrail. During this corrective right steer,94 the bus struck the guardrail and then the bridge rail. Although the roadway might have been wide enough to permit the second Norfolk bus and the accident bus to pass one another on a straightaway, given the off-tracking, overhang, and turning radii characteristics of the two vehicles, it may not have been wide enough for either driver to maneuver his vehicle through the series of curves at the speeds at which the vehicles were traveling. The Safety Board concludes that the roadway geometry in the work zone resulted in extremely tight tolerances on driver performance, which may have been exceeded when the second Norfolk bus and the accident bus approached the West Papillion Creek Bridge. The Safety Board further concludes that although it cannot be determined whether the driver of the oncoming Norfolk bus encroached upon or crossed the centerline, the narrowness of travel lanes in the work zone relative to the space occupied by the buses left the accident bus driver little room for error. Perceived Threat of Frontal Collision by Accident Vehicle Driver The extremely tight tolerances on the drivers’ performance due to the roadway geometry, coupled with the size and handling characteristics of the vehicles, which would have made it difficult for the two buses to have safely passed one another, support the theory that the school bus left the roadway as its driver took evasive action to avoid a frontal collision with the approaching Norfolk bus. Yet the testimony of a witness who regularly drove U.S. 6 and noted that it appeared that oncoming vehicles were impinging on the lane of travel, even when this was not the case, supports the theory that the driver took evasive action to avoid the perceived threat of a frontal collision. Drivers who regularly travel the route may adjust their interpretation of the visual scene to reflect this experience, developing the confidence and experience that ensures safe passage. Drivers, such as the accident bus driver, who had never traveled the work zone in that direction, lack the benefit of this learning and are likely to react based upon their initial impressions. 93 Equivalent to a radius of about 500 feet. 94 To follow the tiremarks, the bus required about a 175- to 290-degree right steer in SIMON after the 70-degree left steer. At 175 degrees or more right steer, the bus would have followed a curve radius of about 150 feet. Above 175 degrees, the bus would have followed about the same radius as at 40 mph but would have yawed and side-slipped. Above 175 degrees, the bus would have rolled over after a quarter of a turn. The steering input may have been reduced slightly due to the right-rear tire dragging along the face of the guardrail.

Analysis 61 Highway Accident Report The Safety Board’s videotape of the accident bus driver’s potential view captured the dynamic interplay between the roadway characteristics (especially vertical and horizontal alignment), vehicle characteristics (in particular, the relative speeds and changes in acceleration of approaching vehicles), and visual phenomena that may have affected the driver’s actions, including interposition,95 linear perspective,96 and motion parallax.97 Naturally occurring visual distortions can affect a drivers’ ability to accurately perceive an object’s location in three-dimensional space, especially beyond a distance of 66 feet (20 meters), in which monocular visual cues predominate as the eye-brain visual system works to develop a three-dimensional representation of the spatial environment. Such distortions may also be compounded when the viewer, the target, or both, are in motion. The Safety Board’s simulation further supports the theory that the accident driver may have experienced a visual illusion of the approaching bus impinging his travel lane. Figure 24 shows frames from the simulation that depict the driver’s potential view and the occurrence of this illusion. 95 Interposition of objects provides spatial information because objects that are further away can be obscured by closer objects in the same visual path. Interposition is a monocular cue of relative spatial location. 96 Linear perspective refers to the monocular visual spatial cue in which parallel lines in a perspective image appear to converge toward a single point at the most distant location in the image (the horizon or infinity). Nearby objects will also appear larger than similar objects at a distance; due to size constancy (the recognition that it is the perception that changes with distance, rather than the real size of the object); consequently, an observer perceives this change as one of distance. Additionally, the apparent shape of an object changes to reflect a change in spatial orientation or distance from the observer (that is, a rectangular door appears as a trapezoid shape as it is opened away from the observer); due to shape constancy (the recognition that the object retains its original shape, while it is our perception of it that changes), this feature provides spatial information. 97 Motion parallax refers to the differences in apparent angular velocity of objects, when the viewer and/or the image are in motion. The apparent velocity is inversely proportional to real distance, that is, nearby objects appear to move (or pass) rapidly by, while those at a distance move/pass much more slowly. Consequently, this dynamic monocular cue permits one to judge distance to an object when the object and/or the observer are in motion. However, when both the object and the observer are in motion, the accuracy of judgments of distance is diminished.

" , !" # (=*

# $

(&*

Analysis 63 Highway Accident Report The simulation shows that the first Norfolk bus may have been on a tangent line headed toward the accident bus as the two buses met at a curve,98 thus the accident bus driver has no indication of where the Norfolk driver will turn as he gets to the curve or how much of the roadway the Norfolk bus will occupy. In addition, as the second and third Norfolk buses pass into a curve and a depression in the roadway prior to crossing the bridge, they appear to cross the centerline because the centerline visually “disappears” into the depression. Both buses are about 9 feet wide with driver’s side mirrors; on the 10 1/2-foot- wide lanes, the slight off-tracking of the buses leaves little room for error in the curve, especially if the Norfolk bus is near the centerline. If the Norfolk buses impinge on the centerline or cross slightly into the other lane, the perception that the Norfolk buses are crowding the accident bus is exacerbated. The illusion of crowding is supported by the second Seward bus driver’s statement that the accident bus was traveling close to the right side of the road. Physical evidence collected during the accident investigation further supports the theory that the accident bus driver feared a frontal collision with the Norfolk bus. (See figures 25 and 26.) In the simulation, as the accident bus driver approaches the west end of the concrete barrier toward the pavement edge, the W-beam tapers gradually, coming closer to the edgeline. During the accident bus’s first sideswipe along the W-beam, it is near the shoulder and must be steered hard left to avoid striking the guardrail with the front of the bus and then hard right for the rear tire to strike the guardrail. By rubbing the guardrail with the rear tire, the bus may have turned more than the driver planned, and corrective steering did not occur before the bus broke through the bridge rail. 98 The curve radius is 1,500 feet, based on the Safety Board’s mapping.

" ,& !" # (?*#

#

} (+*

" ,+ !" #

&

\ = [ & \

[ &\

= \

\ = \%[ \

\ % [

=

\

%\

& \=

&

=

Y \ [& \%\ = [ \ ^ \ & =\ & \ =

=

\ =]=& Y \ [

\

\ ]

=

\ = =

=

&

& Y \ [

=

& =]\ & =

& \= & \

\ \\%[

\\ = = ‰ ]

=&

& Y \ [

==

\

&

& [ =

= =

Y \ [

&

(>*#

#

(,*

Analysis 66 Highway Accident Report Because of the seriousness of his injuries, the accident bus driver stated that he could not recollect his perceptions at the time immediately preceding the accident. DCSO and Safety Board investigators interviewed a large number of witnesses who were in a position to observe the buses as they passed. Those witness reports were consistent with the types of visual phenomena discussed in this section. The driver of an automobile immediately behind the accident bus told investigators that the motorcoach appeared to cross the centerline, thereby partially obstructing the accident bus’s lane of travel. Passengers on the school bus immediately behind that automobile provided similar recollections of having seen the oncoming motorcoach impinge upon the school bus’s lane of travel. Of note, a driver who preceded the accident bus over the bridge told investigators that he observed the second motorcoach in the eastbound convoy cross the centerline by several feet and then correct its alignment less than a mile from its approach to the bridge. Witness statements indicate that the accident bus driver took action to avoid a real or perceived hazard. According to the driver of the second Norfolk bus that entered the curve from the opposite direction, he observed a look of terror on the accident bus driver’s face as the accident sequence unfolded. Yet students on the accident bus, whose view outside was obstructed by their uniforms that hung in the windows, described the early experience of the accident sequence (up to the point of the guardrail strike) as similar to having drifted onto the shoulder and activating the “rumble strip.” This initial experience did not alarm the students, perhaps because they had experienced a similar sensation earlier in the trip, with no untoward consequences. Similarly, the benign nature of the driver’s previous contacts with the rumble strip explains why the noise or kinesthetic sensation reported by the students just before the accident would, in and of itself, not have startled or frightened the accident bus driver. Instead, the accident bus driver, whose view outside the bus was unobstructed, was probably alarmed by something that he saw. The driver of the second approaching Norfolk bus stated that the first indication of a serious problem that he noted was when the accident bus driver abruptly “jerked” his steering wheel to the right. This action is inconsistent with a realization that his bus was aligned too far to the right; it is, however, consistent with the belief that a collision with oncoming traffic was imminent. An abrupt steering maneuver in either direction would suggest that the driver sought to avoid a hazard that he believed existed in the roadway ahead. The Safety Board therefore concludes that the accident bus driver’s behavior at the time of the accident was consistent with anticipation of a frontal collision. The accident bus driver’s action was consistent with the curriculum for school bus driver certification in the State of Nebraska, which advises drivers to reduce their speed and move to the extreme right of the roadway if an approaching (passing) vehicle is in their lane. Under most conditions, the guidance provided to Nebraska school bus drivers is appropriate and prudent advice; the severity of a potential run-off-road accident is typically less than that of a full-impact, head-on collision, or even a glancing impact, given the lack of a crush zone forward of the driver in the transit-style bus. The guidance contained in the busdriver training curriculum is general in nature and not intended to take into account all possible scenarios, such as the potential for a head-on collision while

Analysis 67 Highway Accident Report crossing a bridge. Even in this instance, in which the bus fell from the bridge, injuring 27 passengers and killing 4, a head-on collision with the Norfolk bus would have exposed passengers on both buses to possibly more serious risk of injury. Furthermore, depending on the following distances and speeds maintained by other vehicles in the two convoys and their drivers’ attentiveness, subsequent collisions might have ensued, further increasing the magnitude of the accident. The Norfolk drivers insisted that the second Norfolk bus never crossed out of its own lane. These four witnesses, who were traveling eastbound, would have viewed the scene from a different perspective than the accident bus driver and may not have experienced the perceptual illusion experienced by westbound vehicles. The Norfolk drivers provided the only testimony to refute the theory that the Norfolk bus had come close to or crossed the centerline. The Safety Board concludes that even though all witnesses traveling eastbound on U.S. 6 insisted that the motorcoach maintained its lane, most witnesses who were traveling westbound insisted otherwise; therefore, it cannot be unequivocally determined whether the Norfolk bus encroached upon the westbound lane, creating a potential collision hazard. Highway Design and Driver Performance Whether the motorcoach truly presented a collision hazard for the school bus or only appeared to, the fact remains that the tolerances on the drivers’ performance left little or no room for error. The narrow lane width, coupled with the lack of a shoulder on the bridge, left the drivers with no option in the event that they anticipated a collision risk. Moreover, the rapid closing speed of the two vehicles and the limited sight distance that resulted from the series of curves would have necessitated very fast reaction by one or both drivers. AASHTO99 notes: When drivers use a highway designed to be compatible with their capabilities and limitations, their performance is aided. When a design is incompatible with the capabilities of drivers, the chance for driver errors increases, and crashes or inefficient operation may result. In other words, a driver’s performance is not independent of the roadway design. An apparent driver error is an indicator that the compatibility of the roadway design must be evaluated with respect to drivers’ capabilities and limitations. If a representative segment of the population exhibits a particular limitation, highway engineers have the responsibility to mitigate that limitation through effective highway design. The functional aspects of highway design that most directly affect human behavior under these circumstances are discussed below. 99 American Association of State Highway and Transportation Officials, A Policy on Geometric Design of Highways and Streets, 4th ed. (Washington, DC: AASHTO, 2001) 46.

Analysis 68 Highway Accident Report Roadway Width Lane(s) must be sufficiently wide to permit the widest of vehicles that may legally travel the roadway to be maneuvered in a manner that does not interfere with the ability of others to do the same. Lanes must be wide enough to permit all normal maneuvers and to provide ample options in the event of foreseeable problems. Human performance varies with differences in skill, experience, and other factors. A roadway that does not accommodate such differences—and does not account for an appropriate degree of variability in performance—will promote unsafe conditions. In the case of U.S. 6, the lane shifts and reduction of lane width for the temporary routing of traffic resulted in heavy trucks and buses being routed on 10 1/2-foot-wide lanes through two sets of reverse curves at the lane shifts. When two of these wider vehicles met on this narrowed section— especially in the lane shifts—their drivers confronted actual clearance hazards or the perception of a hazard. Horizontal and Vertical Alignment Roadway geometry affects what drivers are able to see. Effective roadway design provides drivers with an ample view ahead and also minimizes deceptive visual phenomena that may cause drivers to misperceive what they see. When features of the roadway geometry interfere with the accurate perception of the roadway and other vehicles, the likely result will be a misperception of the spatial relationships among the driver’s vehicle and other vehicles and structures in the immediate environment. Because the consequences of such misperceptions can be severe, it is essential to avoid or mitigate the effects of roadway geometries that give rise to visual misperceptions. The Safety Board concludes that the combination of the west lane shift on U.S. 6 and the 10.5-foot lanes and the crest vertical curve on West Papillion Creek Bridge presented drivers with a complicated visual situation that could cause them to misjudge clearances and distances. Speed Speed is inversely related to sight distance requirements and to the amount of time available for a driver to respond to roadway conditions. Reducing speeds increases drivers’ time to acquire and assess information about the roadway conditions ahead and, in turn, permits them to more effectively plan and execute actions needed to control their vehicle. Speed is also a critical factor in motion-induced visual illusions. Reducing speed may lessen the degree of an illusion (or completely eliminate the illusion), while simultaneously providing the driver with more time to evaluate what he or she sees and to potentially recognize the visually deceptive phenomenon. While a posted speed of 45 mph might seem relatively slow compared to a freeway speed limit, at this location it means that the closing speed between opposing vehicles is 90 mph or 132 feet per second. Although speed limits in work zones are generally determined by engineering judgment, various factors, such as roadway geometry, traffic density and type, recovery zones, and positive barrier separation must be considered when making these determinations. However, it appears that narrow lanes, the lane shifts, the absence of a positive barrier between opposing lanes of traffic, the absence of a buffer space between the construction activity area on the bridge, and the two-way operation of

Analysis 69 Highway Accident Report commercial vehicles were not considered in combination when NDOR assigned a 45-mph work zone speed limit to the U.S. 6 project. The Safety Board concludes that the work zone speed limit was too high for existing conditions. Preparation Consistent use of markings and signage and consistent rules for traffic flow (for example, vehicles keep right or vehicles in a rotary have the right of way) promote drivers’ expectancy and facilitate error-resistant behavior. Work zones frequently incorporate features that are admittedly deficient, yet inevitable, and, fortunately, only temporary. Improving drivers’ ability to anticipate the conditions ahead and their required response(s) is vital. Building upon previous learning is preferred over introducing extensive signage, markings, and channelization devices to prepare drivers for a work zone, since such devices greatly increase the visual complexity of the construction scene and maximize cognitive workload and the potential for distractions. When it appeared to the Seward bus driver that a frontal collision was imminent, he acted in a manner that was consistent with the training he had been provided—to steer to the right. Yet the unanticipated absence of a right shoulder left him no room to maneuver. Mere signs warning of potential hazards are a poor substitute for proper geometric design, because they increase visual and cognitive complexity and rely on drivers to change their behavior, rather than perform in a manner that is familiar to them. Nevertheless, they are essential when other means to mitigate risk are unavailable. In this accident situation, drivers were presented with hazardous roadway geometry and no options for recovery, as well as a lack of warnings or other means to alert them to the problems ahead. The Safety Board concludes that poor traffic controls and hazardous roadway geometry left drivers ill-prepared to anticipate danger and to respond properly to any problems encountered. Even if NDOR could not have avoided the inherent hazardous roadway geometry associated with the work zone, it could have designed the work zone to compensate for those hazards by not only reducing the work zone speed limit, but by providing drivers with additional information. For instance, NDOR could have added “Road Narrows”100 signs that are intended for use in advance of a transition on two-lane roads where the pavement width is reduced abruptly to a width such that two cars cannot pass safely without reducing speed. Clearly, with the narrow lane widths, large commercial vehicles were forced to pass each other within inches. Failsafe Design When a driver errs—or equipment fails (or whatever is at the root of a mishap)— highway design should minimize the consequences. A center barrier and positive lane separation reduce the likelihood of frontal collision when a driver loses control or makes an error in lateral guidance. Similarly, lateral barriers help to deflect vehicles away from hazardous roadside obstructions. In this accident, nothing was in place to prevent a vehicle from crossing the centerline of the narrow road or to assure drivers that oncoming traffic would maintain its lane. Further, no positive means existed to prevent off-roadway 100 MUTCD, 1988 edition, as revised 1993, page 2C-20.

Analysis 70 Highway Accident Report excursions, especially on the bridge. The Safety Board concludes that the segment of U.S. 6 where the accident occurred required relatively “perfect” performance, especially by drivers of large, commercial vehicles. Not only were these demands unattainable, but when the driver failed, measures in place to minimize the consequences were inadequate. In the sections that follow, shortcomings in the work zone’s design, geometry, traffic control plan, and maintenance are discussed further from an engineering and regulatory perspective. Work Zone Issues As noted in the preceding section, the construction work zone provided a challenging driving environment. Although the U.S. 6 project has been completed, the potential exists for more accidents on U.S. 6 and on other roads where, as noted earlier, driving requires “perfect” performance and inadequate measures are in place to minimize the consequences. Adequacy of State and Federal Requirements for Traffic Control Plans The FHWA requires a temporary traffic control plan for all Federal-aid projects,101 such as the one underway at the accident site. According to AASHTO,102 a traffic control plan is an essential part of the overall project. A carefully developed traffic control plan should contribute significantly to the safe and efficient flow of traffic, as well as to the safety of the construction workers, and have enough flexibility to accommodate unforeseen changes in work schedule and traffic patterns. According to NDOR, the “generic”103 traffic control plan chosen for this construction project had been in place since the project began in March 2000. This generic plan was insufficient to have incorporated a detailed geometric design for TLTWO, including site- specific elements such as lane shifts, or to have addressed the use of the south side of the West Papillion Creek and railroad bridges for construction work areas. While the geometry of the tapers for the lane shifts met the guidelines in the MUTCD, the reverse curve condition near the east end of the West Papillion Creek Bridge and the 10 1/2-foot lanes resulted in an awkward geometric condition that appears inconsistent with the MUTCD,104 which states, “Frequent and abrupt changes in geometrics such as lane narrowing, dropped lanes, or main roadway transitions that require rapid maneuvers, should be avoided.” Further, this lane shift on a TLTWO with 10 1/2-foot lane widths and little or no shoulders could cause drivers to have difficulty 101 Title 23 CFR 630.1001, Federal-Aid Policy Guide. 102 A Policy on Geometric Design of Highways and Streets, page 301. 103 A “generic” traffic control plan is not site-specific and consists of standard diagrams of signing and traffic control measures necessary to accommodate common types of work zone traffic. 104 MUTCD, 1988 edition, as revised 1993, page 6B-2b.

Analysis 71 Highway Accident Report remaining within their traffic lane, and specifically, could cause them to encroach on the centerline while approaching the bridge deck. Heavy vehicle operators would be especially prone to this since their vehicles can be 9 or more feet wide. The construction planning for this project allowed the contractor to use the south sides on both the West Papillion Creek and railroad bridges for construction work space. On both bridges, construction traffic and equipment had access to U.S. 6. Construction equipment and personnel were moving about in the 24r-foot-wide work space available on the southern half of the bridges. Directly adjacent to this work space, the north sides of the bridges were carrying two-directional traffic flow at a posted speed limit of 45 mph. This condition afforded the possibility for numerous traffic conflicts105 between the construction work space area and the two-way traffic space, with little or no buffer space. For example, eastbound traffic could crowd the centerline due to drivers’ concern about the construction activity on their right in an area where westbound drivers were also crowding the centerline to avoid the bridge wall on their right. The fact that conflicts could occur was demonstrated on May 15, 2001, when an unattended off-the-road earth moving truck rolled out of the work space on the west side of the West Papillion Creek Bridge, traversed both lanes of U.S. 6, and collided with the barrier transition at the northeast corner of the bridge. According to NDOR and its general contractor, the use of TLTWO “sort of evolved.” No consideration was given to construction of a temporary retaining wall to avoid the “lane shift” in the temporary two-lane roadway where the crash occurred. In fact, the implementation of TLTWO was not part of the traffic control plan, but part of a field application by NDOR’s construction supervisor and contractor. Further, contrary to FHWA guidance,106 no consideration was given to physically separating the opposing flows of traffic, even though it was not possible to see from one end of the TLTWO to the other due to the crest vertical curve near the crash site, and U.S. 6 to the east of the project was a six-lane divided highway. In addition, no consideration was given to portable concrete barriers or other separation for the project work spaces on the bridges to protect construction workers and road users. The traffic volume history in table 3 (earlier in this report) shows significant increases in traffic on U.S. 6 over the past several years. It also shows that heavy trucks constituted at least 3 percent of that traffic. This information alone should have prompted NDOR traffic and construction engineering staff to include provisions in the traffic control plan to separate the opposing flows of traffic through the work areas and to accommodate the movement of large vehicles. 105 Traffic conflicts are conditions that place roadway users (pedestrian and vehicular) in positions in which they may interfere with each other. Conflicts are “near-miss” traffic crashes and are therefore predictors of traffic crashes. Institute of Transportation Engineers, Traffic Engineering Handbook, fifth edition (Washington, DC: 1999), page 201. 106 Title 23 CFR 630.1010, Part 5(i).

Analysis 72 Highway Accident Report A well-engineered and detailed traffic control plan, designed by experienced traffic and safety engineering staff, could have made the construction activity area safer and probably more efficient for traffic flow. Such a plan could have either eliminated the traffic lane shifts existing on U.S. 6 at the time of the crash or provided smoother transitions for the lane shifts. It could also have required a buffer between the work areas on the bridge and the through traffic lanes, thereby permitting wider lanes by reducing the potential for encroachment on the through traffic’s lane by construction activity and traffic. The Safety Board therefore concludes that the absence of a site-specific traffic control plan for the U.S. 6 construction project allowed hazardous traffic conflicts to develop in several areas of the project, especially on and near the West Papillion Creek and railroad bridges. The Safety Board further concludes that the decision to construct the lane shift near the east end of the West Papillion Creek Bridge and to allow a construction work area with no buffer space on the south side of the West Papillion Creek Bridge created a hazardous geometric condition that contributed to the accident. The Safety Board will inform AASHTO of the circumstances of this accident, so that AASHTO can, in turn, inform its members and urge them to emphasize traffic safety and management in their construction work zones. Traffic Operations During Construction NDOR relied upon its district construction engineer, project manager, and project assistants to ensure that the contractor complied with the “generic” traffic control plan. None of these NDOR employees had specific or general training in traffic engineering. Further, the ATSSA training that these employees reportedly received did not include the depth of traffic operations and safety engineering training necessary to manage and make traffic engineering control decisions for a large construction project. NDOR acknowledged that traffic engineering office staff did not periodically inspect work zones or monitor traffic accident experience in work zones. The general contractor’s project management personnel also had no training in construction work zone safety. It contracted with a “safety consultant,” but this person’s duties related to workers’ occupational safety, not traffic safety or operations. NDOR conducted random, statewide work zone traffic control reviews annually, as required by FHWA policy. In 1999, a team of FHWA and NDOR engineers traveled approximately 2,000 miles in 4 days to review some 50 Nebraska work zones.107 Merely traveling 2,000 miles in 4 days would require about 33 hours (at an average driving speed of 60 mph). Assuming 12-hour workdays, with no breaks, would leave only 15 hours to inspect 50 projects, about 18 minutes per project. Such figures call into question the thoroughness of the FHWA-required inspections and the accuracy of the resulting statistics. A subsequent FHWA-NDOR work zone review on July 26, 2001, rated the work zone on U.S. 6 (West Dodge Road) as “fair” for 2001. The inspection report mentioned only minor signage discrepancies; it failed to mention the following instances of nonconformance with FHWA policy and MUTCD guidelines: 107 Study of Work Zone Crashes in Nebraska prepared by FHWA and NDOR, August 1999.

Analysis 73 Highway Accident Report • Operation of the TLTWO in an area where road users could not see from one end of the operation to the other and the posted speed limit was 45 mph. • Lack of traffic control training for the individuals apparently responsible for monitoring the safety effectiveness of the traffic control plan. • Failure to monitor reported traffic accidents in the work zone. • Failure to document the lack of a buffer space and barriers between the work and traffic space on the bridges. • Failure to document the May 15, 2001, damage to the barrier caused by the earth moving truck and the barrier’s subsequent inadequate “repair.” Traffic control needs and safety hazards in construction work areas can change frequently as a project progresses. A feature that might not have been hazardous one day can become a danger the next day. Properly trained and vigilant construction supervision personnel can correct hazardous conditions or request assistance from the State traffic engineering office or from AASHTO. In this instance, construction engineering and supervision personnel with training in traffic engineering and work zone traffic control would probably have recognized that this project did not comply with MUTCD guidelines and other traffic safety guidance. Also key to effective work zone management is monitoring the work area’s traffic accident experience so that potential hazards can be corrected. But work zone traffic accident records can be monitored effectively only if reports are acquired in a timely manner, directly from local and State traffic law enforcement agencies. Waiting for the reports to be sent to the State through normal channels can take months, a delay that renders them almost useless for the timely identification of hazards. The Federal-Aid Policy Guide contains more stringent guidelines for work zone safety and monitoring than does the MUTCD. The Federal-Aid Policy Guide requires that “construction zone accidents and accident data shall [emphasis added] be analyzed and used to continually correct deficiencies which are found to exist on individual projects…,” while the applicable MUTCD guideline states, “When warranted [emphasis added], an engineering analysis should be made (in cooperation with law enforcement officials) of all accidents occurring within the temporary traffic control zones.” The Safety Board concludes that because inspections of U.S. 6 required and evaluated by the FHWA and executed by NDOR personnel were inadequate, several hazardous conditions either developed, were left uncorrected, or both. The Safety Board believes that the FHWA should incorporate into the MUTCD the stricter criteria on work zone safety and management contained in the Federal-Aid Policy Guide, 23 CFR 630J, Subchapter G-Engineering and Traffic Operations, Part 630-Preconstruction Procedures, Subpart J-Traffic Safety in Highway and Street Work Zones, to include continuously monitoring traffic accident experience in work zones to detect and correct safety deficiencies existing in individual projects. Further, the traffic accident reports necessary to accomplish this should be obtained monthly, directly from local traffic law enforcement agencies. The Safety Board also believes that the FHWA should require its divisional

Analysis 74 Highway Accident Report offices to participate in the States’ work zone safety inspections and diligently monitor and evaluate the results of those inspections in conformance with the Federal-Aid Policy Guide, 23 CFR 630J, Subchapter G-Engineering and Traffic Operations, Part 630- Preconstruction Procedures, Subpart J-Traffic Safety in Highway and Street Work Zones. The Safety Board further believes that NDOR should initiate a program to obtain work zone traffic accident reports from law enforcement agencies monthly and analyze these data to aid in identifying and eliminating hazards as they develop. Maintenance of Bridge Approach and Barrier Systems Neither the AASHTO, MUTCD, nor FHWA policy documents contain guidance on the maintenance of existing traffic safety features (such as traffic barriers) in construction work zones. Yet these safety features may be even more important in work zones than in the normal operational environment. Because some States, including Nebraska, require contractors to maintain the roadway facility during construction, the need for guidance or standards to which a facility must be maintained is particularly critical. In this case, the contractor had supposedly repaired the barrier system struck by the earth moving vehicle, but not to any accepted standard of performance. The repair resulted in the W-beam not being secured at its west end, and, therefore, it lacked the strength provided by tension from another structure. This allowed the W-beam to act like a “swinging door” and be pushed aside when it was struck by the school bus. The approach angle for the Seward school bus to the guardrail was about 6 degrees—40 percent less than the angle at which crash tests are usually conducted. The Seward bus was traveling at a speed of about 40 mph108 when it struck the barrier. This reduction in speed, from standard crash testing at a speed of 60 mph, represents a decrease in energy by 2.25 times. Given this lower angle of impact and lower speed, the school bus is more likely to have been redirected safely had it struck a barrier that met design and performance guidelines. However, it may have been redirected into the path of the opposing buses. The Safety Board therefore concludes that had the barrier system struck by the accident bus been repaired to its original design and strength, the bus would probably have been deflected back into its lane and its departure from the bridge avoided. The Safety Board further concludes that NDOR and the contractor failed to adequately maintain the barrier system on the northeast corner of the West Papillion Creek Bridge, as required by the construction contract, and this failure contributed to the severity of the accident. Highway engineers, States, and contractors use both the Federal-Aid Policy Guide and the MUTCD in determining the safe design and operation of highway work zones. However, as demonstrated by this accident, both guides are not always utilized. NDOR representatives did not use the Federal-Aid Policy Guide in designing the U.S. 6 work zone. Although the Federal-Aid Policy Guide contains a requirement that contractors maintain traffic safety systems during construction, the MUTCD does not. To ensure the safe design and operation of work zones, the MUTCD and Federal-Aid Policy Guide must 108 The bus fell vertically into the creek in about 1.7 seconds; when combined with the vertical velocity due to gravity of about 38 mph, the bus’s forward speed was determined to be about 40 mph.

Analysis 75 Highway Accident Report provide consistent advice. The Safety Board believes that the FHWA should include in the Manual for Uniform Traffic Control Devices a requirement that, for roadways under construction, traffic safety features (such as barrier systems) be maintained at an equivalent or better level than existed prior to construction. Occupant Safety The primary area of impact on the school bus was the top-left roof section of the bus body. The primary crush points occurred at the bus’s left-front roof corner, adjacent to the driver’s compartment, and the left-rear roof corner, which sustained the most significant deformation. Buckling of the roof was evident, along with wrinkles in the metal “skin” of the body. Intrusion into the bus body occurred, resulting in compromised survival space for the occupants due to roof deformation and subsequent deformation of the overhead luggage racks (see figure 27), although intrusion was not directly correlated to the level of passenger injury. Two passengers seated at the front of the bus (rows 1 and 3) sustained fatal injuries due to blunt-force trauma. In addition, passengers seated in row 5 and forward sustained either serious or fatal injuries, while those seated rearward of row 5, with the exception of a fatality in row 13 caused by blunt-force trauma, sustained injuries ranging from minor to serious. Thus, those seated at the front of the bus sustained higher levels of injury, in general, than those seated toward the rear of the bus. Such damage and corresponding injury patterns are not unexpected in a 49-foot fall. Figure 30. Deformation to luggage racks (as viewed facing rearward). Figure 27.

Analysis 76 Highway Accident Report School buses are designed to meet Federal Motor Vehicle Safety Standards for roof strength, joint strength, and occupant safety, and they have been largely successful in protecting school bus passengers. According to the School Bus Information Council, school bus deaths occur at a rate of 0.01 per 100,000 passenger miles as compared with 0.94 per 100,000 passenger miles for passenger cars.109 Further, according to NHTSA, school bus occupant fatalities averaged only nine per year from 1992 to 2002.110 Despite their success in protecting school bus passengers, these standards were not developed with extreme accident scenarios in mind. As a NASDPTS position paper111 states, It is difficult, if not impossible, to develop ways to protect school bus occupants in catastrophic crashes, such as those involving trains and heavy trucks. The crash forces in those crashes are so great that any reasonable structural design cannot maintain the integrity of the vehicle, which is one critical component of occupant crash protection. It can be argued that the Omaha accident, which combined a fall of 49 feet and an impact into a creek bed, also constitutes a scenario in which crash forces are so great that compliance with a performance standard cannot reasonably provide complete occupant protection. The extreme circumstances of this accident make it difficult to determine the causes of the passenger injuries. Therefore, the Safety Board concludes that because of the difficulties in identifying the passenger locations and orientations at impact after the roll and 49-foot drop, it cannot be determined whether improvements in the accident bus’s body would have mitigated the severity of the passengers’ injuries. Although this accident was unusually severe, the deformation characteristics, intrusion patterns, and loose seat cushions are similar to conditions found in previous accidents investigated by the Board. The Safety Board investigated a school bus accident in Conasauga, Tennessee,112 in which a school bus was struck on the passenger side by a locomotive traveling 51 mph. In the Conasauga accident, the Safety Board found that sidewall components, such as the overhead storage racks, seatframes, and sidewalls, were not designed to be energy-absorbing, and these structures could cause injury to occupants during their lateral movement in a side-impact collision. As a result, the Safety Board issued Safety Recommendation H-01-40 to NHTSA: 109 Information obtained on September 23, 2003, from http://www.schoolbusinfo.org. 110 U.S. Department of Transportation, National Highway Traffic Safety Administration, National Center for Statistics & Analysis, Traffic Safety Facts 2002: School Transportation-Related Crashes, DOT HS 809 615 (Washington, DC: NHTSA, 2002). 111 National Association of State Directors of Pupil Transportation Services, History of School Bus Safety—Why Are School Buses Built As They Are? (The Plains, Virginia: NASDPTS, 2000). 112 National Transportation Safety Board, Collision of CSXT Freight Train and Murray County School District School Bus at Railroad/Highway Grade Crossing, Conasauga, Tennessee, March 28, 2000, Highway Accident Report NTSB/HAR-01/03 (Washington, DC: NTSB, 2001).

Analysis 77 Highway Accident Report H-01-40 Develop and incorporate into the Federal Motor Vehicle Safety Standards performance standards for school buses that address passenger protection for sidewalls, sidewall components, and seatframes. NHTSA responded that it is conducting a research program addressing sidewall occupant protection on buses, and on July 16, 2002, the Safety Board classified Safety Recommendation H-01-40 “Open—Acceptable Action.” The Safety Board understands that NHTSA has issued a contract to perform this research, which should be completed in November 2004. The Safety Board also investigated a school bus accident in Central Bridge, New York,113 during which the seat cushions came loose during impact, and the Board subsequently concluded that the school bus passengers, whether lap belt-restrained or unrestrained, may have sustained more severe injuries because the seat cushion bottoms were unlatched. As a result, the Safety Board made Safety Recommendation H-00-29 to NHTSA: H-00-29 Modify the Federal Motor Vehicle Safety Standards to include the requirement that school bus seat cushion bottoms be installed with fail-safe latching devices to ensure they remain in their installed position during impacts and rollovers. NHTSA responded that it plans to address this issue when the agency upgrades the Federal Motor Vehicle Safety Standards for the next generation of school buses, and on August 6, 2002, the Safety Board classified Safety Recommendation H-00-29 “Open— Acceptable Response.” Because enhanced performance for sidewalls, sidewall components, seatframes, and seat cushion fixation are critical for occupant safety in many accident scenarios, the Safety Board urges speedy action on these recommendations. 113 National Transportation Safety Board, School Bus and Dump Truck Collision, Central Bridge, New York, October 21, 1999, Highway Accident Report NTSB/HAR-00/02 (Washington, DC: NTSB, 2000).

Analysis 78 Highway Accident Report Emergency Preparedness of Students Although State and Federal law require twice-yearly school bus evacuation drills for all students who ride school buses, that was not the practice in the Seward School District; very few of the students on the accident bus had received such training.114 On-scene inspection of the forward and aft roof hatches showed that the latches to open them were in the closed position, and student passengers indicated that they kicked open or kicked out the emergency hatches rather than attempting to open them as designed. Although the students interviewed did not specifically state that they acted out of panic in their opening of the roof hatches, in previous accidents115 investigated by the Safety Board, motorcoach passengers have reported a general sense of panic because they did not know what to do or how to get out of the bus. As a result, the Safety Board made safety recommendations concerning pretrip safety briefings for motorcoach passengers to the U.S. Department of Transportation, American Bus Association, and United Motorcoach Association (UMA).116 114 As stated earlier in the report, Safety Board interviews with student passengers revealed that only one student had received school bus emergency evacuation training while in high school and that only four students had received any form of school bus emergency evacuation training in either elementary or middle school. According to the Seward School District’s transportation supervisor, although two evacuation drills are conducted each school year, none of the accident bus’s passengers had received such training because most of them rode buses only for special events. The director added that Seward’s school buses only pick up students who live outside the city limits, noting that friends or family normally drive students who live inside the city limits to school. 115National Transportation Safety Board, Selective Motorcoach Issues, Special Investigation Report NTSB/SIR-99/01 (Washington, DC: NTSB, 2001). 116 The American Bus Association stated that it had informed its members of the Safety Board’s recommendations to provide pretrip safety briefings and to train drivers in conducting them, prompting the Safety Board to ask for more detailed information and, pending receipt of that information, to classify Safety Recommendations H-99-13 and -14 “Open—Acceptable Response” on October 29, 2001. The UMA took aggressive action, making available to its members a safety briefing video and written script (for use on buses without video equipment) and also developing and distributing driver training materials through the UMA’s Bus and Motorcoach Research and Education Institute. Consequently, on November 16, 1999, the Safety Board classified Safety Recommendation H-99-17 “Closed—Acceptable Action” and Safety Recommendation H-99-18 “Closed—Acceptable Alternate Action.” The U.S. Department of Transportation stated that it believed the UMA’s actions on Safety Recommendations H-99-17 and –18 were sufficient to fulfill the intent of Safety Recommendations H-99-7 and –8 to require and set standards for pretrip safety briefings, prompting the Safety Board to express its concerns that the UMA’s actions may not be indicative of the entire motorcoach industry. On January 7, 2003, the Safety Board classified Safety Recommendations H-99-7 and –8 “Open—Acceptable Response,” pending receipt of information on the U.S. Department of Transportation’s efforts to promote industry best practices on this issue. According to a Federal Motor Carrier Safety Administration official, as a result of an August 2003 conference call and a September 2003 meeting on these recommendations, a Government-industry working group will produce informational cards covering topics such as emergency exits.

Analysis 79 Highway Accident Report The circumstances of this accident demonstrate that pretrip safety information may be critically important for students who ride school buses sporadically, since they may be less familiar with the bus’s general layout and escape routes than regular riders. The Safety Board therefore concludes that had the Seward School District conducted emergency evacuation drills and demonstrations for all students, the passengers’ ability to open emergency exits and evacuate the vehicle in an emergency would have been greatly improved. The Safety Board will inform NASDPTS of the circumstances of this accident, so it can, in turn, inform its members of the difficulty the students had in identifying and opening the emergency exits and of the need to conduct pretrip safety briefings prior to every school-related activity trip. The Seward students’ lack of emergency evacuation training is not atypical. According to a December 2003 survey of State Directors of Transportation conducted by the NASDPTS,117 only 15 States require that students who ride buses for extracurricular functions receive pretrip safety information and only 9 States require physical demonstration of the operation of emergency exits. Despite the Federal recommendation in Guideline 17 that operators conduct pretrip briefings on the location and operation of emergency exits and the adoption of that recommendation in National School Transportation Specifications and Procedures, the NASDPTS survey shows that most schools do not conduct pretrip briefings before every school-related activity trip, and few States have adopted this practice. Therefore, the Safety Board believes that the NASDPTS should prepare a report that can be used by the State Directors to influence their States to require pretrip briefings before school-related activity trips on school buses or school- chartered buses and subsequently assist the States in developing criteria for such briefings, to include training all students regarding the location and use of emergency exits. Obscured Emergency Exit Levers and Signage On-scene examination of the emergency exits revealed that the 2-inch lettering above the emergency door exit and side windows was partially blocked by the overhead luggage racks. The lettering was further obscured by the students’ hats, instruments, and backpacks piled on top of the overhead racks. Because of these hidden overhead warnings, several students interviewed stated that they were unaware of these emergency exit windows and knew only about the side and rear emergency exit doors. The Safety Board therefore concludes that some emergency exit levers and signage were obstructed and not clearly visible and may have hindered the evacuation of the bus after the accident. The Safety Board believes that Thomas Built should ensure that all emergency signage is visible in school buses equipped with overhead luggage racks. 115 116 117 As of December 17, 2003, 42 States had responded to the survey.

Analysis 80 Highway Accident Report In addition, the investigation revealed that, following the accident, the first aid kit was blocking the emergency lever and instructions for the front-loading door. As installed by the manufacturer, Thomas Built, the kit would not have blocked the emergency exit lever or instructions for the front-loading door. The first aid kit likely shifted during the accident impact, not surprising given the bus’s 49-foot fall from the bridge. School Bus Extrication Issues The incident commander noted that the rescuers’ lack of knowledge concerning school bus construction and extrication techniques hindered extrication efforts. Because of reinforced construction on school buses, methods for extricating passengers from school buses differ significantly from methods for extricating passengers from lighter vehicles, necessitating specific training. The President of the International Association of Fire Chiefs told Safety Board investigators that he was unaware of a national standard for providing school bus extrication training and that the need for such training is determined by the States. The training director for the Nebraska Fire Marshal’s Office told investigators that he was unaware of any States that provide such training, given its specialized nature and budgetary constraints. However, school bus extrication training is readily available through courses and videos available from a variety of vendors and equipment manufacturers. The Safety Board concludes that had the rescuers received school bus extrication training, rescue efforts would probably have proceeded more efficiently. Therefore, we are requesting that the International Association of Fire Chiefs inform its members of the circumstances of the Omaha accident and encourage participation in such training. In addition, the Safety Board believes that the Omaha Fire Department should provide its emergency responders with school bus extrication training.

81 Highway Accident Report Conclusions Findings 1. The accident bus driver was not impaired due to drugs, alcohol, or fatigue; further, neither the weather nor the mechanical condition of the accident bus contributed to the accident. 2. Although not detrimental to the emergency response efforts on behalf of the accident victims, communications were inadequate and resulted in a less than optimal emergency response. 3. The accident bus driver’s qualifications neither caused nor contributed to this accident. 4. The accident bus driver’s unfamiliarity with the accident vehicle, which differed both in its perceptual demands and in its handling characteristics from his regular route bus, may have contributed to his inability to accurately judge the lateral distance to the guardrail, bridge rail, and oncoming vehicle and to his inability to properly steer the bus through the work zone. 5. The roadway geometry in the work zone resulted in extremely tight tolerances on driver performance, which may have been exceeded when the second Norfolk bus and the accident bus approached the West Papillion Creek Bridge. 6. Although it cannot be determined whether the driver of the oncoming Norfolk bus encroached upon or crossed the centerline, the narrowness of travel lanes in the work zone relative to the space occupied by the buses left the accident bus driver little room for error. 7. The roadway geometry in the work zone created a visual phenomenon that caused the accident bus driver to perceive the oncoming Norfolk bus as impinging upon its lane, regardless of whether it did or not. 8. The accident bus driver’s behavior at the time of the accident was consistent with anticipation of a frontal collision. 9. Even though all witnesses traveling eastbound on U.S. 6 insisted that the motorcoach maintained its lane, most witnesses who were traveling westbound insisted otherwise; therefore, it cannot be unequivocally determined whether the Norfolk bus encroached upon the westbound lane, creating a potential collision hazard.

Conclusions 82 Highway Accident Report

1. The combination of the west lane shift on U.S. 6 and the 10.5-foot lanes and the crest

vertical curve on West Papillion Creek Bridge presented drivers with a complicated visual situation that could cause them to misjudge clearances and distances.

1. The work zone speed limit was too high for existing conditions.
2. Poor traffic controls and hazardous roadway geometry left drivers ill-prepared to

anticipate danger and to respond properly to any problems encountered.

1. The segment of U.S. 6 where the accident occurred required relatively “perfect”

performance, especially by drivers of large, commercial vehicles.

1. The absence of a site-specific traffic control plan for the U.S. 6 construction project

allowed hazardous traffic conflicts to develop in several areas of the project, especially on and near the West Papillion Creek and railroad bridges.

1. The decision to construct the lane shift near the east end of the West Papillion Creek

Bridge and to allow a construction work area with no buffer space on the south side of the West Papillion Creek Bridge created a hazardous geometric condition that contributed to the accident.

1. Because inspections of U.S. 6 required and evaluated by the Federal Highway

Administration and executed by Nebraska Department of Roads personnel were inadequate, several hazardous conditions either developed, were left uncorrected, or both.

1. Had the barrier system struck by the accident bus been repaired to its original design